At Mozilla, we rely heavily on automation to increase our ability to fuzz Firefox and the components from which it is built. Our fuzzing team is constantly developing tools to help integrate new and existing capabilities into our workflow with a heavy emphasis on scaling. Today we would like to share Grizzly – a browser fuzzing framework that has enabled us to quickly and effectively deploy fuzzers at scale.
Grizzly was designed to allow fuzzer developers to focus solely on writing fuzzers and not worry about the overhead of creating tools and scripts to run them. It was created as a platform for our team to run internal and external fuzzers in a common way using shared tools. It is cross-platform and supports running multiple instances in parallel.
Grizzly is responsible for:
- managing the browser (via Target)
- launching
- terminating
- monitoring logs
- monitoring resource usage of the browser
- handling crashes, OOMs, hangs… etc
- managing the fuzzer/test case generator tool (via Adapter)
- setup and teardown of tool
- providing input for the tool (if necessary)
- creating test cases
- serving test cases
- reporting results
- basic crash deduplication is performed by default
- FuzzManager support is available (with advanced crash deduplication)
Grizzly is extensible by extending the “Target” or “Adapter” interface. Targets are used to add support for specific browsers. This is where the quirks and complexities of each browser are handled. See puppet_target.py for an example which uses FFPuppet to add support for Firefox. Adapters are used to add support for fuzzers. A basic functional example can be found here. See here for a slightly more advanced example that can be modified to support existing fuzzers.
Grizzly is primarily intended to support blackbox fuzzers. For a feedback driven fuzzing interface please see the libfuzzer fuzzing interface. Grizzly also has a test case reduction mode that can be used on crashes it finds.
For more information please checkout the README.md in the repository and the wiki. Feel free to ask questions on IRC in #fuzzing.