Skip to content
STIMSMITH

TCG-based Instrumentation

Technique
First seen 7/12/2026
Last seen 7/12/2026
Evidence 4 chunks

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

5 connections
mtcfuzz_record_tb_exec ← implements 100% 2e
mtcfuzz_record_tb_exec records basic block execution addresses as part of TCG instrumentation.
QEMU ← implements 100% 2e
QEMU uses TCG to translate and instrument basic blocks for coverage measurement.
Multi-target Coverage-based Greybox Fuzzing ← uses 100% 2e
The proposed method uses QEMU TCG instrumentation to measure coverage across software boundaries.
Tiny Code Generator uses → 100% 1e
TCG-based instrumentation uses QEMU's Tiny Code Generator as the translation unit for coverage measurement.
Basic Block uses → 100% 1e
TCG-based instrumentation uses basic blocks as the unit of coverage measurement.