Fuzzer Skill Template
Use this template for language-specific fuzzers (libFuzzer, AFL++, cargo-fuzz, etc.).
Template Structure
---
name: {fuzzer-name-lowercase}
type: fuzzer
description: >
{Summary from handbook}. Use for fuzzing {language} projects.
---
# {Fuzzer Name}
{Brief introduction from handbook - what this fuzzer is and its key differentiator}
## When to Use
{Comparison with other fuzzers for the same language}
| Fuzzer | Best For | Complexity |
|--------|----------|------------|
| {This fuzzer} | {Use case} | {Level} |
| {Alternative 1} | {Use case} | {Level} |
| {Alternative 2} | {Use case} | {Level} |
**Choose {Fuzzer Name} when:**
- {Criterion 1}
- {Criterion 2}
## Quick Start
{Minimal working example - get fuzzing in <5 minutes}
\```{language}
{Minimal harness code}
\```
Compile and run:
\```bash
{Minimal commands to compile and run}
\```
## Installation
{Platform-specific installation instructions}
### Prerequisites
- {Prerequisite 1}
- {Prerequisite 2}
### Linux/macOS
\```bash
{Installation commands}
\```
### Verification
\```bash
{Command to verify installation}
\```
## Writing a Harness
{How to write a fuzzing harness for this fuzzer}
### Harness Structure
\```{language}
{Standard harness template with comments}
\```
### Harness Rules
{Key rules from handbook - what to do and avoid in harness}
| Do | Don't |
|----|-------|
| {Good practice 1} | {Bad practice 1} |
| {Good practice 2} | {Bad practice 2} |
> **See Also:** For detailed harness writing techniques, patterns for handling complex inputs,
> and advanced strategies, see the **fuzz-harness-writing** technique skill.
## Compilation
{How to compile fuzz targets}
### Basic Compilation
\```bash
{Basic compile command}
\```
### With Sanitizers
\```bash
{Compile with ASan/UBSan}
\```
> **See Also:** For detailed sanitizer configuration, common issues, and advanced flags,
> see the **address-sanitizer** and **undefined-behavior-sanitizer** technique skills.
### Build Flags
| Flag | Purpose |
|------|---------|
| {Flag 1} | {Purpose} |
| {Flag 2} | {Purpose} |
## Corpus Management
{How to create and manage input corpus}
### Creating Initial Corpus
{Where to get seed inputs}
\```bash
{Commands for corpus setup}
\```
### Corpus Minimization
\```bash
{Commands to minimize corpus}
\```
> **See Also:** For corpus creation strategies, dictionaries, and seed selection,
> see the **fuzzing-corpus** technique skill.
## Running Campaigns
{How to run fuzzing campaigns}
### Basic Run
\```bash
{Basic run command}
\```
### Multi-Core Fuzzing
\```bash
{Parallel fuzzing command if supported}
\```
### Interpreting Output
{How to read fuzzer output, coverage, crashes}
| Output | Meaning |
|--------|---------|
| {Output indicator 1} | {What it means} |
| {Output indicator 2} | {What it means} |
## Coverage Analysis
{How to measure and improve coverage}
### Generating Coverage Reports
\```bash
{Coverage commands}
\```
### Improving Coverage
{Tips for reaching more code paths}
> **See Also:** For detailed coverage analysis techniques, identifying coverage gaps,
> and systematic coverage improvement, see the **coverage-analysis** technique skill.
