[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82738-en":3,"doc-seo-82738-105":30,"detail-sidebar-cat-0-en-105":83},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},82738,4398048949847,"Eliana","https://ap-avatar.wpscdn.com/avatar/400002536579ef2da7f?_k=1778318612642679267",8,"Research & Report","Execution Divergence Graphs: Effective Discovery of Control Flows from Execution Traces as Fuzzing Feedback","Execution Divergence Graphs presents methods to guide fuzz testing when traditional coverage feedback is unavailable, such as in-situ fuzzing of black-box devices and fuzzing of obfuscated compiled binaries. Instead of relying on static instrumentation, it constructs a CFG-like structure from runtime execution traces to derive feedback for the fuzzer. A divergence-detection baseline is proposed and then improved with an Execution Divergence Graph (EDG). Experiments show the EDG-based approach outperforms blind fuzzing and effectively handles loop repeated execution, enabling efficient fuzzing of obfuscated targets.","arXiv :2607 .03396v 1 [ cs .CR] 3 Jul 2026  \nExecution Divergence Graphs: Effective Discovery of Control-Flows from Execution Traces as Fuzzing Feedback  \nYu-De Lin and Nils Ole Tippenhauer  \nCISPA Helmholtz Center for Information Security, Germany  \nAbstract. Fuzz testing is a popular approach to the security testing of proprietary software. Efficient testing strategies rely on execution feedback to guide the input generation process, particularly when the basic blocks in the binary can be directly observed and instrumented. Unfortunately, collecting such feedback is impossible in scenarios such as in-situ fuzzing of black-box devices and the fuzzing of obfuscated compiled binaries. In this work, we discuss approaches to guide the fuzzer using feedback derived from a control-flow-graph-like (CFG-like) structure constructed from runtime execution.  \nWe start by outlining a simple divergence-detection approach that identifies unique execution traces, and then present an improved approach based on an Execution Divergence Graph (EDG) . We implement both approaches and demonstrate that they outperform a baseline blind fuzzer.  \nIn addition, we discuss particular challenges, such as repeated code execution in loops, and show that the EDG-based approach handles them effectively. We then demonstrate that our approach enables effective fuzzing of a number of obfuscated targets, and compare its performance in scenarios where static instrumentation is impossible. While we focus on a scenario in which full instruction traces are directly observable by the attacker, our scheme can also be applied in scenarios with other feedback channels, such as power consumption.  \n1 Introduction  \nFuzzing is an automated software-testing technology that works by injecting random inputs (called “fuzz” [1]) into a program to expose bugs, crashes, or security vulnerabilities. Unguided fuzzers generate inputs from a corpus [2, 3] or predefined-input rules [4] to explore simple programs. However, unguided fuzzers struggle to reach deeper code paths in complex programs, where serious vulnerabilities are often located. To address this issue, modern guided test approaches [5–10] use coverage, which represents how many code paths are visited during testing, to guide the fuzzer. This coverage-guided fuzzing requires static instrumentation to generate feedback.  \nInstrumentation, however, has several limitations. First, it requires access to the target’s source code or binary for successful code modification. Even when  \n2 Yu-De Lin and Nils Ole Tippenhauer  \na binary is available, its author can use tools to obfuscate it, rendering instrumentation ineffective. For instance, obfuscators such as Movfuscator [11] and Tigress [12] can hide all standard branch instructions. Without distinct controlflow instructions like branches, the concept of a basic block is lost, and the fuzzer cannot accurately map or track connections between basic blocks (edges) . Consequently, the fuzzer cannot obtain the crucial control-flow information, such as which paths an input has visited, needed to guide its exploration.  \nIn this work, we present several approaches to address this issue, and show how to generate suitable feedback for fuzzing by analyzing target execution traces. Such traces could, for example, consist of a sequence of the executed instruction addresses without further annotation. Even without static analysis of the target binary, we show how to process such execution traces to detect execution of novel code segments, while maintaining computational and memory efficiency. While naive approaches to this problem simply store prior execution traces and compare them to new traces, we show that such approaches are particularly unable to detect repeated execution of code segments, and thus vastly overestimate the novelty of inputs. To address this, we introduce the concept of Execution Divergence Graphs (EDGs), a CFG-like structure for tracking observed execution sequences ","cbCaif3pmZ9IC2sz","https://ap.wps.com/l/cbCaif3pmZ9IC2sz","pdf",1083388,3,1,22,"English","en",105,"# Introduction\n## Coverage-Guided Fuzzing","[{\"question\":\"How do Execution Divergence Graphs improve fuzzing feedback?\",\"answer\":\"The approach builds a CFG-like structure from runtime execution traces and uses execution divergence to generate coverage-style feedback. The EDG-based method detects novel execution behavior more effectively than naive trace comparison.\"}]",1784182599,55,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":78,"head_meta":80,"extra_data":82,"updated_unix":28},"execution-divergence-graphs-effective-discovery-of-control-flows-from-execution-traces-as-fuzzing-feedback","",{"@graph":36,"@context":77},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":20},"https://docshare.wps.com/document/research-report/",{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/execution-divergence-graphs-effective-discovery-of-control-flows-from-execution-traces-as-fuzzing-feedback/82738/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-24","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71],{"name":72,"@type":73,"acceptedAnswer":74},"How do Execution Divergence Graphs improve fuzzing feedback?","Question",{"text":75,"@type":76},"The approach builds a CFG-like structure from runtime execution traces and uses execution divergence to generate coverage-style feedback. The EDG-based method detects novel execution behavior more effectively than naive trace comparison.","Answer","https://schema.org",{"og:url":51,"og:type":79,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":81,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":84},[85,89,93,97,102,107,112,115,120,123,127],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":86,"show_sort_weight":87,"slug":88},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":90,"show_sort_weight":91,"slug":92},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Exam",70,"exam",{"id":98,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},5,"Comic",60,"comic",{"id":103,"doc_module":4,"doc_module_name":46,"category_name":104,"show_sort_weight":105,"slug":106},6,"Technology",50,"technology",{"id":108,"doc_module":4,"doc_module_name":46,"category_name":109,"show_sort_weight":110,"slug":111},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":113,"slug":114},30,"research-report",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":46,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":124,"slug":126},10,"Lifestyle","lifestyle",{"id":128,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":98,"slug":130},19,"General","general"]