zzuf - multi-purpose fuzzer

zzuf is a transparent application input fuzzer. Its purpose is to find bugs in applications by corrupting their user-contributed data (which more than often comes from untrusted sources on the Internet). It works by intercepting file and network operations and changing random bits in the program’s input. zzuf’s behaviour is deterministic, making it easier to reproduce bugs. Its main areas of use are:

• quality assurance: use zzuf to test existing software, or integrate it into your own software’s testsuite
• security: very often, segmentation faults or memory corruption issues mean a potential security hole, zzuf helps exposing some of them

zzuf’s primary target is media players, image viewers and web browsers, because the data they process is inherently insecure, but it was also successfully used to find bugs in system utilities such as objdump.

zzuf is not rocket science. The idea of fuzzing input data is barely new. zzuf’s only purpose is to make things easier and automated.

If you did not attend ​FOSDEM 2007 you did not miss my talk, because I missed it as well. But my slides are available: PDF or OpenOffice.

Download

Download zzuf (source code) from zzuf-0.11.tar.gz (18 May 2008). Supported platforms are: Linux (glibc), FreeBSD, OpenBSD, Mac OS X. There is no Windows port yet and NetBSD is almost working.

zzuf tutorial

The zzuf tutorial is a hands-on guide to the most important zzuf features. It starts with the working principles but goes on with very advanced uses of the tool.

Warning: this tutorial requires zzuf version 0.11 or later.

1. Basic zzuf usage
   1.1. Launching zzuf
   1.2. Invoking different programs
   1.3. The fuzzing ratio
   1.4. The random seed
   1.5. Creating fuzzed files
2. zzuf as a batch testing tool
   2.1. Debug mode
   2.2. Include and exclude patterns
   2.3. Seed ranges
   2.4. Ratio ranges
3. WORK IN PROGRESS

Development

There is a public Subversion repository at ​svn://svn.zoy.org/libcaca/zzuf/trunk and an associated ​web interface. If you want to discuss zzuf or report bugs, you can write to me at ​sam@zoy.org or join #libcaca on irc.freenode.net.

The January 2007 media player debacle

Media players are especially sensitive to stream corruption. In fact, zzuf started its life as a tool to find bugs in the VLC media player software. The following table gives a few examples of crashes (all programs were the latest version in Debian i386 sid as of 2007/01/14). Click on each link to download the file that caused the crash:

Disclaimer 1: “robust” does not mean that there is no bug, it just means that zzuf could not find one in reasonable time.

Disclaimer 2: segmentation faults reported below are not necessarily bugs in the program itself; for instance, the MPEG-2 crashes are more likely due to a bug in the libmpeg2 library.

todo

Other bugs

Here is a list of other bugs that were easily found using zzuf, each time in a matter of seconds.

todo