ULIFuzz is an illegal-instruction fuzzer for RISC-V processors. Instead of sampling the negative space uniformly, it models the whole 32-bit encoding space as a hierarchical decoder tree, quantifies how far each illegal subspace lies from the nearest legal encoding, and generates instructions that land on the cracks where illegal encodings border legal ones.
- Portable across cores. Works on bit-pattern decoders (e.g., OpenXiangShan / NEMU) and on handwritten decoder logic (e.g., NeoRV32) without per-core adaptation.
- ISA-model driven. Builds the decoder tree from GEM5 ISA DSL descriptions, so new extensions (e.g., RVV) are supported without hand-written generation rules.
- Calibrated negative space. Static bit-pattern checks plus Spike-based dynamic ground truth label the illegal holes offline, enabling weighted sampling toward high-risk adjacent regions.
The paper is accepted at ASP-DAC 2027. The implementation, the calibration data and the test cases that trigger the reported bugs are being prepared for release and will be published in this repository. Watch or star it to be notified.
@inproceedings{zhong2027between,
title = {Between The Cracks: Uncovering Illegal-Instruction Bugs in {RISC-V}
Processors by Exploring the Unified Encoding Space},
author = {Zhong, Yicheng and Wu, Jingzheng and Ling, Xiang and Luo, Tianyue and Zhao, Chen},
booktitle = {32nd Asia and South Pacific Design Automation Conference (ASPDAC '27)},
year = {2027},
doi = {10.1145/3840404.3848357}
}- Yicheng Zhong, zhongyicheng241@mails.ucas.ac.cn
- Xiang Ling, lingxiang@iscas.ac.cn
Intelligent Software Research Center, Institute of Software, Chinese Academy of Sciences