File: fuzz.1

package info (click to toggle)
fuzz 0.6-7.3
  • links: PTS
  • area: main
  • in suites: etch, etch-m68k, lenny
  • size: 268 kB
  • ctags: 109
  • sloc: ansic: 1,819; sh: 330; makefile: 63
file content (122 lines) | stat: -rw-r--r-- 4,394 bytes parent folder | download | duplicates (7)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
.TH FUZZ 1 "November 3, 1999"
.UC 1
.SH NAME
fuzz \- stress test programs
.SH SYNOPSIS
.B fuzz
[\-t|\-\-timeout timeinsecs] [\-p|\-\-printable] [\-n|\-\-newlines]
[\-l|\-\-length totlen] [\-m|\-\-maxline maxlinelen] 
[\-r|\-\-runcount numruns] [\-b|\-\-bytes] [\-c|\-\-chroot] 
[\-u|\-\-user username] [\-a|\-\-args] [\-o|\-\-omitdata] 
[\-e|\-\-execute filename] [\-x|\-\-maxargs numargs] [\-d|\-\-dontask]
[\-y|\-\-mararglen arglen] [\-V|\-\-version] [\-i|\-\-priority] target 
targetarg...
.SH DESCRIPTION
.BR fuzz
is a program designed to find bugs in other programs. It does this by
doing a form of black box testing. It does this by running the target
program multiple times and passing it random input. Right now this can 
come from one of two places, stdin and the command line
arguments. Testing completes whenever the program either the requested 
number of runs finishes successufully or the program crashes.

Any arguments following the target program are passed directly to the
target program. 
.SS OPTIONS
.TP
.I "\-t, \-\-timeout TIME"
This sets the number of seconds that the fuzz will wait for the other
program before it assumes that the program is hung. The default value
is 120 seconds. This is sensing of when a program is hung is not
entirely reliable. See the 
.BR BUGS 
section.
.TP
.I "\-p, \-\-printable"
This limits both the stdin and the command line arguments to only
printable characters. By default fuzz passes fully random
bytes into the target program.
.TP
.I "\-n, \-\-newlines"
Include random newlines in the input stream.
.TP
.I "\-l, \-\-length LENGTH"
The length in bytes of the data stream to pass through stdin into the
target program. The default length is 100K.
.TP
.I "\-m, \-\-maxline MAXLINELEN"
Specify the maximum line length within the random data stream passed
into stdin. 
.TP
.I "\-r, \-\-runcount RUNCOUNT"
The number of times to run the target program. The default is 10,000.
.TP
.I "\-b, \-\-bytes"
In addition to counting through the number of runs. Count through the
bytes being sent through stdin to the program. This option really
serves no purpose other than making something interesting to watch.
.TP
.I "\-c, \-\-chroot"
Since there is no telling what a program will do when given random
input. this allows a program to be sort of caged while it is run so
that the damage that it may be able to do is minimized. This requires
that the fuzz be run as root. It will drop privlages before it runs
the test program. This option is best used in conjunction with the
\-\-user option. This often times requires that a program is
statically linked.
.TP
.I "\-u, \-\-user USERNAME"
Since there is no telling what a program will do when given random
input, this specifies what user the target program will be run as so
that it is easy to find and repair anything that may have been
scribbled across your file system. This option was designed to be used
in conjuntion with the \-\-chroot option and will only work if fuzz is
run as root.
.TP
.I "\-a, \-\-args"
In addition to passing random data via stdin, pass random command line 
arguments. This simply sets the number or random arguments to be
passed to 256. See the 
.BR BUGS
section.
.TP
.I "\-o, \-\-omitdata"
Some programs don't take input from stdin. They only take input from
the command line arguments. If this is the case simply use the
\-\-omitdata option.
.TP
.I "\-x. \-\-maxargs NUMARGS"
This is to set the maximum number of arguments that are passed to each 
invocation of the target program.
.TP
.I "\-y, \-\-maxarglen ARGLEN"
Sets the maximum length of an arguments passed to the target program.
.TP
.I "\-V, \-\-version"
Print the version of fuzz and exit.
.TP
.I "\-i, \-\-priority"
Run at a specified priority.
.TP
.I "\-d, \-\-dontask"
In the cases where the target program is for sure part of a package and the 
packaging information will provide the needed version information then you 
can use this option to avoid being asked what the version is.
.SH EXAMPLES
.RS
fuzz grep foo
.RE
.RS
fuzz -c -u nobody cpio -i
.RE
.SH BUGS
The random arg functions doesn't work very well right now. The
arguments passed are so random that the program usually just prints
out the usage message and then terminates. This will become much more
useful later when we are mating data sets with the intention of
maximizing code coverage.
.SH AUTHORS
.nf
Ben Woodard <ben@valinux.com>
.fi