Skip to main content
Book cover

International Conference on Fundamental Approaches to Software Engineering

FASE 2021: Fundamental Approaches to Software Engineering pp 363–367Cite as

FuSeBMC: A White-Box Fuzzer for Finding Security Vulnerabilities in C Programs (Competition Contribution)

Part of the Lecture Notes in Computer Science book series (LNTCS,volume 12649)

Abstract

We describe and evaluate a novel white-box fuzzer for C programs named FuSeBMC, which combines fuzzing and symbolic execution, and applies Bounded Model Checking (BMC) to find security vulnerabilities in C programs. FuSeBMC explores and analyzes C programs (1) to find execution paths that lead to property violations and (2) to incrementally inject labels to guide the fuzzer and the BMC engine to produce test-cases for code coverage. FuSeBMC successfully participates in Test-Comp’21 and achieves first place in the Cover-Error category and second place in the Overall category.

Keywords

  • Automated Test-Case Generation
  • Symbolic Execution
  • Bounded Model Checking
  • Fuzzing
  • Security.

K. M. Alshmrany—Jury Member.

Download conference paper PDF

References

  1. Clang documentation. http://clang.llvm.org/docs/index.html

  2. Anand, S., Burke, E.K., Chen, T.Y., Clark, J.A., Cohen, M.B., Grieskamp, W., Harman, M., Harrold, M.J., McMinn, P.: An orchestrated survey of methodologies for automated software test-case generation. J. Syst. Softw. 86(8), 1978–2001, 2013

    Google Scholar 

  3. Beyer, D.: Second competition on software testing: Test-Comp 2020. In FASE, LNCS 12076, pp. 505–519, 2020

    Google Scholar 

  4. Gadelha, M.R., Monteiro, F.R., Morse, J., Cordeiro, L.C., Fischer, B., Nicole, D.A.: ESBMC 5.0: An industrial-strength C model checker. In ASE, pp. 888–891, 2018

    Google Scholar 

  5. Gadelha, M.R., Monteiro, F.R., Cordeiro, B., Nicole: ESBMC v6.0: Verifying C Programs Using k-Induction and Invariant Inference - (Competition Contribution). In TACAS, LNCS 11429, pp. 209–213, 2019

    Google Scholar 

  6. Gadelha, M.R., Menezes, R., Monteiro, F.R., Cordeiro, L.C., Nicole, D.A.: ESBMC: scalable and precise test generation based on the floating-point theory - (competition contribution). In FASE, LNCS 12076, pp. 525–529, 2020

    Google Scholar 

  7. Gadelha, M.R., Cordeiro, L.C., Nicole, D.A.: An Efficient Floating-Point Bit-Blasting API for Verifying C Programs. In VSTTE, LNCS 12549, pp. 178–195, 2020

    Google Scholar 

  8. Menezes, R., Rocha, H., Cordeiro, L., Barreto, R.: Map2check using LLVM and KLEE. In TACAS, LNCS 10806, pp. 437–441, 2018

    Google Scholar 

  9. Niemetz, A., Preiner, M., Biere, A.: Boolector 2.0 system description. Journal on Satisfiability, Boolean Modeling and Computation 9, 53–58 (2014)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. University of Manchester, Manchester, UK Institute of Public Administration, Jeddah, Saudi Arabia

    Kaled M. Alshmrany

  2. Federal University of Amazonas, Manaus, Brazil

    Rafael S. Menezes

  3. SIDIA Instituto de Ciência e Tecnologia, Manaus, Brazil

    Mikhail R. Gadelha

  4. University of Manchester, Manchester, UK

    Lucas C. Cordeiro

Authors
  1. Kaled M. Alshmrany
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Rafael S. Menezes
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Mikhail R. Gadelha
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Lucas C. Cordeiro
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Kaled M. Alshmrany .

Editor information

Editors and Affiliations

  1. Universidad Autónoma de Madrid, Madrid, Spain

    Assoc. Prof. Esther Guerra

  2. University of Twente, Enschede, The Netherlands

    Mariëlle Stoelinga

Rights and permissions

Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

Reprints and Permissions

Copyright information

© 2021 The Author(s)

About this paper

Verify currency and authenticity via CrossMark

Cite this paper

Alshmrany, K.M., Menezes, R.S., Gadelha, M.R., Cordeiro, L.C. (2021). FuSeBMC: A White-Box Fuzzer for Finding Security Vulnerabilities in C Programs (Competition Contribution). In: Guerra, E., Stoelinga, M. (eds) Fundamental Approaches to Software Engineering. FASE 2021. Lecture Notes in Computer Science(), vol 12649. Springer, Cham. https://doi.org/10.1007/978-3-030-71500-7_19

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-71500-7_19

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-71499-4

  • Online ISBN: 978-3-030-71500-7

  • eBook Packages: Computer ScienceComputer Science (R0)