{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,21]],"date-time":"2026-10-21T12:28:58Z","timestamp":1792585738000,"version":"4.5.0"},"reference-count":34,"publisher":"Association for Computing Machinery (ACM)","issue":"OOPSLA","license":[{"start":{"date-parts":[[2019,10,10]],"date-time":"2019-10-10T00:00:00Z","timestamp":1570665600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Program. Lang."],"published-print":{"date-parts":[[2019,10,10]]},"abstract":"<jats:p>Coverage-guided fuzz testing has gained prominence as a highly effective method of finding security vulnerabilities such as buffer overflows in programs that parse binary data. Recently, researchers have introduced various specializations to the coverage-guided fuzzing algorithm for different domain-specific testing goals, such as finding performance bottlenecks, generating valid inputs, handling magic-byte comparisons, etc. Each such solution can require non-trivial implementation effort and produces a distinct variant of a fuzzing tool. We observe that many of these domain-specific solutions follow a common solution pattern.<\/jats:p>\n                  <jats:p>In this paper, we present FuzzFactory, a framework for developing domain-specific fuzzing applications without requiring changes to mutation and search heuristics. FuzzFactory allows users to specify the collection of dynamic domain-specific feedback during test execution, as well as how such feedback should be aggregated. FuzzFactory uses this information to selectively save intermediate inputs, called waypoints, to augment coverage-guided fuzzing. Such waypoints always make progress towards domain-specific multi-dimensional objectives. We instantiate six domain-specific fuzzing applications using FuzzFactory: three re-implementations of prior work and three novel solutions, and evaluate their effectiveness on benchmarks from Google's fuzzer test suite. We also show how multiple domains can be composed to perform better than the sum of their parts. For example, we combine domain-specific feedback about strict equality comparisons and dynamic memory allocations, to enable the automatic generation of LZ4 bombs and PNG bombs.<\/jats:p>","DOI":"10.1145\/3360600","type":"journal-article","created":{"date-parts":[[2019,10,11]],"date-time":"2019-10-11T10:53:33Z","timestamp":1570791213000},"page":"1-29","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":67,"title":["FuzzFactory: domain-specific fuzzing with waypoints"],"prefix":"10.1145","volume":"3","author":[{"given":"Rohan","family":"Padhye","sequence":"first","affiliation":[{"name":"University of California at Berkeley, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Caroline","family":"Lemieux","sequence":"additional","affiliation":[{"name":"University of California at Berkeley, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Koushik","family":"Sen","sequence":"additional","affiliation":[{"name":"University of California at Berkeley, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Laurent","family":"Simon","sequence":"additional","affiliation":[{"name":"Samsung Research, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hayawardh","family":"Vijayakumar","sequence":"additional","affiliation":[{"name":"Samsung Research, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,10,10]]},"reference":[{"key":"e_1_2_2_1_1","volume-title":"Nautilus: Fishing for Deep Bugs with Grammars. In 26th Annual Network and Distributed System Security Symposium (NDSS \u201919)","author":"Aschermann Cornelius","year":"2019","unstructured":"Cornelius Aschermann , Tommaso Frassetto , Thorsten Holz , Patrick Jauernig , Ahmad-Reza Sadeghi , and Daniel Teuchert . 2019 . Nautilus: Fishing for Deep Bugs with Grammars. In 26th Annual Network and Distributed System Security Symposium (NDSS \u201919) . Cornelius Aschermann, Tommaso Frassetto, Thorsten Holz, Patrick Jauernig, Ahmad-Reza Sadeghi, and Daniel Teuchert. 2019. Nautilus: Fishing for Deep Bugs with Grammars. In 26th Annual Network and Distributed System Security Symposium (NDSS \u201919) ."},{"key":"e_1_2_2_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134020"},{"key":"e_1_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978428"},{"key":"e_1_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00046"},{"key":"e_1_2_2_5_1","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Chen Yuanliang","year":"2019","unstructured":"Yuanliang Chen , Yu Jiang , Fuchen Ma , Jie Liang , Mingzhe Wang , Chijin Zhou , Xun Jiao , and Zhuo Su . 