Taint tracking
Open
enhancement
low-priority
major
research
- Dominant language
- Rust
- Stars
- 331
- Forks
- 26
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 2
Description
Full-propagation taint tracking enables some very powerful mutations during fuzzing. We can easily support taint propagation by grabbing instructions on the fly in `hit_count` tracing mode.
- [ ] Choose a taint engine (e.g. libdft, or a variation of it)
- [ ] Enable lifting/propagation from traced instructions into the chosen taint engine
- [ ] Implement feedback/mutators for the taint information
Contributor guide
Assessment
This issue has not been assessed yet.