Demystifying Fuzzer Behaviour

Explore the fundamental mechanisms behind fuzz testing through this 39-minute conference talk that demystifies how fuzzers actually work beyond the common misconceptions. Trace the evolution of fuzzing from its 1988 origins with Miller's random byte sequences to modern coverage-guided tools like American Fuzzy Lop (AFL), examining how different approaches generate inputs based on knowledge about the subject under test. Understand why simply claiming "we fuzz our code" reveals nothing about testing effectiveness and learn how the relationship between fuzzers, their inputs, and programs is often poorly understood even by experienced professionals. Analyze recent research and case studies that reveal the true interactions between fuzzers and software under test, moving beyond the myth that fuzzing is a "magic bug printer." Discover the limitations of current fuzzing research, which has largely stagnated with only minor improvements to existing methods, and gain insights into writing more effective fuzzers and harnesses by understanding the underlying principles rather than relying on opaque automated tools.