Fuzzing guided by program state

Most existing fuzzing techniques rely heavily on coverage guidance. However, such approaches still face a significant limitation: triggering certain vulnerabilities not only depends on code coverage but also on program states. Furthermore, identical code coverage may lead to the discovery of useful new program states for vulnerability detection. To address this issue, this paper proposes Program State and Coverage Feedback Fuzzing (SACFUZZ), which is guided by program states. Specifically, SACFUZZ automatically identifies program state variables crucial for vulnerability detection, which can distinguish between program states. It then recognizes the current program state based on these critical variables, records combinations of value ranges of recently accessed critical program state variables to represent the program state, and utilizes this recorded program state information to guide the iterations of fuzzing. Test cases that trigger new combinations of critical program state variable values or discover new critical program state variables are both added to the seed queue. Experimental results demonstrate that, compared to coverage-guided fuzzing tools, SACFUZZ can discover more crashes in state-intensive programs.