AeonDave honggfuzz
General-purpose evolutionary fuzzer with software/hardware coverage options and strong persistent-mode performance.
Quick Start
# Compile with wrappers
./hfuzz_cc/hfuzz-clang -o target target.c
# Run with file placeholder
./honggfuzz -i seeds -- ./target ___FILE___
# Persistent mode
./honggfuzz -P -i seeds -- ./target
Operator Flow
- Start with a stable target invocation (
___FILE___or-sstdin mode). - Use compile-time instrumentation first; move to hardware counters when appropriate.
- Switch to persistent mode (
-P) as soon as target design allows. - Run corpus minimization (
-M) periodically. - Verify/replay findings with sanitizer builds and deterministic launch args.
Core Flags
| Flag | Description |
|---|---|
-i <dir> |
Input corpus directory |
--output <dir> |
Output directory for dynamic/minimized corpus |
-P |
Persistent mode |
-n <threads> |
Number of fuzzing threads |
-M |
Corpus minimization mode |
-x |
Disable instrumentation feedback (static mode) |
-s |
Feed input via stdin |
--sanitizers |
Enable sanitizer-aware handling (build-dependent) |
Practical Tricks
- Use
-dictfor highly structured input grammars. - Tune timeout (
-t) and mutation count per run (-r) before scaling threads. - For constrained targets, use runtime limits (
--rlimit_*) to prevent campaign collapse. - In black-box cases, compare noinst (
-x) baseline vs coverage-driven modes to validate benefit.
Common Pitfalls
- Can start from empty corpus, but structured seeds improve depth.
- Persistent mode is usually the first optimization to unlock high exec/sec.
- Use with ASAN/UBSAN/MSAN builds for reliable crash triage.
- Ignoring output naming/signature patterns slows bucketing.
- Mixing unstable target startup logic with persistent mode can hide root causes.
Triage Pattern
- Keep crash files plus command/args snapshot.
- Reproduce under sanitizer build of same target path.
- Cluster by signal + PC/stack signature, then minimize and bisect input deltas.