Genericprograminformation-h, --help
Display a short help message and exit.
-V, --version
Output version information and exit.
Operatingmode-f, --fuzzing=mode
Select how the input is fuzzed. Valid values for mode are:
xor randomly set and unset bits
set only set bits
unset only unset bits
The default value for mode is xor.
-O, --opmode=mode
Use operating mode mode. Valid values for mode are:
preload
override functions by preloading libzzuf into the executable using the system's dynamic
linker
copy temporarily copy files that need to be fuzzed
The default value for mode is preload. copy is useful on platforms that do not support dynamic
linker injection, for instance when fuzzing a Cocoa application on Mac OS X.
-s, --seed=seed-s, --seed=start:-s, --seed=start:stop
Specify the random seed to use for fuzzing, or a range of random seeds. Running zzuf twice with
the same random seed will fuzz the files exactly the same way, even with a different target
application. The purpose of this is to use simple utilities such as cat or cp to generate a file
that causes the target application to crash.
If a range is specified, zzuf will run the application several times, each time with a different
seed, and report the behaviour of each run. If no ‘stop’ is specified after ‘:’, zzuf will
increment the seed value indefinitely.
-r, --ratio=ratio-r, --ratio=min:max
Specify the proportion of bits that will be randomly fuzzed. A value of 0 will not fuzz anything.
A value of 0.05 will fuzz 5% of the open files' bits. A value of 1.0 or more will fuzz all the
bytes, theoretically making the input files undiscernible from random data. The default fuzzing
ratio is 0.004 (fuzz 0.4% of the files' bits).
A range can also be specified. When doing so, zzuf will pick ratio values from the interval. The
choice is deterministic and only depends on the interval bounds and the current seed.
-A, --autoinc
Increment random seed each time a new file is opened. This is only required if one instance of the
application is expected to open the same file several times and you want to test a different seed
each time.
Output-d, --debug
Activate the display of debug messages. Can be specified multiple times for increased verbosity.
-q, --quiet
Hide the output of the fuzzed application. This is useful if the application is very verbose but
only its exit code or signaled status is really useful to you.
-v, --verbose
Print information during the run, such as the current seed, what processes get run, their exit
status, etc.
-m, --md5
Instead of displaying the program's standardoutput, just print its MD5 digest to zzuf's standard
output. The standard error channel is left untouched. See also the -X flag.
-X, --hex
Convert the fuzzed program's standardoutput to hexadecimal. The standard error channel is left
untouched. See also the -m flag.
Processcontrol-B, --max-bytes=n
Automatically stop after n bytes have been output.
This either terminates child processes that output more than n bytes on the standard output and
standard error channels, or stop reading from standard input if no program is being fuzzed.
This is useful to detect infinite loops. See also the -U and -T flags.
-C, --max-crashes=n
Stop forking when at least n children have crashed. The default value is 1, meaning zzuf will stop
as soon as one child has crashed. A value of 0 tells zzuf to never stop.
Note that zzuf will not kill any remaining children once n is reached. To ensure that processes do
not last forever, see the -U flag.
A process is considered to have crashed if any signal (such as, but not limited to, SIGSEGV)
caused it to exit. If the -x flag is used, this will also include processes that exit with a non-
zero status.
This option is only relevant if the -s flag is used with a range argument. See also the -t flag.
-D, --delay=delay
Do not launch more than one process every delay seconds. This option should be used together with
-j to avoid fork bombs.
-j, --jobs=jobs
Specify the number of simultaneous children that can be run. By default, zzuf only launches one
process at a time.
This option is only relevant if the -s flag is used with a range argument. See also the -D flag.
-M, --max-memory=mebibytes
Specify the maximum amount of memory, in mebibytes (1 MiB = 1,048,576 bytes), that children are
allowed to allocate. This is useful to detect infinite loops that eat up a lot of memory.
The value should be set reasonably high so as not to interfer with normal program operation. By
default, it is set to 1024 MiB in order to avoid accidental excessive swapping. To disable the
limitation, set the maximum memory usage to -1 instead.
zzuf uses the setrlimit() call to set memory usage limitations and relies on the operating
system's ability to enforce such limitations.
-S, --signal
Prevent children from installing signal handlers for signals that usually cause coredumps. These
signals are SIGABRT, SIGFPE, SIGILL, SIGQUIT, SIGSEGV, SIGTRAP and, if available on the running
platform, SIGSYS, SIGEMT, SIGBUS, SIGXCPU and SIGXFSZ. Instead of calling the signal handler, the
application will simply crash. If you do not want core dumps, you should set appropriate limits
with the limitcoredumpsize command. See your shell's documentation on how to set such limits.
-t, --max-time=n
Stop forking after n seconds. By default, zzuf runs until the end of the seed range is reached.
Note that zzuf will not kill any remaining children once n is reached. To ensure that processes do
not last forever, see the -U flag.
This option is only relevant if the -s flag is used with a range argument. See also the -C flag.