2019 . EnFuzz: Ensemble Fuzzing with Seed Synchronization among Diverse Fuzzers . In 28th USENIX Security Symposium (USENIX Security 19) . USENIX Association, Santa Clara, CA. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/chenyuanliang Yuanliang Chen, Yu Jiang, Fuchen Ma, Jie Liang, Mingzhe Wang, Chijin Zhou, Xun Jiao, and Zhuo Su. 2019. EnFuzz: Ensemble Fuzzing with Seed Synchronization among Diverse Fuzzers. In 28th USENIX Security Symposium (USENIX Security 19) . USENIX Association, Santa Clara, CA. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/chenyuanliang"},{"key":"e_1_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2019.00015"},{"key":"e_1_2_2_7_1","volume-title":"Accessed","year":"2019","unstructured":"Google. 2019 a. Continuous fuzzing of open source software. https:\/\/opensource.google.com\/projects\/oss-fuzz . Accessed March 26, 2019. Google. 2019a. Continuous fuzzing of open source software. https:\/\/opensource.google.com\/projects\/oss-fuzz . Accessed March 26, 2019."},{"key":"e_1_2_2_8_1","volume-title":"Accessed","year":"2019","unstructured":"Google. 2019 b. Set of tests for fuzzing engines. https:\/\/github.com\/google\/fuzzer-test-suite . Accessed March 20, 2019. Google. 2019b. Set of tests for fuzzing engines. https:\/\/github.com\/google\/fuzzer-test-suite . Accessed March 20, 2019."},{"key":"e_1_2_2_9_1","volume-title":"Superion: Grammar-Aware Greybox Fuzzing. In 41st International Conference on Software Engineering (ICSE \u201919)","author":"Junjie Wang Lei Wei","year":"2019","unstructured":"Lei Wei Junjie Wang , Bihuan Chen and Yang Liu . 2019 . Superion: Grammar-Aware Greybox Fuzzing. In 41st International Conference on Software Engineering (ICSE \u201919) . Lei Wei Junjie Wang, Bihuan Chen and Yang Liu. 2019. Superion: Grammar-Aware Greybox Fuzzing. In 41st International Conference on Software Engineering (ICSE \u201919) ."},{"key":"e_1_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3240765.3240842"},{"key":"e_1_2_2_11_1","volume-title":"Accessed","year":"2016","unstructured":"LafIntel. 2016 . Circumventing Fuzzing Roadblocks with Compiler Transformations. https:\/\/lafintel.wordpress.com\/2016\/08\/ 15\/circumventing-fuzzing-roadblocks-with-compiler-transformations\/ . Accessed March 20, 2019. LafIntel. 2016. Circumventing Fuzzing Roadblocks with Compiler Transformations. https:\/\/lafintel.wordpress.com\/2016\/08\/ 15\/circumventing-fuzzing-roadblocks-with-compiler-transformations\/ . Accessed March 20, 2019."},{"key":"e_1_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.5555\/977395.977673"},{"key":"e_1_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213874"},{"key":"e_1_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238176"},{"key":"e_1_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106295"},{"key":"e_1_2_2_16_1","volume-title":"Accessed","author":"LLVM Developer Group","year":"2016","unstructured":"LLVM Developer Group . 2016 . libFuzzer. http:\/\/llvm.org\/docs\/LibFuzzer.html . Accessed March 20, 2019. LLVM Developer Group. 2016. libFuzzer. http:\/\/llvm.org\/docs\/LibFuzzer.html . Accessed March 20, 2019."},{"key":"e_1_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/1065010.1065034"},{"key":"e_1_2_2_18_1","volume-title":"Manuel Egele, Edward J. Schwartz, and Maverick Woo.","author":"Man\u00e8s Valentin J. M.","year":"2018","unstructured":"Valentin J. M. Man\u00e8s , HyungSeok Han , Choongwoo Han , Sang Kil Cha , Manuel Egele, Edward J. Schwartz, and Maverick Woo. 2018 . Fuzzing : Art, Science, and Engineering. CoRR abs\/1812.00140 (2018). arXiv: 1812.00140 http:\/\/arxiv.org\/abs\/ 1812.00140 Valentin J. M. Man\u00e8s, HyungSeok Han, Choongwoo Han, Sang Kil Cha, Manuel Egele, Edward J. Schwartz, and Maverick Woo. 2018. Fuzzing: Art, Science, and Engineering. CoRR abs\/1812.00140 (2018). arXiv: 1812.00140 http:\/\/arxiv.org\/abs\/ 