FUZZ(1)

✨ FUZZ — stress test programs ✨

okay so bestie, welcome to FUZZ(1) from the General Commands Manual — section 1, the commands section, we love her, she's iconic. sit down, grab a strawberry 🍓, and let's talk about throwing garbage at other programs on purpose. it's giving chaotic good and i'm obsessed.

---

🌸 NAME 🌸

fuzz — stress test programs 🫶

---

🎀 SYNOPSIS 🎀

fuzz [-t|--timeout timeinsecs] [-p|--printable] [-n|--newlines N]
[-l|--length totlen] [-m|--maxline maxlinelen] [-r|--runcount numruns]
[-b|--bytes] [-c|--chroot] [-u|--user username] [-a|--args]
[-o|--omitdata] [-e|--execute filename] [-x|--maxargs numargs]
[-d|--dontask] [-y|--mararglen arglen] [-V|--version] [-i|--priority]
target targetarg...

---

💖 DESCRIPTION 💖

fuzz is a program whose whole entire job is finding bugs in other programs. and the way she does it? black box testing, periodt. she runs the target program multiple times and feeds it random input every single time and just… watches what happens. the drama. 😭

right now that random input can come from one of two places, no cap:

• stdin
• the command line arguments

testing is done when either the requested number of runs finishes successfully, or the program crashes. those are the two ways this ends, bestie. 💀

any arguments that come after the target program get passed directly to the target program. no middleman, no editing, just vibes.

⚠️ NOTE: if the program is not in PATH, you gotta refer to it using an absolute path. she's not psychic. 🧚

---

👑 OPTIONS 👑

• -a, --args — in addition to passing random data through stdin, she'll also pass random command line arguments. this one just sets the number of random arguments to be passed to 256. go read the BUGS section, i'm begging you. 🙈
• -b, --bytes — besides counting through the number of runs, she'll also count through the bytes being sent through stdin to the program. honestly? this option really serves no purpose other than making something interesting to watch. and honestly? valid. 👑
• -c, --chroot — since there is no telling what a program will do when you hand it random input, this lets a program be sort of caged while it runs so the damage it might be able to do is minimized. this requires that fuzz be run as root. it will drop privileges before it runs the test program. this option is best used in conjunction with the --user option. this often times requires that a program is statically linked. 🫶
• -d, --dontask — for the cases where the target program is for sure part of a package and the packaging information will provide the needed version information, you can use this to avoid being asked what the version is. she's skipping the small talk. 💅
• -i, --priority — run at a specified priority. that's it, that's the whole thing. ✨
• -l, --length LENGTH — the length in bytes of the data stream to pass through stdin into the target program. the default length is 100K. big stream energy. 🌊
• -m, --maxline MAXLINELEN — specify the maximum line length within the random data stream passed into stdin. keep those lines in check bestie. 📏
• -n, --newlines N — include random N newlines in the input stream. sprinkle sprinkle. 🌧️
• -o, --omitdata — some programs don't take input from stdin at all, they only take input from the command line arguments. if that's the case, simply use --omitdata and skip the stdin situation entirely. 🙅‍♀️
• -p, --printable — this limits both the stdin and the command line arguments to only printable characters. by default fuzz passes fully random bytes into the target program. fully. random. bytes. 💀
• -r, --runcount RUNCOUNT — the number of times to run the target program. the default is 10,000. ten thousand little chaos gremlin runs. 🔥
• -t, --timeout TIME — this sets the number of seconds that fuzz will wait for the other program before it assumes the program is hung. the default value is 120 seconds. this sensing of when a program is hung is not entirely reliable — go check the BUGS section, i mean it. 😭
• -u, --user USERNAME — since there is no telling what a program will do when given random input, this specifies what user the target program will be run as, so that it's easy to find and repair anything that may have been scribbled across your file system. this option was designed to be used in conjunction with the --chroot option and will only work if fuzz is run as root. 🧚
• -V, --version — print the version of fuzz and exit. short, sweet, iconic. ✨
• -x. --maxargs NUMARGS — this is to set the maximum number of arguments that are passed to each invocation of the target program. (yes bestie, the punctuation up there is exactly how she wrote it. we love her, typos and all. 💅)
• -y, --maxarglen ARGLEN — sets the maximum length of an argument passed to the target program. long args? not on her watch. 📏

---

🌈 EXAMPLES 🌈

check grep:

fuzz grep foo

run a program with a different user:

fuzz --chroot --user nobody cpio -i

when the program is not in path, use the absolute path to access it:

fuzz ./src/myprogram

---

💀 BUGS 💀

the random arg functions doesn't work very well right now, bestie, i'm not gonna lie to you. the arguments passed are so random that the program usually just prints out the usage message and then terminates. 💀

this will become much more useful later when they are mating data sets with the intention of maximizing code coverage. the future is coming, we're just not there yet. 🦋

---

🫶 AUTHORS 🫶

Ben Woodard <ben@valinux.com> — the main character who wrote all this. 👑

---

and that's the page, bestie!! this one's from the 3rd Berkeley Distribution, dated November 3, 1999 — vintage, retro, still serving. go fuzz something responsibly. 💖✨🎀