* Manpage layout improvements.
This commit is contained in:
+35
-60
@@ -24,21 +24,13 @@ behaviour is deterministic, making it easy to reproduce bugs.
|
||||
several times, with optional arguments, and will report the application's
|
||||
relevant behaviour on the standard output, eg:
|
||||
.PP
|
||||
.RS
|
||||
.nf
|
||||
\fBzzuf cat /dev/zero\fR
|
||||
.fi
|
||||
.RE
|
||||
\fB zzuf cat /dev/zero\fR
|
||||
.PP
|
||||
If you want to specify flags for your application, put a '\fB\-\-\fR'
|
||||
If you want to specify flags for your application, put a \(oq\fB\-\-\fR\(cq
|
||||
marker before them on the command line (otherwise \fBzzuf\fR will try to
|
||||
interpret them as arguments for itself), eg:
|
||||
.PP
|
||||
.RS
|
||||
.nf
|
||||
\fBzzuf \-B 1000 cat \-\- \-v /dev/zero\fR
|
||||
.fi
|
||||
.RE
|
||||
\fB zzuf \-B 1000 cat \-\- \-v /dev/zero\fR
|
||||
.SH OPTIONS
|
||||
.TP
|
||||
\fB\-B\fR, \fB\-\-max\-bytes\fR=\fIn\fR
|
||||
@@ -49,9 +41,14 @@ infinite loops. See also the \fB\-T\fR flag.
|
||||
\fB\-c\fR, \fB\-\-cmdline\fR
|
||||
Only fuzz files whose name is specified in the target application's command
|
||||
line. This is mostly a shortcut to avoid specifiying twice the argument:
|
||||
\fBzzuf \-c cat file.txt\fR has the same effect as \fBzzuf \-I
|
||||
\(dq^file\\.txt$\(dq cat file.txt\fR. See the \fB\-I\fR flag for more
|
||||
information.
|
||||
|
||||
\fB zzuf \-c cat file.txt\fR
|
||||
|
||||
has the same effect as
|
||||
|
||||
\fB zzuf \-I \(aq^file\\.txt$\(aq cat file.txt\fR
|
||||
|
||||
See the \fB\-I\fR flag for more information.
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Activate the display of debug messages.
|
||||
@@ -104,20 +101,21 @@ tabulation
|
||||
the byte whose hexadecimal value is \fINN\fR
|
||||
.TP
|
||||
\fB\\\\\fR
|
||||
backslash ('\\')
|
||||
backslash (\(oq\\\(cq)
|
||||
.RE
|
||||
.IP
|
||||
You can use '\fB-\fR' to specify ranges. For instance, to protect all bytes
|
||||
from '\fB\\x01\fR' to ' ', use '\fB\-P \(dq\\x01- \(dq\fR'.
|
||||
You can use \(oq\fB-\fR\(cq to specify ranges. For instance, to protect all
|
||||
bytes from \(oq\fB\\x01\fR\(cq to \(oq \(cq, use
|
||||
\(oq\fB\-P\ \(aq\\x01-\ \(aq\fR\(cq.
|
||||
|
||||
The statistical outcome of this option should not be overlooked. Because
|
||||
\fBzzuf\fR cannot know the nature of the input data beforehands and must
|
||||
fuzz it even if only one byte of data was received, protecting characters
|
||||
may change the meaning of the \fB\-r\fR flag depending on the data being
|
||||
fuzzed. For instance, asking to fuzz 1% of input bits and to protect
|
||||
lowercase characters (using '\fB\-r 0.01 \-P a-z\fR') will result in an
|
||||
actual average fuzzing ratio of 0.9% with truly random data, 0.3% with
|
||||
random ASCII data and 0.2% with a normal English text.
|
||||
fuzzed. For instance, asking to fuzz 1% of input bits (\fB\-r\ 0.01\fR)
|
||||
and to protect lowercase characters (\fB\-P\ a-z\fR) will result in
|
||||
an actual average fuzzing ratio of 0.9% with truly random data, 0.3% with
|
||||
random ASCII data and 0.2% with a standard English text.
|
||||
|
||||
See also the \fB\-R\fR flag.
|
||||
.TP
|
||||
@@ -178,65 +176,42 @@ Output version information and exit.
