Modularizing Directed Greybox Fuzzing for Binaries over Multiple CPU Architectures

Directed Greybox Fuzzing has proven effective in vulnerability detection areas such as bug reproduction and patch testing. However, existing directed fuzzers are often difficult to customize, lack modularity and have limited binary support. This constrains their usability on complex software or when the source code is unavailable; a challenge encountered when fuzzing embedded systems. This article addresses these limitations by introducing the Directed Fuzzing Toolkit (DRIFT) as a platform for directed fuzzing within the modular framework LibAFL. DRIFT modularizes techniques from the state-of-the-art directed fuzzer AFLGo and adapts them for binary applications thereby augmenting LibAFL’s highly customizable fuzzers with directed fuzzing capabilities. Additionally, by leveraging Ghidra’s analysis, DRIFT achieves architecture agnostic static analysis, opening doors for DGF to tackle previously challenging scenarios. Our evaluation of DRIFT shows a 90% correlation in static analysis metrics over binary compared to its source-code counterpart. Fuzzing performance was also notable despite operating over emulation. In benchmarks, DRIFT’s performance exceeds the original fuzzer with up to doubled bug discovery rates and 9–40 \(\times \) faster exploitation times of target bugs. These results are attributed to the toolkit’s modular design and its integration with LibAFL. Additionally, DRIFT includes a profiling platform for DGF metrics and is incorporated with the Magma benchmark. Together, these features position DRIFT as a practical advancement in directed fuzzing within LibAFL.