[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DSPSSA062G6CKHFHXGTPND":3,"skill-same:01M6DSPSSA062G6CKHFHXGTPND":51},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":33,"repositoryHtmlUrl":34,"repositoryHomepageUrl":6,"ownerHtmlUrl":35,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":36,"install":37,"resources":50},"01M6DSPSSA062G6CKHFHXGTPND","ruzzy",null,"Ruzzy is a coverage-guided Ruby fuzzer by Trail of Bits. Use for fuzzing pure Ruby code and Ruby C extensions.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fruzzy\u002FSKILL.md",[],[5,18,19,20,21,22,23,24],"fuzzer","fuzzing","code","coverage-guided","ruby","coverage","use","2026-11-10 10:12:30",false,"---\nname: ruzzy\ntype: fuzzer\ndescription: >\n  Ruzzy is a coverage-guided Ruby fuzzer by Trail of Bits.\n  Use for fuzzing pure Ruby code and Ruby C extensions.\n---\n\n# Ruzzy\n\nRuzzy is a coverage-guided fuzzer for Ruby built on libFuzzer. It enables fuzzing both pure Ruby code and Ruby C extensions with sanitizer support for detecting memory corruption and undefined behavior.\n\n## When to Use\n\nRuzzy is currently the only production-ready coverage-guided fuzzer for Ruby.\n\n**Choose Ruzzy when:**\n- Fuzzing Ruby applications or libraries\n- Testing Ruby C extensions for memory safety issues\n- You need coverage-guided fuzzing for Ruby code\n- Working with Ruby gems that have native extensions\n\n## Quick Start\n\nSet up environment:\n```bash\nexport ASAN_OPTIONS=\"allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0\"\n```\n\nTest with the included toy example:\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby -e 'require \"ruzzy\"; Ruzzy.dummy'\n```\n\nThis should quickly find a crash demonstrating that Ruzzy is working correctly.\n\n## Installation\n\n### Platform Support\n\nRuzzy supports Linux x86-64 and AArch64\u002FARM64. For macOS or Windows, use the [Dockerfile](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy\u002Fblob\u002Fmain\u002FDockerfile) or [development environment](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy#developing).\n\n### Prerequisites\n\n- Linux x86-64 or AArch64\u002FARM64\n- Recent version of clang (tested back to 14.0.0, latest release recommended)\n- Ruby with gem installed\n\n### Installation Command\n\nInstall Ruzzy with clang compiler flags:\n\n```bash\nMAKE=\"make --environment-overrides V=1\" \\\nCC=\"\u002Fpath\u002Fto\u002Fclang\" \\\nCXX=\"\u002Fpath\u002Fto\u002Fclang++\" \\\nLDSHARED=\"\u002Fpath\u002Fto\u002Fclang -shared\" \\\nLDSHAREDXX=\"\u002Fpath\u002Fto\u002Fclang++ -shared\" \\\n    gem install ruzzy\n```\n\n**Environment variables explained:**\n- `MAKE`: Overrides make to respect subsequent environment variables\n- `CC`, `CXX`, `LDSHARED`, `LDSHAREDXX`: Ensure proper clang binaries are used for latest features\n\n### Troubleshooting Installation\n\nIf installation fails, enable debug output:\n\n```bash\nRUZZY_DEBUG=1 gem install --verbose ruzzy\n```\n\n### Verification\n\nVerify installation by running the toy example (see Quick Start section).\n\n## Writing a Harness\n\n### Fuzzing Pure Ruby Code\n\nPure Ruby fuzzing requires two scripts due to Ruby interpreter implementation details.\n\n**Tracer script (`test_tracer.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'ruzzy'\n\nRuzzy.trace('test_harness.rb')\n```\n\n**Harness script (`test_harness.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'ruzzy'\n\ndef fuzzing_target(input)\n  # Your code to fuzz here\n  if input.length == 4\n    if input[0] == 'F'\n      if input[1] == 'U'\n        if input[2] == 'Z'\n          if input[3] == 'Z'\n            raise\n          end\n        end\n      end\n    end\n  end\nend\n\ntest_one_input = lambda do |data|\n  fuzzing_target(data)\n  return 0\nend\n\nRuzzy.fuzz(test_one_input)\n```\n\nRun with:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby test_tracer.rb\n```\n\n### Fuzzing Ruby C Extensions\n\nC extensions can be fuzzed with a single harness file, no tracer needed.