x86-sat

Better than brute force is using a model of your instruction set (x86 start here [1]), then using something like Z3 [] to find solutions. Here's a paper doing the same [2]. With these approaches you can get vastly bigger pieces of code generated than brute force, and with significantly less hand heuristic tuning effort (which likely still loses out to current solvers). [1] https://github.com/zwegner/x86-sat [2] https://people.cs.umass.edu/~aabhinav/Publications/Unbounded...