Shark2Pit: Automated Test Template Generation for Protocol Fuzzing Based on Packet Parser
TL;DR
Shark2Pit is an automated tool that generates Pit files from network traffic that uses Tshark to parse traffic, extract protocol metadata, and construct data models, and combines these models with predefined configurations to generate a Pit file.
Abstract
The effectiveness of protocol fuzzing depends on the quality of test templates, specifically the Pit file (XML-based definitions used by the Peach frameworks). These Pit files define both data models and state models. However, manually creating these Pit files is not only time-consuming and error-prone but also requires specialized domain knowledge, hindering the automation process. In this paper, we introduce Shark2Pit, an automated tool that generates Pit files from network traffic. Shark2Pit uses Tshark to parse traffic, extract protocol metadata, and construct data models. Then Shark2Pit synthesizes new data models while preserving their structure. The state model is built from data model sequences, further enhanced by state recombination and repetition. Shark2Pit combines these models with predefined configurations to generate a Pit file. We evaluated Shark2Pit on 8 open-source protocols. The branch coverage of the generated Pit files is comparable to or even higher than that of manually created Pit files (99.4%-106.3% for Peach and 90.6%-102.3% for Peach*). Furthermore, fuzzing with these Pit files revealed 5 previously unknown bugs.