{"id":26373155,"url":"https://github.com/fest1ck/coverage-playground","last_synced_at":"2026-06-07T22:32:47.716Z","repository":{"id":279608059,"uuid":"939365364","full_name":"fEst1ck/coverage-playground","owner":"fEst1ck","description":"Compare code coverage metrics for fuzzing","archived":false,"fork":false,"pushed_at":"2025-12-23T07:18:09.000Z","size":178,"stargazers_count":1,"open_issues_count":2,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2026-01-31T15:51:37.187Z","etag":null,"topics":["fuzzing"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fEst1ck.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-02-26T12:28:54.000Z","updated_at":"2025-08-07T07:42:06.000Z","dependencies_parsed_at":"2025-11-22T22:02:38.152Z","dependency_job_id":null,"html_url":"https://github.com/fEst1ck/coverage-playground","commit_stats":null,"previous_names":["fest1ck/dummy-fuzzer","fest1ck/coverage-playground"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/fEst1ck/coverage-playground","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fEst1ck%2Fcoverage-playground","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fEst1ck%2Fcoverage-playground/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fEst1ck%2Fcoverage-playground/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fEst1ck%2Fcoverage-playground/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fEst1ck","download_url":"https://codeload.github.com/fEst1ck/coverage-playground/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fEst1ck%2Fcoverage-playground/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34041087,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-07T02:00:07.652Z","response_time":124,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fuzzing"],"created_at":"2025-03-17T01:27:32.374Z","updated_at":"2026-06-07T22:32:47.696Z","avatar_url":"https://github.com/fEst1ck.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Coverage Playground\n\nA simple coverage-guided fuzzer designed for comparing different coverage metrics, including but not limited to: block coverage, edge coverage, and path coverage. The focus is on comparing coverage metrics, and so performance of the fuzzer is not our primary concern.\n\n## Build\n\n```bash\ncargo build --release\n```\n\nThe fuzzer binary locates at `target/release/dummy-fuzzer`.\n\n## Usage\n\nThe fuzzer should be used with programs instrumented with [path-cov-instr](https://github.com/fEst1ck/path-cov-instr), which tracks the execution paths of a program. See [here](https://github.com/fEst1ck/coverage-playground-playground) for an example setup.\n\nThe usage is similar to AFL(++):\n\n```bash\n./dummy-fuzzer -i \u003cinput_seeds_dir\u003e -o \u003coutput_dir\u003e [-c \u003cMETRICS\u003e] [-u \u003cMETRICS\u003e] -- \u003ctarget_program\u003e [target_args...]\n```\n\n### Options\n\n- `-i, --input-dir \u003cDIR\u003e`: Directory containing initial seed files\n- `-o, --output-dir \u003cDIR\u003e`: Output directory where findings will be saved\n- `-c, --coverage-type \u003cMETRICS\u003e`: Comma-separated list of coverage metrics to track (block, edge, path)\n- `-u, --use-coverage \u003cMETRICS\u003e`: Comma-separated list of coverage metrics used to provide feedbacks to the fuzzer (block, edge, path)\n- `--debug`: Enable debug mode (prints additional information)\n- `-- \u003ctarget_program\u003e [args...]`: Target program and its arguments\n\n### Input Modes\n\nThe fuzzer supports two modes of providing input to the target program:\n\n1. **File Input**: Use `@@` in the target program's arguments to specify where the input file should be placed\n   ```bash\n   ./dummy-fuzzer -i seeds/ -o output/ -c edge,path -u edge -- ./target -f @@\n   ```\n\n2. **Stdin Input**: If no `@@` is specified, input will be provided via stdin\n   ```bash\n   ./dummy-fuzzer -i seeds/ -o output/ -c block -u block -- ./target\n   ```\n\n### Output Structure\n\nThe fuzzer creates the following directories under the specified output directory:\n\n- `queue/`: Contains test cases that trigger new coverage\n- `crashes/`: Contains inputs that caused the target to crash\n- `stats/`: Contains logging information and statistics\n\nAdditionally, the fuzzer creates:\n- `command.txt`: Records the exact command used to start the fuzzer and the start time\n\n### Logging and Statistics\n\nThe fuzzer automatically logs its state every 30 seconds to provide insights into the fuzzing progress:\n\n- `stats/fuzzer_log.json`: Contains detailed state information at each logging interval\n- `stats/coverage_*.json`: Coverage snapshots with timestamps in the filename\n\nThe logged information includes:\n- Runtime duration\n- Total executions\n- Coverage count for each tracked metric\n- Crash count\n- Queue size\n- Current fuzzing level\n\n### Example\n\n1. Create a seeds directory with initial inputs:\n   ```bash\n   mkdir -p seeds/\n   echo \"test\" \u003e seeds/test.txt\n   ```\n\n2. Run the fuzzer:\n   ```bash\n   # Track edge and path coverage, use edge coverage for feedback\n   ./dummy-fuzzer -i seeds/ -o output/ -c edge,path -u edge -- ./target -f @@\n\n   # Track all coverage types, use block and path coverage for feedback\n   ./dummy-fuzzer -i seeds/ -o output/ -c block,edge,path -u block,path -- ./target -f @@\n\n   # Track and use only block coverage\n   ./dummy-fuzzer -i seeds/ -o output/ -c block -u block -- ./target\n   ```\n\n### Crash Detection\n\nThe fuzzer detects and saves inputs that cause the following signals:\n- SIGSEGV (11): Segmentation fault\n- SIGABRT (6): Abort\n- SIGBUS (7): Bus error\n\nOther signals are logged but don't trigger crash saving.\n\n## Development\n\nThe fuzzer uses multiple mutation strategies:\n1. Bit flip (30% chance)\n2. Byte replacement (20% chance)\n3. Delete consecutive bytes (25% chance)\n4. Clone/insert bytes (25% chance)\n\nCoverage, i.e., execution path, is tracked using shared memory at `/tmp/coverage_shm.bin`. ","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffest1ck%2Fcoverage-playground","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffest1ck%2Fcoverage-playground","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffest1ck%2Fcoverage-playground/lists"}