MTCFuzz

Tool

First seen 7/12/2026

Last seen 7/12/2026

Evidence 12 chunks

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

21 connections

QEMU uses → 100% 3e

MTCFuzz uses QEMU as the virtualization environment for fuzzing.

mtcfuzz_record_tb_exec ← part of 100% 2e

mtcfuzz_record_tb_exec is a function implemented as part of MTCFuzz's QEMU instrumentation.

Multi-target Coverage Feedback uses → 100% 2e

MTCFuzz leverages multi-target coverage feedback from OS and firmware to guide fuzzing.

Coverage Visualization uses → 100% 2e

MTCFuzz provides a coverage visualization feature in HTML format.

CVE-2025-40031 evaluates → 100% 2e

MTCFuzz discovered and validated CVE-2025-40031 through fuzzing.

Multi-target Coverage-based Greybox Fuzzing (Master's Thesis 2025) ← introduces 100% 2e

The paper introduces MTCFuzz as a prototype implementation of Multi-target Coverage-based Greybox Fuzzing.

Fuzzing Workflow ← part of 100% 2e

The fuzzing workflow describes MTCFuzz's execution phases.

Coverage Visualization ← part of 100% 2e

Coverage visualization is a feature of MTCFuzz that generates HTML coverage reports.

Multi-target Coverage-based Greybox Fuzzing implements → 100% 2e

MTCFuzz implements the proposed Multi-target Coverage-based Greybox Fuzzing method.

QMP Protocol uses → 100% 2e

MTCFuzz uses the QEMU QMP protocol to control instrumentation and snapshot operations.

Address-based Coverage Filtering uses → 100% 2e

MTCFuzz uses address-based filtering to restrict coverage measurement to target address ranges.

VM Snapshot Save and Restore uses → 100% 2e

MTCFuzz uses VM snapshot save and restore to reset system state between test executions.

seed corpus uses → 95% 1e

MTCFuzz loads an initial seed corpus during initialization.

analyze_coverage ← part of 100% 1e

analyze_coverage is a procedure in MTCFuzz that filters and processes traced coverage.

mtcfuzz-trace-start QMP command ← part of 100% 1e

mtcfuzz-trace-start is a QMP command added to QEMU as part of MTCFuzz.

mtcfuzz-trace-stop QMP command ← part of 100% 1e

mtcfuzz-trace-stop is a QMP command added to QEMU as part of MTCFuzz.

Binary Search for Address Filtering uses → 100% 1e

MTCFuzz applies binary search to the filtering procedure for efficiency.

Power Scheduling uses → 90% 1e

MTCFuzz uses a power scheduler to assign energy to seeds based on coverage.

addr2line uses → 100% 1e

MTCFuzz uses addr2line to resolve basic block addresses to source code locations.

bpftrace uses → 80% 1e

bpftrace is used in the MTCFuzz evaluation for CPU profiling.

qcow2 Snapshot Storage uses → 100% 1e

MTCFuzz creates a dedicated qcow2 file to store snapshots.