Skip to content
STIMSMITH

Directed graybox fuzzing

Technique

Directed graybox fuzzing (DGF) is a fuzzing technique that steers the generation of test inputs toward specific target locations or conditions in a program, rather than indiscriminately maximizing overall code coverage. Unlike purely coverage-guided graybox fuzzing, which aims to broadly exercise new branches, directed graybox fuzzing prioritizes exploration of designated code regions and (in stateful settings) designated program states, allocating testing resources where vulnerabilities are more likely to occur. The technique has been applied across domains including hardware processor verification and, more recently, smart-contract testing, where stateful directed graybox fuzzing must consider both code and contract state spaces simultaneously.

First seen 6/24/2026
Last seen 6/24/2026
Evidence 1 chunks
Wiki v1

WIKI

Directed graybox fuzzing

Overview

Directed graybox fuzzing (DGF) is a fuzzing paradigm in which the fuzzer uses lightweight instrumentation feedback, as in graybox fuzzing, but uses that feedback to direct the search toward predefined targets in the program under test rather than to maximize overall code coverage. This orientation makes DGF particularly suitable for regression testing of known bugs, targeted security audits, and scenarios where only a subset of the program is of interest.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

CITATIONS

4 sources
4 citations — click to collapse
[1] Coverage-guided fuzzers can lack effective state-space feedback and waste resources on benign code, motivating stateful directed graybox fuzzing. Vulseye: Detect Smart Contract Vulnerabilities via Stateful Directed Graybox Fuzzing
[2] Stateful directed graybox fuzzing introduces Code Targets and State Targets with a fitness metric that leverages feedback from both code space and state space. Vulseye: Detect Smart Contract Vulnerabilities via Stateful Directed Graybox Fuzzing
[3] Static analysis and pattern matching are used to pinpoint Code Targets, and a scalable backward analysis algorithm is used to specify State Targets. Vulseye: Detect Smart Contract Vulnerabilities via Stateful Directed Graybox Fuzzing
[4] Coverage-directed fuzz testing of RTL on FPGAs has been explored as a directed/coverage-directed approach to hardware fuzzing. DATA 2024 proceedings (ChatFuzz paper, references RFUZZ and related hardware fuzzers)