Directed graybox fuzzing

Overview

Directed graybox fuzzing (DGF) is a fuzzing paradigm in which the fuzzer uses lightweight instrumentation feedback, as in graybox fuzzing, but uses that feedback to direct the search toward predefined targets in the program under test rather than to maximize overall code coverage. This orientation makes DGF particularly suitable for regression testing of known bugs, targeted security audits, and scenarios where only a subset of the program is of interest.

Relationship to coverage-guided graybox fuzzing

Classical graybox fuzzers (e.g., AFL-style approaches) use branch or edge coverage as feedback and reward inputs that discover new coverage. Directed graybox fuzzing inverts this priority: coverage feedback is still used (hence "graybox"), but the fitness function biases the search toward a target set of program locations instead of uniformly expanding coverage. Coverage-guided fuzzers applied to stateful programs can waste resources on benign code regions and can struggle to explore the full state space because they lack effective state-space feedback.

Stateful directed graybox fuzzing

When the system under test is stateful, such as a smart contract, naive directed fuzzing over the code space alone is insufficient. A stateful directed graybox fuzzer must jointly direct the search over:

• Code Targets — program locations identified via static analysis and pattern matching as more prone to vulnerabilities.
• State Targets — contract states identified by a scalable backward analysis as states that must be reached for the code targets to be exercised.

Inputs and executions are then prioritized using a fitness metric that combines feedback from both the code space and the state space, so that the fuzzer allocates effort toward regions where vulnerabilities are likely and avoids wasting time on benign areas.

Applications

Hardware / processor verification

Hardware fuzzing for RTL and processor designs has explored directed and coverage-directed approaches. Coverage-directed fuzz testing of RTL on FPGAs (RFUZZ) and related work use coverage signals to guide input generation for hardware designs. Directed techniques in this domain target specific microarchitectural or ISA-level behaviors of interest.

Smart-contract vulnerability detection

Stateful directed graybox fuzzing has been instantiated for smart-contract analysis. A representative system introduces Code Targets (derived from static analysis and pattern matching for vulnerability-prone constructs) and State Targets (derived from a scalable backward analysis that propagates state requirements back from the code targets). A fitness metric integrating code-space and state-space feedback is consumed inside the fuzzing loop. Empirically, this stateful DGF approach has been reported to outperform state-of-the-art coverage-guided fuzzers in both effectiveness and efficiency for smart-contract vulnerability detection, addressing two key limitations of coverage-guided approaches on stateful programs: (i) lack of effective state-space feedback, and (ii) wasted effort on benign code regions.

Limitations of coverage-guided fuzzing that motivate DGF

• Stateful programs: coverage signals do not capture the contract state space, so coverage-guided fuzzers can fail to reach vulnerable states.
• Resource wastage on benign code: aiming for comprehensive coverage can spend disproportionate time in safe regions; this is exacerbated when code and state spaces must both be explored.

Key concepts

References (cited)

• Vulseye: Detect Smart Contract Vulnerabilities via Stateful Directed Graybox Fuzzing (arXiv 2408.10116v1).
• Laeufer et al. RFUZZ: coverage-directed fuzz testing of RTL on FPGAs, ICCAD 2018 (cited as a coverage-directed hardware fuzzer).