honggfuzz - Security-Oriented Coverage-Guided Fuzzer Cheatsheet

honggfuzz - Security-Oriented Coverage-Guided Fuzzer Cheatsheet

honggfuzz is a security-oriented, feedback-driven fuzzer from Google. It is known for being straightforward to point at a target, for solid multi-process and multi-threaded fuzzing out of the box, and for supporting both software instrumentation and hardware-based coverage feedback (Intel BTS/PT) — the latter letting you fuzz binaries you cannot recompile. It has a long track record of finding real vulnerabilities in widely-used software.

Fuzzing can consume large amounts of CPU and disk. Run it on dedicated capacity and in an isolated environment.

Installation

Platform	Command
Debian/Ubuntu	sudo apt install honggfuzz
From source	git clone https://github.com/google/honggfuzz && make
macOS	brew install honggfuzz
Verify	honggfuzz --help

Two Modes

Mode	Use
File-based	Target reads a file/stdin; honggfuzz mutates inputs
Persistent	Target exposes a fuzz entry point; far faster

File-Based Fuzzing

# Fuzz a program that takes a file argument
honggfuzz -i ./input_corpus -W ./workspace -- ./target ___FILE___

Flag	Purpose
-i DIR	Input corpus directory
-W DIR	Workspace (crashes, stats)
-o DIR	Output corpus
___FILE___	Placeholder replaced with the input file
-s	Feed input via stdin instead
-t SECS	Per-run timeout
-n N	Number of concurrent fuzzing threads

Persistent Mode (Fast)

#include <stdint.h>
#include <stddef.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    parse_input(data, size);   // your target function
    return 0;
}

# Compile with honggfuzz's clang wrapper, then fuzz
hfuzz-clang -fsanitize=address fuzz_target.c -o fuzz_target
honggfuzz -i corpus -P -- ./fuzz_target

Element	Note
LLVMFuzzerTestOneInput	Same entry point as libFuzzer — targets are portable
-P	Enable persistent mode
hfuzz-clang / hfuzz-gcc	Compiler wrappers that add instrumentation

Persistent mode avoids process startup per input, often giving 10–100x more executions per second.

Coverage Feedback Options

Mechanism	Flag / requirement
Software instrumentation	Compile with hfuzz-clang (default, best)
Intel BTS	--linux_perf_bts_edge (no recompile)
Intel PT	--linux_perf_ipt_block (no recompile)
Instruction/branch counts	--linux_perf_instr, --linux_perf_branch

Hardware feedback is the escape hatch for closed-source binaries — you get coverage guidance without source access.

Sanitizers

# Build with ASan + UBSan for better crash detection
hfuzz-clang -fsanitize=address,undefined target.c -o target

Sanitizer	Catches
ASan	Buffer overflows, use-after-free
UBSan	Undefined behavior
MSan	Uninitialized reads
LeakSanitizer	Memory leaks

Monitoring and Output

Item	Where
Live stats	Terminal UI (execs/sec, coverage, crashes)
Crashes	WORKSPACE/*.fuzz files
Report	HONGGFUZZ.REPORT.TXT
Crash naming	Includes signal and faulting address

Flag	Effect
-N N	Stop after N iterations
--exit_upon_crash	Stop at the first crash
-v	Verbose
-Q	Quiet

Triage Workflow

# 1) Reproduce a crash
./target < WORKSPACE/SIGSEGV.PC.*.fuzz

# 2) Get a stack trace under a debugger
gdb --args ./target WORKSPACE/SIGSEGV.PC.*.fuzz

# 3) Minimize the input, then file the bug with the reproducer

honggfuzz vs Other Fuzzers

Aspect	honggfuzz	AFL++	libFuzzer	LibAFL
Setup	Very easy	Easy	Easy (in-process)	Build your own
Closed-source targets	Yes (Intel PT/BTS)	QEMU mode	No	Yes
Persistent mode	Yes	Yes	Native	Yes
Best for	Fast start, hardware feedback	Broad ecosystem	Library APIs	Custom fuzzers

Compare with AFL++ for the broadest ecosystem and LibAFL when you need to build a custom fuzzer.

Resources

• GitHub Repository
• Documentation
• Trophy list (found bugs)