## Sanitizer Integration
{How to use AddressSanitizer, UndefinedBehaviorSanitizer, etc.}
### AddressSanitizer (ASan)
\```bash
{ASan compile flags}
\```
### UndefinedBehaviorSanitizer (UBSan)
\```bash
{UBSan compile flags}
\```
### MemorySanitizer (MSan)
\```bash
{MSan compile flags - if applicable}
\```
### Common Sanitizer Issues
| Issue | Solution |
|-------|----------|
| {Issue 1} | {Fix} |
| {Issue 2} | {Fix} |
## Advanced Usage
### Tips and Tricks
| Tip | Why It Helps |
|-----|--------------|
| {Tip 1} | {Explanation} |
| {Tip 2} | {Explanation} |
| {Tip 3} | {Explanation} |
### {Advanced Topic 1 - e.g., Structure-Aware Fuzzing}
{Details}
### {Advanced Topic 2 - e.g., Custom Mutators}
{Details}
### Performance Tuning
{How to maximize fuzzing throughput}
| Setting | Impact |
|---------|--------|
| {Setting 1} | {Effect} |
| {Setting 2} | {Effect} |
## Real-World Examples
{Examples from handbook of fuzzing real projects}
### Example: {Project Name}
{Context and what we're fuzzing}
\```{language}
{Harness code}
\```
\```bash
{Commands to fuzz example project}
\```
## Troubleshooting
{Common issues and solutions from handbook}
| Problem | Cause | Solution |
|---------|-------|----------|
| {Problem 1} | {Cause} | {Solution} |
| {Problem 2} | {Cause} | {Solution} |
| {Problem 3} | {Cause} | {Solution} |
## Related Skills
{Cross-references to technique skills that complement this fuzzer}
### Technique Skills
| Skill | Use Case |
|-------|----------|
| **fuzz-harness-writing** | Detailed guidance on writing effective harnesses |
| **address-sanitizer** | Memory error detection during fuzzing |
| **coverage-analysis** | Measuring and improving code coverage |
| **fuzzing-corpus** | Building and managing seed corpora |
| **fuzzing-dictionaries** | Creating dictionaries for format-aware fuzzing |
### Related Fuzzers
| Skill | When to Consider |
|-------|------------------|
| **{alternative-fuzzer-1}** | {When this alternative is better} |
| **{alternative-fuzzer-2}** | {When this alternative is better} |
## Resources
{From resources section - fetch non-video URLs with WebFetch}
### Key External Resources
{For each non-video URL: fetch with WebFetch, summarize key insights}
**[{Title 1}]({URL})**
{Summarized insights: setup guides, tips, examples extracted from the page}
**[{Title 2}]({URL})**
{Summarized insights from fetched content}
### Video Resources
{Videos - title and URL only, no fetching}
- [{Video Title}]({YouTube/Vimeo URL}) - {Brief description}
Field Extraction Guide
| Template Field |
Handbook Source |
{fuzzer-name-lowercase} |
Slugified directory name (e.g., libfuzzer, aflpp) |
{Summary from handbook} |
From index.md frontmatter or first paragraph |
{language} |
Parent directory (e.g., c-cpp → C/C++, rust → Rust) |
| Quick Start |
Extract minimal example from handbook |
| Harness |
From handbook or link to techniques/writing-harnesses |
| Sanitizers |
From handbook or link to techniques/asan |
| Real-World Examples |
From handbook examples section |
| Related Skills |
Map to other handbook sections that complement this fuzzer |
Related Skills Mapping
When generating a fuzzer skill, identify and link to these technique skills:
| Handbook Section |
Generated Skill Name |
Link Context |
/fuzzing/techniques/writing-harnesses/ |
fuzz-harness-writing |
Harness section |
/fuzzing/techniques/asan/ |
address-sanitizer |
Sanitizer section |
/fuzzing/techniques/ubsan/ |
undefined-behavior-sanitizer |
Sanitizer section |
/fuzzing/techniques/coverage/ |
coverage-analysis |
Coverage section |
/fuzzing/techniques/corpus/ |
fuzzing-corpus |
Corpus section |
/fuzzing/techniques/dictionaries/ |
fuzzing-dictionaries |
Corpus section |
Example: libFuzzer
---
name: libfuzzer
type: fuzzer
description: >
Coverage-guided fuzzer built into LLVM. Use for fuzzing C/C++ projects
that can be compiled with Clang.
---
# libFuzzer
libFuzzer is an in-process, coverage-guided fuzzer that is part of the LLVM project.
