syzkaller is an unsupervised, coverage-guided kernel fuzzer.
It generates and mutates sequences of system calls, executes them on virtual machines or physical devices, and uses the resulting code coverage to guide subsequent tests. The software maintains a persistent corpus of useful programs to explore increasingly deep kernel paths.
When syzkaller detects a crash, it attempts to reproduce the fault and minimise the program responsible. It deduplicates crashes, stores raw logs and symbolised reports, and can produce standalone C reproducers. Statistics, coverage and crash information are available through a web interface.
This is free and open source software.
Key Features
- Coverage-guided generation and mutation of system-call sequences.
- Unsupervised fuzzing with persistent corpus and crash storage.
- Starts, restarts and monitors worker virtual machines.
- Detects kernel crashes, hangs, lockups and lost test-machine connections.
- Automatically reproduces crashes and minimises triggering programs.
- Generates syzkaller and standalone C reproducers.
- Deduplicates crashes and stores raw logs and symbolised reports.
- Uses declarative system-call descriptions which can be extended.
- Web interface displays execution statistics, coverage and crashes.
- Connects multiple manager instances to exchange programs and reproducers.
- Supports virtual machines, Android devices and selected physical hardware.
- Supports Linux, FreeBSD, Fuchsia, gVisor, NetBSD, OpenBSD and Windows.
- Supports cross-architecture and cross-operating-system fuzzing.
Website: github.com/google/syzkaller
Support:
Developer: Google and contributors
License: Apache License 2.0
syzkaller is written in Go. Learn Go with our recommended free books and free tutorials.
Related Software
| Vulnerability Analysis Tools | |
|---|---|
| BeEF | The Browser Exploitation Framework |
| syzkaller | Unsupervised, coverage-guided kernel fuzzer |
| pocsuite3 | Remote vulnerability testing framework |
| AFL++ | Security-oriented fuzzer |
| Jazzer | Coverage-guided, in-process fuzzer for the Java Virtual Machine |
| Ronin | Ruby toolkit for security research and development |
| Kanha | Web-app pentesting suite |
| simple fuzzer | A fuzzer with two network modes of operation |
| Doona | Fork of the Bruteforce Exploit Detector Tool |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.