HFuzz-Rb: Real-Time Roadblock Detection in Fuzz Testing

Fuzz testing or fuzzing has been used regularly used for security evaluation in development and operations (DevSecOps). In fuzzing, the core idea is to execute the software under test with randomized inputs and look for abnormal behavior or validate previously known vulnerabilities such as those in the supply chain. However, for most real-world software, fuzzing does not achieve 100 % code coverage even after a substantially long campaign, leaving behind residual risk. This is due to roadblock branches in the control flow that the fuzzer fails to take despite multiple attempts. In such cases, a popular choice is for the external analyst to intervene and help the fuzzer solve the conditions that prevent the execution of the roadblock branches. To that end, existing fuzzing-related research has been working on roadblock detection and reporting to the external analyst, albeit not in real time i.e. not as roadblocks get discovered by the fuzzing process. This leads to a delay in roadblock resolution, effectively elevating the residual risk factor. In this paper, we address this issue. In pursuit, we identify and answer three research questions pertinent to real-time roadblock detection. Our research prototype builds upon the QEMU mode of the popular fuzzing library AFLplusplus and uses Pythonic modules to analyze branches and help detect roadblocks. Our experiments demonstrate that it may indeed be possible to detect and report roadblocks in realtime.