A fuzz testing technique based on determining valid fields

In the context of vulnerability discovery in Internet of Things (IoT) devices, fuzzing technology has demonstrated better performance. However, under typical circumstances, fuzzing generates test cases by capturing traffic packets exchanged between the front-end and back-end of IoT devices, which tends to overlook the significance of the back-end component. Furthermore, it often engages in blind seed mutation among numerous keywords, thereby producing a large number of ineffective test cases that ultimately decrease the efficiency of fuzz testing. This paper introduces VKFuzz, a fuzz testing tool based on determining effective fields. VKFuzz utilizes reverse engineering techniques to identify these effective fields and, in a forward approach, gathers constraint information about the relationships between the identified key field and other fields. This process ensures the generation of high-quality test cases. To evaluate the efficiency of VKFuzz in detecting vulnerabilities, we tested the tool using firmware from two different manufacturers, consisting of four distinct firmware versions. In comparison to Boofuzz, VKFuzz detected 11 more genuine vulnerabilities, and compared to FirmHunter, it uncovered 2 additional real vulnerabilities. Moreover, under equivalent detection rates, VKFuzz reduced average time consumption by 30.60% as compared to FirmHunter.