Let's say I'd like to begin fuzzing Acme Corp's PDF Reader. I'd like to try to follow what Miller did by downloading a bunch of benign PDFs and mutate them.
Miller began by reducing his corpus of PDF samples to a minimum by pruning samples that had similar code coverage.
How is that specific step done? That is, how did he determine what was a similar code coverage?
I can imagine a tool that traces execution and records JMP/CALLs to get an execution graph, and I suppose you could diff those graphs. But what about JIT code? Wouldn't those graphs be very different since the JIT would likely be in different locations in memory?