Binary Coverage the Wrong Way
Summary
This article traces the evolution of fuzz testing from basic input fuzzers to coverage-guided approaches, explaining how tools like AFL and AFL++ improved code coverage feedback. It delves into hardware-assisted tracing (Intel PT, AMD counters) and black-box strategies, then presents the author's TinyKVM-based TinyCOV project for precise coverage in a guest kernel, along with the trade-offs and potential future applications. The piece ends with a candid assessment of performance limitations and the practicality of these techniques for fuzzing work.