TheHuzz
ToolTheHuzz is a processor instruction-fuzzing tool introduced by a USENIX Security 2022 paper. The provided evidence supports that it uses golden-reference models and is aimed at finding software-exploitable vulnerabilities; later evidence also lists TheHuzz among CPU/hardware fuzzing approaches discussed in the context of multi-hart CPU testing.
First seen 5/27/2026
Last seen 7/16/2026
Evidence 62 chunks
Wiki v4
WIKI
Overview
TheHuzz is a processor instruction-fuzzing tool introduced by the paper TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities. The paper appeared in the proceedings of the 31st USENIX Security Symposium (USENIX Security 22) in 2022, on pages 3219--3236. [C1]
Evidence-backed characterization
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
50 connectionsTheHuzz is a hardware fuzzer implementing hardware fuzzing techniques.
Cascade is evaluated against TheHuzz in terms of coverage and speed
Performance comparison between TheHuzz and DifuzzRTL.
TheHuzz implements instruction fuzzing as indicated by its title.
TheHuzz uses golden-reference models as part of its fuzzing methodology.
TheHuzz is compared with random regression testing, achieving 1.98x the speed.
TheHuzz is evaluated on the Rocket Core processor.
TheHuzz is evaluated on the or1200 processor and found multiple bugs.
TheHuzz uses a stimulus generator to produce new instruction sequences by mutation.
TheHuzz is evaluated on the mor1kx processor and found multiple bugs.
MorFuzz is compared against TheHuzz as a prior processor fuzzer.
TheHuzz uses a seed generator to create initial instruction sequences for fuzzing.
TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities ← introduces 100% 3e
The paper introduces TheHuzz as the tool described in its title.
GoldenFuzz is compared against TheHuzz as a baseline hardware fuzzer.
TheHuzz uses spike ISA emulator as the GRM for Ariane and Rocket Core processors.
TheHuzz uses ModelSim as one of the commercial tools to compile hardware and extract coverage values.
TheHuzz randomly mutates instruction fields.
It reports TheHuzz’s coverage and the time required to reach target coverage.
Direct quantitative comparison of coverage speed and levels.
TheHuzz is a processor fuzzing tool.
TheHuzz uses golden reference model comparison to detect bugs by comparing RTL simulation traces with GRM traces.
TheHuzz uses feedback from coverage metrics to guide the fuzzing process.
TheHuzz uses multiple coverage metrics to guide fuzzing and detect bugs.
TheHuzz uses statement coverage to ensure every line of RTL code is executed.
TheHuzz uses branch coverage to test branching constructs.
TheHuzz uses expression coverage for combinational logic blocks.
TheHuzz uses toggle coverage to check for toggling of DFF values.
TheHuzz uses condition coverage to test condition blocks for all possible input values.
TheHuzz uses FSM coverage as one of its coverage metrics.
TheHuzz uses Synopsys VCS to simulate the target hardware and extract coverage metrics.
TheHuzz generates assembly-level instructions as inputs to the DUT.
TheHuzz uses test instructions as the actual instructions to fuzz the processor.
TheHuzz directly fuzzes the RTL model of the processor.
TheHuzz is compared with Cadence JasperGold formal verification tool.
TheHuzz targets the design under test (DUT) which is the target processor.
TheHuzz collects simulator-based coverage using a commercial simulator.
The paper compares Cascade's performance against TheHuzz
GenHuzz is benchmarked against TheHuzz as a state-of-the-art fuzzer.
The paper evaluates TheHuzz as a baseline for comparison with GenHuzz.
TheHuzz mutates opcode bits to generate illegal instructions and new control paths.
TheHuzz uses bit-flip mutation as one of its AFL-like mutation techniques.
TheHuzz generates illegal instructions by mutating opcode bits to test the processor with out-of-spec inputs.
HWFuzz is compared against TheHuzz as a prior hardware fuzzing approach.
TheHuzz leverages an ISA-level instruction generator for test generation.
The paper compares its approach against TheHuzz.
Mutations of instructions are steered by coverage signals.
Seeds are randomly generated instruction sequences.
Uses code and register coverage to guide input mutations.
The paper mentions TheHuzz as a related hardware fuzzer.
TheHuzz uses FSM coverage among other metrics
LINKED ENTITIES
4 linksTheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities INTRODUCES Extracted graph relationship
instruction fuzzing IMPLEMENTS Extracted graph relationship
Golden Reference Model USES Extracted graph relationship
Software-Exploitable Vulnerabilities EVALUATES Extracted graph relationship
CITATIONS
4 sources4 citations — click to collapse
[1] TheHuzz is introduced by a paper titled 'TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities' that appeared at the 31st USENIX Security Symposium in 2022 on pages 3219--3236. TheHuzz: Instruction Fuzzing of Processors Using Golden ... - USENIX
[2] TheHuzz performs instruction fuzzing of processors, uses golden-reference models, and is aimed at finding software-exploitable vulnerabilities. TheHuzz: Instruction Fuzzing of Processors Using Golden ... - USENIX
[3] The USENIX record lists Rahul Kande, Addison Crump, Garrett Persyn, Patrick Jauernig, Ahmad-Reza Sadeghi, Aakash Tyagi, and Jeyavijayan Rajendran as authors of the TheHuzz paper. TheHuzz: Instruction Fuzzing of Processors Using Golden ... - USENIX
[4] A HARTBREAKER excerpt lists TheHuzz among CPU/hardware fuzzing and testing approaches and discusses hardware fuzzing in relation to single-hart versus multi-hart CPU testing. [PDF] HARTBREAKER: Deterministic Fuzzing of Multi-Hart RISC-V CPUs ...