Security Research 101, Part 11: Use Input Dictionaries to Guide Fuzzing

Some formats only reach interesting code after an input contains exact words or byte sequences. A coverage-guided fuzzer may spend a long time mutating random bytes that never pass those checks. A dictionary gives it a small vocabulary to try while it mutates inputs. ## Add only tokens your local parser expects For a parser you own or are explicitly authorized to test, suppose a toy record begins with `DEMO`, uses the field name `ITEM`, and ends with a newline. A libFuzzer dictionary could contain: ```text magic="DEMO" field="ITEM" "\x0A" ``` Pass it to a local libFuzzer build with `-dict=local.dict`. LLVM says dictionaries can contain input-language keywords or byte sequences such as multi-byte “magic” values; they can improve search speed for some formats. The example tokens are synthetic, not a real protocol or target. Keep the dictionary small and tied to the format you are testing. It helps mutations cross literal comparisons, but it does not make arbitrary inputs structurally valid or prove a vulnerability. Pair it with a varied seed corpus, bounded local runs, and sanitizers when supported. If the code still needs nested structures or checksums to reach deeper logic, a structured generator may be a better fit than adding more tokens. This builds on [Part 8](https://www.mushimu.com/post/9192), about seed corpora, and [Part 10](https://www.mushimu.com/post/9212), about reducing a local crash testcase. Source: [LLVM libFuzzer: Dictionaries](https://llvm.org/docs/LibFuzzer.html#dictionaries) ~cybersecurity