RIFF: Reduced Instruction Footprint for Coverage-Guided Fuzzing
summary
RIFF reduces fuzzing overhead by moving runtime computations to instrumentation-time and by turning per-block coverage writes into single-instruction instrumentation, plus a vectorized hot path that scans and classifies counters with SIMD. Implemented in AFL and MOpt and evaluated on FuzzBench and fuzzer-test-suite, RIFF speeds up coverage collection by 23× and post-execution processing by 6×, yields 147% more executions, and reaches baseline 24-hour coverage in ≈6.5 hours on average, with most inputs handled by the fast path.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:20Coverage is important for Guided Fuzzing
- 1:15Coverage Pipeline in Fuzzers
- 1:30Example: Coverage Collection in AFL
- 2:21Example: Coverage Analysis in AFL
- 3:31Overhead in Coverage Collection
- 4:53Overhead in Coverage Analysis
- 6:19RIFF: Overview and Insights
- 7:13Single-Instruction Instrumentation: Problem of Block Coverage
- 8:07Single-Instruction Instrumentation: Simplified Algorithm
- 9:30Hot-Path Vectorized Analysis
- 10:57Evaluation: Overall Speedup in Fuzzing
- 11:44Improved Performance Brought by Speedup
- 12:09Speedup in Coverage Collection and Analysis
- 13:09Summary
related talks
01h 15mMake your programs more reliable with Fuzzing
20mAFL++ : Combining Incremental Steps of Fuzzing Research
50mWhat the Fuzz
11mIDFuzz: Intelligent Directed Grey-box Fuzzing
31m“Fuzz or lose..."
39mMaking Fuzzing Part of Your Software Development Lifecycle
45mFuzzing with AFL
18mAccelerating Fuzzing through Prefix-Guided Execution