coverageguided

Coverage-guided fuzzing is a software testing technique in which the generation of test inputs is guided by feedback about which parts of a program’s code have been executed. The objective is to maximize code coverage to reveal hidden bugs and security vulnerabilities that may not be exposed by random inputs.

The approach relies on instrumentation to monitor runtime coverage. This can be compiled into the target program (compile-time instrumentation) or achieved through runtime analysis. The feedback is used to drive a fuzzing loop: a seed input is executed, coverage information is collected, and inputs that yield new coverage are added to a pool and used to mutate or recombine, while inputs that do not increase coverage are deprioritized.

Key concepts include edge coverage, basic-block coverage, and sometimes path coverage. Coverage data guides mutation strategies, such as targeted bit flips, tailored mutations around interesting branches, or grammar-aware input generation. The emphasis on coverage allows the fuzzer to automatically explore diverse execution paths and discover inputs that trigger crashes, hangs, or other anomalous behavior.

Applications include automated vulnerability discovery, stress testing of software, and regression testing. Coverage-guided fuzzing is widely used in security research and quality assurance to systematically exercise complex software and uncover defects that are hard to find with manual test design.

Notable implementations include AFL (American Fuzzy Lop), libFuzzer, and honggfuzz. These systems differ in instrumentation, mutation strategies, and parallelization, but share the core feedback-driven loop that uses coverage information to prioritize and generate new inputs. Limitations include dependence on reliable instrumentation and determinism, potential anti-fuzzing defenses, and the fact that coverage does not always correlate with semantic correctness.