Binary Instrumentation

Concept

Binary instrumentation is the technique of inserting monitoring code into compiled programs so that tools such as coverage-guided fuzzers can observe their runtime behavior. In the SearchSYS artifact for testing ARM simulators, gem5 is built with AFL++'s compiler wrappers (afl-cc/afl-c++) to produce an instrumented gem5.opt binary that the fuzzer then exercises.

First seen 8/12/2026

Last seen 8/12/2026

Evidence 3 chunks

Wiki v1

WIKI

Binary Instrumentation

Definition

Binary instrumentation refers to the practice of augmenting a compiled program with additional code at build time (or, less commonly, at load/run time) so that external tools can observe the program's execution. In the context of coverage-guided fuzzing, instrumentation enables the fuzzer to record which code paths, edges, or branches are exercised by each input, which in turn drives mutation toward unexplored code.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

1 connections

AFL ← uses 85% 2e

AFL++ uses binary instrumentation when building gem5 for fuzzing.

LINKED ENTITIES

1 links

AFL USES Extracted graph relationship

CITATIONS

5 sources

5 citations — click to expand

[1] gem5 is built using AFL++'s afl-cc/afl-c++ as CC/CXX/LINK to produce an instrumented gem5.opt for the ARM target. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo

[2] Building an AFL++-instrumented gem5 requires LLVM 13+ and additional toolchain packages (lld, clang, ninja, etc.). Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo

[3] The full fuzzing path with instrumented gem5 requires ~72 GB of RAM, while differential testing without instrumentation needs ~16 GB. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo

[4] After the instrumented gem5 build, custom AFL++ mutators are compiled via compile_share.sh to feed inputs into the fuzzing campaign. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo

[5] SearchSYS combines LLM-generated seeds, AFL++ fuzzing, and differential testing between gem5 and real ARM hardware to identify simulator bugs. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo