Technical Summary: PeAR – A Static Binary Rewriting Framework for Binary-Only Fuzzing

1. Problem Statement

Binary-only fuzzing is essential for discovering bugs in closed-source software where source code is unavailable. In this context, fuzzers rely on either Static Binary Instrumentation (SBI) or Dynamic Binary Instrumentation (DBI) to track code coverage. While DBI (e.g., Intel Pin, QEMU) is widely used due to its perceived ease of implementation and soundness, it incurs significant runtime overhead (often 10–100× slower), severely limiting fuzzer throughput.

Conversely, SBI offers lower runtime costs by rewriting binaries before execution. However, existing SBI frameworks have historically struggled with accuracy and generalizability. Many fail to instrument complex real-world targets, and crucially, they lack support for modern performance-enhancing techniques found in compiler-based or DBI-based fuzzers. Specifically, features such as deferred initialization, persistent mode, and shared-memory fuzzing remain unsupported in most SBI frameworks. This gap raises the question of whether recent advances in static binary rewriting can be leveraged to build a robust, high-performance, and extensible binary-only fuzzer.

2. Methodology

The authors developed PeAR, an extensible binary-only fuzzing framework that utilizes off-the-shelf static binary rewriting technologies to inject modern fuzzing instrumentation.

Core Architecture

PeAR is built upon the GrammaTech Intermediate Representation for Binaries (GTIRB) and the Ddisasm disassembler. The workflow involves:

1. Static Analysis: The target binary is disassembled using Ddisasm (implemented in Datalog) to decode instructions and generate a superset of facts. These are analyzed for symbolization and control flow, then translated into the GTIRB intermediate representation.
2. Instrumentation: Using the gtirb-rewriting framework, PeAR injects instrumentation directly into the GTIRB before lowering it back to native code.

Key Instrumentation Features

Unlike previous SBI tools that primarily focus on basic coverage tracing, PeAR implements a suite of advanced features:

• Coverage Tracing: PeAR inserts trampolines at the start of basic blocks to trace edge coverage, mimicking the __afl_maybe_log logic used in AFL++. It handles interprocedural control flow graphs (CFGs) where blocks can be terminated by call instructions.
• Deferred Initialization: The framework allows users to specify a function or address where the fuzzer's forkserver is initialized. This skips complex target-specific initialization routines for every test case, reducing overhead.
• Persistent Mode: Instead of spawning a new process for every input, PeAR wraps the target function in a loop. The instrumentation saves and restores register states and return addresses, allowing a single process to execute multiple inputs.
• Shared-Memory Fuzzing: To avoid filesystem I/O penalties, PeAR implements a hook that redirects the target's input buffer pointer directly to a shared memory region containing the test case. This is achieved by saving the target's register state, modifying the relevant registers (e.g., rdi for the buffer pointer) via a hook function, and restoring the state before execution.

3. Key Contributions

The paper contributes the following:

1. PeAR Framework: An SBI-based fuzzing framework capable of injecting modern fuzzing instrumentation (deferred init, persistent mode, shared memory) across a wide range of targets.
2. Comprehensive Evaluation: A rigorous evaluation of PeAR and four other state-of-the-art SBI frameworks (ZAFL, StochFuzz, afl-dyninst, E9AFL) on the FuzzBench benchmark suite. The evaluation spans 4.25 CPU-years of fuzzing time.
3. Demonstration of SBI Viability: The work challenges the prevailing assumption that SBI is inherently inaccurate or incapable of supporting advanced features, showing that modern rewriting frameworks can achieve high granularity with negligible performance compromise.

4. Experimental Results

The evaluation was conducted on 25 FuzzBench targets (20 used for coverage/performance analysis).

Robustness

• Instrumentation Success: PeAR successfully instrumented 22 out of 25 targets (88%), a rate comparable to the best SBI-based fuzzers (ZAFL at 23/25 and StochFuzz at 22/25).
• Failure Modes: Failures were primarily due to build/rewriting issues or faulty instrumentation causing crashes on benign inputs. PeAR required manual hints for two targets (curl, libjpeg-turbo) where Ddisasm misidentified data tables or constants.

Code Coverage

• PeAR achieved the highest average normalized coverage score (87.91%) among all SBI-based fuzzers.
• This performance is comparable to AFL++ QEMU mode (87.84%), a DBI baseline, and significantly outperforms other SBI tools like E9AFL (6.62%) and afl-dyninst (57.79%).
• With persistent mode and shared memory enabled, PeAR's coverage improved slightly to 89.95%, demonstrating that higher throughput allows for better state-space exploration.

Throughput and Performance

• Throughput Gains: The ablation study revealed that enabling persistent mode improved PeAR's throughput by a median of 2.56×. Adding shared-memory fuzzing further increased throughput to a median of 4.07× over the base configuration.
• Benchmark Variance: Targets with expensive initialization (e.g., curl) saw massive gains (up to 31.23× with shared memory), while lightweight targets saw smaller improvements.
• Comparison: PeAR with advanced features consistently achieved the highest throughput ratio among binary-only fuzzers, often outperforming the next-fastest SBI fuzzer by a median of 3.56×.

5. Significance and Claims

The authors claim that PeAR demonstrates that SBI is a practical and effective technique for binary-only fuzzing. The paper argues that the historical concerns regarding the accuracy and soundness of SBI are unwarranted when utilizing modern, off-the-shelf rewriting frameworks like GTIRB.

Specifically, the paper claims:

• Extensibility: Modern binary rewriting frameworks can apply complex instrumentation (such as persistent loops and shared memory hooks) with high granularity.
• Performance Parity: SBI can achieve code coverage comparable to compiler-based instrumentation and DBI-based solutions (QEMU mode) while offering significantly better throughput than DBI.
• Feature Parity: It is possible to implement advanced fuzzing techniques (deferred init, persistent mode, shared memory) in an SBI context, a capability previously missing from the SBI ecosystem.

The paper concludes that while challenges remain (e.g., handling unsupported instructions or complex data tables), the combination of robust static analysis and modern rewriting tools makes SBI a viable alternative to DBI for high-performance fuzzing of closed-source software. Future work includes expanding support to Windows PE binaries and additional architectures.