# Honggfuzz

> Auth/lab ref: Feedback-driven, high-speed fuzzer with multi-process/thread execution and persistent fuzzing.

- Skill: `aeondave/honggfuzz` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/honggfuzz`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/honggfuzz/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/honggfuzz

---


# honggfuzz

General-purpose evolutionary fuzzer with software/hardware coverage options and strong persistent-mode performance.

## Quick Start

```bash
# Compile with wrappers
./hfuzz_cc/hfuzz-clang -o target target.c

# Run with file placeholder
./honggfuzz -i seeds -- ./target ___FILE___

# Persistent mode
./honggfuzz -P -i seeds -- ./target
```

## Operator Flow

1. Start with a stable target invocation (`___FILE___` or `-s` stdin mode).
2. Use compile-time instrumentation first; move to hardware counters when appropriate.
3. Switch to persistent mode (`-P`) as soon as target design allows.
4. Run corpus minimization (`-M`) periodically.
5. Verify/replay findings with sanitizer builds and deterministic launch args.

## Core Flags

| Flag | Description |
|------|-------------|
| `-i <dir>` | Input corpus directory |
| `--output <dir>` | Output directory for dynamic/minimized corpus |
| `-P` | Persistent mode |
| `-n <threads>` | Number of fuzzing threads |
| `-M` | Corpus minimization mode |
| `-x` | Disable instrumentation feedback (static mode) |
| `-s` | Feed input via stdin |
| `--sanitizers` | Enable sanitizer-aware handling (build-dependent) |

## Practical Tricks

- Use `-dict` for highly structured input grammars.
- Tune timeout (`-t`) and mutation count per run (`-r`) before scaling threads.
- For constrained targets, use runtime limits (`--rlimit_*`) to prevent campaign collapse.
- In black-box cases, compare noinst (`-x`) baseline vs coverage-driven modes to validate benefit.

## Common Pitfalls

- Can start from empty corpus, but structured seeds improve depth.
- Persistent mode is usually the first optimization to unlock high exec/sec.
- Use with ASAN/UBSAN/MSAN builds for reliable crash triage.
- Ignoring output naming/signature patterns slows bucketing.
- Mixing unstable target startup logic with persistent mode can hide root causes.

## Triage Pattern

- Keep crash files plus command/args snapshot.
- Reproduce under sanitizer build of same target path.
- Cluster by signal + PC/stack signature, then minimize and bisect input deltas.

## Resources

- https://github.com/google/honggfuzz
- https://honggfuzz.dev/
- https://github.com/google/honggfuzz/blob/master/docs/USAGE.md
- https://google.github.io/oss-fuzz/