Binary File Mutation

Concept

Binary file mutation is a fuzz testing technique that applies targeted mutations directly to a compiled binary program, rather than only to its inputs or arguments, to expose bugs in system-under-test simulators and related components.

First seen 8/4/2026

Last seen 8/4/2026

Evidence 2 chunks

Wiki v1

WIKI

Binary File Mutation

Overview

Binary file mutation is a fuzz testing technique in which the bytes of a compiled program (its binary image) are directly altered during fuzzing in order to generate new test inputs for the system under test (SUT). In contrast to mutating only the program's arguments or input data, binary file mutation operates on the executable itself, enabling the discovery of deeper bugs while still preserving structural validity where possible.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections

SearchSYS ← uses 97% 2e

SearchSYS applies bit-flip mutations only to a program's compiled binary file.

Coverage-Guided Fuzz Testing ← uses 94% 1e

Coverage-guided fuzz testing includes binary file mutation as one of its mutation strategies.

LINKED ENTITIES

2 links

SearchSYS USES Extracted graph relationship

Coverage-Guided Fuzz Testing USES Extracted graph relationship

CITATIONS

5 sources

5 citations — click to expand

[1] Naive bit-flip mutations of binaries often produce binaries that fail to load or execute even a single instruction, leading to inefficient SUT testing. Search+LLM-Based Testing for ARM Simulators

[2] SearchSYS introduces a custom bit-flip mutation operator that controls the number and frequency of bit-flips and applies them only to a program's compiled binary file, avoiding mutation of arguments or type information. Search+LLM-Based Testing for ARM Simulators

[3] Binary file mutation is Operator 1 in a three-operator fuzzing pipeline, alongside a range-enhanced argument-value mutator (Operator 2) and a type-changing mutator (Operator 3). Search+LLM-Based Testing for ARM Simulators

[4] The AFL++ afl_custom_fuzz_count parameter governs how many mutations are executed per iteration and is set to 17, 84, and 66 for Operators 1, 2, and 3 respectively. Search+LLM-Based Testing for ARM Simulators

[5] Differential testing is performed after fuzzing by comparing runs of mutated executable binaries and their inputs on ARM hardware against the simulator. Search+LLM-Based Testing for ARM Simulators