google/honggfuzz
FreeSecurity oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
About google/honggfuzz
Honggfuzz is a security-oriented, feedback-driven, evolutionary fuzzer developed by Google. It uses both software and hardware-based code coverage to find bugs. The fuzzer features a multi-process and multi-threaded engine for high performance, supports persistent fuzzing with iteration speeds up to 1 million per second, and can start with an empty corpus to automatically build a valid input set. It employs low-level APIs such as ptrace for deep monitoring to detect hijacked signals and hidden crashes. Honggfuzz supports multiple platforms including Linux, macOS, Android, NetBSD, FreeBSD, and Windows (Cygwin). It includes compiler wrappers (hfuzz-clang/hfuzz-clang++) to easily instrument target binaries and has been used to discover major vulnerabilities in software like Apache HTTPD, OpenSSH, BIND, NGINX Unit, ProFTPD, Samba, and SSL libraries.
Key Features
Pros & Cons
- High performance due to multi-process/multi-threaded design and persistent mode
- Uses both hardware and software code coverage for effective feedback-driven fuzzing
- Can start with an empty corpus, reducing initial setup effort
- Detects hidden crashes and hijacked signals via deep monitoring with ptrace
- Cross-platform support covers major operating systems
- Free and open-source under Apache License 2.0
- Proven track record of finding major CVEs in prominent software
- Requires recompilation of target software with provided compiler wrappers
- Hardware-based coverage (BTS/PT) requires specific Intel CPU features and Linux or macOS
- Persistent fuzzing mode requires target compatibility with in-process fuzzing
- Command-line only; no graphical user interface