  Coverage-based greybox fuzzing (CGF) is one of the most successful methods
for automated vulnerability detection. Given a seed file (as a sequence of
bits), CGF randomly flips, deletes or bits to generate new files. CGF
iteratively constructs (and fuzzes) a seed corpus by retaining those generated
files which enhance coverage. However, random bitflips are unlikely to produce
valid files (or valid chunks in files), for applications processing complex
file formats.
  In this work, we introduce smart greybox fuzzing (SGF) which leverages a
high-level structural representation of the seed file to generate new files. We
define innovative mutation operators that work on the virtual file structure
rather than on the bit level which allows SGF to explore completely new input
domains while maintaining file validity. We introduce a novel validity-based
power schedule that enables SGF to spend more time generating files that are
more likely to pass the parsing stage of the program, which can expose
vulnerabilities much deeper in the processing logic.
  Our evaluation demonstrates the effectiveness of SGF. On several libraries
that parse structurally complex files, our tool AFLSmart explores substantially
more paths (up to 200%) and exposes more vulnerabilities than baseline AFL. Our
tool AFLSmart has discovered 42 zero-day vulnerabilities in widely-used,
well-tested tools and libraries; so far 17 CVEs were assigned.
