skills.rest
trailofbits
trailofbitsOFFICIAL
Explore all skills by this author →
Website𝕏@trailofbitsGitHub

coverage-analysis

Measure code exercised during fuzzing with LLVM, GCC/gcov, and cargo-fuzz instrumentation.

6.5k|561|Updated Jan 14, 2026
Search Tags:#reporting#instrumentation#coverage#llvm#fuzzing#harness
One-click install
npx skills add https://github.com/trailofbits/skills --skill coverage-analysis-trailofbits
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: coverage-analysis
Source: https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/coverage-analysis
Command: npx skills add https://github.com/trailofbits/skills --skill coverage-analysis-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Coverage analysis makes it possible to measure which parts of your code are exercised during fuzzing, helping you identify blockers and assess harness effectiveness over time.

Core Features & Use Cases

  • Instrumentation for coverage tracking (LLVM SanitizerCoverage, GCC/gcov, or Rust tooling)
  • Coverage reporting to identify uncovered paths, magic value checks, and dead code
  • Use cases include baseline fuzz campaigns, regression testing, and CI-configured coverage workflows

Quick Start

Run a coverage-enabled fuzzing workflow by instrumenting your build, executing the fuzzer with a corpus, and generating a report to guide harness improvements.

Frequently Asked Questions about coverage-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I measure code coverage during fuzzing?▼

Fuzzing coverage is measured by instrumenting builds with LLVM SanitizerCoverage, GCC/gcov, or Rust tooling, then executing the fuzzer and generating reports to identify exercised code paths.

Can I use cargo-fuzz workflows to generate Rust coverage reports?▼

Yes, cargo-fuzz workflows are supported for Rust fuzzing projects, allowing you to instrument builds, execute fuzzers with a corpus, and generate coverage reports to guide harness improvements.

What's the best way to identify uncovered paths and dead code in a fuzz campaign?▼

Coverage reporting via llvm-cov, gcovr, and related tooling identifies uncovered paths, magic value checks, and dead code by analyzing instrumented fuzzer execution data across C/C++ and Rust projects.

Does coverage analysis work with both LLVM and GCC instrumentation?▼

Yes, coverage analysis supports LLVM-based instrumentation and GCC/gcov workflows, enabling you to track code exercised during fuzzing across multi-language projects and CI environments.

Why does my fuzzing harness miss certain code paths?▼

Coverage analysis identifies blockers and measures harness effectiveness by revealing gaps in exercised code, helping you tune harnesses to reach uncovered paths and magic value checks.

How do I integrate fuzzing coverage workflows into CI?▼

CI-configured coverage workflows are established by instrumenting builds, executing fuzzers with a corpus, and generating coverage reports to guide harness tuning and verify effectiveness over time.

Related Skills

Explore More Software Engineering Skills→
erenisiklarerenisiklar

coverage-analysis

Identify and quantify LLVM/GCC code coverage during fuzzing to guide harness improvements for C/C++ and Rust targets.

Community
Advanced
Ramprasad4121Ramprasad4121
1

ossfuzz

Set up and run continuous fuzzing for open-source projects with OSS-Fuzz.

Community
Advanced
amano--amano--

coverage-analysis

Measure code coverage during fuzzing campaigns with LLVM and GCC instrumentation.

Community
Intermediate
dakshrawat298-gifdakshrawat298-gif

coverage-analysis

Measure code coverage to reveal untested paths in C/C++ and Rust fuzzing campaigns.

Community
Advanced