AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering | Ji Shi et al. | ResearchPod

Transcript: AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering

Alex: Welcome to another episode of ResearchPod.

Sam: Today we're looking at AIFORE — a system for automatic input format reverse engineering, and what it means for smart fuzzing. The core claim is that you can infer the structure and semantics of a file format purely by watching how a binary processes its input — no manual specification required. And that matters because manual reverse engineering is slow, error-prone, and often completely infeasible for proprietary formats.

Alex: So why haven't automated tools solved this already?

Sam: The existing tools operate at the instruction level, and that granularity is the problem. Individual instructions are too fine-grained — a single logical field might be touched by dozens of instructions across multiple code paths, and trying to cluster bytes at that resolution produces noisy, unreliable field boundaries.

Alex: So AIFORE moves up a level of abstraction?

Sam: Exactly. The key insight is to work with basic blocks instead — sequences of instructions with a single entry point and a single exit. The argument is that a basic block typically processes one complete, indivisible field. So rather than asking which instructions touch which bytes, you ask which basic blocks touch which bytes, then cluster bytes that are always handled by the same set of blocks.

Alex: That's a cleaner signal. Like watching which workstation on an assembly line handles which components, rather than tracking every individual tool movement.

Sam: That's a good analogy. And the clustering algorithm — a minimum cluster approach — is specifically designed to be robust to the noise you get from shared code paths, where the same block might incidentally touch bytes from different fields. Getting the boundaries right is the foundation everything else depends on.

Alex: Because if your field segmentation is wrong, your semantic classification is going to be wrong too.

Sam: Precisely. And semantic classification is the second major contribution. Once they've identified field boundaries, they train a convolutional neural network on the behavioral signatures of the basic blocks that process each field. The intuition is that different semantic types leave distinct fingerprints in how the code interacts with them. A checksum field gets processed differently than an enumeration, which looks different from a length field. Switch-case structures, comparison patterns, arithmetic operations — those all show up in the block's behavior, and the CNN learns to read them.

Alex: So you're doing code behavior analysis rather than code structure analysis.

Sam: Right. You're not reading the assembly and trying to understand what the programmer intended. You're watching what the program actually does with each chunk of bytes and inferring the type from that behavior. It sidesteps a lot of the brittleness that comes from static analysis.

AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering

Ji Shi, Zhun Wang, Zhiyao Feng, Yang Lan, Shisong Qin, Wei You, Wei Zou, Mathias Payer, Chao Zhang

Sep 2, 2026·5:49·user_upload

FuzzingInput Format Reverse EngineeringByte-level Taint AnalysisPower SchedulingDynamic Taint AnalysisFormat Reverse Engineering

Listen

6 min

Briefing

Research Question and Approach

Effective fuzzing requires high-quality inputs that can bypass sanity checks and reach deep code paths. While format-aware fuzzing is a proven strategy, existing reverse engineering techniques often struggle with accuracy, labor-intensive manual rules, or scalability issues. AIFORE addresses these challenges by automatically inferring input formats from the target program's execution behavior rather than relying on static specifications.

The approach consists of three main components:

Field Boundary Analysis: AIFORE uses dynamic taint analysis to track which input bytes are processed by specific basic blocks (BBs). It then applies a minimum cluster algorithm to group these bytes into indivisible fields, assuming that bytes processed together by the same BBs likely belong to the same semantic field.
Field Type Classification: A convolutional neural network (CNN) is trained to predict the semantic type of these fields (e.g., size, offset, magic number, checksum, enumeration, or string). The model learns from features extracted from the program's IR, library calls, and format strings within the BBs that process the field.
Smart Power Scheduling: AIFORE uses the inferred format knowledge to prioritize seeds. It identifies 'valuable' seeds that trigger new code coverage, extracts their format, and dynamically re-assigns mutation power to favor less-tested format variants.

Main Findings

AIFORE significantly outperforms state-of-the-art format-aware fuzzers and reverse engineering tools. In evaluations across 15 real-world programs and 15 different file formats, AIFORE achieved an average field boundary recognition accuracy of 84.06% and a field type prediction accuracy of 84.26% on untrained formats. In 24-hour fuzzing tests, AIFORE achieved higher basic block coverage than existing tools like ProFuzzer and WEIZZ, and successfully uncovered 20 bugs that were missed by other fuzzers.

Why It Matters

By automating the extraction of semantic input formats, AIFORE reduces the need for manual effort in crafting input templates while simultaneously improving the efficiency of vulnerability discovery. Its ability to learn from program behavior—rather than relying on brittle, manually defined rules—makes it a robust solution for testing complex, real-world binary formats. The integration of a machine-learning-based type predictor and a format-aware power scheduler allows the fuzzer to adaptively explore program states that are otherwise difficult to reach.

Key Terms and Definitions

Basic Block (BB) — A sequence of instructions with one entry point and one exit point, used here as the fundamental unit for analyzing how a program processes input bytes.
Dynamic Taint Analysis — A technique used to track the flow of input data through a program's execution, identifying which instructions and basic blocks operate on specific input bytes.
Minimum Cluster (MC) — An algorithm used to group consecutive input bytes that are consistently processed together by the same basic blocks, helping to define field boundaries.
Semantic Type — A classification of an input field based on its functional role in the program (e.g., size, offset, checksum), which is more informative for fuzzing than simple data types like integers or strings.
Forward Slicing — A technique that merges a basic block with its subsequent child blocks that share a dependency on a specific input field, allowing the model to learn more comprehensive features about how the field is used.

AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering: Research Paper Podcast