We add instrumentation at compile-time, just like conventional fuzzers! if (e) a else b becomes if (e) { hit(1); a } else { hit(2); b } There's

We add instrumentation at compile-time, just like conventional fuzzers! if (e) a else b becomes if (e) { hit(1); a } else { hit(2); b } There's more detail in the writeup if you curious, just scroll down!