sbs VS afl

The big downside for SDS is all SDS strings are heap allocated and thus need to be memory managed. Most of these struct based libraries are not so that is the main advantage to me. I've been looking at SBS lately.

You're in for a treat! I used afl, or american fuzzy lop, more specifically the afl++ fork packaged by Debian. The original usage is super simple, and many programs require little or no changes for fuzzing. The program must accept input on standard input or through a file named by a command line argument. When that's the case, compile with afl-gcc, a gcc wrapper which instruments branches, the then run the fuzzer with afl-fuzz.

American Fuzzy Lop (AFL) is awesome. It’s easily the best thing out there for quickly doing cutting-edge fuzzing analysis on command line applications. But what about the situations where accessing the stuff you want to fuzz via command line isn’t so simple? Lots of times you can write a test harness (or maybe use libFuzzer instead), but what if you could just emulate the parts of the code that you want to fuzz and still get all the coverage-based advantages of AFL? For example, maybe you want to fuzz a parsing function from an embedded system that receives input via RF and isn’t easily debugged. Maybe the code you’re interested in is buried deep within a complex, slow program that you can’t easily fuzz through any traditional tools.

I dont know if it will work for riscv but I do regularly use this https://lcamtuf.coredump.cx/afl/

I suppose libdislocator doubles as that.