* Updated manpage, fixed - to \- here and there.

doc/zzuf.1

@@ -72,7 +72,7 @@ and do not want it to fuzz files in the \fB/etc\fR directory.
 Multiple \fB\-E\fR flags can be specified, in which case files matching any one
 of the regular expressions will be ignored.
 .TP
-\fB\-F\fR, \fB\-\-max-forks\fR=\fIforks\fR
+\fB\-F\fR, \fB\-\-max\-forks\fR=\fIforks\fR
 Specify the number of simultaneous children that can be run.
 
 This option is only relevant if the \fB\-s\fR flag is used with an interval
@@ -119,13 +119,13 @@ the byte whose hexadecimal value is \fINN\fR
 backslash (\(oq\\\(cq)
 .RE
 .IP
-You can use \(oq\fB-\fR\(cq to specify ranges. For instance, to protect all
-bytes from \(oq\\001\(cq to \(oq/\(cq, use \(oq\fB\-P\ \(dq\\001-/\(dq\fR\(cq.
+You can use \(oq\fB\-\fR\(cq to specify ranges. For instance, to protect all
+bytes from \(oq\\001\(cq to \(oq/\(cq, use \(oq\fB\-P\ \(dq\\001\-/\(dq\fR\(cq.
 
 The statistical outcome of this option should not be overlooked: if characters
 are protected, the effect of the \(oq\fB\-r\fR\(cq flag will vary depending
 on the data being fuzzed. For instance, asking to fuzz 1% of input bits
-(\fB\-r\ 0.01\fR) and to protect lowercase characters (\fB\-P\ a-z\fR) will
+(\fB\-r\ 0.01\fR) and to protect lowercase characters (\fB\-P\ a\-z\fR) will
 result in an actual average fuzzing ratio of 0.9% with truly random data,
 0.3% with random ASCII data and 0.2% with standard English text.
 
@@ -192,29 +192,29 @@ Fuzz the input of the \fBcat\fR program using default settings:
 .PP
 Fuzz 1% of the input bits of the \fBcat\fR program using seed 94324:
 .PP
-\fB    zzuf -s 94324 -r 0.01 cat /etc/motd\fR
+\fB    zzuf \-s 94324 \-r 0.01 cat /etc/motd\fR
 .PP
 Fuzz the input of the \fBcat\fR program but do not fuzz newline characters
 and prevent non-ASCII characters from appearing in the output:
 .PP
-\fB    zzuf -P \(aq\\n\(aq -R \(aq\\x00-\\x1f\\x7f-\\xff\(aq cat /etc/motd\fR
+\fB    zzuf \-P \(aq\\n\(aq \-R \(aq\\x00\-\\x1f\\x7f\-\\xff\(aq cat /etc/motd\fR
 .PP
 Fuzz the input of the \fBconvert\fR program, using file \fBfoo.jpeg\fR as the
 original input and excluding \fB.xml\fR files from fuzzing (because
 \fBconvert\fR will also open its own XML configuration files and we do not
 want \fBzzuf\fR to fuzz them):
 .PP
-\fB    zzuf -E \(aq\\.xml$\(aq convert -- foo.jpeg -format tga /dev/null\fR
+\fB    zzuf \-E \(aq\\.xml$\(aq convert \-\- foo.jpeg \-format tga /dev/null\fR
 .PP
 Fuzz the input of \fBVLC\fR, using file \fBmovie.avi\fR as the original input
 and restricting fuzzing to filenames that appear on the command line
-(\fB\-c\fR), then generate \fBfuzzy-movie.avi\fR which is a file that
+(\fB\-c\fR), then generate \fBfuzzy\-movie.avi\fR which is a file that
 can be read by \fBVLC\fR to reproduce the same behaviour without using
 \fBzzuf\fR:
 .PP
-\fB    zzuf -c -s 87423 -r 0.01 vlc movie.avi\fR
-\fB    zzuf -c -s 87423 -r 0.01 cp movie.avi fuzzy-movie.avi\fR
-\fB    vlc fuzzy-movie.avi\fR
+\fB    zzuf \-c \-s 87423 \-r 0.01 vlc movie.avi\fR
+\fB    zzuf \-c \-s 87423 \-r 0.01 cp movie.avi fuzzy\-movie.avi\fR
+\fB    vlc fuzzy\-movie.avi\fR
 .PP
 Fuzz 2% of \fBMPlayer\fR's input bits (\fB\-r\ 0.02\fR) with seeds 0 to 9999
 (\fB\-s\ 0:10000\fR), disabling its standard output messages (\fB\-q\fR),
@@ -222,8 +222,8 @@ launching up to three simultaneous child processes (\fB\-F\ 3\fR), killing
 \fBMPlayer\fR if it takes more than one minute to read the file (\fB\-T\ 60\fR)
 and disabling its \fBSIGSEGV\fR signal handler (\fB\-S\fR):
 .PP
-\fB    zzuf -c -r 0.02 -q -s 0:10000 -F 3 -T 60 -S \\\fR
-\fB      mplayer -- -benchmark -vo null -fps 1000 movie.avi\fR
+\fB    zzuf \-c \-r 0.02 \-q \-s 0:10000 \-F 3 \-T 60 \-S \\\fR
+\fB      mplayer \-\- \-benchmark \-vo null \-fps 1000 movie.avi\fR
 .SH RESTRICTIONS
 .PP
 Due to \fBzzuf\fR using shared object preloading (\fBLD_PRELOAD\fR on most
@@ -246,16 +246,13 @@ It is not yet possible to insert or drop bytes from the input, to fuzz
 according to the file format, to swap bytes, etc. More advanced fuzzing
 methods are planned.
 .PP
-\fBZzuf\fR will not work properly with applications using \fBgetc\fR() on
-platforms where it is defined as a macro, such as OpenBSD and FreeBSD,
-because it is unable to intercept calls to \fBgetc\fR().
-.PP
 As of now, \fBzzuf\fR does not really support multithreaded applications. The
 behaviour with multithreaded applications where more than one thread does file
 descriptor operations is undefined.
 .SH NOTES
 In order to intercept file and network operations and signal handlers,
-\fBzzuf\fR diverts and reimplements the following functions:
+\fBzzuf\fR diverts and reimplements the following functions, which can
+be private libc symbols, too:
 .TP
 Unix file descriptor handling:
 \fBopen\fR(), \fBlseek\fR(), \fBread\fR(), \fBaccept\fR(), \fBsocket\fR(),
@@ -270,7 +267,7 @@ Linux-specific:
 \fBgetline\fR(), \fBgetdelim\fR(), \fB__getdelim\fR()
 .TP
 BSD-specific:
-\fBfgetln\fR()
+\fBfgetln\fR(), \fB__srefill()\fR()
 .TP
 Signal handling:
 \fBsignal\fR(), \fBsigaction\fR()
@@ -280,8 +277,11 @@ using functions that are not in that list, \fBzzuf\fR will not fuzz its
 input consistently and the results should not be trusted. You can use a tool
 such as \fBltrace(1)\fR on Linux to know the missing functions.
 .PP
-One important unimplemented function is \fBfscanf\fR(), because of its
-complexity. Missing functions will be implemented based upon user request.
+On some systems, such as FreeBSD, \fB__srefill\fR() is enough to monitor all
+standard IO streams functions. On other systems each function needs to be
+reimplemented on a case by case basis. One important unimplemented function
+is \fBfscanf\fR(), because of its complexity. Missing functions will be
+implemented based upon user request.
 .SH HISTORY
 .PP
 \fBZzuf\fR started its life in 2002 as the \fBstreamfucker\fR tool, a small