datAFLow: Towards a Data-Flow-Guided Fuzzer
Adrian Herrera, Mathias Payer, Antony L. Hosking · 2022
program analyses to model program and input structure, and continuously gather dynamic information about the target.We perform a preliminary evaluation of DATAFLOW, comparing fuzzers driven by control flow, taint analysis (both approximate and exact), and data flow.Our initial results suggest that, so far, pure coverage remains the best coverage metric for uncovering bugs in most targets we fuzzed (72 % of them).However, data-flow coverage does show promise in targets where control flow is decoupled from semantics (e.g., parsers).Further evaluation and analysis on a wider range of targets is required.