It's the recommended starting point for fuzzing C/C++ projects due to its simplicity
and integration with the LLVM toolchain.
## When to Use
| Fuzzer | Best For | Complexity |
|--------|----------|------------|
| libFuzzer | Quick setup, single-threaded | Low |
| AFL++ | Multi-core, diverse mutations | Medium |
| LibAFL | Custom fuzzers, research | High |
**Choose libFuzzer when:**
- You need a simple, quick setup
- Project uses Clang for compilation
- Single-threaded fuzzing is sufficient
## Quick Start
\```c++
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
// Call your code with fuzzer-provided data
my_function(data, size);
return 0;
}
\```
Compile and run:
\```bash
clang++ -fsanitize=fuzzer,address harness.cc target.cc -o fuzz_target
./fuzz_target corpus/
\```
## Writing a Harness
### Harness Structure
\```c++
#include <stdint.h>
#include <stddef.h>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
// 1. Validate input size if needed
if (size < MIN_SIZE) return 0;
// 2. Call target function with fuzz data
target_function(data, size);
// 3. Return 0 (non-zero reserved for future use)
return 0;
}
\```
### Harness Rules
| Do | Don't |
|----|-------|
| Reset global state between runs | Rely on state from previous runs |
| Handle edge cases gracefully | Exit on invalid input |
| Keep harness deterministic | Use random number generators |
| Free allocated memory | Create memory leaks |
> **See Also:** For advanced harness patterns, handling complex inputs, and
> structure-aware fuzzing, see the **fuzz-harness-writing** technique skill.
## Sanitizer Integration
### AddressSanitizer (ASan)
\```bash
clang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz_target
\```
### Common Sanitizer Issues
| Issue | Solution |
|-------|----------|
| ASan slows fuzzing | Use `-fsanitize-recover=address` for non-fatal errors |
| Stack exhaustion | Increase stack with `ASAN_OPTIONS=stack_size=...` |
> **See Also:** For comprehensive sanitizer configuration and troubleshooting,
> see the **address-sanitizer** technique skill.
## Related Skills
### Technique Skills
| Skill | Use Case |
|-------|----------|
| **fuzz-harness-writing** | Advanced harness patterns and structure-aware fuzzing |
| **address-sanitizer** | Memory error detection configuration |
| **coverage-analysis** | Measuring fuzzing effectiveness |
| **fuzzing-corpus** | Seed corpus creation and management |
### Related Fuzzers
| Skill | When to Consider |
|-------|------------------|
| **aflpp** | Multi-core fuzzing or when libFuzzer plateaus |
| **honggfuzz** | Hardware-based coverage on Linux |
...
Notes
- Always include sanitizer section (ASan is essential for fuzzing)
- ALWAYS include Related Skills section linking to technique skills
- Use "See Also" callouts in relevant sections pointing to technique skills
- Keep total lines under 500
- Include comparison with other fuzzers for same language
- Fetch non-video external resources with WebFetch, extract key insights
- For videos (YouTube, Vimeo): include title/URL only, do not fetch
- Related skills help users discover deeper content on harnesses, sanitizers, etc.
1---2name: fuzzer-skill3description: Use this template for language-specific fuzzers (libFuzzer, AFL++, cargo-fuzz, etc.).4---5
6# Fuzzer Skill Template
7
8Use this template for language-specific fuzzers (libFuzzer, AFL++, cargo-fuzz, etc.).
9
10## Template Structure
11
12```markdown
13---
14name: {fuzzer-name-lowercase}
15type: fuzzer
16description: >
17 {Summary from handbook}. Use for fuzzing {language} projects.
