Hybrid Way of Code Coverage Tracking in Fuzz

In software testing, code coverage can be one of the major metrics for evaluating the effectiveness of a test. Among all existing software testing methods, coverage-guided fuzzing is widely used nowadays, but the way it uses to obtain path coverage is mostly based on code instrumentation or emulation. However, a tester cannot take targeted measures if have no information about where the progress of the test is stuck. This paper proposes a method to record precise code coverage in a hybrid way which combining static program analysis and dynamic tracing. This work is on the basis of previous work that leverages hardware mechanism (Intel Processor Trace) to collect branch information and implement a tool called CovFuzz. Our approach can achieve an accurate coverage track that can reversibly find the corresponding source code or assembly code to assist program analysis and break through the bottleneck when the progress of software testing gets stuck. Our experiments show that the code coverage can be improved with the help of accurate path information.