Computer programs are not executed in isolation, but rather interact with the execution environment which drives the program behaviours. Software validation and verification methods, such as greybox fuzzing, thus need to capture the effect of possibly complex environmental interactions, including files, databases, configurations, network sockets, human-user interactions, and more. Conventional approaches for environment capture in symbolic execution and model checking employ environment modelling, which involves manual effort. In this paper, we take a different approach based on an extension of greybox fuzzing. Given a program, we first record all observed environmental interactions at the kernel/user-mode boundary in the form of system calls. Next, we replay the program under the original recorded interactions, but this time with selective mutations applied, in order to get the effect of different program environments -- all without environment modelling. Via repeated (feedback-driven) mutations over a fuzzing campaign, we can search for program environments that induce crashing behaviour. Our EFuzz tool found 33 zero-day bugs in well-known real-world protocol implementations and GUI applications. Many of these are security vulnerabilities and 14 CVEs were assigned.

翻译：计算机程序并非孤立执行，而是与驱动程序行为的执行环境交互。因此，软件验证与确认方法（如灰盒模糊测试）需要捕获可能复杂的环境交互效应，包括文件、数据库、配置、网络套接字、人机交互等。传统符号执行与模型检测中的环境捕获方法采用环境建模，这需要人工干预。本文基于灰盒模糊测试的扩展提出一种不同方法。给定一个程序，我们首先在系统调用形式的系统调用层面记录所有观测到的环境交互，随后在原始记录交互下重放程序，并对其施加选择性突变，从而在不进行环境建模的情况下获得不同程序环境的效果。通过模糊测试过程中反复的（反馈驱动）突变，我们可以搜索到导致崩溃行为的程序环境。我们的EFuzz工具在知名现实协议实现与图形用户界面应用中发现了33个零日漏洞，其中多数为安全漏洞，已分配14个CVE编号。