diff --git a/doc/zzuf.1 b/doc/zzuf.1 index a2f91f8..85c592a 100644 --- a/doc/zzuf.1 +++ b/doc/zzuf.1 @@ -24,21 +24,13 @@ behaviour is deterministic, making it easy to reproduce bugs. several times, with optional arguments, and will report the application's relevant behaviour on the standard output, eg: .PP -.RS -.nf -\fBzzuf cat /dev/zero\fR -.fi -.RE +\fB zzuf cat /dev/zero\fR .PP -If you want to specify flags for your application, put a '\fB\-\-\fR' +If you want to specify flags for your application, put a \(oq\fB\-\-\fR\(cq marker before them on the command line (otherwise \fBzzuf\fR will try to interpret them as arguments for itself), eg: .PP -.RS -.nf -\fBzzuf \-B 1000 cat \-\- \-v /dev/zero\fR -.fi -.RE +\fB zzuf \-B 1000 cat \-\- \-v /dev/zero\fR .SH OPTIONS .TP \fB\-B\fR, \fB\-\-max\-bytes\fR=\fIn\fR @@ -49,9 +41,14 @@ infinite loops. See also the \fB\-T\fR flag. \fB\-c\fR, \fB\-\-cmdline\fR Only fuzz files whose name is specified in the target application's command line. This is mostly a shortcut to avoid specifiying twice the argument: -\fBzzuf \-c cat file.txt\fR has the same effect as \fBzzuf \-I -\(dq^file\\.txt$\(dq cat file.txt\fR. See the \fB\-I\fR flag for more -information. + +\fB zzuf \-c cat file.txt\fR + +has the same effect as + +\fB zzuf \-I \(aq^file\\.txt$\(aq cat file.txt\fR + +See the \fB\-I\fR flag for more information. .TP \fB\-d\fR, \fB\-\-debug\fR Activate the display of debug messages. @@ -104,20 +101,21 @@ tabulation the byte whose hexadecimal value is \fINN\fR .TP \fB\\\\\fR -backslash ('\\') +backslash (\(oq\\\(cq) .RE .IP -You can use '\fB-\fR' to specify ranges. For instance, to protect all bytes -from '\fB\\x01\fR' to ' ', use '\fB\-P \(dq\\x01- \(dq\fR'. +You can use \(oq\fB-\fR\(cq to specify ranges. For instance, to protect all +bytes from \(oq\fB\\x01\fR\(cq to \(oq \(cq, use +\(oq\fB\-P\ \(aq\\x01-\ \(aq\fR\(cq. The statistical outcome of this option should not be overlooked. Because \fBzzuf\fR cannot know the nature of the input data beforehands and must fuzz it even if only one byte of data was received, protecting characters may change the meaning of the \fB\-r\fR flag depending on the data being -fuzzed. For instance, asking to fuzz 1% of input bits and to protect -lowercase characters (using '\fB\-r 0.01 \-P a-z\fR') will result in an -actual average fuzzing ratio of 0.9% with truly random data, 0.3% with -random ASCII data and 0.2% with a normal English text. +fuzzed. For instance, asking to fuzz 1% of input bits (\fB\-r\ 0.01\fR) +and to protect lowercase characters (\fB\-P\ a-z\fR) will result in +an actual average fuzzing ratio of 0.9% with truly random data, 0.3% with +random ASCII data and 0.2% with a standard English text. See also the \fB\-R\fR flag. .TP @@ -178,65 +176,42 @@ Output version information and exit. .PP Fuzz the input of the \fBcat\fR program using default settings: .PP -.RS -.nf -\fBzzuf cat /etc/motd\fR -.fi -.RE +\fB zzuf cat /etc/motd\fR .PP Fuzz 1% of the input bits of the \fBcat\fR program using seed 94324: .PP -.RS -.nf -\fBzzuf -s 94324 -r 0.01 cat /etc/motd\fR -.fi -.RE +\fB zzuf -s 94324 -r 0.01 cat /etc/motd\fR .PP Fuzz the input of the \fBcat\fR program but do not fuzz the newline character and prevent non-ASCII characters from appearing in the output: .PP -.RS -.nf -\fBzzuf -P \(dq\\n\(dq -R \(dq\\0-\\x1f\\x7f-\\xff\(dq cat /etc/motd\fR -.fi -.RE +\fB zzuf -P \(aq\\n\(aq -R \(aq\\0-\\x1f\\x7f-\\xff\(aq cat /etc/motd\fR .PP Fuzz the input of the \fBconvert\fR program, using file \fBfoo.jpeg\fR as the original input and excluding \fB.xml\fR files from fuzzing (because \fBconvert\fR will also open its own XML configuration files and we do not want \fBzzuf\fR to fuzz them): .PP -.RS -.nf -\fBzzuf -E \(dq\\.xml$\(dq convert -- foo.jpeg -format tga /dev/null\fR -.fi -.RE +\fB zzuf -E \(aq\\.xml$\(aq convert -- foo.jpeg -format tga /dev/null\fR .PP Fuzz the input of \fBvlc\fR, using file \fBmovie.avi\fR as the original input and restricting fuzzing to filenames that appear on the command line -(\fB\-c\fR), then generate \fBfuzzy-movie.avi\fR which is a file that can -be read by \fBvlc\fR to reproduce the same behaviour without using \fBzzuf\fR: +(\fB\-c\fR), then generate \fBfuzzy-movie.avi\fR which is a file that +can be read by \fBvlc\fR to reproduce the same behaviour without using +\fBzzuf\fR: .PP -.RS -.nf -\fBzzuf -c -s 87423 -r 0.01 vlc movie.avi\fR -\fBzzuf -c -s 87423 -r 0.01 cp movie.avi fuzzy-movie.avi\fR -\fBvlc fuzzy-movie.avi\fR -.fi -.RE +\fB zzuf -c -s 87423 -r 0.01 vlc movie.avi\fR +\fB zzuf -c -s 87423 -r 0.01 cp movie.avi fuzzy-movie.avi\fR +\fB vlc fuzzy-movie.avi\fR .PP -Fuzz 2% of \fBmplayer\fR's input bits (\fB\-r 0.02\fR) with seeds 0 to 9999 -(\fB\-s 0:10000\fR), disabling its standard output messages (\fB\-q\fR), -launching up to three simultaneous child processes (\fB\-F 3\fR), killing -\fBmplayer\fR if it takes more than one minute to read the file (\fB\-T 60\fR) +Fuzz 2% of \fBmplayer\fR's input bits (\fB\-r\ 0.02\fR) with seeds 0 to 9999 +(\fB\-s\ 0:10000\fR), disabling its standard output messages (\fB\-q\fR), +launching up to three simultaneous child processes (\fB\-F\ 3\fR), killing +\fBmplayer\fR if it takes more than one minute to read the file (\fB\-T\ 60\fR) and disabling its \fBSIGSEGV\fR signal handler (\fB\-S\fR): .PP -.RS -.nf -\fBzzuf -c -q -s 0:10000 -F 3 -T 60 -r 0.02 \\\fR -\fB mplayer -- -benchmark -vo null -fps 1000 movie.avi\fR -.fi -.RE +\fB zzuf -c -q -s 0:10000 -F 3 -T 60 -r 0.02 \\\fR +\fB mplayer -- -benchmark -vo null -fps 1000 movie.avi\fR .SH BUGS .PP Due to \fBzzuf\fR using shared object preloading (\fBLD_PRELOAD\fR on most