Sorry to disappoint, but we're remaining coy on exactly which tools we tested for now – the evaluation was to demonstrate the initial feasibility, rather than t

Sorry to disappoint, but we're remaining coy on exactly which tools we tested for now – the evaluation was to demonstrate the initial feasibility, rather than to pick on anyone. We'll be releasing the corpora from the paper soon so people can do their own comparisons. And the code for the bug injection itself should be released a bit after that, so that it can be extended and built upon. So far some of the things you'd expect hold true: fuzzing doesn't tend to reach bugs deep in the program, symbolic execution has trouble with path explosion and one-way functions, etc. You can see those results in the tables in section VI.D of the paper.