Binary Coverage the Wrong Way

Cybersecurity researchers have long sought efficient ways to test software for vulnerabilities through fuzz testing, a technique that feeds malformed inputs into programs to trigger crashes. However, traditional 'dumb fuzzing' struggled to explore deep code paths, often wasting time on shallow checks. The introduction of coverage-guided fuzzing, notably by American Fuzzy Lop (AFL), marked a paradigm shift by providing real-time feedback on which parts of the code were executed, dramatically improving bug discovery.

Coverage-guided fuzzing works by instrumenting the program under test to record which code paths each input reaches. AFL, for instance, compiles the target with a custom LLVM pass that adds instrumentation on control-flow graph edges. If an input hits a new basic block, the coverage bitmap is updated, and that input is saved for further mutation. This approach proved vastly more effective than random testing, allowing fuzzers to systematically explore program behavior.

For black-box binaries where source code is unavailable, tools like AFL++ offer a QEMU-mode backend. This executes the binary under QEMU user-mode emulation, which lifts x86 assembly to TCG intermediate representation (IR) and then adds similar coverage instrumentation via custom TCG hooks. Despite the overhead of emulation, this method is only about 3–5 times slower than native execution, making it a practical solution for proprietary software.

The gold standard for binary coverage, however, leverages hardware tracing. Intel Processor Trace (PT) enables the CPU to record execution metadata with minimal performance impact—only about 10% slowdown compared to native execution. By reading the trace data, fuzzers can extract exact basic block sequences, enabling precise coverage feedback without software instrumentation. This technique is widely adopted in advanced fuzzing frameworks.

Yet not all processors support Intel PT. AMD processors offer their own Branch Trace Buffer, but it suffers from poorer documentation, higher overhead, and imprecise sampling—either recording only a fraction of events or dropping events when buffers overflow. These limitations make AMD hardware unsuitable for high-fidelity coverage-guided fuzzing, leaving researchers without a clear alternative.

Experts emphasize that hardware-assisted coverage remains critical for security testing, especially as software complexity grows. The inability to use AMD processors for precise tracing means that many systems may rely on less effective software instrumentation or emulation, potentially missing vulnerabilities. The community has called for better documentation and support from AMD to enable similar capabilities.

Looking ahead, the fuzzing field continues to evolve with hybrid approaches combining static analysis, symbolic execution, and machine learning. While Intel PT currently dominates, future CPU designs from both Intel and AMD may integrate more standardized tracing features. Until then, developers must choose between performance penalties and coverage completeness, balancing the trade-offs based on their testing needs.

Turn any website into clean JSON.

Ready-made scrapers & AI agents

Try Apify