pathgrind 
Path based Dynamic Analysis (Works for 32-bit programs only)
Requirements
- bzip2
- autoconf
- make
- gcc
- python
- gawk
- 32 bit libraries for ubuntu (sudo apt-get install ia32-libs)
- 32 bit c library for building c programs for testing with pathgrind (sudo apt-get install libc6-dev-i386)
On ubuntu you can install the dependencies using apt-get, e.g. sudo apt-get install autoconf
Installation
$ ./install.sh
Configuration
Configuration file: fuzz/settings.cfg
Execution
CLI: $ ./fuzz/fuzz.py
GUI: $ ./fuzz/gui.py
Example
$ ./fuzz/fuzz.py test6
New input are created in testcase/input/
Crash files are be saved in testcase/crash/
You can also read a fairly detailed tutorial on Pathgrind at the SRC:CLR blog
Publications
Exploiting Undefined Behaviors for Efficient Symbolic Execution, ICSE 2014
An Empirical Study of Path Feasibility Queries, CoRR 2013
A Critical Review of Dynamic Taint Analysis and Forward Symbolic Execution, Technical Report NUS 2012