AFL might eventually get lucky, but I'm guessing you'd want a hybrid approach that combines symbolic execution with a fuzzer like AFL, e.g. QSYM [1]. [1] https

AFL might eventually get lucky, but I'm guessing you'd want a hybrid approach that combines symbolic execution with a fuzzer like AFL, e.g. QSYM [1]. [1] https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-yun.pdf https://www.usenix.org/system/files/conference/usenixsecurit...