Fig 1.
Framework of Ffuzz at a high level scope.
Fig 2.
Fuzzing agent framework.
Fig 3.
CFG of motivated code.
Table 1.
Sample procedure of FPD.
Fig 4.
Framework of full system fuzz testing with S2E assisted.
The red execution trace denotes the path of the current test case. And the yellow branches are the branches that the symbolic execution engine can cover.
Fig 5.
Pipeline fuzzing framework.
Table 2.
Execution speed* of FFuzz and vanilla AFL.
Table 3.
Basic blocks and instructions handled by full system and user mode.
Fig 6.
Details of execution speed for FFuzz and AFL in one hour.
Figures are generated by afl-plot from AFL.
Fig 7.
Paths* covered by FFuzz and AFL in one hours.
*Path refers to the unique path from AFL. Figures are generated by afl-plot from AFL.
Table 4.
Detail comparison between two different testing modes.
Table 5.
Targets filtered from Juliet benchmark.
Table 6.
Result of real-world device driver testing.
Table 7.
Comparison with AFL, Driller and TriforceAFL.