An Android Fuzzing Retrospective Part II: The "Single-VM" Theory and the Bionic Wall

In my previous post, I detailed how our move from the Android Emulator to standalone Android-x86 VHDX images gave us impressive cost saving wins for our fuzzing budget. With any infrastructure pivot, the moment we finished it, we started looking for ways to optimize it further. The plan would have been to collapse our two-VM Producer/Consumer model into a single-VM footprint.Our next major architectural pivot would have been using ChrootOnAndroid to host both the web server based fuzzer and Edge on one kernel. However, our prototypes hit three massive walls: Bionic libc, Filesystem Permissions, and the Bootloader Logic of Android itself.The Theoretical Efficiency: Debian via ChrootThe logic was simple: If we could run our Linux-based test-case generators (the Producer) inside a Debian Chroot on the same Android-x86 VM running Edge (the Consumer), we could effectively double our scale again.By utilizing ChrootOnAndroid, we would have gained zero-latency fuzzing and unified compute, but…