1812.00140"},{"key":"e_1_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00034"},{"key":"e_1_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3167132.3167289"},{"key":"e_1_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3293882.3339002"},{"key":"e_1_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3293882.3330576"},{"key":"e_1_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-Companion.2019.00107"},{"key":"e_1_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00056"},{"key":"e_1_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.27"},{"key":"e_1_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134073"},{"key":"e_1_2_2_27_1","volume-title":"Alexandru Razvan Caciulescu, and Abhik Roychoudhury","author":"Pham Van-Thuan","year":"2018","unstructured":"Van-Thuan Pham , Marcel B\u00f6hme , Andrew E. Santosa , Alexandru Razvan Caciulescu, and Abhik Roychoudhury . 2018 . Smart Greybox Fuzzing. CoRR abs\/1811.09447 (2018). arXiv: 1811.09447 http:\/\/arxiv.org\/abs\/1811.09447 Van-Thuan Pham, Marcel B\u00f6hme, Andrew E. Santosa, Alexandru Razvan Caciulescu, and Abhik Roychoudhury. 2018. Smart Greybox Fuzzing. CoRR abs\/1811.09447 (2018). arXiv: 1811.09447 http:\/\/arxiv.org\/abs\/1811.09447"},{"key":"e_1_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23404"},{"key":"e_1_2_2_29_1","unstructured":"Kostya Serebryany Vitaly Buka and Matt Morehouse. 2017. Structure-aware fuzzing for Clang and LLVM with libprotobufmutator.  Kostya Serebryany Vitaly Buka and Matt Morehouse. 2017. Structure-aware fuzzing for Clang and LLVM with libprotobufmutator."},{"issue":"3","key":"e_1_2_2_30_1","first-page":"3","article-title":"Using The Gnu Compiler Collection","volume":"4","author":"Stallman Richard M.","year":"2009","unstructured":"Richard M. Stallman 2009 . Using The Gnu Compiler Collection : A Gnu Manual For Gcc Version 4 . 3 . 3 . CreateSpace, Paramount, CA. Richard M. Stallman et al. 2009. Using The Gnu Compiler Collection: A Gnu Manual For Gcc Version 4.3.3. CreateSpace, Paramount, CA.","journal-title":"A Gnu Manual For Gcc Version"},{"key":"e_1_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23368"},{"key":"e_1_2_2_32_1","volume-title":"Proceedings of the 27th USENIX Conference on Security Symposium (SEC\u201918)","author":"Yun Insu","year":"2018","unstructured":"Insu Yun , Sangho Lee , Meng Xu , Yeongjin Jang , and Taesoo Kim . 2018 . QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing . In Proceedings of the 27th USENIX Conference on Security Symposium (SEC\u201918) . USENIX Association, Berkeley, CA, USA, 745\u2013761. http:\/\/dl.acm.org\/citation.cfm?id=3277203.3277260 Insu Yun, Sangho Lee, Meng Xu, Yeongjin Jang, and Taesoo Kim. 2018. QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing. In Proceedings of the 27th USENIX Conference on Security Symposium (SEC\u201918). USENIX Association, Berkeley, CA, USA, 745\u2013761. http:\/\/dl.acm.org\/citation.cfm?id=3277203.3277260"},{"key":"e_1_2_2_33_1","volume-title":"Accessed","author":"Zalewski Micha\u0142","year":"2014","unstructured":"Micha\u0142 Zalewski . 2014 . American Fuzzy Lop. http:\/\/lcamtuf.coredump.cx\/afl . Accessed March 20, 2019. Micha\u0142 Zalewski. 2014. American Fuzzy Lop. http:\/\/lcamtuf.coredump.cx\/afl . Accessed March 20, 2019."},{"key":"e_1_2_2_34_1","volume-title":"Accessed","author":"Zalewski Micha\u0142","year":"2017","unstructured":"Micha\u0142 Zalewski . 2017 . American Fuzzy Lop Technical Details. http:\/\/lcamtuf.coredump.cx\/afl\/technical_details.txt . Accessed March 20, 2019. Micha\u0142 Zalewski. 2017. American Fuzzy Lop Technical Details. http:\/\/lcamtuf.coredump.cx\/afl\/technical_details.txt . Accessed March 20, 2019."}],"container-title":["Proceedings of the ACM on Programming Languages"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3360600","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3360600","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:22:59Z","timestamp":1750188179000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3360600"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,10,10]]},"references-count":34,"journal-issue":{"issue":"OOPSLA","published-print":{"date-parts":[[2019,10,10]]}},"alternative-id":["10.1145\/3360600"],"URL":"https:\/\/doi.org\/10.1145\/3360600","relation":{},"ISSN":["2475-1421"],"issn-type":[{"value":"2475-1421","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,10,10]]},"assertion":[{"value":"2019-10-10","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}