3 ms·
Does a coverage-guided QuickCheck exists, à la AFL? AFL is really good at finding deeper code path that the randomness only approach might not find.
by mrswag 10y ago
Does a coverage-guided QuickCheck exists, à la AFL? AFL is really good at finding deeper code path that the randomness only approach might not find.
- dekimir 10y agoI looked into this while making RamFuzz[1], but parameter generation (QuickCheck) is quite different from input-blob evolution (AFL). It wasn't clear to me how best to leverage a parameter mutation that happens to increase coverage. Ultimately, I decided that random generation (without guidance by coverage) coupled with AI classification of test outcomes is the most interesting approach. [1] https://github.com/dekimir/RamFuzz https://github.com/dekimir/RamFuzz