README
¶
syzkaller - kernel fuzzer
syzkaller ([siːzˈkɔːlə]) is an unsupervised coverage-guided kernel fuzzer.
Supported OSes: FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, Windows.
Mailing list: [email protected] (join on web or by email).
Found bugs: Darwin/XNU, FreeBSD, Linux, NetBSD, OpenBSD, Windows.
Documentation
Initially, syzkaller was developed with Linux kernel fuzzing in mind, but now it's being extended to support other OS kernels as well. Most of the documentation at this moment is related to the Linux kernel. For other OS kernels check: Darwin/XNU, FreeBSD, Fuchsia, NetBSD, OpenBSD, Starnix, Windows, gVisor. Akaros,
- How to install syzkaller
- How to use syzkaller
- How syzkaller works
- How to install syzbot
- How to contribute to syzkaller
- How to report Linux kernel bugs
- Tech talks and articles
- Research work based on syzkaller
Disclaimer
This is not an official Google product.
Directories
¶
| Path | Synopsis |
|---|---|
|
dashboard
|
|
|
api
Package api provides data structures and helper methods to work with the dashboard JSON API.
|
Package api provides data structures and helper methods to work with the dashboard JSON API. |
|
app
command
|
|
|
dashapi
Package dashapi defines data structures used in dashboard communication and provides client interface.
|
Package dashapi defines data structures used in dashboard communication and provides client interface. |
|
pkg
|
|
|
aflow/ai
ai package contains common definitions that are used across pkg/aflow/...
|
ai package contains common definitions that are used across pkg/aflow/... |
|
ast
Package ast parses and formats sys files.
|
Package ast parses and formats sys files. |
|
auth
Package auth contains authentication related code supporting secret passwords and oauth2 tokens on GCE.
|
Package auth contains authentication related code supporting secret passwords and oauth2 tokens on GCE. |
|
build
Package build contains helper functions for building kernels/images.
|
Package build contains helper functions for building kernels/images. |
|
compiler
Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions.
|
Package compiler generates sys descriptions of syscalls, types and resources from textual descriptions. |
|
cover
Package cover provides types for working with coverage information (arrays of covered PCs).
|
Package cover provides types for working with coverage information (arrays of covered PCs). |
|
csource
Package csource generates [almost] equivalent C programs from syzkaller programs.
|
Package csource generates [almost] equivalent C programs from syzkaller programs. |
|
db
Package db implements a simple key-value database.
|
Package db implements a simple key-value database. |
|
gce
Package gce provides wrappers around Google Compute Engine (GCE) APIs.
|
Package gce provides wrappers around Google Compute Engine (GCE) APIs. |
|
gerrit
Package gerrit provides gerrit client for: https://linux.googlesource.com/Documentation/#gerrit-code-reviews-for-the-linux-kernel For documentation on the API see: https://gerrit-review.googlesource.com/Documentation/rest-api-changes.html
|
Package gerrit provides gerrit client for: https://linux.googlesource.com/Documentation/#gerrit-code-reviews-for-the-linux-kernel For documentation on the API see: https://gerrit-review.googlesource.com/Documentation/rest-api-changes.html |
|
ifaceprobe
Package ifaceprobe implements dynamic component of automatic kernel interface extraction.
|
Package ifaceprobe implements dynamic component of automatic kernel interface extraction. |
|
ifuzz/arm64
Package arm64 allows to generate and mutate arm64 machine code.
|
Package arm64 allows to generate and mutate arm64 machine code. |
|
ifuzz/arm64/gen
command
gen generates instruction tables (ifuzz_types/insns.go) from ARM64 JSON.
|
gen generates instruction tables (ifuzz_types/insns.go) from ARM64 JSON. |
|
ifuzz/iset
Package iset ("instruction set") provides base and helper types for ifuzz arch implementations.
|
Package iset ("instruction set") provides base and helper types for ifuzz arch implementations. |
|
ifuzz/riscv64
Package riscv64 allows to generate and mutate riscv64 machine code.
|
Package riscv64 allows to generate and mutate riscv64 machine code. |
|
ifuzz/riscv64/gen
command
gen generates riscv64 instruction tables from riscv-unified-db YAML.
|
gen generates riscv64 instruction tables from riscv-unified-db YAML. |
|
ifuzz/x86
Package x86 allows to generate and mutate x86 machine code.
|
Package x86 allows to generate and mutate x86 machine code. |
|
ifuzz/x86/gen
command
gen generates instruction tables (ifuzz_types/insns.go) from Intel XED tables.
