CAFA: A Checksum-Aware Fuzzing Assistant Tool for Coverage Improvement

Table 2

Intermediate language CAFA-IL.

---

application ::= ins

ins::= cji ∣ cli ∣ oti

cji::= conditional jump instructions

cli ::= constant instructions

oti::= other instructions

operand p::= register ∣ memory

register r::= eax ∣ ebx ∣ ecx ∣ edx ∣ eflags ∣ …

taint status::= T ∣ F

taint labels::= labels of the taint source

::= map of register or memory addresses to taint statuses

::= map of register or memory addresses to taint labels

::= typical OR operator

::= typical XOR operator

::= typical UNION operator for sets

---