README
¶
syzkaller - kernel fuzzer
syzkaller is an unsupervised coverage-guided kernel fuzzer. Linux kernel fuzzing has the most support, akaros, freebsd, fuchsia, netbsd and windows are supported to varying degrees.
The project mailing list is syzkaller@googlegroups.com. You can subscribe to it with a google account or by sending an email to syzkaller+subscribe@googlegroups.com.
Documentation
Initially, syzkaller was developed with Linux kernel fuzzing in mind, but now it's being extended to support other OS kernels as well. Most of the documentation at this moment is related to the Linux kernel. For other OS kernels check: Akaros, FreeBSD, Fuchsia, NetBSD, Windows.
- How to install syzkaller
- How to use syzkaller
- How syzkaller works
- How to contribute to syzkaller
- How to report Linux kernel bugs
External Articles
- From HardenedLinux project:
- Kernel QA with syzkaller and qemu (tutorial on how to setup syzkaller with qemu)
- Syzkaller crash DEMO (tutorial on how to extend syzkaller with new syscalls)
- Kernel debug tool with syzkaller (debugging qemu VM created by syz-manager with gdb)
- Explanation of some syzkaller internals
- A example of fuzzing the ceph filesystem
- Coverage-guided kernel fuzzing with syzkaller (by David Drysdale)
- ubsan, kasan, syzkaller und co (video) (by Florian Westphal)
- Debugging a kernel crash found by syzkaller (by Quentin Casasnovas)
- Linux Plumbers 2016 talk slides
- syzkaller: the next gen kernel fuzzer (basics of operations, tutorial on how to run syzkaller and how to extend it to fuzz new drivers)
Disclaimer
This is not an official Google product.
Directories
¶
| Path | Synopsis |
|---|---|
|
dashboard
|
|
|
dashapi
Package dashapi defines data structures used in dashboard communication and provides client interface.
|
Package dashapi defines data structures used in dashboard communication and provides client interface. |
|
pkg
|
|
|
ast
Package ast parses and formats sys files.
|
Package ast parses and formats sys files. |
|
compiler
Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions.
|
Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions. |
|
cover
Package cover provides types for working with coverage information (arrays of covered PCs).
|
Package cover provides types for working with coverage information (arrays of covered PCs). |
|
csource
Package csource generates [almost] equivalent C programs from syzkaller programs.
|
Package csource generates [almost] equivalent C programs from syzkaller programs. |
|
db
Package db implements a simple key-value database.
|
Package db implements a simple key-value database. |
|
gce
Package gce provides wrappers around Google Compute Engine (GCE) APIs.
|
Package gce provides wrappers around Google Compute Engine (GCE) APIs. |
|
gcs
Package gcs provides wrappers around Google Cloud Storage (GCS) APIs.
|
Package gcs provides wrappers around Google Cloud Storage (GCS) APIs. |
|
git
Package git provides helper functions for working with git repositories.
|
Package git provides helper functions for working with git repositories. |
|
ifuzz
Package ifuzz allows to generate and mutate x86 machine code.
|
Package ifuzz allows to generate and mutate x86 machine code. |
|
ifuzz/gen
command
gen generates instruction tables (ifuzz/insns.go) from Intel XED tables.
|
gen generates instruction tables (ifuzz/insns.go) from Intel XED tables. |
|
instance
Package instance provides helper functions for creation of temporal instances used for testing of images, patches and bisection.
|
Package instance provides helper functions for creation of temporal instances used for testing of images, patches and bisection. |
|
kd
Minimal KD protocol decoder.
|
Minimal KD protocol decoder. |
|
kernel
Package kernel contains helper functions for working with Linux kernel (building kernel/image).
|
Package kernel contains helper functions for working with Linux kernel (building kernel/image). |
|
log
Package log provides functionality similar to standard log package with some extensions:
|
Package log provides functionality similar to standard log package with some extensions: |
|
report
Package report contains functions that process kernel output, detect/extract crash messages, symbolize them, etc.
|
Package report contains functions that process kernel output, detect/extract crash messages, symbolize them, etc. |
|
rpctype
Package rpctype contains types of message passed via net/rpc connections between various parts of the system.
|
Package rpctype contains types of message passed via net/rpc connections between various parts of the system. |
|
signal
Package signal provides types for working with feedback signal.
|
Package signal provides types for working with feedback signal. |
|
syz-extract
command
|
|
|
syz-sysgen
command
|
|
|
syz-ci is a continuous fuzzing system for syzkaller.
|
syz-ci is a continuous fuzzing system for syzkaller. |
|
tools
|
|
|
syz-benchcmp
command
syz-benchcmp visualizes syz-manager benchmarking results.
|
syz-benchcmp visualizes syz-manager benchmarking results. |
|
syz-bisect
command
|
|
|
syz-crush
command
syz-crush replays crash log on multiple VMs.
|
syz-crush replays crash log on multiple VMs. |
|
syz-db
command
|
|
|
syz-env
command
|
|
|
syz-execprog
command
execprog executes a single program or a set of programs and optionally prints information about execution.
|
execprog executes a single program or a set of programs and optionally prints information about execution. |
|
syz-fmt
command
syz-fmt re-formats sys files into standard form.
|
syz-fmt re-formats sys files into standard form. |
|
syz-imagegen
command
imagegen generates syz_mount_image/syz_read_part_table calls from disk images.
|
imagegen generates syz_mount_image/syz_read_part_table calls from disk images. |
|
syz-mutate
command
mutates mutates a given program and prints result.
|
mutates mutates a given program and prints result. |
|
syz-parse
command
|
|
|
syz-prog2c
command
|
|
|
syz-repro
command
|
|
|
syz-stress
command
|
|
|
syz-symbolize
command
|
|
|
syz-tty
command
syz-tty is utility for testing of usb console reading code.
|
syz-tty is utility for testing of usb console reading code. |
|
syz-upgrade
command
upgrade upgrades corpus from an old format to a new format.
|
upgrade upgrades corpus from an old format to a new format. |
|
Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
|
Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system. |
|
gce
Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs.
|
Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs. |
|
kvm
Package kvm provides VMs based on lkvm (kvmtool) virtualization.
|
Package kvm provides VMs based on lkvm (kvmtool) virtualization. |
|
vmimpl
Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
|
Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system. |
Click to show internal directories.
Click to hide internal directories.