Directed Fuzzing

Technique

Directed fuzzing (also called directed greybox fuzzing, DGF) is an automated testing technique that focuses fuzzing effort on predefined code regions or submodules rather than maximizing overall coverage. It uses guiding mechanisms, often based on control-flow distance or other target-related metrics, to direct the fuzzer toward specified target sites, with applications in both software and hardware verification.

First seen 6/19/2026

Last seen 6/26/2026

Evidence 2 chunks

Wiki v1

WIKI

Definition

Directed fuzzing is an automated software and hardware testing technique that focuses error-detection effort on predefined code regions, target sites, or hardware submodules rather than maximizing overall coverage. It is also referred to as directed greybox fuzzing (DGF).

Guiding Mechanism

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

1 connections

DirectFuzz ← implements 98% 1e

DirectFuzz implements directed fuzzing to focus on specific submodules.

LINKED ENTITIES

8 links

AFLGo Compared against AFLGo is a well-known directed greybox fuzzer mentioned in evidence as a baseline for directed fuzzing comparisons.

DirectFuzz Instance of DirectFuzz is explicitly described as a DGF-based implementation in the evidence chunks.

Profuzz Follows PROFUZZ is described in the evidence as a DGF-based framework that builds upon and addresses limitations of DirectFuzz.

RFUZZ Predecessor of DirectFuzz is described as building upon RFuzz in the evidence.

Verilator Used by DirectFuzz and RFuzz use Verilator for hardware simulation per the evidence.

ProcessorFuzz Related to ProcessorFuzz is described in the evidence as improving DiFuzzRTL using CSRs as coverage with differential fuzzing.

Symbolic Execution Combined with The public context describes hybrid directed fuzzing that combines directed fuzzing with symbolic execution to overcome difficult program constraints.

CITATIONS

6 sources

6 citations — click to expand

[1] Directed greybox fuzzing focuses on error detection in predefined code regions but can struggle with difficult program constraints that symbolic execution can address, motivating hybrid approaches. Hybrid Approach to Directed Fuzzing

[2] Classical directed fuzzing uses control-flow distance to the target as feedback, and this distance calculation is feasibility-unaware. AFLGopher: Accelerating Directed Fuzzing via Feasibility-Aware Guidance

[3] AFLGopher is 3.76x, 2.57x, 3.30x, 2.52x and 2.86x faster than AFLGo, BEACON, WindRanger, SelectFuzz and enhanced AFLGo, respectively, in reaching targets, and 5.60x, 5.20x, 4.98x, 4.52x, and 5.07x faster in triggering known vulnerabilities. AFLGopher: Accelerating Directed Fuzzing via Feasibility-Aware Guidance

[4] DirectFuzz is a DGF-based hardware fuzzing implementation built upon RFuzz that uses Verilator to simulate hardware designs and allows focusing on specific submodules of a larger system. Fuzzing IPv4 modules on FPGAs

[5] DirectFuzz has limitations including inability to capture hardware-specific semantics and structure, misaligned coverage metrics, limited scalability to multiple design regions, and inability to perform targeted verification across multiple modules. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis

[6] PROFUZZ is a DGF-based hardware fuzzing framework that operates at the hardware's native abstraction level instead of Verilator-based software simulation, integrating with industry-standard EDA tools. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis