or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

advanced-features.mdcore-fuzzing.mddata-provider.mdindex.mdinstrumentation.md
tile.json

tessl/pypi-atheris

A coverage-guided fuzzer for Python and Python extensions based on libFuzzer

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/atheris@2.3.x

To install, run

npx @tessl/cli install tessl/pypi-atheris@2.3.0

index.mddocs/

Atheris

A coverage-guided Python fuzzing engine based on libFuzzer. Atheris enables fuzzing of Python code and native extensions, providing feedback-guided testing to discover bugs through automatic input generation and mutation.

Package Information

  • Package Name: atheris
  • Language: Python
  • Installation: pip install atheris
  • Supported Platforms: Linux (32-bit, 64-bit), Mac OS X
  • Python Versions: 3.6 - 3.11

Core Imports

import atheris

For specific functionality:

from atheris import Setup, Fuzz, FuzzedDataProvider
from atheris import instrument_imports, instrument_func, instrument_all

Basic Usage

#!/usr/bin/python3

import atheris
import sys

# Import libraries to fuzz within instrumentation context
with atheris.instrument_imports():
    import some_library

def TestOneInput(data):
    """Fuzzer entry point that receives random bytes from libFuzzer."""
    some_library.parse(data)

# Configure and start fuzzing
atheris.Setup(sys.argv, TestOneInput)
atheris.Fuzz()

Advanced usage with data provider:

import atheris
import sys

with atheris.instrument_imports():
    import target_module

def TestOneInput(data):
    fdp = atheris.FuzzedDataProvider(data)
    
    # Extract structured data from raw bytes
    length = fdp.ConsumeIntInRange(1, 100)
    text = fdp.ConsumeUnicodeNoSurrogates(length)
    flag = fdp.ConsumeBool()
    
    target_module.process(text, flag)

atheris.Setup(sys.argv, TestOneInput)
atheris.Fuzz()

Architecture

Atheris implements coverage-guided fuzzing through several key components:

  • libFuzzer Integration: Uses LLVM's libFuzzer engine for input generation, mutation, and coverage feedback
  • Bytecode Instrumentation: Dynamically patches Python bytecode to collect branch and comparison coverage
  • Import-time Instrumentation: Hooks module imports to automatically instrument loaded code
  • Native Extension Support: Instruments C/C++ extensions when built with appropriate compiler flags
  • Custom Mutators: Supports user-defined mutation strategies for domain-specific input generation

Capabilities

Core Fuzzing Functions

Essential functions for setting up and running the fuzzer, including configuration and execution control.

def Setup(args, test_one_input, internal_libfuzzer=None, custom_mutator=None, custom_crossover=None):
    """
    Configure the fuzzer with test function and options.
    
    Args:
        args (list): Command-line arguments (typically sys.argv)
        test_one_input (callable): Function that takes bytes and performs testing
        internal_libfuzzer (bool, optional): Use internal libfuzzer (auto-detected if None)
        custom_mutator (callable, optional): Custom mutation function
        custom_crossover (callable, optional): Custom crossover function
    
    Returns:
        list: Remaining command-line arguments after fuzzer consumption
    """

def Fuzz():
    """
    Start the fuzzing loop. Must call Setup() first.
    
    This function does not return - it runs until the fuzzer stops
    due to finding a crash, reaching run limits, or external termination.
    """

def Mutate(data, max_size):
    """
    Mutate input data using libFuzzer's built-in mutator.
    
    Args:
        data (bytes): Input data to mutate
        max_size (int): Maximum size of mutated output
    
    Returns:
        bytes: Mutated data
    """

Core Fuzzing

Data Provider

Utilities for converting raw fuzzer bytes into structured data types for more effective testing.

class FuzzedDataProvider:
    """Converts raw fuzzer bytes into various data types."""
    
    def __init__(self, input_bytes: bytes):
        """Initialize with raw fuzzer input."""
    
    def ConsumeBytes(self, count: int) -> bytes:
        """Consume count bytes from the input."""
    
    def ConsumeInt(self, byte_size: int) -> int:
        """Consume a signed integer of specified byte size."""
    
    def ConsumeIntInRange(self, min_val: int, max_val: int) -> int:
        """Consume an integer in the range [min_val, max_val]."""
    
    def ConsumeBool(self) -> bool:
        """Consume either True or False."""

Data Provider

Code Instrumentation

Functions for adding coverage instrumentation to Python code at import-time, runtime, or globally.

def instrument_imports(include=None, exclude=None, enable_loader_override=True):
    """
    Context manager that instruments Python modules imported within the context.
    
    Args:
        include (list, optional): Module names to include
        exclude (list, optional): Module names to exclude
        enable_loader_override (bool): Enable custom loader instrumentation
    
    Returns:
        Context manager for instrumented imports
    """

def instrument_func(func):
    """
    Decorator that instruments a specific Python function.
    
    Args:
        func (callable): Function to instrument
    
    Returns:
        callable: Instrumented function
    """

def instrument_all():
    """Instrument all currently loaded Python functions."""

Code Instrumentation

Advanced Features

Hook management, custom mutators, and specialized instrumentation for regex and string operations.

# Hook management
enabled_hooks = EnabledHooks()  # Global hook manager

def gen_match(pattern):
    """
    Generate a string that matches a regex pattern.
    
    Args:
        pattern (str or bytes): Regular expression pattern
    
    Returns:
        str or bytes: String that matches the pattern
    """

def path() -> str:
    """
    Get the path to the Atheris installation directory.
    
    Returns:
        str: Path to the directory containing Atheris files
    """

# Constants
ALL_REMAINING: int  # Special value for FuzzedDataProvider to consume all remaining bytes

Advanced Features

Types

class EnabledHooks:
    """Manages the set of enabled instrumentation hooks."""
    
    def add(self, hook: str) -> None:
        """
        Enable a specific hook.
        
        Args:
            hook (str): Hook name ('RegEx' or 'str')
        """
    
    def __contains__(self, hook: str) -> bool:
        """
        Check if a hook is enabled.
        
        Args:
            hook (str): Hook name to check
            
        Returns:
            bool: True if the hook is enabled
        """