Instrumentation

The process of inserting probes into a program at compile or binary rewrite time to collect runtime information for the fuzzer.

Instrumentation is the mechanism by which a fuzzer observes the target's behavior during execution. At compile time, LLVM's SanitizerCoverage or AFL++'s LLVM pass inserts callbacks or inline counter increments at every edge or basic block; these fire during execution and update a shared-memory coverage bitmap the fuzzer reads after each run. Binary-only instrumentation (QEMU mode, Frida, DynamoRIO) rewrites the target at runtime without source changes, at the cost of higher overhead. Instrumentation granularity matters: basic-block coverage misses which edge was taken in a multi-way branch; edge (branch) coverage is the standard because it distinguishes which direction a conditional went. Higher-precision instrumentation — context-sensitive coverage, call-stack hashing — can improve the fuzzer's ability to distinguish functionally different paths but increases bitmap size and reduces throughput.