AssignEnergy Function

Concept

The AssignEnergy function is the component of the power scheduler in a coverage-based greybox fuzzer (specifically MTCFuzz) that determines how much energy (i.e., how many mutations/executions) to assign to each seed in the corpus. It computes each seed's energy from aggregated metadata about how often the same code coverage has been observed across different seeds, allowing the fuzzer to concentrate effort on seeds that exercise less-frequently-covered or unique code regions.

First seen 7/12/2026

Last seen 7/12/2026

Evidence 3 chunks

Wiki v1

WIKI

AssignEnergy Function

Overview

The AssignEnergy function is the routine, within the power scheduler of a coverage-based greybox fuzzer, that calculates and assigns a numerical energy value to each seed in the fuzzing corpus. The energy value controls how many mutated inputs are generated from a given seed during the fuzzing campaign — higher-energy seeds are mutated more often, while lower-energy seeds are deprioritized.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections

Coverage-based Greybox Fuzzing part of → 100% 2e

AssignEnergy is a key function in the CGF algorithm that prioritizes seeds.

Coverage-based Greybox Fuzzing ← uses 100% 1e

CGF uses the AssignEnergy function to prioritize seeds for mutation.

LINKED ENTITIES

1 links

Coverage-based Greybox Fuzzing PART_OF Extracted graph relationship

CITATIONS

3 sources

3 citations — click to collapse

[1] The number of times the same code coverage has been observed in different seeds is aggregated and used by the power scheduler when calculating the energy assigned to each seed. MTCFuzz paper (arXiv:2603.25354)

[2] MTCFuzz extends the QEMU QMP API with mtcfuzz-trace-start / mtcfuzz-trace-stop commands to control coverage tracking windows, and instruments at TCG translation time on a basic-block basis. MTCFuzz paper (arXiv:2603.25354)

[3] MTCFuzz is designed to fuzz low-level software such as kernels and firmware, with fuzzing management running on the host OS and the test harness running inside the QEMU guest (transferred via scp/9p and launched via ssh). MTCFuzz paper (arXiv:2603.25354)