-T, --max-cputime=n
Automatically terminate child processes that use more than n seconds of CPU time.
zzuf uses the setrlimit() call to set CPU usage limitations and relies on the operating system's
ability to enforce such limitations. If the system sends SIGXCPU signals and the application
catches that signal, it will receive a SIGKILL signal after 5 seconds.
This is more accurate than -U because the behaviour should be independent from the system load,
but it does not detect processes stuck into infinite select() calls because they use very little
CPU time. See also the -B and -U flags.
-U, --max-usertime=n
Automatically terminate child processes that run for more than n seconds. This is useful to detect
infinite loops or processes stuck in other situations. See also the -B and -T flags.
-x, --check-exit
Report processes that exit with a non-zero status. By default only processes that crash due to a
signal are reported.
Filtering-a, --allow=list
Only fuzz network input for IPs in list, a comma-separated list of IP addresses. If the list
starts with !, the flag meaning is reversed and all addresses are fuzzed except the ones in the
list.
As of now, this flag only understands INET (IPv4) addresses.
This option requires network fuzzing to be activated using -n.
-b, --bytes=ranges
Restrict fuzzing to bytes whose offsets in the file are within ranges.
Range values start at zero and are inclusive. Use dashes between range values and commas between
ranges. If the right-hand part of a range is omitted, it means end of file. For instance, to
restrict fuzzing to bytes 0, 3, 4, 5 and all bytes after offset 31, use ‘-b0,3-5,31-’.
This option is useful to preserve file headers or corrupt only a specific portion of a file.
-c, --cmdline
Only fuzz files whose name is specified in the target application's command line. This is mostly a
shortcut to avoid specifying the argument twice:
zzuf-ccatfile.txt
has the same effect as
zzuf-I'^file\.txt$'catfile.txt
See the -I flag for more information on restricting fuzzing to specific files.
-E, --exclude=regex
Do not fuzz files whose name matches the regex regular expression. This option supersedes anything
that is specified by the -I flag. Use this for instance if you are unsure of what files your
application is going to read and do not want it to fuzz files in the /etc directory.
Multiple -E flags can be specified, in which case files matching any one of the regular
expressions will be ignored.
-i, --stdin
Fuzz the application's standard input. By default zzuf only fuzzes files.
-I, --include=regex
Only fuzz files whose name matches the regex regular expression. Use this for instance if your
application reads configuration files at startup and you only want specific files to be fuzzed.
Multiple -I flags can be specified, in which case files matching any one of the regular
expressions will be fuzzed. See also the -c flag.
-l, --list=list
Cherry-pick the list of file descriptors that get fuzzed. The Nth descriptor will really be fuzzed
only if N is in list.
Values start at 1 and ranges are inclusive. Use dashes between values and commas between ranges.
If the right-hand part of a range is omitted, it means all subsequent file descriptors. For
instance, to restrict fuzzing to the first opened descriptor and all descriptors starting from the
10th, use ‘-l1,10-’.
Note that this option only affects file descriptors that would otherwise be fuzzed. Even if 10
write-only descriptors are opened at the beginning of the program, only the next descriptor with a
read flag will be the first one considered by the -l flag.
-P, --protect=list
Protect a list of characters so that if they appear in input data that would normally be fuzzed,
they are left unmodified instead.
Characters in list can be expressed verbatim or through escape sequences. The sequences
interpreted by zzuf are:
\n new line
\r return
\t tabulation
\NNN the byte whose octal value is NNN\xNN the byte whose hexadecimal value is NN\\ backslash (‘\’)
You can use ‘-’ to specify ranges. For instance, to protect all bytes from ‘\001’ to ‘/’, use
‘-P'\001-/'’.
The statistical outcome of this option should not be overlooked: if characters are protected, the
effect of the ‘-r’ flag will vary depending on the data being fuzzed. For instance, asking to fuzz
1% of input bits (-r0.01) and to protect lowercase characters (-Pa-z) will result in an actual
average fuzzing ratio of 0.9% with truly random data, 0.3% with random ASCII data and 0.2% with
standard English text.
See also the -R flag.
-R, --refuse=list
Refuse a list of characters by not fuzzing bytes that would otherwise be changed to a character
that is in list. This does not prevent characters from appearing in the output if the original
byte was already in list.
See the -P option for a description of list.
Network-n, --network
Fuzz the application's network input. By default zzuf only fuzzes files.
Only INET (IPv4) and INET6 (IPv6) connections are fuzzed. Other protocol families are not yet
supported.
-p, --ports=ranges
Only fuzz network ports that are in ranges. By default zzuf fuzzes all ports. The port considered
is the listening port if the socket is listening and the destination port if the socket is
connecting, because most of the time the source port cannot be predicted.
Range values start at zero and are inclusive. Use dashes between range values and commas between
ranges. If the right-hand part of a range is omitted, it means end of file. For instance, to
restrict fuzzing to the HTTP and HTTPS ports and to all unprivileged ports, use ‘-p80,443,1024-’.
This option requires network fuzzing to be activated using -n.
Install Now
PNG Icons
Emojis
