What is FuzzedDataProvider?

It is a helper class used in C++ fuzzing to easily extract structured data (like integers, floats, and strings) from a raw byte stream provided by the fuzzer.

Which languages are supported by this skill?

This skill provides specific patterns and examples for C, C++, and Rust, which are the most common languages for high-performance fuzzing.

How does this help with security audits?

It guides you in creating harnesses that reach deep code paths and handle edge cases, making it easier to discover memory corruption and logical vulnerabilities.

What is a fuzzing harness?

A harness is the entrypoint function that receives random data from a fuzzer and routes it to the system under test (SUT) to find bugs and vulnerabilities.

Can I use this for structure-aware fuzzing?

Yes, it includes patterns for using the 'arbitrary' crate in Rust and guidance for using Protocol Buffers to fuzz highly structured data formats.

Fuzzing Harness Writing

Name: Fuzzing Harness Writing
Author: trailofbits

bytrailofbits

•

938

•

Security & Testing

Provides expert guidance and implementation patterns for creating effective fuzzing harnesses across multiple programming languages.

This skill empowers security researchers and developers to build high-quality fuzzing harnesses that bridge the gap between random data generation and target APIs. It offers specialized patterns for C++, Rust, and structure-aware fuzzing, ensuring high code coverage, determinism, and reproducible crash discovery. By following these established implementation patterns, users can more effectively identify memory leaks, logic errors, and security vulnerabilities in complex parsers and protocol handlers.

Key Features

01Structured input extraction using FuzzedDataProvider patterns

02Techniques for performance optimization and crash reproducibility

03Implementation guides for interleaved and structure-aware fuzzing

04938 GitHub stars

05Cross-language support for C, C++, and Rust fuzzing targets

06Best practices for ensuring determinism and resetting global state

Use Cases

01Building a new fuzzing entry point for a complex file format parser

02Converting raw byte streams into typed data for API-level security testing

03Improving code coverage in an existing security audit or vulnerability research project

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add trailofbits/skills harness-writing

For use in Claude.ai and ChatGPT

Download Skill