Skip to content
Google Protocol Buffers message generator
Python
Branch: master
Clone or download

Latest commit

Fetching latest commit…
Cannot retrieve the latest commit at this time.

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
protofuzz
.codeclimate.yml Make CodeClimate generate a grade May 19, 2016
.gitignore
.gitmodules Initial import May 17, 2016
.travis.yml Initial import May 17, 2016
LICENSE Initial import May 17, 2016
MANIFEST.in Initial import May 17, 2016
README.md Initial import May 17, 2016
setup.py

README.md

ProtoFuzz

Build Status Test Coverage Issue Count PyPI version

ProtoFuzz is a generic fuzzer for Google’s Protocol Buffers format. Instead of defining a new fuzzer generator for custom binary formats, protofuzz automatically creates a fuzzer based on the same format definition that programs use. ProtoFuzz is implemented as a stand-alone Python3 program.

Installation

Make sure you have protobuf package installed and protoc is accessible from $PATH, and that protoc can generate Python3-compatible code.

$ git clone --recursive git@github.com:trailofbits/protofuzz.git
$ cd protofuzz
$ python3 setup.py install

Usage

>>> from protofuzz import protofuzz
>>> message_fuzzers = protofuzz.from_description_string("""
...     message Address {
...      required int32 house = 1;
...      required string street = 2;
...     }
... """)
>>> for obj in message_fuzzers['Address'].permute():
...     print("Generated object: {}".format(obj))
...
Generated object: house: -1
street: "!"

Generated object: house: 0
street: "!"

Generated object: house: 256
street: "!"
...

You can also create dependencies between arbitrary fields that are resolved with any callable object:

>>> message_fuzzers = protofuzz.from_description_string("""
...     message Address {
...      required int32 house = 1;
...      required string street = 2;
...     }
...     message Other {
...       required Address addr = 1;
...       required uint32 foo = 2;
...     }
... """)
>>> fuzzer = message_fuzzers['Other']
>>> # The following creates a dependency that ensures Other.foo is always set
>>> # to 1 greater than Other.addr.house
>>> fuzzer.add_dependency('foo', 'addr.house', lambda x: x+1)
>>> for obj in fuzzer.permute():
...     print("Generated object: {}".format(obj))

Note however, the values your lambda creates must be conformant to the destination type.

Caveats

Currently, we use fuzzdb for values. This might not be complete or appropriate for your use. Consider swapping it for your own values.

You can’t perform that action at this time.