Un-bee-lievable Performance: Fast Coverage-guided Fuzzing with Honeybee and Intel Processor Trace

Summary: Trail of Bits released an experimental coverage-guided fuzzer called Honeybee that records program control flow using Intel Processor Trace, a hardware feature that captures traces at 8-15% overhead. Honeybee uses static, ahead-of-time generated caches called "hives" to decode traces, decoding a 1.25GB clang trace in 3.5 seconds versus two-and-a-half minutes for Intel's reference decoder, a 44x improvement.
What you should know: Honeybee brings coverage-guided fuzzing to closed-source, unmodified binaries at speeds competitive with source-level instrumentation, which means security teams can fuzz targets they previously could not instrument at all.

Read the original at Trail of Bits Blog ↗