How about Fuzzing a binary by reversing it to source code?

Question

I am researching how to use AFL to fuzz a binary. I know that it is possible to use qemu mode to achieve it. However, using qemu mode really impact the fuzzing performance.

Thus, I am wondering that what if I reverse the target binary to C code by using IDA PRO, then compile the C code with afl-gcc? Will this idea going to be work? Or it will lead to distortion.

Answer 1

Fuzzing a binary without source code can be done with tools like McSema. It lifts the binary to LLVM bitcode and allows you to fuzz it with libFuzzer. But as user3804799 already said, decompilation isn't perfect.

Answer 2

From my experience the code should be executable to be able to run fuzzing well. In case it is source code and you won't be able to execute it, the fuzzing won't work as expected. However, when you have the source code, you may perform the static code analytics.