Coverage-guided fuzzing via dynamic instrumentation

A computer-implemented method for obtaining coverage-guided fuzzing of software on a hardware target, the hardware target including at least one breakpoint register and being configured to stop an execution of the software, prior to execution of an instruction of the software, when the instruction is reached during the execution of the software, and a memory address of the instruction is set in the at least one breakpoint register, the method comprising the following steps:

• setting a first breakpoint prior to a first instruction of the software;
• executing or continuing a fuzzing iteration of the software;
• first checking for whether the first breakpoint is reached while executing or continuing the fuzzing iteration;
• and
• storing a first piece of log information that includes that the first instruction in the fuzzing iteration has been reached, based on the first check being positive;
• wherein the coverage-guided fuzzing of the software includes the first piece of log information.

A computer system configured to obtain coverage-guided fuzzing of software on a hardware target, the hardware target including at least one breakpoint register and being configured to stop an execution of the software, prior to execution of an instruction of the software, when the instruction is reached during the execution of the software, and a memory address of the instruction is set in the at least one breakpoint register, the computer system configured to:

• set a first breakpoint prior to a first instruction of the software;
• execute or continue a fuzzing iteration of the software;
• perform a first check for whether the first breakpoint is reached while executing or continuing the fuzzing iteration;
• and
• store a first piece of log information that includes that the first instruction in the fuzzing iteration has been reached, based on the first check being positive;
• wherein the coverage-guided fuzzing of the software includes the first piece of log information.

A non-transitory computer-readable medium on which is stored a computer program for obtaining coverage-guided fuzzing of software on a hardware target, the hardware target including at least one breakpoint register and being configured to stop an execution of the software, prior to execution of an instruction of the software, when the instruction is reached during the execution of the software, and a memory address of the instruction is set in the at least one breakpoint register, the computer program, when executed by a computer, causing the computer to perform the following steps:

• setting a first breakpoint prior to a first instruction of the software;
• executing or continuing a fuzzing iteration of the software;
• first checking for whether the first breakpoint is reached while executing or continuing the fuzzing iteration;
• and
• storing a first piece of log information that includes that the first instruction in the fuzzing iteration has been reached, based on the first check being positive;
• wherein the coverage-guided fuzzing of the software includes the first piece of log information.