Hmm, that's the tricky bit to explain in a quick post. It has an independent code interpreter that works on the internal representation of the fuzzed code. The

Hmm, that's the tricky bit to explain in a quick post. It has an independent code interpreter that works on the internal representation of the fuzzed code. The output of that internal representation in fed through the Flow compiler (then C++). There is basically a "check([random number])" statement on every other line of code which should be reached in a known order. We compare the check log of the fuzz tester's interpreter to the check log of the compiled code.