|
gen generates instruction tables (ifuzz_types/insns.go) from Intel XED tables. |
|
instance
Package instance provides helper functions for creation of temporal instances used for testing of images, patches and bisection.
|
Package instance provides helper functions for creation of temporal instances used for testing of images, patches and bisection. |
|
kconfig
Package kconfig implements parsing of the Linux kernel Kconfig and .config files and provides some algorithms to work with these files.
|
Package kconfig implements parsing of the Linux kernel Kconfig and .config files and provides some algorithms to work with these files. |
|
kd
Minimal KD protocol decoder.
|
Minimal KD protocol decoder. |
|
kfuzztest-executor
Package kfuzztestexecutor implements local execution (i.e., without the C++ executor program) for KFuzzTest targets.
|
Package kfuzztestexecutor implements local execution (i.e., without the C++ executor program) for KFuzzTest targets. |
|
log
Package log provides functionality similar to standard log package with some extensions:
|
Package log provides functionality similar to standard log package with some extensions: |
|
report
Package report contains functions that process kernel output, detect/extract crash messages, symbolize them, etc.
|
Package report contains functions that process kernel output, detect/extract crash messages, symbolize them, etc. |
|
rpctype
Package rpctype contains types of message passed via net/rpc connections between syz-manager and syz-hub.
|
Package rpctype contains types of message passed via net/rpc connections between syz-manager and syz-hub. |
|
runtest
Package runtest is a driver for end-to-end testing of syzkaller programs.
|
Package runtest is a driver for end-to-end testing of syzkaller programs. |
|
signal
Package signal provides types for working with feedback signal.
|
Package signal provides types for working with feedback signal. |
|
stat/sample
Package sample provides various statistical operations and algorithms.
|
Package sample provides various statistical operations and algorithms. |
|
tool
Package tool contains various helper utilitites useful for implementation of command line tools.
|
Package tool contains various helper utilitites useful for implementation of command line tools. |
|
vcs
Package vcs provides helper functions for working with various repositories (e.g.
|
Package vcs provides helper functions for working with various repositories (e.g. |
|
vminfo
Package vminfo extracts information about the target VM.
|
Package vminfo extracts information about the target VM. |
|
fuchsia/fidlgen
command
|
|
|
syz-extract
command
|
|
|
syz-sysgen
command
|
|
|
syz-ci is a continuous fuzzing system for syzkaller.
|
syz-ci is a continuous fuzzing system for syzkaller. |
|
syz-cluster
|
|
|
controller
command
|
|
|
dashboard
command
|
|
|
email-reporter
command
|
|
|
pkg/controller
Package controller provides the server part of the *api.Client interface.
|
Package controller provides the server part of the *api.Client interface. |
|
reporter-server
command
|
|
|
series-tracker
command
|
|
|
tools/db-mgmt
command
|
|
|
tools/send-test-email
command
|
|
|
workflow/boot
command
|
|
|
workflow/build
command
|
|
|
workflow/fuzz
command
|
|
|
workflow/triage
command
|
|
|
tools
|
|
|
arm64
command
Generate KVM ARM64 register IDs for dev_kvm.txt Usage:
|
Generate KVM ARM64 register IDs for dev_kvm.txt Usage: |
|
kfuzztest-gen
command
Small tool for systematically outputting syzlang descriptions of KFuzzTest of a vmlinux binary.
|
Small tool for systematically outputting syzlang descriptions of KFuzzTest of a vmlinux binary. |
|
syz-aflow
command
syz-aflow tool can be used to invoke any agentic workflow registered with pkg/aflow.
|
syz-aflow tool can be used to invoke any agentic workflow registered with pkg/aflow. |
|
syz-base-commit
command
|
|
|
syz-benchcmp
command
syz-benchcmp visualizes syz-manager benchmarking results.
|
syz-benchcmp visualizes syz-manager benchmarking results. |
|
syz-bisect
command
syz-bisect runs bisection to find cause/fix commit for a crash.
|
syz-bisect runs bisection to find cause/fix commit for a crash. |
|
syz-build
command
syz-build is a wrapper around pkg/build for testing purposes.
|
syz-build is a wrapper around pkg/build for testing purposes. |
|
syz-check
command
syz-check does best-effort static correctness checking of the syscall descriptions in sys/os/*.txt.
|
syz-check does best-effort static correctness checking of the syscall descriptions in sys/os/*.txt. |
|
syz-codesearch
command
|
|
|
syz-cover
command
syz-cover generates coverage HTML report from raw coverage files.
