03-syzkaller/

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

README ¶

syzkaller - kernel fuzzer

syzkaller is an unsupervised coverage-guided kernel fuzzer.
Supported OSes: Akaros, FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, Windows.

Mailing list: syzkaller@googlegroups.com (join on web or by email).

Found bugs: Akaros, Darwin/XNU, FreeBSD, Linux, NetBSD, OpenBSD, Windows.

Documentation

Initially, syzkaller was developed with Linux kernel fuzzing in mind, but now it's being extended to support other OS kernels as well. Most of the documentation at this moment is related to the Linux kernel. For other OS kernels check: Akaros, Darwin/XNU, FreeBSD, Fuchsia, NetBSD, OpenBSD, Windows, gVisor.

External Articles

Research work based on syzkaller
From HardenedLinux project:
- Kernel QA with syzkaller and qemu (tutorial on how to setup syzkaller with qemu)
- Syzkaller crash DEMO (tutorial on how to extend syzkaller with new syscalls)
- Kernel debug tool with syzkaller (debugging qemu VM created by syz-manager with gdb)
- Explanation of some syzkaller internals
- A example of fuzzing the ceph filesystem
Coverage-guided kernel fuzzing with syzkaller (by David Drysdale)
ubsan, kasan, syzkaller und co (video) (by Florian Westphal)
Debugging a kernel crash found by syzkaller (by Quentin Casasnovas)
Linux Plumbers 2016 talk slides
syzkaller: the next gen kernel fuzzer (basics of operations, tutorial on how to run syzkaller and how to extend it to fuzz new drivers)
syzbot and the tale of thousand kernel bugs [video]

Disclaimer

This is not an official Google product.

Directories ¶

Path	Synopsis
dashboard
app
dashapi Package dashapi defines data structures used in dashboard communication and provides client interface.	Package dashapi defines data structures used in dashboard communication and provides client interface.
executor
pkg
ast Package ast parses and formats sys files.	Package ast parses and formats sys files.
bisect
build Package build contains helper functions for building kernels/images.	Package build contains helper functions for building kernels/images.
compiler Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions.	Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions.
config
cover Package cover provides types for working with coverage information (arrays of covered PCs).	Package cover provides types for working with coverage information (arrays of covered PCs).
csource Package csource generates [almost] equivalent C programs from syzkaller programs.	Package csource generates [almost] equivalent C programs from syzkaller programs.
db Package db implements a simple key-value database.	Package db implements a simple key-value database.
dra
email
gce Package gce provides wrappers around Google Compute Engine (GCE) APIs.	Package gce provides wrappers around Google Compute Engine (GCE) APIs.
gcs Package gcs provides wrappers around Google Cloud Storage (GCS) APIs.	Package gcs provides wrappers around Google Cloud Storage (GCS) APIs.
hash
host
html
ifuzz Package ifuzz allows to generate and mutate x86 machine code.	Package ifuzz allows to generate and mutate x86 machine code.
ifuzz/gen gen generates instruction tables (ifuzz/insns.go) from Intel XED tables.	gen generates instruction tables (ifuzz/insns.go) from Intel XED tables.
ifuzz/generated
instance Package instance provides helper functions for creation of temporal instances used for testing of images, patches and bisection.	Package instance provides helper functions for creation of temporal instances used for testing of images, patches and bisection.
ipc
ipc/ipcconfig
kd Minimal KD protocol decoder.	Minimal KD protocol decoder.
log Package log provides functionality similar to standard log package with some extensions:	Package log provides functionality similar to standard log package with some extensions:
mgrconfig
osutil
report Package report contains functions that process kernel output, detect/extract crash messages, symbolize them, etc.	Package report contains functions that process kernel output, detect/extract crash messages, symbolize them, etc.
repro
rpctype Package rpctype contains types of message passed via net/rpc connections between various parts of the system.	Package rpctype contains types of message passed via net/rpc connections between various parts of the system.
runtest Package runtest is a driver for end-to-end testing of syzkaller programs.	Package runtest is a driver for end-to-end testing of syzkaller programs.
serializer
signal Package signal provides types for working with feedback signal.	Package signal provides types for working with feedback signal.
symbolizer
vcs Package vcs provides helper functions for working with various repositories (e.g.	Package vcs provides helper functions for working with various repositories (e.g.
prog
test
sys
akaros
akaros/gen AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.	AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
freebsd
freebsd/gen AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.	AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
fuchsia
fuchsia/fidlgen
fuchsia/gen AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.	AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
linux
linux/gen AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.	AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
netbsd
netbsd/gen AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.	AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
openbsd
openbsd/gen AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.	AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
syz-extract
syz-sysgen
targets
test
test/gen AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.	AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
trusty
trusty/gen AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.	AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
windows
windows/gen AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.	AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
syz-ci syz-ci is a continuous fuzzing system for syzkaller.	syz-ci is a continuous fuzzing system for syzkaller.
syz-fuzzer
syz-hub
state
syz-manager
tools
read_result
syz-benchcmp syz-benchcmp visualizes syz-manager benchmarking results.	syz-benchcmp visualizes syz-manager benchmarking results.
syz-bisect
syz-cover syz-cover generates coverage HTML report from raw coverage files.	syz-cover generates coverage HTML report from raw coverage files.
syz-crush syz-crush replays crash log on multiple VMs.	syz-crush replays crash log on multiple VMs.
syz-db
syz-env
syz-execprog execprog executes a single program or a set of programs and optionally prints information about execution.	execprog executes a single program or a set of programs and optionally prints information about execution.
syz-fmt syz-fmt re-formats sys files into standard form.	syz-fmt re-formats sys files into standard form.
syz-imagegen imagegen generates syz_mount_image/syz_read_part_table calls from disk images.	imagegen generates syz_mount_image/syz_read_part_table calls from disk images.
syz-mutate mutates mutates a given program and prints result.	mutates mutates a given program and prints result.
syz-prog2c
syz-repro
syz-runtest Runtest runs syzkaller test programs in sys//test/.	Runtest runs syzkaller test programs in sys//test/.
syz-stress
syz-symbolize
syz-testbuild syz-testbuild tests kernel build/boot on releases as it will be done by pkg/bisect.	syz-testbuild tests kernel build/boot on releases as it will be done by pkg/bisect.
syz-trace2syz syz-trace2syz converts strace traces to syzkaller programs.	syz-trace2syz converts strace traces to syzkaller programs.
syz-trace2syz/parser nolint	nolint
syz-trace2syz/proggen
syz-tty syz-tty is utility for testing of usb console reading code.	syz-tty is utility for testing of usb console reading code.
syz-upgrade upgrade upgrades corpus from an old format to a new format.	upgrade upgrades corpus from an old format to a new format.
syz-usbgen
vm Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.	Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
adb
gce Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs.	Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs.
gvisor Package gvisor provides support for gVisor, user-space kernel, testing.	Package gvisor provides support for gVisor, user-space kernel, testing.
isolated
kvm Package kvm provides VMs based on lkvm (kvmtool) virtualization.	Package kvm provides VMs based on lkvm (kvmtool) virtualization.
odroid
qemu
vmimpl Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.	Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
vmm Package vmm provides VMs based on OpenBSD vmm virtualization.	Package vmm provides VMs based on OpenBSD vmm virtualization.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL