Static Analysis and Bugfinding

• Randomly generate an input which would follow the general expected input data template. For example, the JPEG format defines a number of data segments, which all start by byte 0xFF followed by the segment type identifier byte. The generator would independently generate all the fields and construct a globally valid JPEG file by taking into account the above specification. This approach requires some knowledge of the input file format and takes more efforts to implement than the mutation technique, as in general the format can be much more complex than in the case of JPEG.