English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Coverage-guided fuzzing's aggressive, high-volume testing has helped revealtens of thousands of software security flaws. While executing billions of testcases mandates fast code coverage tracing, the nature of binary-only targetsleads to reduced tracing performance. A recent advancement in binary fuzzingperformance is Coverage-guided Tracing (CGT), which brings orders-of-magnitudegains in throughput by restricting the expense of coverage tracing to only whennew coverage is guaranteed. Unfortunately, CGT suits only a basic blockcoverage granularity -- yet most fuzzers require finer-grain coverage metrics:edge coverage and hit counts. It is this limitation which prohibits nearly allof today's state-of-the-art fuzzers from attaining the performance benefits ofCGT.  This paper tackles the challenges of adapting CGT to fuzzing's mostubiquitous coverage metrics. We introduce and implement a suite of enhancementsthat expand CGT's introspection to fuzzing's most common code coverage metrics,while maintaining its orders-of-magnitude speedup over conventional always-oncoverage tracing. We evaluate their trade-offs with respect to fuzzingperformance and effectiveness across 12 diverse real-world binaries (8 open-and 4 closed-source). On average, our coverage-preserving CGT attainsnear-identical speed to the present block-coverage-only CGT, UnTracer; andoutperforms leading binary- and source-level coverage tracers QEMU, Dyninst,RetroWrite, and AFL-Clang by 2-24x, finding more bugs in less time.

Same Coverage, Less Bloat: Accelerating Binary-only Fuzzing with Coverage-preserving Coverage-guided Tracing