README
¶
syzkaller - linux kernel fuzzer
syzkaller is an unsupervised coverage-guided Linux kernel fuzzer.
The project mailing list is syzkaller@googlegroups.com. You can subscribe to it with a google account or by sending an email to syzkaller+subscribe@googlegroups.com.
Documentation
- How to install syzkaller
- How to use syzkaller
- How syzkaller works
- How to contribute to syzkaller
- How to report Linux kernel bugs
External Articles
- Kernel QA with syzkaller and qemu (tutorial on how to setup syzkaller with qemu)
- Syzkaller crash DEMO (tutorial on how to extend syzkaller with new syscalls)
- Coverage-guided kernel fuzzing with syzkaller (by David Drysdale)
- ubsan, kasan, syzkaller und co (video) (by Florian Westphal)
- Debugging a kernel crash found by syzkaller (by Quentin Casasnovas)
- Linux Plumbers 2016 talk slides
- syzkaller: the next gen kernel fuzzer (basics of operations, tutorial on how to run syzkaller and how to extend it to fuzz new drivers)
Disclaimer
This is not an official Google product.
Directories
¶
| Path | Synopsis |
|---|---|
|
dashboard
|
|
|
dashapi
package dashapi defines data structures used in dashboard communication and provides client interface.
|
package dashapi defines data structures used in dashboard communication and provides client interface. |
|
pkg
|
|
|
ast
Package ast parses and formats sys files.
|
Package ast parses and formats sys files. |
|
compiler
Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions.
|
Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions. |
|
cover
Package cover implements set operations on slices (arrays of coverage PCs).
|
Package cover implements set operations on slices (arrays of coverage PCs). |
|
csource
AUTOGENERATED FROM executor/common_linux.h
|
AUTOGENERATED FROM executor/common_linux.h |
|
db
Package db implements a simple key-value database.
|
Package db implements a simple key-value database. |
|
gce
Package gce provides wrappers around Google Compute Engine (GCE) APIs.
|
Package gce provides wrappers around Google Compute Engine (GCE) APIs. |
|
gcs
Package gcs provides wrappers around Google Cloud Storage (GCS) APIs.
|
Package gcs provides wrappers around Google Cloud Storage (GCS) APIs. |
|
git
Package git provides helper functions for working with git repositories.
|
Package git provides helper functions for working with git repositories. |
|
ifuzz
Package ifuzz allows to generate and mutate x86 machine code.
|
Package ifuzz allows to generate and mutate x86 machine code. |
|
ifuzz/gen
command
gen generates instruction tables (ifuzz/insns.go) from Intel XED tables.
|
gen generates instruction tables (ifuzz/insns.go) from Intel XED tables. |
|
kd
Minimal KD protocol decoder.
|
Minimal KD protocol decoder. |
|
kernel
Package kernel contains helper functions for working with Linux kernel (building kernel/image).
|
Package kernel contains helper functions for working with Linux kernel (building kernel/image). |
|
log
log package provides functionality similar to standard log package with some extensions:
|
log package provides functionality similar to standard log package with some extensions: |
|
rpctype
Package rpctype contains types of message passed via net/rpc connections between various parts of the system.
|
Package rpctype contains types of message passed via net/rpc connections between various parts of the system. |
|
freebsd
AUTOGENERATED FILE
|
AUTOGENERATED FILE |
|
fuchsia
AUTOGENERATED FILE
|
AUTOGENERATED FILE |
|
linux
AUTOGENERATED FILE
|
AUTOGENERATED FILE |
|
syz-extract
command
|
|
|
syz-sysgen
command
|
|
|
windows
AUTOGENERATED FILE
|
AUTOGENERATED FILE |
|
syz-ci is a continuous fuzzing system for syzkaller.
|
syz-ci is a continuous fuzzing system for syzkaller. |
|
tools
|
|
|
moonshine
command
|
|
|
moonshine/scanner
line 1 "scanner/lex.rl"
|
line 1 "scanner/lex.rl" |
|
syz-benchcmp
command
syz-benchcmp visualizes syz-manager benchmarking results.
|
syz-benchcmp visualizes syz-manager benchmarking results. |
|
syz-cover
command
|
|
|
syz-crush
command
syz-crush replays crash log on multiple VMs.
|
syz-crush replays crash log on multiple VMs. |
|
syz-db
command
|
|
|
syz-execprog
command
execprog executes a single program or a set of programs and optinally prints information about execution.
|
execprog executes a single program or a set of programs and optinally prints information about execution. |
|
syz-fmt
command
syz-fmt re-formats sys files into standard form.
|
syz-fmt re-formats sys files into standard form. |
|
syz-mutate
command
mutates mutates a given program and prints result.
|
mutates mutates a given program and prints result. |
|
syz-prog2c
command
|
|
|
syz-report
command
|
|
|
syz-repro
command
|
|
|
syz-strace
command
|
|
|
syz-stress
command
|
|
|
syz-symbolize
command
|
|
|
syz-tty
command
syz-tty is utility for testing of usb console reading code.
|
syz-tty is utility for testing of usb console reading code. |
|
syz-upgrade
command
upgrade upgrades corpus from an old format to a new format.
|
upgrade upgrades corpus from an old format to a new format. |
|
Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
|
Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system. |
|
gce
Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs.
|
Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs. |
|
kvm
Package kvm provides VMs based on lkvm (kvmtool) virtualization.
|
Package kvm provides VMs based on lkvm (kvmtool) virtualization. |
|
vmimpl
Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
|
Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system. |
Click to show internal directories.
Click to hide internal directories.