Cyber Risks · Trail of Bits Blog

A fuzzer and a symbolic executor walk into a cloud

Summary: Trail of Bits built two bug-finding systems, GRR, a high-throughput full-system emulator fuzzer, and PySymEmu (PSE), a binary symbolic executor that stores expressions rather than raw bytes and uses a theorem prover to follow only satisfiable paths. During DARPA's Cyber Grand Challenge, the team performed tens of billions of input mutations and program executions in 24 hours, and in the qualifying event its GRR+PSE combination found more bugs than AFL integrated into Driller and than angr.

Bottom line: In a head-to-head at DARPA's qualifying event, the GRR+PSE combination out-found both AFL-in-Driller and angr, and GRR was already twice as fast as PIN before any optimization - a reminder that the bug-finding tools your team relies on may be leaving exploitable crashes undiscovered.

Read the original at Trail of Bits Blog ↗