Fuzzilli

Fuzzilli is a coverage-guided fuzzer for dynamic language interpreters, based on a custom intermediate language, FuzzIL, which can be mutated and translated to JavaScript. It is aimed at finding bugs in JavaScript engines.

To use it, the source code of one of the supported engines, such as V8, SpiderMonkey or JavaScriptCore, is patched and compiled with coverage instrumentation, then Fuzzilli generates and mutates programs in FuzzIL and runs them in the engine. Working on an intermediate language keeps the generated programs syntactically and semantically meaningful. Several instances can be connected to fuzz in a distributed way.

Fuzzilli was started at Google Project Zero, is written in Swift, and is free and open source under the Apache 2.0 licence.