Differential edge/region hit frequency between fuzzers AND visualization similar to cookie_dough

[inferno-chromium]

@eqv's idea
Either
1: Capture a sample of inputs generated during fuzzing and then store path/state transitions that happen.
2. Capture path/state transitions in real-time (without slowing things).

[eqv]

Just to avoid flaming: The idea is to sample a very small percentage of the inputs during fuzzing.

[inferno-chromium]

Just to avoid flaming: The idea is to sample a very small percentage of the inputs during fuzzing.

Corrected in description.

[mboehme]

What are path or state transitions?

[lszekeres]

What are path or state transitions?

I think that refers to a "coverage point" (eg. edge / block / region / or what have you).

[mboehme]

Great idea! I suppose this would show the coverage overlap (difference) between fuzzers? Might help with debugging a fuzzer.

[eqv]

exactly & relative frequency of the areas explored.

[lszekeres]

Great idea! I suppose this would show the coverage overlap (difference) between fuzzers? Might help with debugging a fuzzer.

Note that the coverage overlap/difference between fuzzers is already shown by the unique coverage plots.

[inferno-chromium]

I think this one is about edge/region transitions and not about edges/regions covered.

[aflgo]

Maybe @eqv can clarify, but I understood it more like what he mentioned in his blog post.

https://hexgolems.com/2020/08/on-measuring-and-visualizing-fuzzer-performance/

(I would also be intetested in the data).

[eqv]

Like @aflgo said, initially it was meant to be about the difference in frequency. Which is stronger than difference in coverage. The downside is that it requires additional changes to be measured. Note that we cannot simply compute this based on the queue. Instead we would have to live sample from the fuzzing process. Like the visualization done by Brandon, but as a proper measurement: https://twitter.com/gamozolabs/status/1288440436680306688