\n\n**Example harness for msgpack (`fuzz_msgpack.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'msgpack'\nrequire 'ruzzy'\n\ntest_one_input = lambda do |data|\n  begin\n    MessagePack.unpack(data)\n  rescue Exception\n    # We're looking for memory corruption, not Ruby exceptions\n  end\n  return 0\nend\n\nRuzzy.fuzz(test_one_input)\n```\n\nRun with:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby fuzz_msgpack.rb\n```\n\n### Harness Rules\n\n| Do | Don't |\n|----|-------|\n| Catch Ruby exceptions if testing C extensions | Let Ruby exceptions crash the fuzzer |\n| Return 0 from test_one_input lambda | Return other values |\n| Keep harness deterministic | Use randomness or time-based logic |\n| Use tracer script for pure Ruby | Skip tracer for pure Ruby code |\n\n> **See Also:** For detailed harness writing techniques, patterns for handling complex inputs,\n> and advanced strategies, see the **fuzz-harness-writing** technique skill.\n\n## Compilation\n\n### Installing Gems with Sanitizers\n\nWhen installing Ruby gems with C extensions for fuzzing, compile with sanitizer flags:\n\n```bash\nMAKE=\"make --environment-overrides V=1\" \\\nCC=\"\u002Fpath\u002Fto\u002Fclang\" \\\nCXX=\"\u002Fpath\u002Fto\u002Fclang++\" \\\nLDSHARED=\"\u002Fpath\u002Fto\u002Fclang -shared\" \\\nLDSHAREDXX=\"\u002Fpath\u002Fto\u002Fclang++ -shared\" \\\nCFLAGS=\"-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -fno-common -fPIC -g\" \\\nCXXFLAGS=\"-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -fno-common -fPIC -g\" \\\n    gem install \u003Cgem-name>\n```\n\n### Build Flags\n\n| Flag | Purpose |\n|------|---------|\n| `-fsanitize=address,fuzzer-no-link` | Enable AddressSanitizer and fuzzer instrumentation |\n| `-fno-omit-frame-pointer` | Improve stack trace quality |\n| `-fno-common` | Better compatibility with sanitizers |\n| `-fPIC` | Position-independent code for shared libraries |\n| `-g` | Include debug symbols |\n\n## Running Campaigns\n\n### Environment Setup\n\nBefore running any fuzzing campaign, set ASAN_OPTIONS:\n\n```bash\nexport ASAN_OPTIONS=\"allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0\"\n```\n\n**Options explained:**\n1. `allocator_may_return_null=1`: Skip common low-impact allocation failures (DoS)\n2. `detect_leaks=0`: Ruby interpreter leaks data, ignore these for now\n3. `use_sigaltstack=0`: Ruby recommends disabling sigaltstack with ASan\n\n### Basic Run\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb\n```\n\n**Note:** `LD_PRELOAD` is required for sanitizer injection. Unlike `ASAN_OPTIONS`, do not export it as it may interfere with other programs.\n\n### With Corpus\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb \u002Fpath\u002Fto\u002Fcorpus\n```\n\n### Passing libFuzzer Options\n\nAll libFuzzer options can be passed as arguments:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb \u002Fpath\u002Fto\u002Fcorpus -max_len=1024 -timeout=10\n```\n\nSee [libFuzzer options](https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html#options) for full reference.\n\n### Reproducing Crashes\n\nRe-run a crash case by passing the crash file:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb .\u002Fcrash-253420c1158bc6382093d409ce2e9cff5806e980\n```\n\n### Interpreting Output\n\n| Output | Meaning |\n|--------|---------|\n| `INFO: Running with entropic power schedule` | Fuzzing campaign started |\n| `ERROR: AddressSanitizer: heap-use-after-free` | Memory corruption detected |\n| `SUMMARY: libFuzzer: fuzz target exited` | Ruby exception occurred |\n| `artifact_prefix='.\u002F'; Test unit written to .\u002Fcrash-*` | Crash input saved |\n| `Base64: ...