https://github.com/vanhauser-thc/libfuzzer-cov
Get actually nice HTML coverage overview on libfuzzer runs
https://github.com/vanhauser-thc/libfuzzer-cov
coverage fuzzing libfuzzer
Last synced: about 1 month ago
JSON representation
Get actually nice HTML coverage overview on libfuzzer runs
- Host: GitHub
- URL: https://github.com/vanhauser-thc/libfuzzer-cov
- Owner: vanhauser-thc
- License: agpl-3.0
- Created: 2020-04-23T14:41:11.000Z (about 5 years ago)
- Default Branch: master
- Last Pushed: 2023-04-21T11:54:49.000Z (about 2 years ago)
- Last Synced: 2025-03-18T21:54:26.406Z (about 1 month ago)
- Topics: coverage, fuzzing, libfuzzer
- Language: Shell
- Size: 31.3 KB
- Stars: 29
- Watchers: 3
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# coverage for libfuzzer
libfuzzer is good but checking the coverage the tools are not as advanced as
what gcc has available.
hence these tools to have gcc coverage on libfuzzer fuzzing targets
NOTE: by default clang/clang++ is used. if you want to use gcc/g++ instead
then specify the -g option in cov-build.sh and cov-generate.sh, and edit
cov-compile.sh to use the g++ line instead.
# how-to
## step 1: build the target
build the target library for coverage with `cov-build.sh`.
usually enough is a
```
$ cov-build.sh ./configure --disable-shared
```
## step 2: build the coverage tool
same as the fuzz.cc harness to fuzz, we need to have a tool built to to get the
coverage. this is easy:
Execute with your fuzzing harness: `./cov-compile.sh fuzz.cc .libs/libfoo.a -Iinclude -I.`
Basically the same options you needed to compile your fuzzing harness but omit `-o outputfile`.
## step 3: gather the coverage
simply run the `cov-generate.sh` script with the libfuzzer queue directory and
the compiled `cov` binary (you must still be in the source top directory of the
for coverage compiled target):
```
$ cov-generate.sh ../libTARGET/queue ./cov
```
## step 4: view the coverage
open a webbrowser for `./report/index.html`