AI-Assisted Fuzzing Harness Generation with a Local LLM

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://8ksec.io/ai-assisted-fuzzing-harness-local-llm
• Blog Title: AI-Assisted Fuzzing Harness Generation with a Local LLM
• Suggested Section: Generic Methodologies & Resources > Fuzzing Methodology > AI Assisted Fuzzing And Vulnerability Discovery

🎯 Content Summary

Overview

The post presents a reproducible, offline workflow for using a local large language model to draft C/C++ fuzzing harnesses. The open-weights model qwen3.6:35b-a3b runs locally through Ollama, generates a minimal libFuzzer harness for a C record parser, and helps produce structured harnesses, seed corpora, dictionaries, sanitizer builds, and coverage-driven revisions. The actual vulnerability discovery remains the res...

🔧 Technical Details

AI-assisted fuzzing harness generation: Provide a local code model with the exact target declaration and require a minimal LLVMFuzzerTestOneInput(const uint8_t *data, size_t size). Compare the generated declaration and call with the real header, make the harness deterministic, remove I/O and persistent state, guard every read from the fuzz buffer, and verify target execution through coverage. The model generates glue and supporting artifacts; coverage-guided mutation finds inputs, and sanitizers detect defects.

Finding unvalidated length-field vulnerabilities: Identify parsers where attacker-controlled lengths reach memcpy, memmove, allocation sizes, pointer arithmetic, array indexes, or loops without being compared against both destination capacity and remaining source bytes. In the demonstrated pattern, an 8-bit len controls memcpy(value, ..., len) while value is 1...

🤖 Agent Actions

Plan:

1. Inspect the repository’s fuzzing and AI documentation, reading at least five relevant pages and checking for duplication.
2. Select one existing page (or, only if necessary, create a properly linked AI-section page) and verify source details against primary documentation.
3. Implement a concise, cited addition, then review the diff and run targeted Markdown/link checks.
   Repository discovery found an existing dedicated page, src/AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.md, plus the general fuzzing methodology. I’m now comparing that page against adjacent AI, fuzzing, sanitizer, and parser-fuzzing documentation before deciding whether anything is genuinely missing.
   The dedicated AI page covers LLM seed/grammar generation but not the blog’s key missing technique: reviewed generation of deterministic, structure-aware LLVMFuzzerTestOneInput adapters, coupled to sanitizer builds and an iterative source-coverage feedback loop. I’ll add that workflow to this existing AI page only, avoiding duplication of the generic fuzzing page’s deeper AFL++ material.
   The existing page has now been extended in place with the missing local-harness workflow, dual structure-aware target strategy, reviewed seed/dictionary generation, sanitizer builds, and a coverage-driven LLM revision loop. I’m validating the diff, citation numbering, heading order, and repository build tooling now.
   Validation has confirmed contiguous citations and a clean diff; the repository lacks both mdbook and clang++, so I’m using structural Markdown checks, internal-link resolution, and source URL checks as the available verification path.
   Updated:

src/AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.md

Added:

• Local-LLM libFuzzer harness generation and review workflow.
• Minimal and structure-aware harness examples.
• Separate valid-structure and malformed-metadata strategies.
• Seed corpus, dictionary, sanitizer, and coverage commands.
• Coverage-driven LLM refinement loop.
• References to LLVM, OSS-Fuzz-Gen, Google research, and the 8kSec article.

Validation passed for Markdown structure, citations, internal links, source URLs, and git diff --check. mdbook and clang++ were unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://8ksec.io/ai-assisted-fuzzing-harness-local-llm

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Fuzzing Methodology > AI Assisted Fuzzing And Vulnerability Discovery".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0