WARNING: this is just an unsorted collection of notes currently.
Are there any public syzkaller instances?
How to manually run a ``Syz repro``?
- install a few packages: go, gcc, gmake, and whatever comes along with it
run go get -u github.com/google/syzkaller
- Once the build finished successfully:
put the Syz repro output into a file (I call it x).
you may want to play with -procs <n> -repeat <n|0> -stdout -debug
also note the head of the Syz repro output has options encoded already
How do I add a new system call?
- pkg install llvm, to get clang-format
- add a description of the system call to sys/freebsd/*.txt (start a new file if appropriate, e.g., capsicum.txt for Capsicum-related system calls)
from the root of the syzkaller source tree, run gmake extract SOURCEDIR=/usr/src
recreate automatically generated syscall definition files: gmake generate
rebuild syzkaller: gmake
echo 'dumpdev="NO"' >> /etc/rc.conf
# cat /etc/dhclient-exit-hooks if [ "$reason" = BOUND ] || \ [ "$reason" = REBOOT ] || \ [ -z "$old_ip_address" ] || \ [ "$old_ip_address" != "$new_ip_address" ]; then dumpon -s 169.254.0.1 -c $new_ip_address $interface fi