` | Base64 encoding of crash input |\n\n## Sanitizer Integration\n\n### AddressSanitizer (ASan)\n\nRuzzy includes a pre-compiled AddressSanitizer library:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb\n```\n\nUse ASan for detecting:\n- Heap buffer overflows\n- Stack buffer overflows\n- Use-after-free\n- Double-free\n- Memory leaks (disabled by default in Ruzzy)\n\n### UndefinedBehaviorSanitizer (UBSan)\n\nRuzzy also includes UBSan:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::UBSAN_PATH') \\\n    ruby harness.rb\n```\n\nUse UBSan for detecting:\n- Signed integer overflow\n- Null pointer dereferences\n- Misaligned memory access\n- Division by zero\n\n### Common Sanitizer Issues\n\n| Issue | Solution |\n|-------|----------|\n| Ruby interpreter leak warnings | Use `ASAN_OPTIONS=detect_leaks=0` |\n| Sigaltstack conflicts | Use `ASAN_OPTIONS=use_sigaltstack=0` |\n| Allocation failure spam | Use `ASAN_OPTIONS=allocator_may_return_null=1` |\n| LD_PRELOAD interferes with tools | Don't export it; set inline with ruby command |\n\n> **See Also:** For detailed sanitizer configuration, common issues, and advanced flags,\n> see the **address-sanitizer** and **undefined-behavior-sanitizer** technique skills.\n\n## Real-World Examples\n\n### Example: msgpack-ruby\n\nFuzzing the msgpack MessagePack parser for memory corruption.\n\n**Install with sanitizers:**\n\n```bash\nMAKE=\"make --environment-overrides V=1\" \\\nCC=\"\u002Fpath\u002Fto\u002Fclang\" \\\nCXX=\"\u002Fpath\u002Fto\u002Fclang++\" \\\nLDSHARED=\"\u002Fpath\u002Fto\u002Fclang -shared\" \\\nLDSHAREDXX=\"\u002Fpath\u002Fto\u002Fclang++ -shared\" \\\nCFLAGS=\"-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -fno-common -fPIC -g\" \\\nCXXFLAGS=\"-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -fno-common -fPIC -g\" \\\n    gem install msgpack\n```\n\n**Harness (`fuzz_msgpack.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'msgpack'\nrequire 'ruzzy'\n\ntest_one_input = lambda do |data|\n  begin\n    MessagePack.unpack(data)\n  rescue Exception\n    # We're looking for memory corruption, not Ruby exceptions\n  end\n  return 0\nend\n\nRuzzy.fuzz(test_one_input)\n```\n\n**Run:**\n\n```bash\nexport ASAN_OPTIONS=\"allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0\"\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby fuzz_msgpack.rb\n```\n\n### Example: Pure Ruby Target\n\nFuzzing pure Ruby code with a custom parser.\n\n**Tracer (`test_tracer.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'ruzzy'\n\nRuzzy.trace('test_harness.rb')\n```\n\n**Harness (`test_harness.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'ruzzy'\nrequire_relative 'my_parser'\n\ntest_one_input = lambda do |data|\n  begin\n    MyParser.parse(data)\n  rescue StandardError\n    # Expected exceptions from malformed input\n  end\n  return 0\nend\n\nRuzzy.fuzz(test_one_input)\n```\n\n**Run:**\n\n```bash\nexport ASAN_OPTIONS=\"allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0\"\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby test_tracer.rb\n```\n\n## Troubleshooting\n\n| Problem | Cause | Solution |\n|---------|-------|----------|\n| Installation fails | Wrong clang version or path | Verify clang path, use clang 14.0.0+ |\n| `cannot open shared object file` | LD_PRELOAD not set | Set LD_PRELOAD inline with ruby command |\n| Fuzzer immediately exits | Missing corpus directory | Create corpus directory or pass as argument |\n| No coverage progress | Pure Ruby needs tracer | Use tracer script for pure Ruby code |\n| Leak detection spam | Ruby interpreter leaks | Set `ASAN_OPTIONS=detect_leaks=0` |\n| Installation debug needed | Compilation errors | Use `RUZZY_DEBUG=1 gem install --verbose ruzzy` |\n\n## Related Skills\n\n### Technique Skills\n\n| Skill | Use Case |\n|-------|----------|\n| **fuzz-harness-writing** | Detailed