Crates.io | tree-crasher-python |
lib.rs | tree-crasher-python |
version | 0.4.0 |
source | src |
created_at | 2023-07-17 18:19:21.420065 |
updated_at | 2023-07-17 18:19:21.420065 |
description | Easy-to-use grammar-based black-box fuzzer |
homepage | https://github.com/langston-barrett/tree-crasher |
repository | https://github.com/langston-barrett/tree-crasher |
max_upload_size | |
id | 918742 |
size | 25,642 |
tree-crasher is an easy-to-use grammar-based black-box fuzzer. It parses a number of input files using tree-sitter grammars, and produces new files formed by splicing together their ASTs.
tree-crasher aims to occupy a different niche from more advanced grammar-based fuzzers like Gramatron, Nautilus, and Grammarinator. Rather than achieve maximal coverage and bug-finding through complete, hand-written grammars and complex techniques like coverage-based feedback, tree-crasher aims to achieve maximal ease-of-use by using off-the-shelf tree-sitter grammars and not requiring any instrumentation (nor even source code) for the target. In short, tree-crasher wants to be the Radamsa of grammar-based fuzzing.
tree-crasher uses treereduce to automatically minimize generated test-cases.
For more information, see the documentation.
When reading these examples, keep in mind that fuzzing can cause unpredictable behaviors. Always fuzz in a VM or Docker container with a memory limit, no network access, and no important files.
Obtain a collection of JavaScript files and put them in corpus/
(for
example, using this script). Then here's how to fuzz
JerryScript and Boa:
tree-crasher-javascript corpus/ jerry
tree-crasher-javascript corpus/ boa
(By default, tree-crasher passes input to the target on stdin.)
Write rx.py
like so:
import re
import sys
try:
s = sys.stdin.read()
r = re.compile(s)
print(r.match(s))
except:
pass
Put some sample regular expressions in corpus/
. Then:
tree-crasher-regex corpus/ -- python3 $PWD/rx.py
tree-crasher has found many bugs in rustc. Here's how it was done! The special
@@
symbol on the command line gets replaced by the file generated by
tree-crasher.
tree-crasher-rust \
--interesting-stderr "(?m)^error: internal compiler error:" \
corpus \
-- \
rustc +nightly --crate-type=lib --emit=mir -Zmir-opt-level=4 @@.rs
(The regex syntax is that of the regex crate.)
See the documentation for more examples.
tree-crasher uses tree-splicer to generate test cases, see the list of bugs found in that project's README.
If you find a bug with tree-crasher, please let me know! One great way to do so would be to submit a PR to tree-splicer to add it to the README.
tree-crasher supports 9+ languages, see the documentation for details.
Documentation is available online or in ./doc
.