18---
19
20# {Fuzzer Name}
21
22{Brief introduction from handbook - what this fuzzer is and its key differentiator}
23
24## When to Use
25
26{Comparison with other fuzzers for the same language}
27
28| Fuzzer | Best For | Complexity |
29|--------|----------|------------|
30| {This fuzzer} | {Use case} | {Level} |
31| {Alternative 1} | {Use case} | {Level} |
32| {Alternative 2} | {Use case} | {Level} |
33
34**Choose {Fuzzer Name} when:**
35- {Criterion 1}
36- {Criterion 2}
37
38## Quick Start
39
40{Minimal working example - get fuzzing in <5 minutes}
41
42\```{language}
43{Minimal harness code}
44\```
45
46Compile and run:
47\```bash
48{Minimal commands to compile and run}
49\```
50
51## Installation
52
53{Platform-specific installation instructions}
54
55### Prerequisites
56
57- {Prerequisite 1}
58- {Prerequisite 2}
59
60### Linux/macOS
61
62\```bash
63{Installation commands}
64\```
65
66### Verification
67
68\```bash
69{Command to verify installation}
70\```
71
72## Writing a Harness
73
74{How to write a fuzzing harness for this fuzzer}
75
76### Harness Structure
77
78\```{language}
79{Standard harness template with comments}
80\```
81
82### Harness Rules
83
84{Key rules from handbook - what to do and avoid in harness}
85
86| Do | Don't |
87|----|-------|
88| {Good practice 1} | {Bad practice 1} |
89| {Good practice 2} | {Bad practice 2} |
90
91> **See Also:** For detailed harness writing techniques, patterns for handling complex inputs,
92> and advanced strategies, see the **fuzz-harness-writing** technique skill.
93
94## Compilation
95
96{How to compile fuzz targets}
97
98### Basic Compilation
99
100\```bash
101{Basic compile command}
102\```
103
104### With Sanitizers
105
106\```bash
107{Compile with ASan/UBSan}
108\```
109
110> **See Also:** For detailed sanitizer configuration, common issues, and advanced flags,
111> see the **address-sanitizer** and **undefined-behavior-sanitizer** technique skills.
112
113### Build Flags
114
115| Flag | Purpose |
116|------|---------|
117| {Flag 1} | {Purpose} |
118| {Flag 2} | {Purpose} |
119
120## Corpus Management
121
122{How to create and manage input corpus}
123
124### Creating Initial Corpus
125
126{Where to get seed inputs}
127
128\```bash
129{Commands for corpus setup}
130\```
131
132### Corpus Minimization
133
134\```bash
135{Commands to minimize corpus}
136\```
137
138> **See Also:** For corpus creation strategies, dictionaries, and seed selection,
139> see the **fuzzing-corpus** technique skill.
140
141## Running Campaigns
142
143{How to run fuzzing campaigns}
144
145### Basic Run
146
147\```bash
148{Basic run command}
149\```
150
151### Multi-Core Fuzzing
152
153\```bash
154{Parallel fuzzing command if supported}
155\```
156
157### Interpreting Output
158
159{How to read fuzzer output, coverage, crashes}
160
161| Output | Meaning |
162|--------|---------|
163| {Output indicator 1} | {What it means} |
164| {Output indicator 2} | {What it means} |
165
166## Coverage Analysis
167
168{How to measure and improve coverage}
169
170### Generating Coverage Reports
171
172\```bash
173{Coverage commands}
174\```
175
176### Improving Coverage
177
178{Tips for reaching more code paths}
179
180> **See Also:** For detailed coverage analysis techniques, identifying coverage gaps,
181> and systematic coverage improvement, see the **coverage-analysis** technique skill.
