README
¶
syzkaller - kernel fuzzer
syzkaller is an unsupervised coverage-guided kernel fuzzer.
Supported OSes: Akaros, FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, Windows.
Mailing list: syzkaller@googlegroups.com (join on web or by email).
Found bugs: Akaros, Darwin/XNU, FreeBSD, Linux, NetBSD, OpenBSD, Windows.
Documentation
Initially, syzkaller was developed with Linux kernel fuzzing in mind, but now it's being extended to support other OS kernels as well. Most of the documentation at this moment is related to the Linux kernel. For other OS kernels check: Akaros, Darwin/XNU, FreeBSD, Fuchsia, NetBSD, OpenBSD, Windows, gVisor.
- How to install syzkaller
- How to use syzkaller
- How syzkaller works
- How to contribute to syzkaller
- How to report Linux kernel bugs
External Articles
- Research work based on syzkaller
- From HardenedLinux project:
- Kernel QA with syzkaller and qemu (tutorial on how to setup syzkaller with qemu)
- Syzkaller crash DEMO (tutorial on how to extend syzkaller with new syscalls)
- Kernel debug tool with syzkaller (debugging qemu VM created by syz-manager with gdb)
- Explanation of some syzkaller internals
- A example of fuzzing the ceph filesystem
- Coverage-guided kernel fuzzing with syzkaller (by David Drysdale)
- ubsan, kasan, syzkaller und co (video) (by Florian Westphal)
- Debugging a kernel crash found by syzkaller (by Quentin Casasnovas)
- Linux Plumbers 2016 talk slides
- syzkaller: the next gen kernel fuzzer (basics of operations, tutorial on how to run syzkaller and how to extend it to fuzz new drivers)
- syzbot and the tale of thousand kernel bugs [video]
Disclaimer
This is not an official Google product.
Directories
¶
| Path | Synopsis |
|---|---|
|
dashboard
|
|
|
dashapi
Package dashapi defines data structures used in dashboard communication and provides client interface.
|
Package dashapi defines data structures used in dashboard communication and provides client interface. |
|
pkg
|
|
|
ast
Package ast parses and formats sys files.
|
Package ast parses and formats sys files. |
|
build
Package build contains helper functions for building kernels/images.
|
Package build contains helper functions for building kernels/images. |
|
compiler
Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions.
|
Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions. |
|
cover
Package cover provides types for working with coverage information (arrays of covered PCs).
|
Package cover provides types for working with coverage information (arrays of covered PCs). |
|
csource
Package csource generates [almost] equivalent C programs from syzkaller programs.
|
Package csource generates [almost] equivalent C programs from syzkaller programs. |
|
db
Package db implements a simple key-value database.
|
Package db implements a simple key-value database. |
|
gce
Package gce provides wrappers around Google Compute Engine (GCE) APIs.
|
Package gce provides wrappers around Google Compute Engine (GCE) APIs. |
|
gcs
Package gcs provides wrappers around Google Cloud Storage (GCS) APIs.
|
Package gcs provides wrappers around Google Cloud Storage (GCS) APIs. |
|
ifuzz
Package ifuzz allows to generate and mutate x86 machine code.
|
Package ifuzz allows to generate and mutate x86 machine code. |
|
ifuzz/gen
gen generates instruction tables (ifuzz/insns.go) from Intel XED tables.
|
gen generates instruction tables (ifuzz/insns.go) from Intel XED tables. |
|
instance
Package instance provides helper functions for creation of temporal instances used for testing of images, patches and bisection.
|
Package instance provides helper functions for creation of temporal instances used for testing of images, patches and bisection. |
|
kd
Minimal KD protocol decoder.
|
Minimal KD protocol decoder. |
|
log
Package log provides functionality similar to standard log package with some extensions:
|
Package log provides functionality similar to standard log package with some extensions: |
|
report
Package report contains functions that process kernel output, detect/extract crash messages, symbolize them, etc.
