Once you lifted the code to LLVM, you can do some interesting things, like fuzzing with libFuzzer: https://github.com/trailofbits/mcsema/blob/master/docs/Using...
back
2 comments
The technique is derivative of machine-code to machine-code translation ("dynamic recompilation"), which isn't new. For instance, it was used in a Mac emulator¹ for the PC, released in 1990. Valgrind performs code-to-code transformation to do its tricks.
—
1. https://en.wikipedia.org/wiki/Executor_(software) "Executor translates 68k big-endian binary code into x86 little-endian binary code."
Depending on the situation it may be simpler to just use AFL's qemu mode.