Fuzzing
TechniqueFuzzing, in the provided ARM-simulator testing artifact, is an AFL++-based technique that runs an instrumented gem5 ARM simulator against inputs from prepared seed corpora, uses SearchSYS custom mutators in custom-mutator-only mode, records queue/crash/hang outputs and fuzzer_stats, and then supports differential testing of fuzzed queue seeds against native execution.
First seen 6/4/2026
Last seen 8/12/2026
Evidence 60 chunks
Wiki v3
WIKI
Fuzzing
Definition in this artifact
In the Search+LLM-based ARM simulator testing artifact, fuzzing is implemented as an AFL++ workflow over an instrumented ARM build of gem5. The fuzzer is run with an input corpus, an output directory for fuzzed results, and three SearchSYS custom mutator libraries: cm-gem5c.so, cm-gem5c-bin.so, and cm-gem5c-types.so [C1].
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
36 connectionsSearchSYS implements fuzzing as one of its testing strategies.
The paper compares symbolic execution to fuzzing, noting that fuzzing is susceptible to missing corner-case bugs.
Fuzzing relies on seed inputs to start the mutation process.
Fuzzing uses synthetically generated test-cases to stress-test the CPU emulator.
The paper uses fuzzing as one of the core testing techniques.
Fuzzing uses the LLM-generated seed corpus as initial inputs.
Fuzzing with AFL++ uses custom mutators tailored for gem5.
The paper presents a testing methodology based on fuzzing for CPU emulators.
Fuzz4All is a fuzzing tool that uses LLMs for input generation.
TitanFuzz uses LLMs to generate and mutate human-like code for fuzzing deep learning libraries.
Coverage-guided fuzzing is a specific type of fuzzing technique.
ProcessorFuzz implements fuzzing for processor testing.
SIGFuzz implements fuzzing to discover timing side channels.
Fuzzing uses a mutation engine to generate mutated inputs.
Fuzzing uses coverage feedback to guide input generation.
LKL-fuzzer is a kernel fuzzing technique that generates eBPF programs to find correctness bugs.
BRF is a kernel fuzzing technique that generates eBPF programs passing the verifier to find correctness bugs.
BVF is a kernel fuzzing technique that generates eBPF programs passing the verifier to find correctness bugs.
WADIFF generated test cases for each Wasm operator and then fuzzed them.
Wasmaker performs similar fuzzing to WADIFF but generates more complex binaries.
ChatFuzz is a fuzzing tool that leverages LLMs to improve fuzz testing.
OSS-Fuzz implements continuous fuzzing for open source software.
Fuzzing has become a powerful technique for vulnerability discovery.
Experiment-ARM-24h.sh runs the 24-hour fuzzing campaigns for each corpus.
Sandsifter uses depth-first-search-based fuzzing to determine x86 instruction lengths.
Hardware fuzzing is an adaptation of software fuzzing techniques applied to hardware verification.
UISFuzz is a hardware fuzzing method for CPU undocumented instruction searching.
Fuzzing is used to improve test case quality in verification contexts.
Fuzzing is an advanced software testing technique applied to processor verification.
Simulation-based approaches incorporate fuzzing to improve coverage.
Coverage-guided fuzzing is a modern form of fuzzing that uses coverage to guide mutation.
Symbolic execution is contrasted with fuzzing, noted as a formal technique that can explore large state spaces more efficiently.
The repository is described as hosting fuzzing code for Cascade.
The paper mentions fuzzing as a related technique for RISC-V verification.
TestRIG includes a single-implementation mode that enables more traditional fuzzing.
Positions hardware fuzzing as an approach that builds on principles established by (software) fuzzing.
LINKED ENTITIES
5 linksCITATIONS
9 sources9 citations — click to expand
[1] AFL++ fuzzing is configured with SearchSYS custom mutator libraries, corpus input/output directories, gem5 as target, and ARM workload invocation. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo
[2] The fuzzing run uses custom-mutator-only mode, and standard AFL mutation stages are disabled in that mode. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo
[3] The artifact builds AFL++ and then builds an ARM gem5 target with AFL++ compiler-wrapper instrumentation. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo
[4] Model-specific corpus preparation compiles C programs, copies binaries into cmin corpus directories, and rewrites input paths for models including Magicoder, TinyLlama, Phi, gpt3.5-new, and gpt3.5-old. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo
[5] Full fuzzing results are produced with Experiment-ARM-24h.sh over multiple initial corpora and repeats, and each script run lasts 24 hours per repeat and input corpus. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo
[6] AFL++ reports successful loading and installation of custom mutator libraries by finding afl_custom_mutator and afl_custom_fuzz_count. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo
[7] Run analysis examines queue, crash, and hang folders, with additional statistics in fuzzer_stats, and fuzzing randomness can cause slight differences between repeats. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo
[8] Differential testing is applied to fuzzed queue outputs and bug identification is manual and requires a system simulator expert. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo
[9] An example differential comparison shows matching gem5 and native outputs, so no bug is exposed in that case. Artifact of Search+LLM-based Testing for ARM Simulators - Zenodo