FormatFuzzer：二进制文件格式的有效模糊测试
FormatFuzzer: Effective Fuzzing of Binary File Formats
AI总结：
本文提出 FormatFuzzer，将 010 Editor 二进制模板编译为兼具解析、变异和生成能力的 C++ 模糊测试器，可独立使用或与 AFL 集成，并在 MP4、ZIP 测试中发现 ffmpeg 和 timidity 的未知内存错误。
摘要：
对处理多媒体文件等结构化二进制输入的程序进行有效模糊测试是一项具有挑战性的任务，因为这些程序期望非常特定的输入格式。然而，现有模糊测试器大多与格式无关，这使其具有通用性，但在需要特定格式时也会失效。我们提出了 FormatFuzzer，一个用于生成特定格式模糊测试器的生成器。FormatFuzzer 接收二进制模板（010 Editor 使用的格式规范）作为输入，并将其编译为 C++ 代码，该代码充当解析器、变异器以及符合语言规则的高效输入生成器。所得的特定格式模糊测试器可在无法获得程序指导的黑盒环境中用作独立的生成器或变异器。此外，通过提供可变的决策种子，它可以轻松地与 AFL 等任意与格式无关的模糊测试器集成，使其具备格式感知能力。在我们针对 MP4 或 ZIP 等复杂格式的评估中，FormatFuzzer 被证明是一种高效的有效输入生成器，同时还检测到了 ffmpeg 和 timidity 中此前未知的内存错误。
英文摘要：
Effective fuzzing of programs that process structured binary inputs, such as multimedia files, is a challenging task, since those programs expect a very specific input format. Existing fuzzers, however, are mostly format-agnostic, which makes them versatile, but also ineffective when a specific format is required. We present FormatFuzzer, a generator for format-specific fuzzers. FormatFuzzer takes as input a binary template (a format specification used by the 010 Editor) and compiles it into C++ code that acts as parser, mutator, and highly efficient generator of inputs conforming to the rules of the language. The resulting format-specific fuzzer can be used as a standalone producer or mutator in black-box settings, where no guidance from the program is available. In addition, by providing mutable decision seeds, it can be easily integrated with arbitrary format-agnostic fuzzers such as AFL to make them format-aware. In our evaluation on complex formats such as MP4 or ZIP, FormatFuzzer showed to be a highly effective producer of valid inputs that also detected previously unknown memory errors in ffmpeg and timidity.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
