Yeah, fuzzing stream inputs is relatively straightforward. It's everything else that affects program outcome that's the issue. Trying to implement something lik

Yeah, fuzzing stream inputs is relatively straightforward. It's everything else that affects program outcome that's the issue. Trying to implement something like this via LD_PRELOAD manually is going to be a pretty enormous task. Realistically, you'd have to automatically detect the calls made, for system calls you have ptrace (most commonly used by strace), though I'm not sure how you reroute them. I guess there must be some kernel-side hook. Still, that's likely to be too low-level for GUIs for example. Preloading dynamic libraries like that also only works well on ELF-based systems, other OSes behave rather differently, and if you're trying to test kernel code, it's a whole other problem. Once you're simulating errors, you have to specify correct behaviour. For stream input fuzzing for security purposes, you're usually just probing for crashes. In the general case, the test framework will need to know the intended outcome of errors. For either part, I'm not aware of anything existing like this. I'm slowly custom-building little islands of functionality like it, but it's a far cry from some kind of general solution.