SpecDoctor

Tool

First seen 6/13/2026

Last seen 9/10/2026

Evidence 10 chunks

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

16 connections

DiFuzzRTL ← compares with 85% 2e

Both SpecDoctor and DifuzzRTL are RTL fuzzers for CPU verification using differential fuzzing, making them comparable tools in the same domain.

Specure compares with → 97% 2e

Specure is compared with SpecDoctor as the state-of-the-art hardware pre-silicon fuzzer.

PORTRUSH ← uses 95% 1e

PORTRUSH combines with SpecDoctor to monitor whether transient execution is successfully triggered.

The SpecDoctor paper introduces the SpecDoctor tool as an automated RTL fuzzer to discover transient execution vulnerabilities.

Differential Fuzzing implements → 97% 1e

SpecDoctor uses differential fuzz testing to find transient execution vulnerabilities.

RTL Fuzzing implements → 97% 1e

SpecDoctor is an automated RTL fuzzer targeting transient execution vulnerabilities.

Multi-phased Fuzzing implements → 98% 1e

SpecDoctor performs multi-phased fuzzing where each phase addresses an individual vulnerability constraint.

Fuzzing Template uses → 98% 1e

SpecDoctor designs a fuzzing template allowing it to test all transient execution vulnerability scenarios with a single template.

SpecDoctor is designed to find transient execution vulnerabilities in CPUs.

BOOM (RISC-V CPU) evaluates → 99% 1e

SpecDoctor was evaluated on the BOOM out-of-order RISC-V CPU.

NutShell-Argo CPU evaluates → 99% 1e

SpecDoctor was evaluated on the NutShell-Argo out-of-order RISC-V CPU.

Side-Channel Attack mentions → 93% 1e

SpecDoctor discovered a Spectre-type attack with a port contention side channel in NutShell CPU.

SpecDoctor relies on differential fuzzing with varied secrets to detect vulnerabilities.

SpecDoctor employs a multi-phase random instruction generation process for transient execution bug detection.

Pre-Silicon Fuzzing implements → 95% 1e

SpecDoctor is described as the state-of-the-art hardware pre-silicon fuzzer.

SpecDoctor utilizes differential testing to detect sensitive data leakage.