syzkaller

WARNING: this is just an unsorted collection of notes currently.

1. syzbot (crash report mailing list)
2. <more private ones run by some>

1. install a few packages: go, gcc, gmake, and whatever comes along with it
2. run go get -u github.com/google/syzkaller
3. cd ~/go/src/github.com/google/syzkaller
4. gmake
5. Once the build finished successfully:
6. bin/freebsd_amd64
7. put the Syz repro output into a file (I call it x).
8. ./syz-execprog x
   • you may want to play with -procs <n> -repeat <n|0> -stdout -debug
   • also note the head of the Syz repro output has options encoded already

1. add a description of the system call to sys/freebsd/*.txt (start a new file if appropriate, e.g., capsicum.txt for Capsicum-related system calls)
2. from the root of the syzkaller source tree, run gmake extract SOURCEDIR=/usr/src
3. recreate automatically generated syscall definition files: gmake generate
4. rebuild syzkaller: gmake

Step 1 may be non-trivial depending on the complexity of the system call interface in question. The syzkaller repo contains some pages describing the syscall description language: 1, 2.