You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1.7 KiB

Fuzz-testing Bitcoin Core

A special test harness test_bitcoin_fuzzy is provided to provide an easy entry point for fuzzers and the like. In this document we'll describe how to use it with AFL.

Building AFL

It is recommended to always use the latest version of afl:

tar -zxvf afl-latest.tgz
cd afl-<version>


To build Bitcoin Core using AFL instrumentation (this assumes that the AFLPATH was set as above):

./configure --disable-ccache --disable-shared --enable-tests CC=${AFLPATH}/afl-gcc CXX=${AFLPATH}/afl-g++
export AFL_HARDEN=1
cd src/
make test/test_bitcoin_fuzzy

We disable ccache because we don't want to pollute the ccache with instrumented objects, and similarly don't want to use non-instrumented cached objects linked in.

Preparing fuzzing

AFL needs an input directory with examples, and an output directory where it will place examples that it found. These can be anywhere in the file system, we'll define environment variables to make it easy to reference them.

mkdir inputs
mkdir outputs

Example inputs are available from:

Extract these (or other starting inputs) into the inputs directory before starting fuzzing.


To start the actual fuzzing use:

$AFLPATH/afl-fuzz -i ${AFLIN} -o ${AFLOUT} -m52 -- test/test_bitcoin_fuzzy

You may have to change a few kernel parameters to test optimally - afl-fuzz will print an error and suggestion if so.