4 ms·
The semiconductor industry was using fuzzing before it was used in software (starting about two decades ago), but they didn't call it that. They (or rather, the
by not2b 5y ago
The semiconductor industry was using fuzzing before it was used in software (starting about two decades ago), but they didn't call it that. They (or rather, the academics who pioneered it) called it coverage-directed constrained random simulation, and it worked in much the same way as modern fuzzers do.
- snovv_crash 5y agoI wonder if you could fuzz a chip directly, without having the schematics, so that if the manufacturer inserts something off-the-books it still gets explored.
- not2b 5y agoFor fuzzing to be effective you need access to coverage information. If you have the RTL (SystemVerilog or VHDL source) you can verify that you're hitting all the paths and the branches, and use a constraint solver to find paths that increase coverage. If you just have the registers and latches you can see how much of the state you've reached. But if you just have a chip too much of the internal state is unreachable: you'll never find the magic sequence that triggers the badness (if it exists) by random simulation, the heat death of the universe will happen first.
- snovv_crash 5y agoWhat if you had some kind of microscope which could see which gates get activated?