guidance on writing effective harnesses |\n| **address-sanitizer** | Memory error detection during fuzzing |\n| **undefined-behavior-sanitizer** | Detecting undefined behavior in C extensions |\n| **libfuzzer** | Understanding libFuzzer options (Ruzzy is built on libFuzzer) |\n\n### Related Fuzzers\n\n| Skill | When to Consider |\n|-------|------------------|\n| **libfuzzer** | When fuzzing Ruby C extension code directly in C\u002FC++ |\n| **aflpp** | Alternative approach for fuzzing Ruby by instrumenting Ruby interpreter |\n\n## Resources\n\n### Key External Resources\n\n**[Introducing Ruzzy, a coverage-guided Ruby fuzzer](https:\u002F\u002Fblog.trailofbits.com\u002F2024\u002F03\u002F29\u002Fintroducing-ruzzy-a-coverage-guided-ruby-fuzzer\u002F)**\nOfficial Trail of Bits blog post announcing Ruzzy, covering motivation, architecture, and initial results.\n\n**[Ruzzy GitHub Repository](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy)**\nSource code, additional examples, and development instructions.\n\n**[libFuzzer Documentation](https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html)**\nSince Ruzzy is built on libFuzzer, understanding libFuzzer options and behavior is valuable.\n\n**[Fuzzing Ruby C extensions](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy#fuzzing-ruby-c-extensions)**\nDetailed guide on fuzzing C extensions with compilation flags and examples.\n\n**[Fuzzing pure Ruby code](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy#fuzzing-pure-ruby-code)**\nDetailed guide on the tracer pattern required for pure Ruby fuzzing.\n","# Ruzzy\n\nRuzzy is a coverage-guided fuzzer for Ruby built on libFuzzer. It enables fuzzing both pure Ruby code and Ruby C extensions with sanitizer support for detecting memory corruption and undefined behavior.\n\n## When to Use\n\nRuzzy is currently the only production-ready coverage-guided fuzzer for Ruby.\n\n**Choose Ruzzy when:**\n- Fuzzing Ruby applications or libraries\n- Testing Ruby C extensions for memory safety issues\n- You need coverage-guided fuzzing for Ruby code\n- Working with Ruby gems that have native extensions\n\n## Quick Start\n\nSet up environment:\n```bash\nexport ASAN_OPTIONS=\"allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0\"\n```\n\nTest with the included toy example:\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby -e 'require \"ruzzy\"; Ruzzy.dummy'\n```\n\nThis should quickly find a crash demonstrating that Ruzzy is working correctly.\n\n## Installation\n\n### Platform Support\n\nRuzzy supports Linux x86-64 and AArch64\u002FARM64. For macOS or Windows, use the [Dockerfile](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy\u002Fblob\u002Fmain\u002FDockerfile) or [development environment](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy#developing).\n\n### Prerequisites\n\n- Linux x86-64 or AArch64\u002FARM64\n- Recent version of clang (tested back to 14.0.0, latest release recommended)\n- Ruby with gem installed\n\n### Installation Command\n\nInstall Ruzzy with clang compiler flags:\n\n```bash\nMAKE=\"make --environment-overrides V=1\" \\\nCC=\"\u002Fpath\u002Fto\u002Fclang\" \\\nCXX=\"\u002Fpath\u002Fto\u002Fclang++\" \\\nLDSHARED=\"\u002Fpath\u002Fto\u002Fclang -shared\" \\\nLDSHAREDXX=\"\u002Fpath\u002Fto\u002Fclang++ -shared\" \\\n    gem install ruzzy\n```\n\n**Environment variables explained:**\n- `MAKE`: Overrides make to respect subsequent environment variables\n- `CC`, `CXX`, `LDSHARED`, `LDSHAREDXX`: Ensure proper clang binaries are used for latest features\n\n### Troubleshooting Installation\n\nIf installation fails, enable debug output:\n\n```bash\nRUZZY_DEBUG=1 gem install --verbose ruzzy\n```\n\n### Verification\n\nVerify installation by running the toy example (see Quick Start section).