Effective fuzzing of programs that process structured binary inputs, such as multimedia files, is a challenging task, since those programs expect a very specific input format. Existing fuzzers, however, are mostly format-agnostic, which makes them versatile, but also ineffective when a specific format is required. We present FormatFuzzer, a generator for format-specific fuzzers. FormatFuzzer takes as input a binary template (a format specification used by the 010 Editor) and compiles it into C++ code that acts as parser, mutator, and highly efficient generator of inputs conforming to the rules of the language. The resulting format-specific fuzzer can be used as a standalone producer or mutator in black-box settings, where no guidance from the program is available. In addition, by providing mutable decision seeds, it can be easily integrated with arbitrary format-agnostic fuzzers such as AFL to make them format-aware. In our evaluation on complex formats such as MP4 or ZIP, FormatFuzzer showed to be a highly effective producer of valid inputs that also detected previously unknown memory errors in ffmpeg and timidity.

翻译：摘要：对处理结构化二进制输入（如多媒体文件）的程序进行高效模糊测试是一项具有挑战性的任务，因为这些程序期望非常特定的输入格式。然而，现有模糊测试器大多与格式无关，这使其具有通用性，但在需要特定格式时效率低下。我们提出FormatFuzzer——一种面向特定格式的模糊测试生成器。FormatFuzzer以二进制模板（010 Editor使用的格式规范）作为输入，并将其编译为C++代码，该代码可作为解析器、变异器和高效生成符合语言规则的输入。由此生成的格式特定模糊测试器可作为独立生产者或变异器在黑盒场景中使用，无需程序提供指导信息。此外，通过提供可变的决策种子，它可轻松集成到任意格式无关的模糊测试器（如AFL）中，使其具备格式感知能力。我们在MP4、ZIP等复杂格式上的评估表明，FormatFuzzer是高效的有效输入生成器，并在ffmpeg和timidity中检测到了此前未知的内存错误。