I'm curious how much manual effort it takes for an individual to break this kind of protections. I understand that you basically try one exploit after another, but is there a smart way to automate this? For example, AFL can give you a lot of test samples, but burning and testing tens of thousands of DVDs for potential code path doesn't seem to be feasible, so ideally one would put many cases - but that can't apply to e.g. DVD headers and crafting the test cases sound like a total pain. On the other hand, if one achieved that, they could do some sort of binary search to figure out which exploits work. Perhaps the trick is to plug in a modified DVD reader in order to automate the process?<p>I guess that my question is: is there something like AFL, but instead of generating many test cases, tries to create a big one containing as many potential crashes as possible?