Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tidy up README #5

Open
wants to merge 2 commits into
base: master
from
Open
Changes from 1 commit
Commits
File filter...
Filter file types
Jump to…
Jump to file
Failed to load files.

Always

Just for now

Prev

Tidy up README

  • Loading branch information
ham1 committed Apr 20, 2020
commit 632b561cb272a3befe754c71ad4133bfa5c5e1e5
@@ -1,12 +1,13 @@
# Javafuzz: coverage-guided fuzz testing for Java

Javafuzz is coverage-guided [fuzzer](https://developer.mozilla.org/en-US/docs/Glossary/Fuzzing)
Javafuzz is a coverage-guided [fuzzer](https://developer.mozilla.org/en-US/docs/Glossary/Fuzzing)
for testing Java packages.

Fuzzing for safe languages like nodejs is a powerful strategy for finding bugs like unhandled exceptions, logic bugs,
Fuzzing is a powerful strategy for finding bugs like unhandled exceptions, logic bugs,
security bugs that arise from both logic bugs and Denial-of-Service caused by hangs and excessive memory usage.

Fuzzing can be seen as a powerful and efficient strategy in real-world software in addition to classic unit-tests.
Fuzzing can be seen as a powerful and efficient test technique in addition to classic unit tests.


## Usage

@@ -28,46 +29,44 @@ public class FuzzExample extends AbstractFuzzTarget {

Features of the fuzz target:

* Javafuzz will call the fuzz target in an infinite loop with random data (according to the coverage guided algorithm) passed to `buf`.
* The function must catch and ignore any expected only (dont catch Exception) exceptions that arise when passing invalid input to the tested package.
* The fuzz target must call the test function/library with with the passed buffer or a transformation on the test buffer
if the structure is different or from different type.
* Fuzz functions can also implement application level checks to catch application/logical bugs - For example:
decode the buffer with the testable library, encode it again, and check that both results are equal. To communicate the results
the result/bug the function should throw an exception.
* Javafuzz will report any unhandled exceptions as crashes as well as inputs that hit the memory limit specified to javafuzz
or hangs/they run more the the specified timeout limit per testcase.
* Javafuzz will call the fuzz target in an infinite loop with random data (according to the coverage guided algorithm) passed to `data`.
* The function must catch and ignore only expected exceptions that arise when passing invalid input to the tested package (i.e. don't catch `Exception`).
* The fuzz target must call the test function/library with the passed buffer or a transformation on the test buffer
if the structure or type is different.
* Fuzz functions can also implement application level checks to catch application/logical bugs
* For example: decode the buffer with the testable library, encode it again, and check that both results are equal.
To communicate unexpected results the function should throw an exception.
* Javafuzz will report any unhandled exceptions as crashes, as well as inputs that hit the specified memory limit. It will also report hangs i.e. runs that take longer than the specified timeout per testcase.

### Installing
Add this to your `pom.xml`

```yaml
<dependencies>
<dependency>
<groupId>dev.fuzzit.javafuzz</groupId>
<artifactId>core</artifactId>
<version>1.23-SNAPSHOT</version>
<scope>test</scope>
</dependency>
</dependencies>
Add this to your `pom.xml`

```xml
<dependencies>
<dependency>
<groupId>dev.fuzzit.javafuzz</groupId>
<artifactId>core</artifactId>
<version>1.23-SNAPSHOT</version>
<scope>test</scope>
</dependency>
</dependencies>

<plugins>
<plugin>
<plugin>
<groupId>dev.fuzzit.javafuzz</groupId>
<artifactId>javafuzz-maven-plugin</artifactId>
<version>1.22</version>
</plugin>
<groupId>dev.fuzzit.javafuzz</groupId>
<artifactId>javafuzz-maven-plugin</artifactId>
<version>1.22</version>
</plugin>
</plugins>
```


### Running

The next step is to javafuzz with your fuzz target function

The next step is to use javafuzz with your fuzz target function.

