Fuzz drivers are essential components of greybox fuzzing, as they encapsulate target interfaces, define test spaces, and largely determine fuzzing effectiveness. Existing fuzz drivers typically rely on crash-based oracles for security testing, overlooking library functionality and limiting bug detection capability. In this paper, we present the first study on metamorphic-based fuzz oracle enhancement (MFOE), which augments existing fuzz drivers with metamorphic-based oracles derived from metamorphic relations (MRs). Since constructing and integrating such oracles requires substantial domain knowledge, automating MFOE is challenging. To address this challenge, we propose MetaFOE, an LLM-based framework that automatically generates and integrates metamorphic-based oracles. We evaluate MetaFOE on OSS-Fuzz drivers using three modern LLMs and five prompt strategies. MetaFOE generates 3,475 MRs, of which 77.3% are applicable, and implements 12,351 meta drivers, with 6,228 being valid. After three hours of fuzzing, the valid meta drivers improve edge coverage by an average of 18.7% and trigger 1,528 unique crashes. Our results demonstrate both the effectiveness of metamorphic-based oracle enhancement and the feasibility of using LLMs to automate MFOE, providing valuable insights for advancing greybox fuzzing.

翻译：模糊驱动程序是灰盒模糊测试的核心组件，其封装目标接口、定义测试空间并在很大程度上决定模糊测试效能。现有模糊驱动程序通常依赖基于崩溃的预言进行安全测试，忽略库功能特性且限制缺陷检测能力。本文首次开展基于蜕变关系的模糊测试预言增强研究，通过从蜕变关系衍生的蜕变式预言增强现有模糊驱动程序。由于构建和集成此类预言需要大量领域知识，实现预言增强自动化极具挑战性。为应对该挑战，我们提出MetaFOE——基于大语言模型的自主生成与集成蜕变式预言的框架。我们在OSS-Fuzz数据集上采用三种现代大语言模型和五种提示策略进行评估，MetaFOE共生成3,475条蜕变关系（其中77.3%可实际应用），实现12,351个元驱动程序（其中6,228个通过验证）。经三小时模糊测试，有效元驱动程序平均提升18.7%的边覆盖率，并触发1,528个独特崩溃。实验结果表明蜕变式预言增强的有效性，同时验证了利用大语言模型实现模糊测试预言增强自动化的可行性，为推进灰盒模糊测试技术提供了重要启示。