# ObFuzzer: Object-Oriented Hybrid Fuzzer for Binaries
## 6 Evaluation
### Performance Overhead  
ObFuzzer is divided into three parts. The static analysis and symbolic execution parts are executed only once. In contrast, the fuzzing part requires a lot of repeated executions to discover potential vulnerabilities in the program. Therefore, the execution efficiency of the fuzzing phase has a more significant impact on the effectiveness of vulnerability discovery. The efficiency of ObFuzzer's fuzzing phase execution is tested in this paper. Since the execution information acquisition of AFL is implemented by program instrumentation, the execution information acquisition of ObFuzzer is implemented by Intel Processor Trace. Exploiting program vulnerabilities in the absence of source code is also an advantage of this paper. Therefore, it is not fair to directly compare the implementation efficiency of the two tools. In practice, this paper adopts a multi-level comparison approach to more scientifically measure the execution efficiency of ObFuzzer. By comparing the AFL's execution efficiency with the AFL-Honeybee, we can obtain the performance loss introduced by Intel Processor Trace. Then, we compare AFL-Honeybee's execution efficiency with the ObFuzzer fuzzing phase and we can compare the performance difference between the coverage-based vulnerability-discovery approach and object operation complexity-based vulnerability-discovery approach. We present the execution efficiency of AFL, AFL-Honeybee and ObFuzzer fuzzing phase in Figures 10 and 11. In Figure 10, the \(x\)-axis represents test time (hours) and the \(y\)-axis represents the number of executions per second. The red line represents the execution efficiency of AFL, the green line represents the execution efficiency of AFL-Honeybee and the blue line represents the execution efficiency of ObFuzzer fuzzing phase. Experimentation shows that a simple Intel Processor Trace approach to information acquisition can introduce significant overhead when testing procedure-oriented programs. This conclusion can be drawn from a comparison of the red and green lines in the first five plots in Figure 10, which is a comparison of AFL and AFL-Honeybee. The overhead of converting procedure-oriented metrics to object-oriented metrics on the base of Intel Processor Trace is relatively small. This conclusion can be drawn from a comparison of the green and blue lines in the first five plots in Figure 10, which is a comparison of AFL-Honeybee and the ObFuzzer fuzzing phase. In object-oriented programs, the overhead introduced by Intel Processor Trace is further reduced. This conclusion can be drawn from a comparison of the green and blue lines in the last four plots in Figure 10, which is a comparison of AFL-Honeybee and the ObFuzzer fuzzing phase. The main reason for this is that more instructions are executed in object-oriented programs, which can better apportion the performance loss. In addition, due to the slow execution efficiency of \"woff2 compress\", with AFL it is hard to find any new information and AFL cannot output execution efficiency information. Therefore, the plotted execution efficiency is approximately linear. Figure 10: Execution Speed of AFL, AFL-Honeybee and ObFuzzer Fuzzing Phase. In Figure 11, the \(x\)-axis represents different programs and the \(y\)-axis represents the number of executions per second. The red bar represents the number of executions per second of AFL, the green bar represents the number of executions per second of AFL-Honeybee and the blue bar represents the number of executions per second of the ObFuzzer fuzzing phase. Intel Processor Trace introduces 70% average performance overhead in procedure-oriented programs compared with AFL. Moreover, it introduces 14% average performance overhead in object-oriented programs. Object-oriented metrics based on Intel Processor Trace introduce 21% average performance overhead in procedure-oriented programs compared with AFL. Furthermore, it introduces 42% average performance overhead in object-oriented programs.