.png){kind=icon}
.png){kind=icon}
Return
PriSat: Prioritized satisfaction of critical path and data conditions for directed greybox fuzzing
.png){kind=icon}
PRE
AI
Y
Y
W
L
P
W
DOI：10.1016/j.cose.2026.105020.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Directed greybox fuzzing (DGF) aims to efficiently discover potential vulnerabilities in specific target locations in a program. It has been widely used in scenarios such as patch testing, crash reproduction, static analysis report validation, and proof-of-concept generation. The effectiveness of DGF hinges on solving two types of conditions: path conditions required to reach the target location and data conditions necessary to trigger the vulnerability. Despite tremendous efforts, most existing DGF approaches still struggle to effectively reach and trigger target vulnerabilities due to their passive and indirect approach to satisfying path and data conditions. In this paper, we present PriSat, a new DGF system that accelerates vulnerability exposure via the prioritized satisfaction of critical path and data conditions. Specifically, PriSat introduces (1) a hybrid static-dynamic prioritization mechanism that assigns each path condition a composite priority based on its static control-flow distance and dynamic execution frequency, and (2) a key-variable–guided strategy that identifies highly influential program variables via probing feedback and selectively mutates the input bytes controlling them. We evaluate PriSat on a standard benchmark consisting of real-world bugs, and compare its performance with six state-of-the-art fuzzers including AFLGo, WindRanger, Beacon, DAFL, WAFLGo, and Angora. The evaluation results demonstrate that PriSat significantly outperforms its competitors in reproducing target vulnerabilities.
Journal
C
IF:
5.4
Papers:
164
Citations:
0
Organization
Cited Papers