* Manpage layout improvements.

This commit is contained in:
Sam Hocevar
2007-01-05 00:24:43 +00:00
committed by sam
parent 3dc82f3b69
commit bd659d383c
+35 -60
View File
@@ -24,21 +24,13 @@ behaviour is deterministic, making it easy to reproduce bugs.
several times, with optional arguments, and will report the application's
relevant behaviour on the standard output, eg:
.PP
.RS
.nf
\fBzzuf cat /dev/zero\fR
.fi
.RE
\fB zzuf cat /dev/zero\fR
.PP
If you want to specify flags for your application, put a '\fB\-\-\fR'
If you want to specify flags for your application, put a \(oq\fB\-\-\fR\(cq
marker before them on the command line (otherwise \fBzzuf\fR will try to
interpret them as arguments for itself), eg:
.PP
.RS
.nf
\fBzzuf \-B 1000 cat \-\- \-v /dev/zero\fR
.fi
.RE
\fB zzuf \-B 1000 cat \-\- \-v /dev/zero\fR
.SH OPTIONS
.TP
\fB\-B\fR, \fB\-\-max\-bytes\fR=\fIn\fR
@@ -49,9 +41,14 @@ infinite loops. See also the \fB\-T\fR flag.
\fB\-c\fR, \fB\-\-cmdline\fR
Only fuzz files whose name is specified in the target application's command
line. This is mostly a shortcut to avoid specifiying twice the argument:
\fBzzuf \-c cat file.txt\fR has the same effect as \fBzzuf \-I
\(dq^file\\.txt$\(dq cat file.txt\fR. See the \fB\-I\fR flag for more
information.
\fB zzuf \-c cat file.txt\fR
has the same effect as
\fB zzuf \-I \(aq^file\\.txt$\(aq cat file.txt\fR
See the \fB\-I\fR flag for more information.
.TP
\fB\-d\fR, \fB\-\-debug\fR
Activate the display of debug messages.
@@ -104,20 +101,21 @@ tabulation
the byte whose hexadecimal value is \fINN\fR
.TP
\fB\\\\\fR
backslash ('\\')
backslash (\(oq\\\(cq)
.RE
.IP
You can use '\fB-\fR' to specify ranges. For instance, to protect all bytes
from '\fB\\x01\fR' to ' ', use '\fB\-P \(dq\\x01- \(dq\fR'.
You can use \(oq\fB-\fR\(cq to specify ranges. For instance, to protect all
bytes from \(oq\fB\\x01\fR\(cq to \(oq \(cq, use
\(oq\fB\-P\ \(aq\\x01-\ \(aq\fR\(cq.
The statistical outcome of this option should not be overlooked. Because
\fBzzuf\fR cannot know the nature of the input data beforehands and must
fuzz it even if only one byte of data was received, protecting characters
may change the meaning of the \fB\-r\fR flag depending on the data being
fuzzed. For instance, asking to fuzz 1% of input bits and to protect
lowercase characters (using '\fB\-r 0.01 \-P a-z\fR') will result in an
actual average fuzzing ratio of 0.9% with truly random data, 0.3% with
random ASCII data and 0.2% with a normal English text.
fuzzed. For instance, asking to fuzz 1% of input bits (\fB\-r\ 0.01\fR)
and to protect lowercase characters (\fB\-P\ a-z\fR) will result in
an actual average fuzzing ratio of 0.9% with truly random data, 0.3% with
random ASCII data and 0.2% with a standard English text.
See also the \fB\-R\fR flag.
.TP
@@ -178,65 +176,42 @@ Output version information and exit.
.PP
Fuzz the input of the \fBcat\fR program using default settings:
.PP
.RS
.nf
\fBzzuf cat /etc/motd\fR
.fi
.RE
\fB zzuf cat /etc/motd\fR
.PP
Fuzz 1% of the input bits of the \fBcat\fR program using seed 94324:
.PP
.RS
.nf
\fBzzuf -s 94324 -r 0.01 cat /etc/motd\fR
.fi
.RE
\fB zzuf -s 94324 -r 0.01 cat /etc/motd\fR
.PP
Fuzz the input of the \fBcat\fR program but do not fuzz the newline character
and prevent non-ASCII characters from appearing in the output:
.PP
.RS
.nf
\fBzzuf -P \(dq\\n\(dq -R \(dq\\0-\\x1f\\x7f-\\xff\(dq cat /etc/motd\fR
.fi
.RE
\fB zzuf -P \(aq\\n\(aq -R \(aq\\0-\\x1f\\x7f-\\xff\(aq cat /etc/motd\fR
.PP
Fuzz the input of the \fBconvert\fR program, using file \fBfoo.jpeg\fR as the
original input and excluding \fB.xml\fR files from fuzzing (because
\fBconvert\fR will also open its own XML configuration files and we do not
want \fBzzuf\fR to fuzz them):
.PP
.RS
.nf
\fBzzuf -E \(dq\\.xml$\(dq convert -- foo.jpeg -format tga /dev/null\fR
.fi
.RE
\fB zzuf -E \(aq\\.xml$\(aq convert -- foo.jpeg -format tga /dev/null\fR
.PP
Fuzz the input of \fBvlc\fR, using file \fBmovie.avi\fR as the original input
and restricting fuzzing to filenames that appear on the command line
(\fB\-c\fR), then generate \fBfuzzy-movie.avi\fR which is a file that can
be read by \fBvlc\fR to reproduce the same behaviour without using \fBzzuf\fR:
(\fB\-c\fR), then generate \fBfuzzy-movie.avi\fR which is a file that
can be read by \fBvlc\fR to reproduce the same behaviour without using
\fBzzuf\fR:
.PP
.RS
.nf
\fBzzuf -c -s 87423 -r 0.01 vlc movie.avi\fR
\fBzzuf -c -s 87423 -r 0.01 cp movie.avi fuzzy-movie.avi\fR
\fBvlc fuzzy-movie.avi\fR
.fi
.RE
\fB zzuf -c -s 87423 -r 0.01 vlc movie.avi\fR
\fB zzuf -c -s 87423 -r 0.01 cp movie.avi fuzzy-movie.avi\fR
\fB vlc fuzzy-movie.avi\fR
.PP
Fuzz 2% of \fBmplayer\fR's input bits (\fB\-r 0.02\fR) with seeds 0 to 9999
(\fB\-s 0:10000\fR), disabling its standard output messages (\fB\-q\fR),
launching up to three simultaneous child processes (\fB\-F 3\fR), killing
\fBmplayer\fR if it takes more than one minute to read the file (\fB\-T 60\fR)
Fuzz 2% of \fBmplayer\fR's input bits (\fB\-r\ 0.02\fR) with seeds 0 to 9999
(\fB\-s\ 0:10000\fR), disabling its standard output messages (\fB\-q\fR),
launching up to three simultaneous child processes (\fB\-F\ 3\fR), killing
\fBmplayer\fR if it takes more than one minute to read the file (\fB\-T\ 60\fR)
and disabling its \fBSIGSEGV\fR signal handler (\fB\-S\fR):
.PP
.RS
.nf
\fBzzuf -c -q -s 0:10000 -F 3 -T 60 -r 0.02 \\\fR
\fB mplayer -- -benchmark -vo null -fps 1000 movie.avi\fR
.fi
.RE
\fB zzuf -c -q -s 0:10000 -F 3 -T 60 -r 0.02 \\\fR
\fB mplayer -- -benchmark -vo null -fps 1000 movie.avi\fR
.SH BUGS
.PP
Due to \fBzzuf\fR using shared object preloading (\fBLD_PRELOAD\fR on most