Fuzz Testing
Coverage-Guided Fuzzing Internals: How AFL++ and libFuzzer Actually Work
Coverage-guided fuzzing finds more bugs than random fuzzing because it learns from execution. Each input that exercises new code paths is kept; inputs that don't are discarded. Over time, the fuzzer builds a corpus that covers increasingly deep program states. Understanding how this works internally — instrumentation, coverage