I feel like trying Angora, a fuzzer with very promising algorithms (also written in Rust!), and isn't our friend goblin a trusty good target?! Stay tuned!

The insight of AFL/LibFuzzer is that a little smart (coverage guiding) combined with speed beats full smart, symbolic approaches like KLEE. Angora shows it can be combined with a little more smart (taint guiding). Two instrumented executables are produced for coverage and taint, run taint a little (it's slow!), run coverage a lot, but do not mutate randomly but use taint info!, it all seems beautiful. Let's see how it works in practice.

Super excited to see what you uncover here :) The mach-o and and PE backends could use some fuzz-love too :)

In the meanwhile I've done a pass with plain old AFL. I've targeted the elf parser since it contains a suspicious amount of unsafe code. I've also thrown in some FreeBSD binaries as seeds. Here's the generated corpus that can be used for subsequent fuzzing: min-elf-corpus.zip

Fuzzing harness targets ELF decoding specifically, this usually produces better results than all-in-one: https://github.com/Shnatsel/goblin/blob/master/fuzz-afl/src/main.rs