Hawkeye：定向灰盒模糊测试技术

最新推荐文章于 2025-08-27 10:15:35 发布

原创

最新推荐文章于 2025-08-27 10:15:35 发布 · 2.7k 阅读

3 ·

CC 4.0 BY-SA版权

Hawkeye是一种定向模糊测试技术，通过精确的静态分析和动态策略，如能量调度、适应性变异及种子优先级排序，显著提高了到达目标点的速度和发现漏洞的效率。与AFL和AFLGo相比，Hawkeye能在更短时间内找到目标位置，成功检测到41个未知崩溃，其中15个获得CVE编号。

Hawkeye Towards a Desired Directed Grey-box Fuzzer

Remarks

Conference: CCS 2018
Full Paper: https://hongxuchen.github.io/pdf/hawkeye.pdf
Slides: https://hongxuchen.github.io/pdf/hawkeye-slides.pdf

Abstract

Grey-box fuzzing is a practically effective approach to test real-world programs. However, most existing grey-box fuzzers lack directedness, i.e. the capability of executing towards user-specified target sites in the program. To emphasize existing challenges in directed fuzzing, we propose Hawkeye to feature four desired properties of directed grey-box fuzzers. Owing to a novel static analysis on the program under test and the target sites, Hawkeye precisely collects the information such as the call graph, function and basic block level distances to the targets. During fuzzing, Hawkeye evaluates exercised seeds based on both static information and the execution traces to generate the dynamic metrics, which are then used for seed prioritization, power scheduling and adaptive mutating. These strategies help Hawkeye to achieve better direc