Enhanced Taint Inference for Directed Fuzzing

In recent years, fuzzing has become a well-known automated testing tool. Although fast execution speed, fuzzing does not have information about the program state and data flow such that it cannot meet more complex branch conditions and extend the program coverage in depth. If fuzzing can introduce the technology of taint analysis, the input portion that dominates the branch conditions will be obtained. Mutation operations specifically targeting critical bytes can significantly reduce the input length and quantity used for testing and improve the ability to pass complex branch conditions. There are two challenges that must be overcome when applying a taint analysis. First, excessive time seriously affects the execution speed of fuzzing; second, strict execution environment requirements will limit the application scope of fuzzing. Taint inference was the first to be proposed as a solution with faster execution speed and lower execution environment requirements, using corresponding mutation strategies to generate effective test inputs, allowing program execution to penetrate into more complex branches.The feasibility of introducing taint inference into directed fuzzing is verified preliminarily. The results show that Saryn(Go) can indeed reach program locations that are difficult to reach with other fuzzing tools. In addition, it can be used only for branch conditions that must be passed to reach the target program position and have not yet been passed, not for branches that cannot reach the target program position or have been satisfied, alleviating the overhead caused by taint inference and thereby increasing the efficiency of directed fuzzing.