Directed symbolic execution
Grammar-based whitebox fuzzing