\n\n## Writing a Harness\n\n### Fuzzing Pure Ruby Code\n\nPure Ruby fuzzing requires two scripts due to Ruby interpreter implementation details.\n\n**Tracer script (`test_tracer.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'ruzzy'\n\nRuzzy.trace('test_harness.rb')\n```\n\n**Harness script (`test_harness.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'ruzzy'\n\ndef fuzzing_target(input)\n  # Your code to fuzz here\n  if input.length == 4\n    if input[0] == 'F'\n      if input[1] == 'U'\n        if input[2] == 'Z'\n          if input[3] == 'Z'\n            raise\n          end\n        end\n      end\n    end\n  end\nend\n\ntest_one_input = lambda do |data|\n  fuzzing_target(data)\n  return 0\nend\n\nRuzzy.fuzz(test_one_input)\n```\n\nRun with:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby test_tracer.rb\n```\n\n### Fuzzing Ruby C Extensions\n\nC extensions can be fuzzed with a single harness file, no tracer needed.\n\n**Example harness for msgpack (`fuzz_msgpack.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'msgpack'\nrequire 'ruzzy'\n\ntest_one_input = lambda do |data|\n  begin\n    MessagePack.unpack(data)\n  rescue Exception\n    # We're looking for memory corruption, not Ruby exceptions\n  end\n  return 0\nend\n\nRuzzy.fuzz(test_one_input)\n```\n\nRun with:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby fuzz_msgpack.rb\n```\n\n### Harness Rules\n\n| Do | Don't |\n|----|-------|\n| Catch Ruby exceptions if testing C extensions | Let Ruby exceptions crash the fuzzer |\n| Return 0 from test_one_input lambda | Return other values |\n| Keep harness deterministic | Use randomness or time-based logic |\n| Use tracer script for pure Ruby | Skip tracer for pure Ruby code |\n\n> **See Also:** For detailed harness writing techniques, patterns for handling complex inputs,\n> and advanced strategies, see the **fuzz-harness-writing** technique skill.\n\n## Compilation\n\n### Installing Gems with Sanitizers\n\nWhen installing Ruby gems with C extensions for fuzzing, compile with sanitizer flags:\n\n```bash\nMAKE=\"make --environment-overrides V=1\" \\\nCC=\"\u002Fpath\u002Fto\u002Fclang\" \\\nCXX=\"\u002Fpath\u002Fto\u002Fclang++\" \\\nLDSHARED=\"\u002Fpath\u002Fto\u002Fclang -shared\" \\\nLDSHAREDXX=\"\u002Fpath\u002Fto\u002Fclang++ -shared\" \\\nCFLAGS=\"-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -fno-common -fPIC -g\" \\\nCXXFLAGS=\"-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -fno-common -fPIC -g\" \\\n    gem install \u003Cgem-name>\n```\n\n### Build Flags\n\n| Flag | Purpose |\n|------|---------|\n| `-fsanitize=address,fuzzer-no-link` | Enable AddressSanitizer and fuzzer instrumentation |\n| `-fno-omit-frame-pointer` | Improve stack trace quality |\n| `-fno-common` | Better compatibility with sanitizers |\n| `-fPIC` | Position-independent code for shared libraries |\n| `-g` | Include debug symbols |\n\n## Running Campaigns\n\n### Environment Setup\n\nBefore running any fuzzing campaign, set ASAN_OPTIONS:\n\n```bash\nexport ASAN_OPTIONS=\"allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0\"\n```\n\n**Options explained:**\n1. `allocator_may_return_null=1`: Skip common low-impact allocation failures (DoS)\n2. `detect_leaks=0`: Ruby interpreter leaks data, ignore these for now\n3. `use_sigaltstack=0`: Ruby recommends disabling sigaltstack with ASan\n\n### Basic Run\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb\n```\n\n**Note:** `LD_PRELOAD` is required for sanitizer injection. Unlike `ASAN_OPTIONS`, do not export it as it may interfere with other programs.\n\n### With Corpus\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb \u002Fpath\u002Fto\u002Fcorpus\n```\n\n### Passing libFuzzer Options\n\nAll libFuzzer options can be passed as arguments:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb \u002Fpath\u002Fto\u002Fcorpus -max_len=1024 -timeout=10\n```\n\nSee [libFuzzer options](https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html#options) for full reference.