All Classes and Interfaces
Class
Description
A mutable state representing the current call stack with prefix counts,
used to compute light-weight execution indexes.
A front-end that uses AFL for guided fuzzing.
Turns one input into the arguments for a single trial.
Builds an
ArgumentsGenerator for a specific test method.The
Comparison annotation marks a method as a comparison
function for regression-based fuzz testing.This is an instruction visitor that has additional convenience methods
for visiting control-flow instructions.
Maps integer keys to integer counts using a fixed-size table.
Utility class to collect branch and function coverage
An implementation of the Janala instruction visitor interface
that does nothing for each instruction.
The
DiffFuzz annotation marks a method as an entry-point for
regression-based fuzz testing.Wraps a
TrialExecutor to capture each trial's outcome for differential fuzzing.A representation of an execution index sans the counts, equivalent to
a call stack.
An execution index represents a unique point in a program's execution.
Entry point for fuzzing with Execution Indexing.
A guidance that represents inputs as maps from
execution indexes to parameters.
A blocking queue for single-producer and single-consumer where the producer and
consumer never change and are distinct threads.
An implementation of
Counter that uses an IntIntHashMap to store values
"Fast" in that it is faster than using something that involves other HashMaps,
and boxing to-and-from primitive values.Utility class to collect branch and function coverage
A source of randomness with better performance but looser
statistical guarantees.
The
Fuzz annotation marks a method as an entry-point for
coverage-guided fuzz testing.A test-framework integration that supplies the execution half of a fuzzing run.
The outcome of a fuzzing campaign for one test method.
The fuzzing loop, independent of any test framework.
A JUnit
Statement that runs a method under guided fuzz testing.Marks a method as a JQF/Zest fuzz-test entry point for JUnit 5 (Jupiter).
An object to keep track of (classId, methodId, instructionId) tuples during
instrumentation.
A front-end for guided fuzzing.
Functional interface for creating guidance instances
Utility class for computing bounded hash values.
Lazy provider of bytes from an input stream.
Builds Instancio-backed
ArgumentsGenerators.Utility class containing static methods for common I/O operations
ExecutionIndexingState implementation for Janala
instrumentation framework.
Generates one trial's arguments by running the per-parameter jetCheck generators
against the engine's guided byte stream.
Builds a
JetCheckArgumentsGenerator.Builds jetCheck-backed
ArgumentsGenerators.Runs a jetCheck
Generator against JQF's guided byte stream.This class extends JUnit and Quickcheck runners to enable guided
fuzz testing.
Wraps the first failing input found by a fuzzing campaign so Jupiter reports it
as a test failure.
The Jupiter extension behind
FuzzTest.The JUnit 4 execution provider, discoverable through
ServiceLoader.Classifies trial throwables for the JUnit 4 run path.
Runs trials through a JUnit 4
TrialRunner.Builds
Junit4TrialExecutors.Reads a
@FuzzTest's run configuration from its annotation, system
properties, the environment, and any externally installed guidance.A named source of one regression input's bytes.
The JUnit 5 execution provider, discoverable through
ServiceLoader.The reusable JUnit 5 fuzzing entry point.
Classifies trial throwables for the JUnit 5 run path.
Runs trials reflectively under a JUnit 5 (Jupiter) lifecycle.
Builds
Junit5TrialExecutors.Author: Koushik Sen (ksen@cs.berkeley.edu)
Date: 6/21/12
Time: 5:02 PM
Maps integer keys to integer counts using a fixed-size table.
A special marker instruction indicating that the method
is exiting abruptly due to an exception being thrown, and thus
the stack frame must be destroyed.
MovingAverage - A data structure for collecting a moving average.
Aggregates several trial failures from one fuzzing campaign into a single error.
A front-end that only generates random inputs.
Provides a generation status that does not track the number of trials
generated so far.
An extension of
Counter that caches which entries
are non-zero.A front-end that uses AFL for increasing performance counters
in addition to code coverage.
Configuration of what feedback to send AFL in second-half of map.
An
ArgumentsGenerator backed by junit-quickcheck generators.Builds junit-quickcheck-backed
ArgumentsGenerators.A front-end that provides a specified set of inputs for test
case reproduction,
This class enables reproduction of a test case with an input file
generated by a guided fuzzing front-end such as AFL.
Represents the result of a guided fuzzing trial.
Classifies a throwable raised by a trial into an engine-level outcome.
A ClassWriter that computes the common super class of two classes without
actually loading them with a ClassLoader.
Signals that the current input cannot produce a trial and should be skipped.
A special probe instruction added by the instrumentation.
This class extends
Random to act as a generator of
"random" values, which themselves are read from a static file.This class is responsible for tracing for an instruction stream
generated by a single thread in the application.
A version of
Runnable that throws arbitrary, possibly checked, exceptions.An interface representing by a trace event such as CALL, RETURN or BRANCH.
Visitor class for
TraceEvent instances.A singleton class which manages per-thread tracers.
Runs a single trial of a test method with generated arguments.
Builds a
TrialExecutor for a specific test method.Author: Koushik Sen (ksen@cs.berkeley.edu)
Date: 7/1/12
Time: 10:50 PM
CLI for Zest based guidance.
Entry point for fuzzing with Zest.
A guidance that performs coverage-guided fuzzing using two coverage maps,
one for all inputs and one for valid inputs only.
A candidate or saved test input that maps objects of type K to bytes.