docs: assorted improvements

This commit is contained in:
Andrey Konovalov 2017-10-27 15:09:26 +02:00 committed by Andrey Konovalov
parent 06a268ea21
commit 80c748800e
5 changed files with 23 additions and 12 deletions

View File

@ -1,5 +1,8 @@
# How syzkaller works
Below is the generic descriptions of how syzkaller works.
Check [this](linux/internals.md) for Linux kernel specific things.
## Overview
The process structure for the syzkaller system is shown in the following diagram;

4
docs/linux/internals.md Normal file
View File

@ -0,0 +1,4 @@
# How syzkaller works
It's possible to fuzz some external Linux kernel interfaces with syzkaller.
Right now there's only support for [external fuzzing of the networking stack](external_fuzzing_network.md).

View File

@ -1,4 +1,13 @@
# Generic setup instructions
# How to set up syzkaller
Below are the generic instructions for how to set up syzkaller to fuzz the Linux kernel.
Instructions for a particular VM type or kernel arch can be found on these pages:
- [Setup: Ubuntu host, QEMU vm, x86-64 kernel](setup_ubuntu-host_qemu-vm_x86-64-kernel.md)
- [Setup: Ubuntu host, Odroid C2 board, arm64 kernel](setup_ubuntu-host_odroid-c2-board_arm64-kernel.md)
- [Setup: Linux host, QEMU vm, arm64 kernel](setup_linux-host_qemu-vm_arm64-kernel.md)
- [Setup: Linux host, Android device, arm64 kernel](setup_linux-host_android-device_arm64-kernel.md)
- [Setup: Linux isolated host](setup_linux-host_isolated.md)
## Install

View File

@ -1,13 +1,7 @@
# How to install syzkaller
# How to set up syzkaller
Generic setup instructions for fuzzing Linux kernel are outlined [here](linux/setup.md).
Instructions for a particular VM or kernel arch can be found on these pages:
- [Setup: Ubuntu host, QEMU vm, x86-64 kernel](linux/setup_ubuntu-host_qemu-vm_x86-64-kernel.md)
- [Setup: Ubuntu host, Odroid C2 board, arm64 kernel](linux/setup_ubuntu-host_odroid-c2-board_arm64-kernel.md)
- [Setup: Linux host, QEMU vm, arm64 kernel](linux/setup_linux-host_qemu-vm_arm64-kernel.md)
- [Setup: Linux host, Android device, arm64 kernel](linux/setup_linux-host_android-device_arm64-kernel.md)
- [Setup: Linux isolated host](linux/setup_linux-host_isolated.md)
For other OS kernels check: [Akaros](/docs/akaros.md), [FreeBSD](/docs/freebsd.md), [Fuchsia](/docs/fuchsia.md), [NetBSD](/docs/netbsd.md), [Windows](/docs/windows.md).
After following these instructions you should be able to run `syz-manager`, see it executing programs and be able to access statistics exposed at `http://127.0.0.1:56741`:
@ -26,6 +20,10 @@ $ ./bin/syz-manager -config=my.cfg
2017/06/14 16:40:35 executed 15504, cover 132403, crashes 0, repro 0
```
At this point it's important to ensure that syzkaller is able to collect code coverage of the executed programs
(unless you specified `"cover": false` in the config or coverage is not yet supported for the kernel you're fuzzing).
The `cover` counter on the web page should be non zero.
More information on the configuration file format is available [here](configuration.md).
See [this page](troubleshooting.md) for troubleshooting tips.

View File

@ -11,9 +11,6 @@ The `syz-manager` process will wind up VMs and start fuzzing in them.
The `-config` command line option gives the location of the configuration file, which is [described here](configuration.md).
Found crashes, statistics and other information is exposed on the HTTP address specified in the manager config.
At this point it's important to ensure that syzkaller is able to collect code coverage of the executed programs (unless you specified `"cover": false` in the config).
The `cover` counter on the web page should be non zero.
## Crashes
Once syzkaller detected a kernel crash in one of the VMs, it will automatically start the process of reproducing this crash (unless you specified `"reproduce": false` in the config).