Binary Fuzzing With Snapshot-Assisted-Driven Comparison Branch Analysis

This talk presents a snapshot-assisted method for extracting comparison values from closed-source binaries without symbolic execution, helping fuzzers reach vulnerability-triggering code. It covers input generation, snapshot creation, branch and memory analysis, and integration with AFL through the Lightbranch tool.

Syllabus

Introduction
About Me
Summary
Motivations
Example
Input Generation
Input Generation Techniques
Approach
Action Mechanism
Snapshot Repository
Snapshot Creation Flow
Leap Node Detection
Page Block Reasoning
Selection Rules
Memory Selection
Control Flow Hijacking
Memory Access Errors
Comparison Branch Types
UData Analysis
Comparison Value Extraction
Offset
White Sequencing
Architecture
Demo