anti-fuzzing

Concept

Anti-fuzzing is a security technique demonstrated in the Examiner paper that exploits inconsistencies in instruction behavior between CPU emulators and real ARM hardware to substantially reduce the code coverage attained by emulation-based fuzzers, thereby degrading their effectiveness.

First seen 6/7/2026

Last seen 6/7/2026

Evidence 2 chunks

Wiki v1

WIKI

Overview

Anti-fuzzing is one of three security applications built on top of the Examiner system (the other two being emulator detection and anti-emulation). It refers to the adversarial use of inconsistent instructions — instructions whose execution result differs between a CPU emulator (e.g., QEMU) and a real ARM device — to interfere with the operation of fuzzers that rely on software emulation.

Motivation: Emulator-Based Fuzzing

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections

Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM ← mentions 100% 2e

The paper demonstrates anti-fuzzing as a security application using inconsistent instructions.

inconsistent instructions uses → 100% 2e

Inconsistent instructions are used to build anti-fuzzing applications.

LINKED ENTITIES

2 links

Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM MENTIONS Extracted graph relationship

inconsistent instructions USES Extracted graph relationship

CITATIONS

6 sources

6 citations — click to expand

[1] Anti-fuzzing is one of three security applications (emulator detection, anti-emulation, anti-fuzzing) built and demonstrated in the Examiner paper. Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM

[2] By (ab)using inconsistent instructions, the coverage of a program being fuzzed inside an emulator can be highly decreased. Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM

[3] Emulator-based fuzzing tools include the QEMU mode of AFL, Unicornfuzz, FirmAFL, P2IM, HALucinator, and TriforceAFL. Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM

[4] Examiner located 155,642 inconsistent instruction streams covering 30% of all instruction encodings and 47.8% of the instructions between four real ARM devices (ARMv5, ARMv6, ARMv7-a, ARMv8-a) and QEMU. Automatically Locating ARM Instructions Deviation between Real Devices and CPU Emulators

[5] The major causes of inconsistencies are undefined implementation in the ARM manual and implementation bugs in emulators; 12 such bugs were confirmed by developers, including ones affecting commonly used instructions such as BLX that can crash emulators. Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM

[6] The authors present emulator detection, anti-emulation, and anti-fuzzing as demonstration use cases of the inconsistent-instruction findings, noting that other applications may exist. Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM