https://github.com/planetis-m/libfuzzer Skip to content Sign up * Why GitHub? Features - + Mobile - + Actions - + Codespaces - + Packages - + Security - + Code review - + Project management - + Integrations - + GitHub Sponsors - + Customer stories- * Team * Enterprise * Explore + Explore GitHub - Learn and contribute + Topics - + Collections - + Trending - + Learning Lab - + Open source guides - Connect with others + The ReadME Project - + Events - + Community forum - + GitHub Education - + GitHub Stars program - * Marketplace * Pricing Plans - + Compare plans - + Contact Sales - + Education - [ ] [search-key] * # In this repository All GitHub | Jump to | * No suggested jump to results * # In this repository All GitHub | Jump to | * # In this user All GitHub | Jump to | * # In this repository All GitHub | Jump to | Sign in Sign up {{ message }} planetis-m / libfuzzer * Notifications * Star 16 * Fork 0 Thin interface for libFuzzer, an in-process, coverage-guided, evolutionary fuzzing engine. MIT License 16 stars 0 forks Star Notifications * Code * Issues 0 * Pull requests 0 * Actions * Projects 0 * Security * Insights More * Code * Issues * Pull requests * Actions * Projects * Security * Insights master Switch branches/tags [ ] Branches Tags Could not load branches Nothing to show {{ refName }} default View all branches Could not load tags Nothing to show {{ refName }} default View all tags 1 branch 0 tags Code Clone HTTPS GitHub CLI [https://github.com/p] Use Git or checkout with SVN using the web URL. [gh repo clone planet] Work fast with our official CLI. Learn more. * Open with GitHub Desktop * Download ZIP Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching Xcode If nothing happens, download Xcode and try again. Go back Launching Visual Studio Code Your codespace will open once ready. There was a problem preparing your codespace, please try again. Latest commit @planetis-m planetis-m cleanup ... 5c671f9 Jun 5, 2021 cleanup 5c671f9 Git stats * 37 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time docs fix docs Jun 4, 2021 examples readme Jun 5, 2021 experiments up Jun 4, 2021 libfuzzer fix docs Jun 4, 2021 tests example Jun 5, 2021 .gitignore updates Jun 4, 2021 LICENSE updates Jun 4, 2021 libfuzzer.nimble updates Jun 4, 2021 nakefile.nim fix docs Jun 4, 2021 readme.rst cleanup Jun 5, 2021 View code libFuzzer Introduction Clang Sanitizers Example Coverage report Structure-Aware Fuzzing Installation Presentations Further Readings readme.rst libFuzzer Thin interface for LLVM/Clang libFuzzer, an in-process, coverage-guided, evolutionary fuzzing engine. Introduction Fuzzing is a type of automated testing which continuously manipulates inputs to a program to find issues such as panics or bugs. These semi-random data mutations can discover new code coverage that existing unit tests may miss, and uncover edge case bugs which would otherwise go unnoticed. Since fuzzing can reach these edge cases, fuzz testing is particularly valuable for finding security exploits and vulnerabilities. Read the Documentation Clang Sanitizers Sanitizers are compiler build-in error detectors with relatively small runtime cost. Clang has: * AddressSanitizer - use-after-free, double-free, ... * MemorySanitizer - uninitialized reads * UndefinedBehaviourSanitizer - overflows, divide by zero, ... * ThreadSanitizer - data races For more information watch the talk Sanitize your C++ code [4] There are demos at the tests directory. Example In 95% of cases all you need is to define the procedure testOneInput in your file. proc fuzzMe(data: openarray[byte]): bool = result = data.len >= 3 and data[0].char == 'F' and data[1].char == 'U' and data[2].char == 'Z' and data[3].char == 'Z' # :-< proc testOneInput(data: openarray[byte]): cint {.exportc: "LLVMFuzzerTestOneInput".} = result = 0 discard fuzzMe(data) Compile with: $ nim c --cc:clang -t:"-fsanitize=fuzzer,address" -l:"-fsanitize=fuzzer,address" -d:nosignalhandler --nomain:on -g tfuzz.nim Coverage report Use Clang Coverage to visualize and study your code coverage. Include the standalone main procedure for fuzz targets. Follow the instructions given at the test coverage example. When running the executable, pass as parameter a list of test units. Structure-Aware Fuzzing But the lack of an input grammar can also result in inefficient fuzzing for complicated input types, where any traditional mutation (e.g. bit flipping) leads to an invalid input rejected by the target API in the early stage of parsing. With some additional effort, however, libFuzzer can be turned into a grammar-aware (i.e. structure-aware) fuzzing engine for a specific input type. --Structure-Aware Fuzzing with libFuzzer [5] Take a look at the snappy compression example. Installation * Copy the files libfuzzer/fuzztarget.{nim,nims}, libfuzzer/ standalone.nim at your testing directory. * Fill in the implementations of the exported procedures. * Compile and run with an empty corpus directory as an argument. Presentations [1] Jonathan Metzman Fuzzing 101 [2] Kostya Serebryany Fuzz or lose... [3] Kostya Serebryany Sanitize your C++ code Further Readings [4] libFuzzer Tutorial [5] Structure-Aware Fuzzing with libFuzzer [6] Efficient Fuzzing Guide About Thin interface for libFuzzer, an in-process, coverage-guided, evolutionary fuzzing engine. Topics security unit-testing hacking fuzzing Resources Readme License MIT License Languages * Nim 100.0% * (c) 2021 GitHub, Inc. * Terms * Privacy * Security * Status * Docs * Contact GitHub * Pricing * API * Training * Blog * About You can't perform that action at this time. You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.