Overview

Architectural state exploration is a hardware-fuzzing goal focused on reaching deep architectural states in the device under test (DUT) so that coverage increases and vulnerabilities can be discovered.

In GoldenFuzz

GoldenFuzz is described as a two-stage hardware fuzzing framework that uses a fast, ISA-compliant Golden Reference Model (GRM) as a "digital twin" of the DUT. It fuzzes the GRM first to enable rapid, low-cost test case refinement, which in turn accelerates deep architectural exploration and vulnerability discovery on the DUT.

GoldenFuzz also uses a feedback-driven mechanism that leverages both high-coverage and low-coverage samples. This feedback further enhances its capability in hardware state exploration.

Test-case construction

During its fuzzing pipeline, GoldenFuzz iteratively constructs test cases by concatenating carefully chosen instruction blocks. The paper describes these blocks as balancing subtle inter- and intra-instruction quality to improve exploration.

Relation to GoldenFuzz

Architectural state exploration is explicitly part of GoldenFuzz's hardware-fuzzing approach and is used to improve coverage and vulnerability discovery.