## 4 System Design
### Locating RC Points and Negating Procedure
The key points of Algorithm 2 are to first construct the tree for each input, then take a _branch_ from _TreeConstr_, and then get that branch neighbor which is located below from that _branch_ and finally check that _Neighbor_ is covered by the fuzzing tool in Algorithm 1. If the _Neighbor_ of the branch is not located in the covered information _CovInfo_, that _branch_ is considered the RC destination. In addition, _TreeConstr_ is built by merging _traces_ which are taken by trace analysis for each _seed_ in the _SeedPool_ and branch neighbors are _produced_ by analyzing the target program CFG. ```
1:CovInfo (Coverage information)
2:SeedPool (New seeds taken from AFL++)
3:CFG (Target binary)
4:RC locations \(\leftarrow\)O
5:TreeConstr \(\leftarrow\)O
6:forseed \(\in\)SeedPool do {
7: trace \(\leftarrow\)TraceAnalyzing(seed)
8:iftrace \(\
otin\)TreeConstr then {
9: TreeConstr \(\leftarrow\)TreeConstr \(\cup\)trace
10: }
11: }
12:forbranch \(\in\)TreeConstr do {
13: branchNeigh \(\leftarrow\)PickItUpNeighbor(branch, CFG)
14: Branches(branchNeigh)++
15:forNeighbor \(\in\)Branches do {
16:ifNeighbor \(\
otin\)CovInfo then {
17: RC \(\leftarrow\)RC \(\cup\)branch
18: }
19: }
20: }
21: } ```

**OUTPUT:** RC candidate locations;The negation process of RC destinations is straightforward. After RC detection process condition of the RC conditional jump instruction is flipped by DeepDiver. To achieve this, we leveraged the _r2 pipe_[37; 38] python script. ### Hybrid Fuzzer Approach

Fuzz testing approachAlthough there are efficient fuzzing techniques such as AFL [3], AFLFast [27], Hongfuzz [28] and VUzzer [32] in this research, we decided to use AFL++ [34] fuzzing tool with concolic execution. The rationale is that it is a highly efficient fuzzing tool and has been integrated with a significant number of excellent software vulnerability testing tool features. For example, AFLFast's _Power Schedules_[39], improved the seed selection strategy of AFL. It also smartly arranged the generated inputs from a seed, MOpt [40] mutator, InsTrim [27; 41] very efficient CFG LLVM mode instrumentation for real-world applications, Radamsa [42] mutator and others. These features make AFL++ a more powerful and effective fuzzing technique than other existing state-of-the-art fuzzers. In addition, to extend vulnerability finding capability, DeepDiver supports floating-point instructions. We can see floating-point instructions in many real-world applications such as _ffmpeg_ and there are some file formats that use raw floats in the specification. While instrumenting the target program by Laf-Intel instrumentation in LLVM mode, floating-point instructions can be split, and it creates opportunities for the fuzzer to analyze the target better. In addition, the example given in Listing 2 illustrates the next problem with the existing fuzzing approaches. Assume _magic number_ takes _1.23_ as an input in Listing 2 simple program. The fuzzer probability of generating an input that is exactly _1.23_ to explore the vulnerable functions is very low. After the floating-point splitting process, the probability of the bypassing a comparison such as line 8 in can be higher since three chained partial comparisons are used. Quite specifically, the floating-point instruction split process divides the comparison into small comparisons splitting _mantissa_, _sign_ and _exponent_ and splitting the _mantissa_ and _exponent_ again into bytes comparisons. The probability of the triggered application flaws detection can be high, first if the sign is right, then if the exponent is right, and finally if the mantissa part is right. Also, exponent and mantissa comparisons are split into chained 8-bit comparisons. That means there are many more partial steps with corresponding instrumented basic blocks, which allow AFL++ to monitor progress better when trying to find the right floating-point value. Concolic execution approachConcolic testing is extensively used in different security-related testing approaches, such as automatic test input generation [43; 44].