moonlight-steinsgate/ecofuzz

EcoFuzz-An adaptive energy-saving greybox fuzzer

EcoFuzz

1.Introduction

EcoFuzz is an adaptive energy-saving greybox fuzzer based on AFL. More details of EcoFuzz are introduced in our technical paper "EcoFuzz: Adaptive Energy-Saving Greybox Fuzzing as a Variant of the Adversarial Multi-Armed Bandit", which has been published on USENIX Security 2020.

2.Installtion and Usage

The installation and usage of EcoFuzz are the same as those of AFL. In addition, EcoFuzz implements a static analysis module for extracting some magic bytes to a dictionary for certain programs, which is a shell script named "static_module.sh". You can get the dictionary of magic bytes from test binary by executing the command

./static_module.sh test_binary dictionary_directory

Then, the dictionary_directory can be provided for EcoFuzz to fuzz the test_binary in the dictionary mode.

ecofuzz's Issues

restore deterministic strategies

1. Ecofuzz runs without the deterministic strategies. what should I do if I want to restore the deterministic stage ? I think the deterministic stage is helpful for mutation, such as eff_map.
2. I don't understand what the function calculate_power does when I try to restore the deterministic stage.
   

   EcoFuzz/EcoFuzz/afl-fuzz.c

   Line 5341 in 1fd9460

   if(energy < calculate_power(len))

   
   Thanks!

Question about information_of_time file

Hello, I tried using Ecofuzz to test gif2png for about 18 hours, and the output contains the information_of_time file. Its size is about 20G. I'm not sure why it happened, could you please help to check the reason? In addition, for the test of gif2png, I randomly downloaded 9 gif files from the Internet as initial seeds.