ziggy
ziggy
is a fuzzer manager for Rust projects which is built to:
Features will also include:
First, install ziggy
and its dependencies by running:
cargo install --force ziggy cargo-afl honggfuzz grcov
Here is the output of the tool's help:
$ cargo ziggy
A multi-fuzzer management utility for all of your Rust fuzzing needs π§βπ€
Usage: cargo ziggy <COMMAND>
Commands:
build Build the fuzzer and the runner binaries
fuzz Fuzz targets using different fuzzers in parallel
run Run a specific input or a directory of inputs to analyze backtrace
minimize Minimize the input corpus using the given fuzzing target
cover Generate code coverage information using the existing corpus
plot Plot AFL++ data using afl-plot
add-seeds Add seeds to the running AFL++ fuzzers
triage Triage crashes found with casr - currently only works for AFL++
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
-V, --version Print version
To create a fuzzer, simply add ziggy
as a dependency.
[dependencies]
ziggy = { version = "1.1.0", default-features = false }
Then use the fuzz!
macro inside your main
to create a harness.
fn main() {
ziggy::fuzz!(|data: &[u8]| {
println!("{data:?}");
});
}
For a well-documented fuzzer, see the url example.
output
directoryAfter you've launched your fuzzer, you'll find a couple of items in the output
directory:
corpus
directory containing the full corpuscrashes
directory containing any crashes detected by the fuzzerslogs
directory containing a fuzzer log filesafl
directory containing AFL++'s outputhonggfuzz
directory containing Honggfuzz's outputqueue
directory that is used by ziggy to pass items from AFL++ to HonggfuzzThe cargo cover
command will not generate coverage for the dependencies of your fuzzed project
by default.
If this is something you would like to change, you can use the following trick:
CARGO_HOME=.cargo cargo ziggy cover
This will clone every dependency into a .cargo
directory and this directory will be included in
the generated coverage.
ziggy
logsIf you want to see ziggy
's internal logs, you can set RUST_LOG=INFO
.