Google Git
Sign in
android / platform / external / honggfuzz / d81045ad1bedfca193638497501ef50d7081f5b9
commitd81045ad1bedfca193638497501ef50d7081f5b9[log] [tgz]
authorandroid-build-team Robot <android-build-team-robot@google.com>Mon Oct 09 08:06:30 2017 +0000
committerandroid-build-team Robot <android-build-team-robot@google.com>Mon Oct 09 08:06:30 2017 +0000
tree7cf9ab85c614fc613d61527c05ccdd9f5ec2f867
parent4e4378e2dbe62cc5cffa3858ac7f24cca7b2b2fc [diff]
parentf983823d9566677fe0e6a3c792bd82db9798a08e [diff]
Snap for 4384511 from f983823d9566677fe0e6a3c792bd82db9798a08e to pi-release

Change-Id: Ia31d85453612a74af2597b12c4fbb6f58c2fffa7
tree: 7cf9ab85c614fc613d61527c05ccdd9f5ec2f867
  1. docs/
  2. examples/
  3. hfuzz_cc/
  4. libcommon/
  5. libhfuzz/
  6. linux/
  7. mac/
  8. posix/
  9. third_party/
  10. tools/
  11. .gitignore
  12. .gitmodules
  13. Android.bp
  14. arch.h
  15. CHANGELOG
  16. cmdline.c
  17. cmdline.h
  18. CONTRIBUTING
  19. COPYING
  20. display.c
  21. display.h
  22. Dockerfile
  23. fuzz.c
  24. fuzz.h
  25. honggfuzz.c
  26. LICENSE
  27. Makefile
  28. mangle.c
  29. mangle.h
  30. METADATA
  31. README.md
  32. report.c
  33. report.h
  34. sancov.c
  35. sancov.h
  36. sanitizers.c
  37. sanitizers.h
  38. subproc.c
  39. subproc.h
README.md

honggfuzz

Description

A security oriented, feedback-driven, evolutionary, easy-to-use fuzzer with interesting analysis options. See USAGE for more data on the usage.

  • It's multi-threaded and multi-process: no need to run multiple copies of your fuzzer, as honggfuzz can unlock potential of all your available CPU cores. The file corpus is shared between threads (and fuzzed instances)
  • It's blazingly fast (esp. in the persistent fuzzing mode). A simple LLVMFuzzerTestOneInput function can be tested with up to 1mo iterations per second on a relatively modern CPU (e.g. i7-6600K)
  • Has a nice track record of uncovered security bugs: e.g. the only (to the date) vulnerability in OpenSSL with the critical score mark was discovered by honggfuzz
  • Uses low-level interfaces to monitor processes (e.g. ptrace under Linux). As opposed to other fuzzers, it will discover and report hidden signals (caught and potentially hidden by signal handlers)
  • Easy-to-use, feed it a simple input corpus (can even consist of a single, 1-byte file) and it will work its way up expanding it utilizing feedback-based coverage metrics
  • Supports several (more than any other coverage-based feedback-driven fuzzer) hardware-based (CPU: branch/instruction counting, Intel BTS, Intel PT) and software-based feedback-driven fuzzing methods known from other fuzzers (libfuzzer, afl)
  • Works (at least) under GNU/Linux, FreeBSD, Mac OS X, Windows/CygWin and Android
  • Supports persistent fuzzing mode (long-lived process calling a fuzzed API repeatedly) with libhfuzz/libhfuzz.a. More on that can be found here
  • Can fuzz remote/standalone long-lasting processes (e.g. network servers like Apache's httpd and ISC's bind)
  • It comes with the examples directory, consisting of real world fuzz setups for widely-used software (e.g. Apache and OpenSSL)

Code

  • Latest stable version: 1.1, but using the master branch is highly encouraged
  • Changelog

Requirements

  • Linux - The BFD library (libbfd-dev) and libunwind (libunwind-dev/libunwind8-dev), clang-4.0 or higher for software-based coverage modes
  • FreeBSD - gmake, clang-3.6 or newer (clang-devel/4.0 suggested)
  • Android - Android SDK/NDK. Also see this detailed doc on how to build and run it
  • Windows - CygWin
  • Darwin/OS X - Xcode 10.8+
  • if Clang/LLVM is used to compile honggfuzz - link it with the BlocksRuntime Library (libblocksruntime-dev)

Trophies

Honggfuzz has been used to find a few interesting security problems in major software packages; An incomplete list:

Projects utilizing Honggfuzz

Examples

The examples directory contains code demonstrating (among others) how to use honggfuzz to find bugs in the OpenSSL library and in the Apache web server.

Other

This is NOT an official Google product