search menu icon-carat-right cmu-wordmark

Well There’s Your Problem: Isolating the Crash-Inducing Bits in a Fuzzed File

October 2012 Technical Note
Allen D. Householder

In this 2012 report, Allen Householder describes an algorithm for reverting bits from a fuzzed file to those found in the original seed file to recreate the crash.

Publisher:

Software Engineering Institute

CMU/SEI Report Number

CMU/SEI-2012-TN-018

Abstract

Mutational input testing (fuzzing, and in particular dumb fuzzing) is an effective technique for discovering vulnerabilities in software. However, many of the bitwise changes in fuzzed input files are not relevant to the actual software crashes found. This report describes an algorithm that efficiently reverts bits from the fuzzed file to those found in the original seed file, keeping only the minimal bits required to recreate the crash under investigation. This technique reduces the complexity of analyzing a crashing test case by eliminating the changes to the seed file that are not essential to the crash being evaluated.