|
||||
.PP
|
||||
Fuzz the input of the \fBcat\fR program using default settings:
|
||||
.PP
|
||||
.RS
|
||||
.nf
|
||||
\fBzzuf cat /etc/motd\fR
|
||||
.fi
|
||||
.RE
|
||||
\fB zzuf cat /etc/motd\fR
|
||||
.PP
|
||||
Fuzz 1% of the input bits of the \fBcat\fR program using seed 94324:
|
||||
.PP
|
||||
.RS
|
||||
.nf
|
||||
\fBzzuf -s 94324 -r 0.01 cat /etc/motd\fR
|
||||
.fi
|
||||
.RE
|
||||
\fB zzuf -s 94324 -r 0.01 cat /etc/motd\fR
|
||||
.PP
|
||||
Fuzz the input of the \fBcat\fR program but do not fuzz the newline character
|
||||
and prevent non-ASCII characters from appearing in the output:
|
||||
.PP
|
||||
.RS
|
||||
.nf
|
||||
\fBzzuf -P \(dq\\n\(dq -R \(dq\\0-\\x1f\\x7f-\\xff\(dq cat /etc/motd\fR
|
||||
.fi
|
||||
.RE
|
||||
\fB zzuf -P \(aq\\n\(aq -R \(aq\\0-\\x1f\\x7f-\\xff\(aq cat /etc/motd\fR
|
||||
.PP
|
||||
Fuzz the input of the \fBconvert\fR program, using file \fBfoo.jpeg\fR as the
|
||||
original input and excluding \fB.xml\fR files from fuzzing (because
|
||||
\fBconvert\fR will also open its own XML configuration files and we do not
|
||||
want \fBzzuf\fR to fuzz them):
|
||||
.PP
|
||||
.RS
|
||||
.nf
|
||||
\fBzzuf -E \(dq\\.xml$\(dq convert -- foo.jpeg -format tga /dev/null\fR
|
||||
.fi
|
||||
.RE
|
||||
\fB zzuf -E \(aq\\.xml$\(aq convert -- foo.jpeg -format tga /dev/null\fR
|
||||
.PP
|
||||
Fuzz the input of \fBvlc\fR, using file \fBmovie.avi\fR as the original input
|
||||
and restricting fuzzing to filenames that appear on the command line
|
||||
(\fB\-c\fR), then generate \fBfuzzy-movie.avi\fR which is a file that can
|
||||
be read by \fBvlc\fR to reproduce the same behaviour without using \fBzzuf\fR:
|
||||
(\fB\-c\fR), then generate \fBfuzzy-movie.avi\fR which is a file that
|
||||
can be read by \fBvlc\fR to reproduce the same behaviour without using
|
||||
\fBzzuf\fR:
|
||||
.PP
|
||||
.RS
|
||||
.nf
|
||||
\fBzzuf -c -s 87423 -r 0.01 vlc movie.avi\fR
|
||||
\fBzzuf -c -s 87423 -r 0.01 cp movie.avi fuzzy-movie.avi\fR
|
||||
\fBvlc fuzzy-movie.avi\fR
|
||||
.fi
|
||||
.RE
|
||||
\fB zzuf -c -s 87423 -r 0.01 vlc movie.avi\fR
|
||||
\fB zzuf -c -s 87423 -r 0.01 cp movie.avi fuzzy-movie.avi\fR
|
||||
\fB vlc fuzzy-movie.avi\fR
|
||||
.PP
|
||||
Fuzz 2% of \fBmplayer\fR's input bits (\fB\-r 0.02\fR) with seeds 0 to 9999
|
||||
(\fB\-s 0:10000\fR), disabling its standard output messages (\fB\-q\fR),
|
||||
launching up to three simultaneous child processes (\fB\-F 3\fR), killing
|
||||
\fBmplayer\fR if it takes more than one minute to read the file (\fB\-T 60\fR)
|
||||
Fuzz 2% of \fBmplayer\fR's input bits (\fB\-r\ 0.02\fR) with seeds 0 to 9999
|
||||
(\fB\-s\ 0:10000\fR), disabling its standard output messages (\fB\-q\fR),
|
||||
launching up to three simultaneous child processes (\fB\-F\ 3\fR), killing
|
||||
\fBmplayer\fR if it takes more than one minute to read the file (\fB\-T\ 60\fR)
|
||||
and disabling its \fBSIGSEGV\fR signal handler (\fB\-S\fR):
|
||||
.PP
|
||||
.RS
|
||||
.nf
|
||||
\fBzzuf -c -q -s 0:10000 -F 3 -T 60 -r 0.02 \\\fR
|
||||
\fB mplayer -- -benchmark -vo null -fps 1000 movie.avi\fR
|
||||
.fi
|
||||
.RE
|
||||
\fB zzuf -c -q -s 0:10000 -F 3 -T 60 -r 0.02 \\\fR
|
||||
\fB mplayer -- -benchmark -vo null -fps 1000 movie.avi\fR
|
||||
.SH BUGS
|
||||
.PP
|
||||
Due to \fBzzuf\fR using shared object preloading (\fBLD_PRELOAD\fR on most
|
||||
|
||||
Reference in New Issue
Block a user