https://github.com/planetis-m/libfuzzer
Thin interface for libFuzzer, an in-process, coverage-guided, evolutionary fuzzing engine.
https://github.com/planetis-m/libfuzzer
fuzzing hacking security unit-testing
Last synced: 19 days ago
JSON representation
Thin interface for libFuzzer, an in-process, coverage-guided, evolutionary fuzzing engine.
- Host: GitHub
- URL: https://github.com/planetis-m/libfuzzer
- Owner: planetis-m
- License: mit
- Created: 2021-06-04T10:36:58.000Z (almost 4 years ago)
- Default Branch: master
- Last Pushed: 2023-02-11T19:13:20.000Z (about 2 years ago)
- Last Synced: 2024-11-15T05:32:27.877Z (5 months ago)
- Topics: fuzzing, hacking, security, unit-testing
- Language: Nim
- Homepage:
- Size: 122 KB
- Stars: 43
- Watchers: 1
- Forks: 1
- Open Issues: 8
-
Metadata Files:
- Readme: readme.rst
- License: LICENSE
Awesome Lists containing this project
- awesome-nim - libfuzzer - LibFuzzer's interface bindings. (Development Tools / Fuzzing)
README
=========================================================
libFuzzer
=========================================================
Thin interface for LLVM/Clang libFuzzer, an in-process, coverage-guided,
evolutionary fuzzing engine.
Introduction
============
Fuzzing is a type of automated testing which continuously manipulates inputs to
a program to find issues such as panics or bugs. These semi-random data mutations
can discover new code coverage that existing unit tests may miss, and uncover
edge case bugs which would otherwise go unnoticed. Since fuzzing can reach these
edge cases, fuzz testing is particularly valuable for finding security exploits
and vulnerabilities.
Read the `Documentation `_
Clang Sanitizers
================
Sanitizers are compiler build-in error detectors with relatively small runtime
cost. Clang has:
- `AddressSanitizer `_ - use-after-free, double-free, ...
- `MemorySanitizer `_ - uninitialized reads
- `UndefinedBehaviourSanitizer `_ - overflows, divide by zero, ...
- `ThreadSanitizer `_ - data races
For more information watch the talk *Sanitize your C++ code* [4]_
There are demos at the `tests `_ directory.
Example
=======
In 95% of cases all you need is to define the procedure ``testOneInput`` in your file.
.. code-block:: nim
proc fuzzMe(data: openarray[byte]): bool =
result = data.len >= 3 and
data[0].char == 'F' and
data[1].char == 'U' and
data[2].char == 'Z' and
data[3].char == 'Z' # :‑<
proc initialize(): cint {.exportc: "LLVMFuzzerInitialize".} =
{.emit: "N_CDECL(void, NimMain)(void); NimMain();".}
proc testOneInput(data: ptr UncheckedArray[byte], len: int): cint {.
exportc: "LLVMFuzzerTestOneInput", raises: [].} =
result = 0
discard fuzzMe(data.toOpenArray(0, len-1))
Compile with:
.. code-block::
$ nim c --cc:clang -t:"-fsanitize=fuzzer,address,undefined" -l:"-fsanitize=fuzzer,address,undefined" -d:nosignalhandler --nomain:on -g tfuzz.nim
Coverage report
===============
Use `Clang Coverage `_ to visualize and study your code coverage.
- Include the `standalone `_ main procedure for fuzz targets.
- Follow the instructions given at the `test coverage `_ example.
- When running the executable, pass as parameter a list of test units.
Structure-Aware Fuzzing
=======================
But the lack of an input grammar can also result in inefficient fuzzing
for complicated input types, where any traditional mutation (e.g. bit
flipping) leads to an invalid input rejected by the target API in the
early stage of parsing. With some additional effort, however, libFuzzer
can be turned into a grammar-aware (i.e. structure-aware) fuzzing engine
for a specific input type.
—*Structure-Aware Fuzzing with libFuzzer* [5]_
Take a look at the snappy compression `example `_
and ` `_
Installation
============
- Copy the files ``libfuzzer/fuzztarget.{nim,nims}``, ``libfuzzer/standalone.nim`` at your testing directory.
- Fill in the implementations of the exported procedures.
- Compile and run with an empty corpus directory as an argument.
Presentations
=============
.. [#] Jonathan Metzman `Fuzzing 101 `_
.. [#] Kostya Serebryany `Fuzz or lose... `_
.. [#] Kostya Serebryany `Sanitize your C++ code `_
Further Readings
================
.. [#] `libFuzzer Tutorial `_
.. [#] `Structure-Aware Fuzzing with libFuzzer `_
.. [#] `Efficient Fuzzing Guide `_