Coverage-Guided Windows Fuzzer

A Windows binary fuzzer written in C that mutates an input configuration file, runs a target executable, collects code coverage with DynamoRIO/drcov, and logs crashes with exception details.

About

This project implements a simple coverage-guided fuzzer for testing Windows binaries. The fuzzer modifies bytes in the input file, executes the target program, tracks basic block coverage, detects crashes, and saves useful debugging information such as exception codes, register values, and stack snapshots.

Features

• Single-byte mutation mode
• Multi-byte mutation mode
• Manual and automatic fuzzing modes
• Input file backup and restoration
• Payload region detection and exclusion
• Code coverage collection with DynamoRIO/drcov
• Crash detection through Windows exception codes
• Register and stack dump logging
• Coverage improvement tracking
• Fuzzing progress output

Tech Stack

• C
• Windows API
• DynamoRIO
• drcov
• Win32 debugging API

Project Structure

.
├── fuzzer.c          # Main fuzzer source code
├── config_13         # Input file used for mutation
├── config_13_bak     # Backup of the original input file
├── func.dll          # Target dependency
├── vuln13.exe        # Target executable
└── fuzz_log.txt      # Fuzzing log output

How It Works

The fuzzer follows these steps:

1. Loads the original input file.
2. Creates a backup copy.
3. Detects the payload region that should not be mutated.
4. Applies byte-level mutations to the input file.
5. Runs the target executable.
6. Collects coverage information using DynamoRIO/drcov.
7. Checks the process exit code and Windows exceptions.
8. Logs crashes, register values, stack snapshots, and coverage changes.
9. Restores the input file when needed.

Mutation Strategies

The fuzzer supports several mutation patterns:

• Single-byte replacement:

  • 0x00
  • 0x01
  • 0x7F
  • 0x80
  • 0xFE
  • 0xFF
  • space character

• Multi-byte replacement:

  • 0x0000
  • 0xFFFF
  • 0x7FFF
  • 0x8000
  • 0x000000
  • 0xFFFFFF
  • 0x00000000
  • 0xFFFFFFFF
  • AAAA

Requirements

• Windows
• C compiler with WinAPI support
• DynamoRIO installed
• 32-bit target executable

Before running, update the DynamoRIO path in fuzzer.c:

static char DYNAMORIO_PATH[MAX_PATH] = "D:\\DynamoRIO-Windows-11.3.0-1\\bin32\\drrun.exe";

Build

Using Microsoft Visual Studio Developer Command Prompt:

cl fuzzer.c

Or with MinGW:

gcc fuzzer.c -o fuzzer.exe

Usage

Run the compiled fuzzer:

fuzzer.exe

The program provides an interactive console menu for choosing mutation modes and displaying fuzzing results.

Output

The fuzzer writes results to:

fuzz_log.txt

The log may include:

• mutation description
• exception code
• coverage block count
• register values
• stack dump
• crash information