MaxAFL Overview Maximize code coverage using optimization algorithm. Main Idea construct global objective function for optimization based on static code analysis. implement fast optimization algorithm using gradient descent. Implementation implement instrumentation for fuzzing using LLVM Pass. Dev environment Ubuntu 18.04 Visual Studio Code Dependencies LLVM 8.0.0 Boost Graph Library 1.6.2 Test LLVM Pass Test opt -load (path_to_so_file)/FuncBlockCount.so -funcblockcount sample.ll clang -O0 -S -emit-llvm sample.c -o sample.ll Paper Work Google Docs Related Works Angora use gradient descent to explore path. use taint analysis and type inference for efficient gradient descent. pdf, github NEUZZ train Deep Neural Network that predict branch coverage(TBA). pdf, github GRsan(Proximal gradient analysis) use chain rule to compute gradient of variable w.r.t. input. pdf, source code is not available yet. Links Fuzzing corpus corpus Fuzzing targets targets Analyze Result gen_cov.py -> coverage.py -> plot.py
