Skip to main content
IMMUNITYSEC

Honggfuzz

Multi-threaded, feedback-driven fuzzer using software and hardware coverage counters to uncover memory corruption defects.

Technical Architecture & Overview

Honggfuzz is a multi-process, multi-threaded fuzzing engine. It supports software-based coverage (SanitizerCoverage) and hardware-based coverage (Intel PT/BTS), making it suitable for fuzzing large, complex, and binary-only targets.

Targeted Technical Use Cases

Fuzzing large software projects and binary-only targets using hardware-based coverage feedback.

Evaluation & Trade-offs

Core Strengths

  • +Supports hardware-based coverage via Intel Processor Trace (PT) and Branch Trace Store (BTS).
  • +Persistent mode tests APIs in-process at high iteration speeds.
  • +Has found bugs in projects such as BIND, LibreSSL, and LibTIFF, with many more reported through OSS-Fuzz.

Trade-Offs & Limitations

  • -Hardware coverage features require specific Intel CPU support.
  • -Windows support runs through Cygwin.

Defensive Security Application

Finding memory corruption bugs in complex software through continuous hardware-assisted fuzzing.

Frequently Asked Questions

What is Honggfuzz?→

Honggfuzz is a multi-process, multi-threaded fuzzing engine. It supports software-based coverage (SanitizerCoverage) and hardware-based coverage (Intel PT/BTS), making it suitable for fuzzing large, complex, and binary-only targets.

What is Honggfuzz used for?→

Fuzzing large software projects and binary-only targets using hardware-based coverage feedback.

What are the strengths of Honggfuzz?→
  • +Supports hardware-based coverage via Intel Processor Trace (PT) and Branch Trace Store (BTS).
  • +Persistent mode tests APIs in-process at high iteration speeds.
  • +Has found bugs in projects such as BIND, LibreSSL, and LibTIFF, with many more reported through OSS-Fuzz.
What are the limitations of Honggfuzz?→
  • +Hardware coverage features require specific Intel CPU support.
  • +Windows support runs through Cygwin.
How is Honggfuzz used defensively?→

Finding memory corruption bugs in complex software through continuous hardware-assisted fuzzing.