Can tsffs finds out Non-crashing vulnerabilities?

[MC-box]

For example, when a program encounters a particular statement, tsffs will recognize and treat it as a solution.

[novafacing]

Sure, you can use breakpoints or you can call tsffs.fuzz.solution() (doc) to tell TSFFS a solution has happened, no matter what that is (you'd want to set up detection in your SIMICS script in this case).