TATOO: A Flexible Hardware Platform for Binary-Only Fuzzing

Hardware-based tracing, being efficient, can be a good alternative to the computationally-expensive software-based instrumentation in binary-only greybox fuzzing. However, it only records all branches within a specified address range, lacking the flexibility to re-filter them. To overcome these limitations, this paper introduces Tatoo, a hardware platform that employs tagged architectures and hardware tracing to enable users to perform instruction-level tagging, which can significantly reduce the volume of traced data and improve fuzzing efficiency. Tatoo also supports recording the dataflow information for smart mutations. Implemented on a real hardware FPGA platform, Tatoo demonstrates a mere 8.7% performance overhead.