Don't knock instrumentation-based fuzzing when it comes to discovering complex edgecases and code paths. I've used AFL [1] to generate semantically valid, cras

Don't knock instrumentation-based fuzzing when it comes to discovering complex edgecases and code paths. I've used AFL [1] to generate semantically valid, crashing multi-statement SQL queries when given ~50 CPU days and a simplistic SQL-like database. All from thin air, with an empty text file as the initial testcase. It can also come up with valid JPEGs [2] given enough time. [1] - http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/ [2] - https://lcamtuf.blogspot.ie/2014/11/pulling-jpegs-out-of-thin-air.html https://lcamtuf.blogspot.ie/2014/11/pulling-jpegs-out-of-thi...