They no longer just try out random combinations or cover the input space exhaustively (which is not feasible anyway). Nowadays they use instrumentation in the

They no longer just try out random combinations or cover the input space exhaustively (which is not feasible anyway). Nowadays they use instrumentation in the fuzzed/tested code to have guidance in what direction the input should be modified to get more cases the code covered. Good example: http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/