HF-DGF: Hybrid Feedback Guided Directed Grey-Box Fuzzing

Abstract

Directed Grey-box Fuzzing (DGF) is widely used for crash reproduction and patch testing because it can steer execution toward predefined target locations. However, existing DGF tools often rely on limited runtime feedback, which weakens both target convergence and target-state exploration. This paper presents HF-DGF , a directed grey-box fuzzing framework with hybrid feedback-guided seed scheduling. HF-DGF integrates control-flow distance, value-flow influence score, and slice coverage. For precise distance guidance, we design a backward-stepping algorithm that computes basic-block-level distances on a virtual interprocedural control-flow graph (ICFG). For deeper target-state exploration, we introduce value-flow influence and its corresponding metric, the value-flow influence score. To control the runtime cost introduced by hybrid feedback, we further adopt a selective instrumentation strategy. Evaluation on 41 real-world vulnerabilities (32 valid for comparative analysis) shows that HF-DGF consistently outperforms existing tools. On average, it reproduces crashes 5.05 $\mathbf{\times}$ faster than AFL, 50.56 $\mathbf{\times}$ faster than AFL ${+}{+}$ , 5.79 $\mathbf{\times}$ faster than AFLGo, 73.75 $\mathbf{\times}$ faster than WindRanger, 2.56 $\mathbf{\times}$ faster than DAFL, and 8.45 $\mathbf{\times}$ faster than Beacon. Notably, among cases where all fuzzers trigger the target crash, HF-DGF achieves the lowest code coverage, indicating stronger directionality. It also outperforms AFLGo, WindRanger, DAFL, and Beacon in static-analysis efficiency.