Actually,you kinda described it by yourself...you study the protocol you're interested in,
and then you write/mod a '
fuzzer' in order to suit the needs of your target's implementation...
But this doesn't really have much to do with malware analysis,does it?