182
183## Sanitizer Integration
184
185{How to use AddressSanitizer, UndefinedBehaviorSanitizer, etc.}
186
187### AddressSanitizer (ASan)
188
189\```bash
190{ASan compile flags}
191\```
192
193### UndefinedBehaviorSanitizer (UBSan)
194
195\```bash
196{UBSan compile flags}
197\```
198
199### MemorySanitizer (MSan)
200
201\```bash
202{MSan compile flags - if applicable}
203\```
204
205### Common Sanitizer Issues
206
207| Issue | Solution |
208|-------|----------|
209| {Issue 1} | {Fix} |
210| {Issue 2} | {Fix} |
211
212## Advanced Usage
213
214### Tips and Tricks
215
216| Tip | Why It Helps |
217|-----|--------------|
218| {Tip 1} | {Explanation} |
219| {Tip 2} | {Explanation} |
220| {Tip 3} | {Explanation} |
221
222### {Advanced Topic 1 - e.g., Structure-Aware Fuzzing}
223
224{Details}
225
226### {Advanced Topic 2 - e.g., Custom Mutators}
227
228{Details}
229
230### Performance Tuning
231
232{How to maximize fuzzing throughput}
233
234| Setting | Impact |
235|---------|--------|
236| {Setting 1} | {Effect} |
237| {Setting 2} | {Effect} |
238
239## Real-World Examples
240
241{Examples from handbook of fuzzing real projects}
242
243### Example: {Project Name}
244
245{Context and what we're fuzzing}
246
247\```{language}
248{Harness code}
249\```
250
251\```bash
252{Commands to fuzz example project}
253\```
254
255## Troubleshooting
256
257{Common issues and solutions from handbook}
258
259| Problem | Cause | Solution |
260|---------|-------|----------|
261| {Problem 1} | {Cause} | {Solution} |
262| {Problem 2} | {Cause} | {Solution} |
263| {Problem 3} | {Cause} | {Solution} |
264
265## Related Skills
266
267{Cross-references to technique skills that complement this fuzzer}
268
269### Technique Skills
270
271| Skill | Use Case |
272|-------|----------|
273| **fuzz-harness-writing** | Detailed guidance on writing effective harnesses |
274| **address-sanitizer** | Memory error detection during fuzzing |
275| **coverage-analysis** | Measuring and improving code coverage |
276| **fuzzing-corpus** | Building and managing seed corpora |
277| **fuzzing-dictionaries** | Creating dictionaries for format-aware fuzzing |
278
279### Related Fuzzers
280
281| Skill | When to Consider |
282|-------|------------------|
283| **{alternative-fuzzer-1}** | {When this alternative is better} |
284| **{alternative-fuzzer-2}** | {When this alternative is better} |
285
286## Resources
287
288{From resources section - fetch non-video URLs with WebFetch}
289
290### Key External Resources
291
292{For each non-video URL: fetch with WebFetch, summarize key insights}
293
294**[{Title 1}]({URL})**
295{Summarized insights: setup guides, tips, examples extracted from the page}
296
297**[{Title 2}]({URL})**
298{Summarized insights from fetched content}
299
300### Video Resources
301
302{Videos - title and URL only, no fetching}
303
304- [{Video Title}]({YouTube/Vimeo URL}) - {Brief description}
305```
306
307## Field Extraction Guide
308
309| Template Field | Handbook Source |
310|----------------|-----------------|
311| `{fuzzer-name-lowercase}` | Slugified directory name (e.g., `libfuzzer`, `aflpp`) |
312| `{Summary from handbook}` | From `index.md` frontmatter or first paragraph |
313| `{language}` | Parent directory (e.g., `c-cpp` → C/C++, `rust` → Rust) |
314| Quick Start | Extract minimal example from handbook |
315| Harness | From handbook or link to techniques/writing-harnesses |
316| Sanitizers | From handbook or link to techniques/asan |
317| Real-World Examples | From handbook examples section |
318| Related Skills | Map to other handbook sections that complement this fuzzer |
319
320## Related Skills Mapping
321
322When generating a fuzzer skill, identify and link to these technique skills:
323
324| Handbook Section | Generated Skill Name | Link Context |
325|------------------|---------------------|--------------|
326| `/fuzzing/techniques/writing-harnesses/` | `fuzz-harness-writing` | Harness section |
327| `/fuzzing/techniques/asan/` | `address-sanitizer` | Sanitizer section |
328| `/fuzzing/techniques/ubsan/` | `undefined-behavior-sanitizer` | Sanitizer section |
329| `/fuzzing/techniques/coverage/` | `coverage-analysis` | Coverage section |
330| `/fuzzing/techniques/corpus/` | `fuzzing-corpus` | Corpus section |
331| `/fuzzing/techniques/dictionaries/` | `fuzzing-dictionaries` | Corpus section |
332
333## Example: libFuzzer
334
335```markdown
336---
337name: libfuzzer
338type: fuzzer
339description: >
340 Coverage-guided fuzzer built into LLVM. Use for fuzzing C/C++ projects
341 that can be compiled with Clang.
