Whitebox Fuzzing

Fuzzing that uses full program analysis — typically symbolic or concolic execution — to generate inputs that satisfy specific constraints.

Whitebox fuzzing (also called smart fuzzing or SAGE-style fuzzing) uses complete program analysis — symbolic execution, concolic execution, or model checking — to systematically generate inputs that satisfy branch constraints deep in the program. A concolic engine runs the program on a concrete input while simultaneously tracking symbolic path constraints; it then negates individual constraints to produce inputs that take alternative branches. This allows whitebox fuzzers to solve multi-byte magic values, checksums, and complex conditional logic that stop greybox fuzzers. The cost is scalability: symbolic execution suffers from state explosion and requires significant compute per input. In practice, whitebox techniques are often combined with greybox fuzzing — using symbolic execution to break through blocking constraints and then handing solved inputs back to a coverage-guided corpus.