# Constructing More Complete Control Flow Graphs Utilizing Directed Gray-Box Fuzzing
## 6 Evaluation
### Evaluation of DGF in CFG Construction (RQ1)  
In order to evaluate the effectiveness of DGF in discovering indirect jumps, we implement and compare two CFG constructors. **DGF-CFGConstructor (ours)**. It is our prototype that is implemented based on our proposed approaches, i.e., the DGF-based test case generation and iterative feedback mechanism. In the DGF-based test case generation, we adopt the annealing-based power schedules and set _time-to-exploitation_ to one hour. **CGF-CFGConstructor**. It is identical to our prototype except for the test case generation approach. The CFG constructor employs the CFG-based approach proposed in [26]. We use the two CFG constructors to analyze the eight benchmarks for 20 h. Figure 7 shows the trend of the number of indirect jumps discovered by the two approaches in the experiment. Figure 8 shows the statistical results after 20 h. Based on the results, we observe the following cases. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Project** & **Version** & **Description** & **LoC** & **Program** & **parameter** \\ \hline libxml2 & 2.9.10 & Xml parser & 496 k & xmllint & -valid -recover file \\ JasPer & 2.0.16 & Picture handler & 33 k & imgcmp & -f sample -F result \\ libming & 0.4.8 & Swf parser & 96 k & swftophp & swf\_file \\ FreeType & 2.10.0 & Library to render fonts & 219 k & testusite & file \\ libpng & 1.6.37 & Png handler & 97 k & pngtest & -m file \\ ImageMagick & 7.0.8.6 & Picture handler & 553 k & magick & covert file result \\ libjpeg-turbo & 1.5.1 & Image codec & 91 k & djpeg & switches file \\ libtiff & 4.1.0 & Tiff processor & 138 k & tiffsplit & file -o /dev/null \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The information about the benchmarks. * In the early phase of the analysis (about the first 2 h), the number of indirect jump relations discovered by DGF-CFG constructor (the red line) is similar to that discovered by CGF-CFGConstructor (the blue line). The reason is that DGF-CFG constructor adopts the annealing-based power schedules. The weight of the seed distance in energy assignment is zero at the beginning and increases with the testing time. Therefore, the two implementations have similar performance in the early phase. * After the early phase, the number of indirect jump relations discovered by DGF-CFG constructor on 7 out of 8 benchmarks (except libpng) shows a better increase than that discovered by CFG-CFGConstructor. * The statistical results in Figure 8 shows that DGF-Constructor (the red bar) discovers more indirect jump relations than CFG-Constructor (the blue bar). For example, in the analysis of libxml2, CGF-CFGConstructor discovers 821 indirect jump relations. DGF-CFGConstructor is able to discover 1480 indirect jump relations, 80.3% more than CGF-CFGConstructor. On average, DGF-CFGConstructor discovers 61.9% more indirect jump relations than CGF-CFGConstructor on the eight benchmarks. * In the analysis of libpng, DGF-CFGConstructor and CGF-CFGConstructor discover similar number of indirect jump relations, which is not as expected. The reason may be that there are too few indirect jumps in libpng. The newly discovered indirect jumps cannot provide more feedback to DGF-based test case generation. Therefore, the two approaches show similar performance on this benchmark. The main reason for the poor performance of CGF-CFGConstructor in discovering indirect jumps is that CGF aims to generate test cases covering the whole program. The approach assumes that all paths have the same priority and performs a undirected path exploration. This wastes a lot of time to test the code unrelated to indirect jumps. We introduce DGF-based test cases generation to mitigate this problem. The result shows that our approach discovers more indirect jump relations than the existing approach on most benchmarks. Overall, the analysis indicates that the answer to RQ1 is definite: the DGF-based approach is able to resolve more indirect jump relations than the existing approach.