342---
343
344# libFuzzer
345
346libFuzzer is an in-process, coverage-guided fuzzer that is part of the LLVM project.
347It's the recommended starting point for fuzzing C/C++ projects due to its simplicity
348and integration with the LLVM toolchain.
349
350## When to Use
351
352| Fuzzer | Best For | Complexity |
353|--------|----------|------------|
354| libFuzzer | Quick setup, single-threaded | Low |
355| AFL++ | Multi-core, diverse mutations | Medium |
356| LibAFL | Custom fuzzers, research | High |
357
358**Choose libFuzzer when:**
359- You need a simple, quick setup
360- Project uses Clang for compilation
361- Single-threaded fuzzing is sufficient
362
363## Quick Start
364
365\```c++
366extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
367 // Call your code with fuzzer-provided data
368 my_function(data, size);
369 return 0;
370}
371\```
372
373Compile and run:
374\```bash
375clang++ -fsanitize=fuzzer,address harness.cc target.cc -o fuzz_target
376./fuzz_target corpus/
377\```
378
379## Writing a Harness
380
381### Harness Structure
382
383\```c++
384#include <stdint.h>
385#include <stddef.h>
386
387extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
388 // 1. Validate input size if needed
389 if (size < MIN_SIZE) return 0;
390
391 // 2. Call target function with fuzz data
392 target_function(data, size);
393
394 // 3. Return 0 (non-zero reserved for future use)
395 return 0;
396}
397\```
398
399### Harness Rules
400
401| Do | Don't |
402|----|-------|
403| Reset global state between runs | Rely on state from previous runs |
404| Handle edge cases gracefully | Exit on invalid input |
405| Keep harness deterministic | Use random number generators |
406| Free allocated memory | Create memory leaks |
407
408> **See Also:** For advanced harness patterns, handling complex inputs, and
409> structure-aware fuzzing, see the **fuzz-harness-writing** technique skill.
410
411## Sanitizer Integration
412
413### AddressSanitizer (ASan)
414
415\```bash
416clang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz_target
417\```
418
419### Common Sanitizer Issues
420
421| Issue | Solution |
422|-------|----------|
423| ASan slows fuzzing | Use `-fsanitize-recover=address` for non-fatal errors |
424| Stack exhaustion | Increase stack with `ASAN_OPTIONS=stack_size=...` |
425
426> **See Also:** For comprehensive sanitizer configuration and troubleshooting,
427> see the **address-sanitizer** technique skill.
428
429## Related Skills
430
431### Technique Skills
432
433| Skill | Use Case |
434|-------|----------|
435| **fuzz-harness-writing** | Advanced harness patterns and structure-aware fuzzing |
436| **address-sanitizer** | Memory error detection configuration |
437| **coverage-analysis** | Measuring fuzzing effectiveness |
438| **fuzzing-corpus** | Seed corpus creation and management |
439
440### Related Fuzzers
441
442| Skill | When to Consider |
443|-------|------------------|
444| **aflpp** | Multi-core fuzzing or when libFuzzer plateaus |
445| **honggfuzz** | Hardware-based coverage on Linux |
446
447...
448```
449
450## Notes
451
452- Always include sanitizer section (ASan is essential for fuzzing)
453- ALWAYS include Related Skills section linking to technique skills
454- Use "See Also" callouts in relevant sections pointing to technique skills
455- Keep total lines under 500
456- Include comparison with other fuzzers for same language
457- Fetch non-video external resources with WebFetch, extract key insights
458- For videos (YouTube, Vimeo): include title/URL only, do not fetch
459- Related skills help users discover deeper content on harnesses, sanitizers, etc.
majiayu000