aeondave/libfuzzer
offensive-tools/fuzzing/libfuzzer/SKILL.md
Auth/lab ref: In-process, coverage-guided fuzzing engine integrated with Clang/LLVM. For fast unit-level fuzz targets, parser hardening, sanitizer-first bug discovery, and corpus-driven regression loops in C/C++ code.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill libfuzzerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 8, 2026, 3:51 AM152.4s1 file scanned
SKILL.md
- name:
- libfuzzer
- description:
- Auth/lab ref: In-process, coverage-guided fuzzing engine integrated with Clang/LLVM. For fast unit-level fuzz targets, parser hardening, sanitizer-first bug discovery, and corpus-driven regression loops in C/C++ code.
- license:
- NCSA
- compatibility:
- Clang/LLVM toolchains on Linux/macOS/Windows.
- author:
- GitHub Copilot
- version:
- 1.1
libfuzzer
LLVM-native in-process fuzzer using LLVMFuzzerTestOneInput entrypoints.
Quick Start
# Minimal target
# extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
# Build with libFuzzer + ASAN
clang++ -g -O1 -fsanitize=fuzzer,address fuzz_target.cc -o fuzz_target
# Run
./fuzz_target corpus/
Operator Flow
- Build a narrow, deterministic
LLVMFuzzerTestOneInputharness. - Add ASAN/UBSAN first; add MSAN when dependency hygiene allows.
- Seed with small valid/invalid corpus.
- Run long enough to stabilize coverage features, then merge/minimize corpus.
- Keep crashing artifacts as regression tests.
Key Practice
- Keep fuzz target deterministic, fast, and side-effect-light.
- Prefer narrow targets per format/API instead of one giant dispatcher.
- Seed with small valid+invalid samples; then minimize via
-merge=1.
Useful Flags
| Flag | Purpose |
|------|---------|
| -runs=N | Bounded runs |
| -max_total_time=N | Time budget |
| -dict=file | Token dictionary |
| -jobs / -workers | Parallel campaigns |
| -fork=N | Crash/OOM/timeout-resistant subprocess mode |
| -use_value_profile=1 | Stronger cmp-guided search |
| -merge=1 | Corpus minimization/merge |
Practical Tricks
- Use
FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTIONto disable fuzz-hostile randomness/checksums in harness builds. - Return
-1for intentionally rejected inputs to reduce corpus pollution. - Use
-artifact_prefix/ fixed artifact paths in CI pipelines for predictable collection. - For very large corpora, use resumable merge workflows.
Common Pitfalls
- Original authors shifted major innovation to Centipede; libFuzzer remains supported for bug fixes.
- Excellent fit for CI regression with saved crash artifacts.
- Non-deterministic harness behavior causes corpus bloat and noisy triage.
- Overly broad max lengths can waste cycles on low-value regions.
- Neglecting sanitizers in in-process mode delays detection of latent memory issues.
Resources
- https://llvm.org/docs/LibFuzzer.html
- https://clang.llvm.org/docs/SanitizerCoverage.html
- https://google.github.io/oss-fuzz/
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026