|
syz-cover generates coverage HTML report from raw coverage files. |
|
syz-covermerger
command
|
|
|
syz-crush
command
syz-crush replays crash log on multiple VMs.
|
syz-crush replays crash log on multiple VMs. |
|
syz-db
command
|
|
|
syz-db-export
command
|
|
|
syz-declextract
command
|
|
|
syz-diff
command
|
|
|
syz-execprog
command
execprog executes a single program or a set of programs and optionally prints information about execution.
|
execprog executes a single program or a set of programs and optionally prints information about execution. |
|
syz-expand
command
|
|
|
syz-fillreports
command
|
|
|
syz-fix-analyzer
command
syz-fix-analyzer analyzes fixed bugs on the dashboard for automatic fixability and prints statistics.
|
syz-fix-analyzer analyzes fixed bugs on the dashboard for automatic fixability and prints statistics. |
|
syz-fmt
command
syz-fmt re-formats sys files into standard form.
|
syz-fmt re-formats sys files into standard form. |
|
syz-gemini-seed
command
syz-gemini-seed generates program seeds based on existing programs in the corpus using Gemini API.
|
syz-gemini-seed generates program seeds based on existing programs in the corpus using Gemini API. |
|
syz-hubtool
command
syz-hubtool uploads local reproducers to syz-hub.
|
syz-hubtool uploads local reproducers to syz-hub. |
|
syz-imagegen
command
syz-imagegen generates sys/linux/test/syz_mount_image_* test files.
|
syz-imagegen generates sys/linux/test/syz_mount_image_* test files. |
|
syz-kcidb
command
|
|
|
syz-kconf
command
syz-kconf generates Linux kernel configs in dashboard/config/linux.
|
syz-kconf generates Linux kernel configs in dashboard/config/linux. |
|
syz-linter
command
This is our linter with custom checks for the project.
|
This is our linter with custom checks for the project. |
|
syz-lore
command
|
|
|
syz-make
command
syz-make provides information required to build native code for the Makefile.
|
syz-make provides information required to build native code for the Makefile. |
|
syz-minconfig
command
syz-minconfig is a tool for manual checking of config minimization functionality in pkg/kconfig/minimize.go.
|
syz-minconfig is a tool for manual checking of config minimization functionality in pkg/kconfig/minimize.go. |
|
syz-mutate
command
mutates mutates a given program and prints result.
|
mutates mutates a given program and prints result. |
|
syz-prog2c
command
|
|
|
syz-query-subsystems
command
|
|
|
syz-reporter
command
syz-reporter creates table information from crashes.
|
syz-reporter creates table information from crashes. |
|
syz-repro
command
|
|
|
syz-showprio
command
syz-showprio visualizes the call to call priorities from the prog package.
|
syz-showprio visualizes the call to call priorities from the prog package. |
|
syz-symbolize
command
|
|
|
syz-testbed
command
|
|
|
syz-testbuild
command
syz-testbuild tests kernel build/boot on releases as it will be done by pkg/bisect.
|
syz-testbuild tests kernel build/boot on releases as it will be done by pkg/bisect. |
|
syz-trace2syz
command
syz-trace2syz converts strace traces to syzkaller programs.
|
syz-trace2syz converts strace traces to syzkaller programs. |
|
syz-tty
command
syz-tty is utility for testing of usb console reading code.
|
syz-tty is utility for testing of usb console reading code. |
|
syz-upgrade
command
upgrade upgrades corpus from an old format to a new format.
|
upgrade upgrades corpus from an old format to a new format. |
|
syz-usbgen
command
|
|
|
Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
|
Package vm provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system. |
|
cuttlefish
Package cuttlefish allows to use Cuttlefish Android emulators hosted on Google Compute Engine (GCE) virtual machines as VMs.
|
Package cuttlefish allows to use Cuttlefish Android emulators hosted on Google Compute Engine (GCE) virtual machines as VMs. |
|
gce
Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs.
|
Package gce allows to use Google Compute Engine (GCE) virtual machines as VMs. |
|
gvisor
Package gvisor provides support for gVisor, user-space kernel, testing.
|
Package gvisor provides support for gVisor, user-space kernel, testing. |
|
proxyapp
Package proxyapp package implements the experimental plugins support.
|
Package proxyapp package implements the experimental plugins support. |
|
vmimpl
Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system.
|
Package vmimpl provides an abstract test machine (VM, physical machine, etc) interface for the rest of the system. |
|
vmm
Package vmm provides VMs based on OpenBSD vmm virtualization.
|
Package vmm provides VMs based on OpenBSD vmm virtualization. |
Click to show internal directories.
Click to hide internal directories.