Definition
Directed fuzzing is an automated software and hardware testing technique that focuses error-detection effort on predefined code regions, target sites, or hardware submodules rather than maximizing overall coverage. It is also referred to as directed greybox fuzzing (DGF).
Guiding Mechanism
The core of directed fuzzing is the guiding mechanism that directs the fuzzing campaign to a specified target. A general guiding mechanism adopted in existing directed fuzzers calculates the control-flow distance between the current execution progress and the target, and uses that distance as feedback to guide fuzzing.
A fundamental limitation of this classical approach is that the distance calculation is feasibility-unaware: it treats all branches as equally traversable without predicting whether they can actually be satisfied at runtime. To address this, feasibility-aware directed fuzzing has been proposed, which adds a runtime feasibility-prediction mechanism that gradually and efficiently improves prediction precision, and a new classification method that predicts the feasibility of all branches based on limited traces.
Hybridization with Symbolic Execution
Directed greybox fuzzing is one of the most popular automated testing methods that focuses on error detection in predefined code regions. However, it can struggle to overcome difficult program constraints. Symbolic execution can address such constraints, but at the cost of lower performance. Combining directed fuzzing with symbolic execution can therefore lead to more efficient error detection. Hybrid approaches have been proposed that include:
- A novel seed scheduling algorithm based on target-related interestingness and coverage.
- Minimization and sorting of objective seeds according to target-related information.
- An implementation integrating a LibAFL-based directed fuzzer (LibAFL-DiFuzz) with a dynamic symbolic executor (e.g., Sydr), evaluated using a Time-to-Exposure metric against pure LibAFL-DiFuzz, AFLGo, BEACON, WAFLGo, WindRanger, FishFuzz, and Prospector, with reported speedups up to 1.86x over the second-best result on several examples.
Directed Fuzzing in Hardware Verification
In hardware design verification, directed greybox fuzzing (DGF) has been adapted to focus testing on specific submodules of a larger system. This is useful when a system contains several subsystems or components and new components are progressively added: the fuzzer can save time by focusing on the newly added component instead of re-fuzzing older, unchanged parts.
DirectFuzz
DirectFuzz is a DGF-based hardware-fuzzing tool built upon RFuzz. It implements directed fuzzing for hardware designs and, like RFuzz, uses Verilator (an open-source Verilog/SystemVerilog simulator that compiles designs into optimized C++/SystemC models) to simulate the hardware design.
Reported limitations of DirectFuzz include:
- Inability to capture hardware-specific semantics and structure.
- Misaligned coverage metrics that do not align well with established verification practices.
- Limited scalability when targeting multiple design regions.
- Inability to perform targeted verification across multiple modules.
PROFUZZ
PROFUZZ is a hardware fuzzing framework based on DGF designed to overcome the limitations of DirectFuzz. Rather than using software-abstraction simulation through Verilator, PROFUZZ simulates directly at the hardware's native (RTL) abstraction level, allowing it to accurately model inherent hardware behaviors (such as concurrency and signal interactions) and use coverage metrics that reflect hardware-specific characteristics. It also integrates with industry-standard Electronic Design Automation (EDA) tools.
Related Approaches in Hardware Fuzzing
- RFuzz: predecessor tool that uses mux-coverage as a replacement for code coverage; can fuzz via synthesized design or via Verilator simulation.
- DiFuzzRTL: focuses on CPU designs; uses differential testing by comparing an RTL simulation against an Instruction Set Architecture (ISA) simulation golden reference; uses register coverage to better capture Finite State Machine (FSM) state transitions.
- ProcessorFuzz: improves on DiFuzzRTL by using Control and Status Registers (CSRs) as coverage and differential fuzzing with an ISA golden reference.
Performance Comparisons (Software Directed Fuzzers)
Reported speedups for feasibility-aware directed fuzzing (AFLGopher) versus prior directed fuzzers, measured in time-to-reach-targets:
- 3.76x faster than AFLGo
- 2.57x faster than BEACON
- 3.30x faster than WindRanger
- 2.52x faster than SelectFuzz
- 2.86x faster than enhanced AFLGo
In triggering known vulnerabilities: 5.60x, 5.20x, 4.98x, 4.52x, and 5.07x faster than AFLGo, BEACON, WindRanger, SelectFuzz, and enhanced AFLGo, respectively.