LibFuzzer Description
LibFuzzer, a coverage-guided evolutionary fuzzing tool, is a fuzzing engine that works in the background. LibFuzzer links with the library being tested and feeds fuzzed data to the library through a specific fuzzing target function. The fuzzer tracks the code coverage and generates mutations based on the input data to maximize it. SanitizerCoverage, an instrumentation of LLVM, provides code coverage information. LibFuzzer will still be fully supported, in that important bugs are fixed. To use libFuzzer with a library, you must first implement a fuzz-target. This is a function which accepts an array and performs something interesting using the API being tested. This fuzz target is not dependent on libFuzzer, so it can be used with other fuzzing engine like AFL or Radamsa.
LibFuzzer Alternatives
american fuzzy lop
American fuzzy lop, a security-oriented fuzzer, uses a novel form of compile-time tooling and genetic algorithms to discover clean test cases that trigger internal states within the binary. This improves the functional coverage of the fuzzed codes. The compact corpora generated by the tool can also be used to seed other, more resource-intensive or labor-intensive testing regimes in the future. Afl-fuzz, in comparison to other instrumented fuzzers, is designed to be practical. It has a modest overhead, uses highly effective fuzzing techniques and effort minimization tricks. It requires little configuration and handles complex real-world use-cases, such as common image parsing and file compression libraries. It's an instrumentation-guided genetic fuzzer capable of synthesizing complex file semantics in a wide range of non-trivial targets.
Learn more
Honggfuzz
Honggfuzz, a software fuzzer focusing on security, is available. Supports evolutionary feedback-driven fuzzing (SW and Hardware-based) based on code cover. Honggfuzz is multi-processed and multi-threaded. You don't need to run multiple instances of your fuzzer as it can unlock all of your CPU cores. The file corpus will be automatically shared and improved among all fuzzed process. When persistent fuzzing is used, it's lightning fast. A simple/empty LLVMFuzzerTestOneInput function can be tested with up to 1mo iteration per second on a relatively modern CPU. Honggfuzz has a track record of discovering security bugs. The only vulnerability (to date) in OpenSSL that received the critical score was discovered by Honggfuzz. It will report hijacked/ignored crashes signals (intercepted by a fuzzed application and potentially hidden).
Learn more
Atheris
Atheris is an engine for Python fuzzing that uses coverage-guided fuzzing. It supports fuzzing Python code as well as native extensions written in CPython. Atheris is based off libFuzzer. Atheris is a tool that can be used for fuzzing native code to find additional bugs. Atheris supports Linux 32- and 64-bit and Mac OS X with Python versions 3.6-3.10. It comes with an integrated libFuzzer that is suitable for fuzzing Python code. If you want to fuzz native extensions you may have to build Atheris from source in order to match the libFuzzer versions. Atheris relies upon libFuzzer which is distributed along with Clang. Apple Clang does not come with libFuzzer. You'll have to install a different version of LLVM. Atheris is based upon a coverage-guided, mutation-based fuzzer called LibFuzzer. This has the benefit of not requiring a grammar definition to generate inputs. It makes its setup easier. The disadvantage is that the fuzzer will have a harder time generating inputs for complex data types.
Learn more
go-fuzz
Go-fuzz provides coverage-guided fuzzing for testing Go packages. Fuzzing is most useful for packages that parse binary and text inputs. It is also useful to harden systems that parse inputs that are potentially malicious (anything that is accepted over a LAN). Go Modules are now supported by go-fuzz. Please file an issue if you encounter a module problem. Data is a randomly generated input by go-fuzz. Note that it is usually invalid. The function must return 0 if no input should be added to the corpus, but the fuzzer must increase the priority. The fuzz function has to be in a package go-fuzz is able to import. This means that the code you wish to test cannot be in package main. However, fuzzing internal packages can be done.
Learn more
Pricing
Pricing Starts At:
Free
Free Version:
Yes
Company Details
Company:
LLVM Project
Year Founded:
2003
Website:
llvm.org/docs/LibFuzzer.html
Media
Recommended Products
Secure your business by securing your people.
Take the guesswork out of password management, shadow IT, infrastructure, and secret sharing so you can keep your people safe and your business moving.
Product Details
Platforms
Windows
Linux
Type of Training
Documentation
Customer Support
Online
LibFuzzer Features and Options
LibFuzzer User Reviews
Write a Review- Previous
- Next