VrankenFuzz – a multi-sensor, multi-generator mutational fuzz testing engine [pdf]

I read most of this paper and skimmed a few sections I felt were old hat. The author discusses various problems that apply to all fuzzers focusing especially on a naive fuzzer's inability to achieve depth into complex code paths. This, they explain, is solved by modifying the target program, or by seeding with data that is known to exercise deep paths. These are well known techniques. The rest of it is explaining the author's concept of three basic components of fuzzers, which are "sensors" (what e.g. AFL and others would call "instrumentation"), "generators" (just what it sounds like, this component generates target program inputs) and "processors" (these read sensors and influence the generators). I like the clarity the author brings to the subject and the framework is good for thinking about fuzzer design in a clear way. I'm not sure that the particular subject of the paper, VrankenFuzz, is anything groundbreaking. Also the author says at the end that they want "compensation" before they release it as open source.