Automated Configurable Harness for Fuzz Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current fuzz testing techniques require complex scripting and extensive expertise to develop customized harnesses for different software systems, making it time-consuming and challenging to effectively configure and execute fuzz testing across various applications with diverse input channels.
Innovation Solution
An automated, configurable harness is developed using a manifest generated from recorded interactions with the System Under Test (SUT), allowing for the encoding of inputs into archives and feeding derived inputs over specified channels, simplifying the process and reducing the need for extensive expertise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a generic blob fuzzer is used to fuzz multiple SUTs, then the fuzzing tool can be applied broadly, but it cannot properly handle different input channels and blocking behaviors of various SUTs
Solution Approach 1:
The patent segments the fuzzing process into distinct phases: recording phase (capturing input channels and blocking behaviors), processing phase (generating harness code and test cases), and execution phase (running fuzz tests). This segmentation allows the system to adapt to different SUTs while maintaining reliable fuzzing through phase-specific optimizations.
Solution Approach 2:
The patent performs preliminary recording of SUT interactions to capture input channel characteristics and blocking behaviors before actual fuzzing begins. This preliminary action enables the system to generate customized harnesses that are tailored to each SUT's specific requirements, resolving the contradiction between generic applicability and reliable execution.
2Reliability
If customized harnesses are written manually for each SUT, then the fuzzing can be tailored to specific input requirements, but the process becomes time-consuming and expertise-intensive
Solution Approach 1:
The system performs self-service by automatically generating harness code and test cases through a recording and processing pipeline. The recorder captures SUT interactions, the processor generates customized harnesses, and the executor runs tests without requiring manual harness writing, thus eliminating time loss while maintaining customization reliability.
Solution Approach 2:
The patent replaces the mechanical process of manual harness writing with an automated computational system. The recorder-processor-executor pipeline substitutes human expertise with algorithmic generation, transforming the time-consuming manual process into an automated workflow that produces equivalent customized harnesses.
3Manufacturing precision
If extensive scripting technology is used for harness generation, then the harness can be configured precisely, but the complexity of the setup increases significantly
Solution Approach 1:
The patent introduces an intermediary processing layer between the recording phase and harness generation. The processor acts as a mediator that translates recorded interactions into customized harness code, abstracting away the complexity of scripting technology while maintaining precise configuration capabilities through structured data processing.
Data Source
AI summary
Certain example embodiments relate to software test with automated configurable harness capabilities. Certain example embodiments automatically generate harnesses and properly encoded seed inputs by recording the input operations of a system under test (SUT), identifying the processes to be fuzz tested, generating seed inputs and a manifest describing the SUT's input vectors, and generating the harness to effectively feed derived (and potentially “malformed”) input to the SUT. The techniques described herein may be used to test a computer system, e.g., to probe for potential vulnerabilities.