```bash
docker run -it maven:3.6.2-jdk-11 /bin/bash
docker run -it maven:3.6.3-jdk-11 /bin/bash
git clone https://github.com/fuzzitdev/javafuzz.git
cd javafuzz
mvn install
@@ -76,10 +75,7 @@ wget -O jacocoagent.jar https://github.com/fuzzitdev/javafuzz/raw/master/javafuz
MAVEN_OPTS="-javaagent:jacocoagent.jar" mvn javafuzz:fuzz -DclassName=dev.fuzzit.javafuzz.examples.FuzzYaml
```


```bash
# Output:
#0 READ units: 0
#1 NEW cov: 61 corp: 0 exec/s: 1 rss: 23.37 MB
@@ -97,15 +93,14 @@ MAVEN_OPTS="-javaagent:jacocoagent.jar" mvn javafuzz:fuzz -DclassName=dev.fuzzit
#97857 PULSE cov: 108 corp: 9 exec/s: 0 rss: 1566.01 MB
```

This example quickly finds an infinite hang which takes all the memory in `jpeg-js`.

### Corpus

Javafuzz will generate and test various inputs in an infinite loop. `corpus` is optional directory and will be used to
save the generated testcases so later runs can be started from the same point and provided as seed corpus.
Javafuzz will generate and test various inputs in an infinite loop.
`corpus` is optional directory and will be used to save the generated testcases so
later runs can be started from the same point and provided as seed corpus.

Javafuzz can also start with an empty directory (i.e no seed corpus) though some valid test-cases in the seed corpus
may speed up the fuzzing substantially.
Javafuzz can also start with an empty directory (i.e. no seed corpus) though some
valid test-cases in the seed corpus will likely substantially speed up the fuzzing.

Javafuzz tries to mimic some of the arguments and output style from [libFuzzer](https://llvm.org/docs/LibFuzzer.html).

@@ -120,8 +115,8 @@ For coverage instrumentation we use [JaCoCo library](https://github.com/jacoco/j
## Other languages

Currently this library also exists for the following languages:
* javascript [jsfuzz](https://github.com/fuzzitdev/jsfuzz)
* python via [pythonfuzz](https://github.com/fuzzitdev/pythonfuzz)
* Javascript [jsfuzz](https://github.com/fuzzitdev/jsfuzz)
* Python via [pythonfuzz](https://github.com/fuzzitdev/pythonfuzz)

## Credits & Acknowledgments

@@ -130,13 +125,14 @@ Javafuzz is a port of [fuzzitdev/jsfuzz](https://github.com/fuzzitdev/jsfuzz).
Which in turn based based on [go-fuzz](https://github.com/dvyukov/go-fuzz) originally developed by [Dmitry Vyukov's](https://twitter.com/dvyukov).
Which is in turn heavily based on [Michal Zalewski](https://twitter.com/lcamtuf) [AFL](http://lcamtuf.coredump.cx/afl/).

Another solid fuzzing with coverage library for java is [JQF](https://github.com/rohanpadhye/jqf) but is more
Another solid fuzzing with coverage library for Java is [JQF](https://github.com/rohanpadhye/jqf) but is more
focused on semantic fuzzing (i.e structure aware) and thus depends on quickcheck. JavaFuzz does not
depends on any framework an focuses on mutations producing buffer array and using coverage to find more bugs.
depend on any framework and focuses on mutations producing an array and using coverage to find more bugs.

## Contributions

Contributions are welcome!:) There are still a lot of things to improve, and tests and features to add. We will slowly post those in the
issues section. Before doing any major contribution please open an issue so we can discuss and help guide the process before
any unnecessary work is done.

Contributions are welcome! :)
There are still a lot of things to improve, and tests and features to add.
We will slowly post those in the issues section.
Before doing any major contribution please open an issue so we can discuss
and help guide the process before any unnecessary work is done.
ProTip! Use n and p to navigate between commits in a pull request.
You can’t perform that action at this time.