codeql

CodeQL This open source repository contains the standard CodeQL libraries and queries that power GitHub Advanced Security and the other application security products that GitHub makes available to its customers worldwide. How do I learn CodeQL and run queries? There is extensive documentation abo...

autoharness

AutoHarness 由 Akshat Parikh 创建 这个工具是什么？ AutoHarness 是一个自动为你生成模糊测试（fuzzing）桩的工具。这个想法源于当前模糊测试代码库中的一个并行问题：大型代码库拥有数千个函数和代码片段，它们可能深嵌在库中。即使对于智能模糊测试器来说，要触及这些代码路径也非常困难，有时甚至不可能。 即使是像 oss-fuzz 这样的大型模糊测试项目，代码库中仍有部分区域未被模糊测试覆盖。因此，这个程序试图在一定程度上缓解这个问题，并为安全研究人员提供一个可用于初步测试代码库的工具。该程序仅支持用 C 和 C++ 编写的代码库。 设置/演示 该程序利用...

toothpicker

ToothPicker ToothPicker is an in-process, coverage-guided fuzzer for iOS. It was developed to specifically targets iOS's Bluetooth daemon bluetoothd and to analyze various Bluetooth protocols on iOS. As it is built using FRIDA, it can be adapted to target any platform that runs FRIDA. This...

test-fuzz

test-fuzz test-fuzz es un subcomando de Cargo y una colección de macros de Rust para automatizar ciertas tareas relacionadas con el fuzzing con afl.rs, incluyendo: generar un corpus de fuzzing implementar un harness de fuzzing test-fuzz logra esto en parte utilizando las facilidades de prueba de...

tmux-fuzzing

Laboratorio de Fuzzing: Mejorando el Fuzzing para tmux Seguridad de Software @ EPFL, Primavera 2025 Resumen En este laboratorio, mejoramos los esfuerzos de fuzzing para el multiplexor de terminal tmux dentro de la infraestructura OSS-Fuzz de Google. Primero establecimos una línea base evaluando l...

OpenEXR Makes Use of Uninitialized Memory

SummaryWhile fuzzing openexrexrcheckfuzzer, Valgrind reports a conditional branch depending on uninitialized data inside genericunpack. This indicates a use of uninitialized memory CWE-457. The issue is reproducible with the current OSS-Fuzz harness and a single-file PoC. DetailsEnvironment:-...

Coverage-Guided Multi-Agent Harness Generation for Java Library Fuzzing

Coverage-guided fuzzing has proven effective for software testing, but targeting library code requires specialized fuzz harnesses that translate fuzzer-generated inputs into valid API invocations. Manual harness creation is time-consuming and requires deep understanding of API semantics,...