#!/usr/bin/env python # coding: utf-8 # # Part IV: Semantic Fuzzing # # This part introduces test generation techniques that take the _semantics_ of the input into account, notably the behavior of the program that processes the input. # # * [Fuzzing with Constraints](FuzzingWithConstraints.ipynb) adds _semantic constraints_ to grammars. By solving these automatically, we can produce inputs that are syntactically _and_ semantically valid. # # * [Grammar Mining](GrammarMiner.ipynb) shows how to extract an input grammar from a program by analyzing how individual parts of the input are processed. The resulting grammars can be directly used for fuzzing. # # * [Tracking Information Flow](InformationFlow.ipynb) shows how to track inputs throughout the program, in order to discover information leaks and further improve analysis techniques. # # * [Concolic Fuzzing](ConcolicFuzzer.ipynb) analyzes program code to solve _path constraints_ in the program to cover branches and behaviors that are hard to reach. # # * [Symbolic Fuzzing](SymbolicFuzzer.ipynb) works like concolic fuzzing, but does not require any executions at all. # # * [Mining Function Specifications](DynamicInvariants.ipynb) extracts type information as well as pre- and postconditions from program executions – useful information for program analysis, testing, and verification. #