DirectFuzz

Tool

DirectFuzz is a hardware directed graybox fuzzing (DGF) tool that builds upon RFuzz to enable focused, targeted fuzzing of specific submodules within a larger hardware design. It uses Verilator to simulate the RTL design and communicates fuzzing feedback via shared memory buffers, aiming to improve directed coverage in hardware verification.

First seen 6/6/2026

Last seen 7/15/2026

Evidence 12 chunks

Wiki v1

WIKI

DirectFuzz

Overview

DirectFuzz is a directed graybox fuzzing (DGF) tool for hardware designs. It is described in the literature as a DGF-based implementation that builds upon RFuzz and aims to bring directionality into the fuzzing process in order to improve targeted coverage of hardware designs.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

16 connections

Hardware fuzzing depends on → 90% 2e

DirectFuzz is built on hardware fuzzing concepts adapted from DGF

DirectFuzz operates on RTL designs and uses RTL-specific coverage feedback

Directed Greybox Fuzzing implements → 95% 2e

DirectFuzz adapts directed greybox fuzzing to the hardware domain

Sadullah Canakci authored by → 100% 2e

DirectFuzz is proposed by Sadullah Canakci as part of his dissertation

Sodor Processor evaluates → 95% 1e

DirectFuzz is evaluated on the Sodor processor

Fine-Grained Code Analysis for Processor Fuzzing ← mentions 85% 1e

The paper mentions DirectFuzz as prior work using module connectivity graphs.

Directed Graybox Fuzzing (DGF) implements → 95% 1e

DirectFuzz is explicitly described as a DGF-based implementation, indicating it realizes the DGF technique.

RFUZZ extends → 97% 1e

DirectFuzz built upon RFuzz and implements directed fuzzing.

Directed Fuzzing implements → 98% 1e

DirectFuzz implements directed fuzzing to focus on specific submodules.

Verilator uses → 97% 1e

DirectFuzz uses Verilator for hardware simulation, like RFuzz.

Profuzz compares with → 85% 1e

Profuzz takes a different approach to DirectFuzz by not using Verilator for simulation.

ProcessorFuzz compares with → 70% 1e

DirectFuzz is cited as related hardware fuzzing research.

Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection ← mentions 100% 1e

The paper mentions DirectFuzz as a related hardware fuzzer.

Boston University published by → 90% 1e

DirectFuzz was developed and published as part of a Boston University dissertation

RFUZZ compares with → 98% 1e

DirectFuzz is experimentally compared against RFUZZ

Instance Connectivity Graph uses → 90% 1e

DirectFuzz uses an instance connectivity graph for hardware design analysis

LINKED ENTITIES

1 links

Directed Graybox Fuzzing (DGF) IMPLEMENTS Extracted graph relationship

CITATIONS

5 sources

5 citations — click to expand

[1] DirectFuzz is a DGF-based implementation that aimed to bring directionality into the fuzzing process to improve targeted coverage. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis

[2] DirectFuzz exhibits limitations including inability to capture hardware-specific semantics and structure, misaligned coverage metrics, limited scalability when targeting multiple design regions, and inability to perform targeted verification across multiple modules. Intelligent Graybox Fuzzing via ATPG-Guided Seed Generation and Submodule Analysis

[3] DirectFuzz is another fuzzing tool that built upon RFuzz and implements directed fuzzing which allows for focusing the fuzzing on certain submodules in a larger system. Fuzzing IPv4 modules on FPGAs

[4] DirectFuzz, like RFuzz, uses Verilator to simulate the hardware design, and communicates with the fuzzer via buffers in shared memory. Fuzzing IPv4 modules on FPGAs

[5] PROFUZZ motivates its design by noting that using Verilator (as DirectFuzz does) results in an inherent mismatch between key intrinsic hardware characteristics and a software-level abstraction. Fuzzing IPv4 modules on FPGAs