# Honggfuzz

**A security-oriented, feedback-driven, evolutionary fuzzer.**

Honggfuzz is a general-purpose fuzzer that uses code coverage (software and hardware-based) to find bugs. It is multi-process, multi-threaded, and supports persistent fuzzing for extreme speed.

## Key Features

*   **Fast**: Multi-process and multi-threaded engine. unlocking full CPU potential.
*   **Persistent Fuzzing**: Test APIs directly in-process with iteration speeds up to 1M/sec.
*   **Feedback-Driven**: Uses hardware (Intel BTS/PT) and software code coverage to evolve inputs.
*   **Easy**: Can start with an empty corpus and automatically build a valid input set.
*   **Deep Monitoring**: Uses low-level APIs (`ptrace`) to detect hijacked signals and hidden crashes.
*   **Broad Support**: Linux, macOS, Android, NetBSD, FreeBSD, and Windows (Cygwin).

## Installation

### Dependencies

**Linux (Ubuntu/Debian)**
```bash
sudo apt-get install binutils-dev libunwind-dev libblocksruntime-dev clang
```

**macOS**
Requires [Xcode](https://developer.apple.com/xcode/) (10.8+) and `libblocksruntime`.

### Build

```bash
make
# Compilation wrappers are created in hfuzz_cc/
```

## Usage

### 1. Compile Target
Use the provided compiler wrappers to automatically add instrumentation:

```bash
# C code
./hfuzz_cc/hfuzz-clang -o my_target my_target.c

# C++ code
./hfuzz_cc/hfuzz-clang++ -o my_target my_target.cpp
```

### 2. Run Fuzzer
Point it to an input corpus directory (can be empty) and your binary:

```bash
# Basic run
./honggfuzz -i input_dir/ -- ./my_target ___FILE___

# Persistent mode (faster)
./honggfuzz -P -i input_dir/ -- ./my_target
```

*Note: `___FILE___` is a placeholder for the input filename generated by honggfuzz.*

For advanced examples (Apache, OpenSSL, BIND, etc.), check the `examples/` directory.

See [USAGE.md](docs/USAGE.md) for detailed options.

## Trophies

Honggfuzz has discovered major security vulnerabilities in critical software.

### HTTP & Servers
*   **Apache HTTPD**:
    *   CVE-2017-7659 (mod_http2 remote crash)
    *   CVE-2017-9789 (Use-after-free)
    *   CVE-2018-1301, CVE-2018-1302, CVE-2018-1303
*   **OpenSSH**: Pre-auth remote crash (commit 28652bca)
*   **BIND**: Multiple bugs
*   **NGINX Unit**: Infinite loop
*   **ProFTPD**: CVE-2019-18217 (DoS)
*   **Samba**: CVE-2019-14907, CVE-2020-10745, CVE-2021-20277

### Cryptography & SSL
*   **OpenSSL**:
    *   **CVE-2016-6309 (Critical, Potential RCE)**
    *   CVE-2015-1789, CVE-2016-7054, CVE-2017-3731
*   **LibreSSL**: Multiple crashes and invalid frees
*   **BoringSSL**: Uninitialized memory use
*   **Crypto++**: CVE-2016-9939 (Remote DoS)

### Languages & Interpreters
*   **PHP**: WDDX bugs, generic interpreter crashes
*   **Python/Ruby**: Interpreter bugs
*   **Rust**: Panics/safety issues in `regex`, `h2`, `sleep-parser`, `lewton`
*   **Perl**: Multiple interpreter crashes

### Media & Formats
*   **FreeType 2**: CVE-2010-2497 through CVE-2010-2527 (7+ CVEs)
*   **LibTIFF**: Multiple bugs
*   **LibJPEG/Turbo**: Multiple bugs
*   **VLC**: Double-free RCE
*   **Adobe Flash**: CVE-2015-0316
*   **ImageIO (iOS/macOS)**: Multiple security problems (Project Zero)
*   **LibreOffice**: Memory corruption

### System & Utils
*   **Systemd**: Tested by honggfuzz
*   **fwupd**: 17+ bugs found
*   **TCPDump**: Multiple bugs
*   **Rsyslog**: Multiple bugs

*(See [OSS-Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/list?q=honggfuzz&can=1) for hundreds more)*

## Projects Using Honggfuzz

*   **Google OSS-Fuzz**: Continuous fuzzing for open source software.
*   **Android**: Used by Android Security team.
*   **Rust**: `honggfuzz-rs` crate for fuzzing Rust code.
*   **Bitcoin Core**: Fuzzing infrastructure.
*   **Apache HTTP Server**: CI fuzzing.
*   **Systemd**: CI fuzzing.
*   **Cifasis QuickFuzz**
*   **Mozilla FuzzOS**

## License

Apache License 2.0.

__This is NOT an official Google product__