DynamicFuzz: Confidence-based directed greybox fuzzing for programs with unreliable call graphs

Abstract

Directed greybox fuzzing (DGF) is a security testing technique designed to test specific targets. Current DGF techniques face challenges due to the dynamic nature of indirect calls. The main challenges include mitigating the influence of indirect call omissions and misjudgments on seed guidance and guiding fuzzing on unreliable function call graphs.

This paper introduces DynamicFuzz, a novel dynamic guidance mechanism that uses the confidence of indirect calls to update the call graph and adjust path priorities during fuzzing. Our key insight is that functions connected by indirect calls tend to form function islands in the call graph. These islands help focus fuzzing on critical areas, improving both guidance efficiency and control over complex program structures. DynamicFuzz also incorporates two depth metrics – function depth and island depth – to better estimate the importance of each path. Based on this, DynamicFuzz employs four guiding strategies: the Target Function Selection Strategy, the Function Island Prioritization Strategy, the High-Confidence Path Prioritization Strategy, and the Deep Indirect Call Prioritization Strategy. These strategies allow DynamicFuzz to guide fuzzing effectively even when the call graph is unreliable. We evaluate DynamicFuzz on 17 benchmarks from three test suites. Compared to AFLGo, AFL, and FairFuzz, it reaches target locations 5.64$\times$ , 3.01$\times$ , and 2.89$\times$ faster, and detects target crashes 69.8$\times$ , 48.37$\times$ , and 161.20$\times$ faster, respectively. Additionally, DynamicFuzz discovered 8 CVEs from the real world.