mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
29 lines
1.1 KiB
TeX
29 lines
1.1 KiB
TeX
\section{Coverage-Guided Fuzzing Internals}
|
|
|
|
|
|
\subsection{How Coverage Guidance Works}
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item The fuzzer instruments the binary to track which basic blocks (or edges) are
|
|
executed.
|
|
\item For each input, the fuzzer runs the code and records the set of covered edges.
|
|
\item If an input covers a new edge (one not covered by any previous input in the
|
|
corpus), the input is added to the corpus.
|
|
\item New inputs are generated by mutating corpus entries (bit flips, byte insertions,
|
|
arithmetic operations on integer fields).
|
|
\end{enumerate}
|
|
|
|
\subsection{Why It Matters for Crypto}
|
|
|
|
Cryptographic code has many conditional branches that depend on input values:
|
|
\begin{itemize}[nosep]
|
|
\item Modular reduction: triggered when $a \geq q$.
|
|
\item Carry propagation: triggered by specific bit patterns.
|
|
\item Branch-free constant-time code: still has compiler-generated branches.
|
|
\end{itemize}
|
|
|
|
Coverage-guided fuzzing systematically explores these branches, while random testing
|
|
may miss rare conditions.
|
|
|
|
%% ============================================================
|