Fig. 2

Overview of Revery. It first analyzes the vulnerability in the crashing path and gets the layout-contributor digraph to characterize the vulnerability, then guides a fuzzer with this digraph to explore diverging paths and search for exploitable states, and finally stitches the diverging path with the crashing path to synthesize exploits