|
Package report contains functions that process kernel output, detect/extract crash messages, symbolize them, etc. |
|
rpctype
Package rpctype contains types of message passed via net/rpc connections between various parts of the system.
|
Package rpctype contains types of message passed via net/rpc connections between various parts of the system. |
|
runtest
Package runtest is a driver for end-to-end testing of syzkaller programs.
|
Package runtest is a driver for end-to-end testing of syzkaller programs. |
|
signal
Package signal provides types for working with feedback signal.
|
Package signal provides types for working with feedback signal. |
|
vcs
Package vcs provides helper functions for working with various repositories (e.g.
|
Package vcs provides helper functions for working with various repositories (e.g. |
|
akaros/gen
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
|
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags. |
|
freebsd/gen
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
|
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags. |
|
fuchsia/gen
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
|
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags. |
|
linux/gen
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
|
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags. |
|
netbsd/gen
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
|
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags. |
|
openbsd/gen
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
|
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags. |
|
test/gen
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
|
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags. |
|
trusty/gen
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
|
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags. |
|
windows/gen
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags.
|
AUTOGENERATED FILE This file is needed if OS is completely excluded by build tags. |
|
syz-ci is a continuous fuzzing system for syzkaller.
|
syz-ci is a continuous fuzzing system for syzkaller. |
|
tools
|
|
|
syz-benchcmp
syz-benchcmp visualizes syz-manager benchmarking results.
|
syz-benchcmp visualizes syz-manager benchmarking results. |
|
syz-bisect
syz-bisect runs bisection to find cause/fix commit for a crash.
|
syz-bisect runs bisection to find cause/fix commit for a crash. |
|
syz-cover
syz-cover generates coverage HTML report from raw coverage files.
|
syz-cover generates coverage HTML report from raw coverage files. |
|
syz-crush
syz-crush replays crash log on multiple VMs.
|
syz-crush replays crash log on multiple VMs. |
|
syz-execprog
execprog executes a single program or a set of programs and optionally prints information about execution.
|
execprog executes a single program or a set of programs and optionally prints information about execution. |
|
syz-fmt
syz-fmt re-formats sys files into standard form.
|
syz-fmt re-formats sys files into standard form. |
|
syz-imagegen
imagegen generates syz_mount_image/syz_read_part_table calls from disk images.
|
imagegen generates syz_mount_image/syz_read_part_table calls from disk images. |
|
syz-mutate
mutates mutates a given program and prints result.
|
mutates mutates a given program and prints result. |
|
syz-runtest
Runtest runs syzkaller test programs in sys/*/test/*.
|
Runtest runs syzkaller test programs in sys/*/test/*. |
|
syz-showprio
syz-showprio visualizes the call to call priorities from the prog package.
|
syz-showprio visualizes the call to call priorities from the prog package. |
|
syz-testbuild
syz-testbuild tests kernel build/boot on releases as it will be done by pkg/bisect.
|
syz-testbuild tests kernel build/boot on releases as it will be done by pkg/bisect. |
|
syz-trace2syz
syz-trace2syz converts strace traces to syzkaller programs.
|
syz-trace2syz converts strace traces to syzkaller programs. |
|
syz-tty
syz-tty is utility for testing of usb console reading code.
|
syz-tty is utility for testing of usb console reading code. |
|
syz-upgrade
upgrade upgrades corpus from an old format to a new format.
|
upgrade upgrades corpus from an old format to a new format. |
|
Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
|
Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system. |
|
gce
Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs.
|
Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs. |
|
gvisor
Package gvisor provides support for gVisor, user-space kernel, testing.
|
Package gvisor provides support for gVisor, user-space kernel, testing. |
|
kvm
Package kvm provides VMs based on lkvm (kvmtool) virtualization.
|
Package kvm provides VMs based on lkvm (kvmtool) virtualization. |
|
vmimpl
Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
|
Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system. |
|
vmm
Package vmm provides VMs based on OpenBSD vmm virtualization.
|
Package vmm provides VMs based on OpenBSD vmm virtualization. |
Click to show internal directories.
Click to hide internal directories.