libzzuf(3)

✨ NAME ✨

libzzuf — the helper library for the zzuf multiple purpose fuzzer 💖

okay so real quick, bestie: this is the manual page for libzzuf(3), straight out of the Library Functions Manual. it's a library, it's a baddie, and it's about to make your fuzzing life so much easier. let's get into it 🫶

---

🌸 DESCRIPTION 🌸

libzzuf is a helper library that zzuf automatically preloads whenever it's fuzzing applications. but here's the tea — it can also be used all on its own, for debugging purposes or for those specific cases that zzuf just can't cover. main character energy fr 💅

---

🎀 USAGE 🎀

libzzuf has to be preloaded using your operating system's default way of preloading libraries. like, the normal one, nothing fancy. for example, on a typical Linux installation:

LD_PRELOAD=/usr/lib/zzuf/libzzuf.so

periodt. that's the whole vibe. ✨

---

🦋 ENVIRONMENT VARIABLES 🦋

so libzzuf's initial setup happens through environment variables. and listen — after they're read, no further information can be sent to the fuzzed process. that's it, that's the window, it closes. 🙈

all environment variables are optional. every single one. no pressure bestie 💜

• ZZUF_DEBUG — this one gets set to the debugging level. 0 means no debugging information is sent to zzuf. 1 logs important information as well as all diverted functions. 2 logs fuzzing status and all optional file stream information. pick your level of yapping 💅
• ZZUF_DEBUGFD — set this to a file descriptor, and libzzuf will send its debugging information there. this is how data gets shipped off to the main zzuf controlling binary. it's giving messenger 🦋
• ZZUF_SEED — set to the initial random seed. corresponding zzuf flag: --seed.
• ZZUF_MINRATIO, ZZUF_MAXRATIO — these get set to the minimal and maximal fuzzing ratios. corresponding zzuf flag: --ratio.
• ZZUF_AUTOINC — if this one is set, the random seed gets incremented each time a new file is opened. corresponding zzuf flag: --autoinc.
• ZZUF_BYTES — contains byte ranges that fuzzing should be restricted to. corresponding zzuf flag: --bytes.
• ZZUF_LIST — contains file descriptor ranges that fuzzing should be restricted to. corresponding zzuf flag: --list.
• ZZUF_NETWORK — if this is set, network mode is activated. corresponding zzuf flag: --network.
• ZZUF_PORTS — contains port ranges that fuzzing should be restricted to. corresponding zzuf flag: --port.
• ZZUF_PROTECT, ZZUF_REFUSE — these contain character ranges to protect or refuse. corresponding zzuf flags: --protect, --refuse.
• ZZUF_INCLUDE, ZZUF_EXCLUDE — these contain regular expressions to indicate which files should be included in or excluded from the list of fuzzed files. corresponding zzuf flags: --include, --exclude.
• ZZUF_SIGNAL — if this is set, the fuzzed process will be prevented from installing signal handlers that usually cause coredumps. corresponding zzuf flag: --signal.
• ZZUF_MEMORY — contains the maximum amount of memory that the fuzzed process is allowed to allocate. corresponding zzuf flag: --max-memory.
• ZZUF_STDIN — if this is set, standard input will be fuzzed, too. corresponding zzuf flag: --stdin.

---

💀 NOTES 💀

okay so to intercept file and network operations, signal handlers, and memory allocations, libzzuf diverts and reimplements the following functions. heads up though — sometimes these are private C library symbols, too. iykyk 👑

📂 Unix file descriptor handling:

open(), dup(), dup2(), lseek(), read(), readv(), pread(), accept(), socket(), recv(), recvfrom(), recvmsg(), aio_read(), aio_return(), close()

🌈 Standard IO streams:

fopen(), freopen(), fseek(), fseeko(), rewind(), fread(), getc(), getchar(), fgetc(), fgets(), ungetc(), fclose()

🧠 Memory management:

mmap(), munmap(), malloc(), calloc(), valloc(), free(), memalign(), posix_memalign()

🐧 Required on Linux:

open64(), lseek64(), mmap64(), _IO_getc(), getline(), getdelim(), __getdelim(), getc_unlocked(), getchar_unlocked(), fgetc_unlocked(), fgets_unlocked(), fread_unlocked(), __uflow()

🍓 Required on BSD systems:

fgetln(), __srefill(), __srget()

🍎 Required on Mac OS X:

map_fd()

💜 Required on HP-UX:

__open64(), __lseek64(), __filbuf()

☀️ Required on OpenSolaris:

freopen64(), fseeko64(), fsetpos64()

🚨 Signal handling:

signal(), sigaction()

---

okay this part is IMPORTANT, bestie, listen up: if an application manipulates file descriptors (reading data, seeking around) using functions that are not in that list, then libzzuf will not fuzz its input consistently and the results should not be trusted. like, do not trust them. at all. 🙈 you can use a tool such as ltrace(1) on Linux to figure out which functions are missing.

on BSD systems, such as FreeBSD or Mac OS X, __srefill() alone is enough to monitor all standard IO streams functions. on other systems, such as Linux, each function is reimplemented on a case by case basis. one important unimplemented function is fscanf(), because of its complexity. missing functions will be added upon user request — so like, just ask 🫶

---

👑 SEE ALSO 👑

zzuf(1), ld.so(8)

---

💖 AUTHOR 💖

Copyright © 2002-2015 Sam Hocevar <sam@hocevar.net>.

libzzuf and this manual page are free software. they come without any warranty, to the extent permitted by applicable law. you can redistribute them and/or modify them under the terms of the Do What the Fuck You Want to Public License, Version 2, as published by the WTFPL Task Force. see http://www.wtfpl.net/ for more details.

zzuf's webpage can be found at http://caca.zoy.org/wiki/zzuf. an overview of the architecture and inner works is at http://caca.zoy.org/wiki/zzuf/internals.

---

and that's the whole page, bestie 💅 this was libzzuf version 0.15, dated 2015-01-06 — go fuzz something iconic 🦋✨