notes

DirectedFuzzer.md (2462B)

---

 # Directed Fuzzer
 
 **Source:** Where To Fuzz (paper)
 
 **Definition:** Directed fuzzers are fuzzers that focus on specific parts of source code / a binary. These locations can either be defined manually or using some sort of heuristic.
 
 ## Examples
 
 One example is regression greybox fuzzing which focuses on recently changed code. The idea behind this is that recently changed code is more likely to impose regressions than existing code which has been, presumably, more thoroughly tested. 
 
 Another example are the metrics used in [Orion](Orion.md) for calculating interfaces of interest to write fuzzing harnesses for. Their approach combines deterministic values like cyclomatic complexity and call graph size with LLM derived values coming from the usage of techniques commonly associated with vulnerabilities (eg. pointer arithmetic and the likes).
 
 ## Categorization
 
 A simple approach to the categorization of existing directed fuzzers can be done on the basis of
 
 1. The source of the information
     - Source code
         - like code complexity
     - Binary code
         - like sanitizer instrumentation
     - External information
         - like recently changed code or CVE site information used to find code patterns
 2. Discrete or continuous scoring
     - Scoring type
 3. Granularity
     - Block
     - Function
         - This seems to be the most common approach for the evaluation of selection methods
     - Source code line
 4. Scoring mechanism
     - Two broad categories
         1. metrics
             - use code metrics to score individual locations
             - examples include:
                 - TortoiseFuzz & CollAFL
                     - Focus on memory access count in selected method
                 - Leopard
                     - Uses structural complexity and vulnerability metrics which are properties of a code region like pointer arithmetic and nested control structures.
         2. patterns
             - uses heuristics
             - examples include:
                 - ODDFuzz
                     - selects deserialization methods in Java as targets
                 - StrawFuzzer
                     - Data storing instructions as targets in an attempt to cause OS crashes
                 - AmpFuzz
                     - Targets networking related functions for amplification attack searching
                 - ParmeSan, SAVIOR, and FishFuzz
                     - Uses sanitizer instrumentation as a heuristic for relevant code