3 ms·
At work I help others to automate testing, build processes etc. Mainly I write Python, help others with Docker and Jenkins pipelines. How could I dive into fuzz
by hpaavola 8y ago
At work I help others to automate testing, build processes etc. Mainly I write Python, help others with Docker and Jenkins pipelines. How could I dive into fuzzing?
What's the best tutorial for fuzzing? Or should I pick some tool and focus on that and then extend from there? Something else? (We are mostly building embedded devices, mostly C and C++)
- nuclx 8y agoIf you're using clang, I can recommend starting with libFuzzer. It's pretty straightforward to use - basically add one C file with a function definition, which gets called by the fuzzer engine with the test data. Add a bunch of compiler switches to the build, and you're done. Note that for coverage-guided fuzzing you need a custom C/C++ build with some kind of coverage-tracking active. See https://llvm.org/docs/LibFuzzer.html https://llvm.org/docs/LibFuzzer.html.
- evmunro 8y agoEither libFuzzer or AFL are your best bet for getting started - they both use very similar algorithms and just differ on execution. libFuzzer is more suited to fuzzing a single method, while AFL gives you a little more freedom when deciding how to fuzz your code. This is a nice initial look at libFuzzer: https://github.com/google/fuzzer-test-suite/blob/master/tutorial/libFuzzerTutorial.md https://github.com/google/fuzzer-test-suite/blob/master/tuto... And here are a couple of my favourite AFL tutorials: - https://fuzzing-project.org/tutorial3.html https://fuzzing-project.org/tutorial3.html - https://github.com/ThalesIgnite/afl-training https://github.com/ThalesIgnite/afl-training Happy to answer any questions!