Cyber Risks · Trail of Bits Blog

Fuzzing an API with Deep State (Part 1)

Summary: Trail of Bits describes converting a handwritten red-black tree fuzzer into a DeepState test harness with minimal coding effort, gaining replay of regression tests, test-case reduction, and multiple data-generation back-ends including Manticore, angr, libFuzzer, and AFL. Using symbolic execution, the DeepState version discovered artificially introduced bugs that the original fuzzer missed.

Key Takeaway: The original fuzzer only printed an error and crashed, leaving hundreds or thousands of steps before the failure with no saved or minimized test case; DeepState's replay and reduction turn a found bug into something a team can actually debug and add to CI.

Read the original at Trail of Bits Blog ↗