Summary
This document is a research article that presents Tango, an extensible framework designed for state-aware fuzzing. The framework aims to enhance the effectiveness of fuzzing in complex systems, particularly those with persistent targets whose behavior is influenced by the system's state. The article introduces the concept of state inference, a technique that distills portable coverage metrics to uncover hidden path dependencies within the target. By treating 'state' as a first-class entity, Tango allows for more comprehensive testing of stateful targets, such as network servers and video games. The authors detail how state inference can significantly reduce the scheduling queue of a fuzzer, thereby improving its efficiency. The evaluation of Tango demonstrates its capability to uncover new bugs in existing software, showcasing its flexibility and effectiveness in exploring complex systems. Furthermore, the article discusses the challenges of fuzzing stateful systems and how Tango addresses these challenges through its innovative design and implementation.
