Directed Test Case Generation for x86 Instruction Decoding

The x86 instruction set has historically grown to have a very complex definition. Simply enumerating a representative for every type of instruction can already be challenging, but does not consider the allowed redundancies in instruction encoding, the variation of operand, addressing and constant choices and the generation of illegal instruction words. We are proposing a framework for directly targeting a broader set of instruction word choices in a controlled way based on a formal model of the x86 instruction encoding. This can be used for directed test case generation for the decoding of x86 instructions.