一句话：利用微控制器调试接口的硬件断点提取未插桩二进制的部分覆盖率，实现通用嵌入式模糊测试。
嵌入式系统模糊测试面临挑战：微控制器高度多样、难以虚拟化，且其软件往往无法修改或插桩。论文观察到多数微控制器提供调试接口，可通过调试探针（通常由 GDB 控制）设置有限数量的硬件断点。作者据此设计 GDBFuzz，利用硬件断点从未插桩二进制代码中提取部分覆盖率反馈，从而以通用且广泛可用的机制实现覆盖引导模糊测试。在四块不同微控制器板上的评估表明，GDBFuzz 能快速达到高代码覆盖率，并检测到已知和新漏洞。由于适用于任何 GDB 可调试的程序与系统，它是最低依赖、最多才多艺的覆盖引导模糊器之一。
Fuzzing embedded systems is hard. Their key components – microcontrollers – are highly diverse and cannot be easily virtualized; their software may not be changed or instrumented. However, we observe that many, if not most, microcontrollers feature a debug interface through which a debug probe (typically controllable via GDB, the GNU debugger) can set a limited number of hardware breakpoints. Using these, we extract partial coverage feedback even for uninstrumented binary code; and thus enable effective fuzzing for embedded systems through a generic, widespread mechanism. In its evaluation on four different microcontroller boards, our prototypical implementation GDBFuzz quickly reaches high code coverage and detects known and new vulnerabilities. As it can be applied to any program and system that GDB can debug, GDBFuzz is one of the least demanding and most versatile coverage-guided fuzzers.