  Dynamic data flow analysis has been widely used to guide greybox fuzzing.
However, traditional dynamic data flow analysis tends to go astray in the
massive path tracking and requires to process a large volume of data, resulting
in low efficiency in reaching the target location. In this paper, we propose a
directed greybox fuzzer based on dynamic constraint filtering and focusing
(CONFF). First, all path constraints are tracked, and those with high priority
are filtered as the next solution targets. Next, focusing on a single path
constraint to be satisfied, we obtain its data condition and probe the mapping
relationship between it and the input bytes through multi-byte mapping and
single-byte mapping. Finally, various mutation strategies are utilized to solve
the path constraint currently focused on, and the target location of the
program is gradually approached through path selection. The CONFF fuzzer can
reach a specific location faster in the target program, thus efficiently
triggering the crash. We designed and implemented a prototype of the CONFF
fuzzer and evaluated it with the LAVA-1 dataset and some real-world
vulnerabilities. The results show that the CONFF fuzzer can reproduce crashes
on the LAVA-1 dataset and most of the real-world vulnerabilities. For most
vulnerabilities, the CONFF fuzzer reproduced the crashes with significantly
reduced time compared to state-of-the-art fuzzers. On average, the CONFF fuzzer
was 23.7x faster than the state-of-the-art code coverage-based fuzzer Angora
and 27.3x faster than the classical directed greybox fuzzer AFLGo.