\n\n### Reproducing Crashes\n\nRe-run a crash case by passing the crash file:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb .\u002Fcrash-253420c1158bc6382093d409ce2e9cff5806e980\n```\n\n### Interpreting Output\n\n| Output | Meaning |\n|--------|---------|\n| `INFO: Running with entropic power schedule` | Fuzzing campaign started |\n| `ERROR: AddressSanitizer: heap-use-after-free` | Memory corruption detected |\n| `SUMMARY: libFuzzer: fuzz target exited` | Ruby exception occurred |\n| `artifact_prefix='.\u002F'; Test unit written to .\u002Fcrash-*` | Crash input saved |\n| `Base64: ...` | Base64 encoding of crash input |\n\n## Sanitizer Integration\n\n### AddressSanitizer (ASan)\n\nRuzzy includes a pre-compiled AddressSanitizer library:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby harness.rb\n```\n\nUse ASan for detecting:\n- Heap buffer overflows\n- Stack buffer overflows\n- Use-after-free\n- Double-free\n- Memory leaks (disabled by default in Ruzzy)\n\n### UndefinedBehaviorSanitizer (UBSan)\n\nRuzzy also includes UBSan:\n\n```bash\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::UBSAN_PATH') \\\n    ruby harness.rb\n```\n\nUse UBSan for detecting:\n- Signed integer overflow\n- Null pointer dereferences\n- Misaligned memory access\n- Division by zero\n\n### Common Sanitizer Issues\n\n| Issue | Solution |\n|-------|----------|\n| Ruby interpreter leak warnings | Use `ASAN_OPTIONS=detect_leaks=0` |\n| Sigaltstack conflicts | Use `ASAN_OPTIONS=use_sigaltstack=0` |\n| Allocation failure spam | Use `ASAN_OPTIONS=allocator_may_return_null=1` |\n| LD_PRELOAD interferes with tools | Don't export it; set inline with ruby command |\n\n> **See Also:** For detailed sanitizer configuration, common issues, and advanced flags,\n> see the **address-sanitizer** and **undefined-behavior-sanitizer** technique skills.\n\n## Real-World Examples\n\n### Example: msgpack-ruby\n\nFuzzing the msgpack MessagePack parser for memory corruption.\n\n**Install with sanitizers:**\n\n```bash\nMAKE=\"make --environment-overrides V=1\" \\\nCC=\"\u002Fpath\u002Fto\u002Fclang\" \\\nCXX=\"\u002Fpath\u002Fto\u002Fclang++\" \\\nLDSHARED=\"\u002Fpath\u002Fto\u002Fclang -shared\" \\\nLDSHAREDXX=\"\u002Fpath\u002Fto\u002Fclang++ -shared\" \\\nCFLAGS=\"-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -fno-common -fPIC -g\" \\\nCXXFLAGS=\"-fsanitize=address,fuzzer-no-link -fno-omit-frame-pointer -fno-common -fPIC -g\" \\\n    gem install msgpack\n```\n\n**Harness (`fuzz_msgpack.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'msgpack'\nrequire 'ruzzy'\n\ntest_one_input = lambda do |data|\n  begin\n    MessagePack.unpack(data)\n  rescue Exception\n    # We're looking for memory corruption, not Ruby exceptions\n  end\n  return 0\nend\n\nRuzzy.fuzz(test_one_input)\n```\n\n**Run:**\n\n```bash\nexport ASAN_OPTIONS=\"allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0\"\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby fuzz_msgpack.rb\n```\n\n### Example: Pure Ruby Target\n\nFuzzing pure Ruby code with a custom parser.\n\n**Tracer (`test_tracer.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'ruzzy'\n\nRuzzy.trace('test_harness.rb')\n```\n\n**Harness (`test_harness.rb`):**\n\n```ruby\n# frozen_string_literal: true\n\nrequire 'ruzzy'\nrequire_relative 'my_parser'\n\ntest_one_input = lambda do |data|\n  begin\n    MyParser.parse(data)\n  rescue StandardError\n    # Expected exceptions from malformed input\n  end\n  return 0\nend\n\nRuzzy.fuzz(test_one_input)\n```\n\n**Run:**\n\n```bash\nexport ASAN_OPTIONS=\"allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0\"\nLD_PRELOAD=$(ruby -e 'require \"ruzzy\"; print Ruzzy::ASAN_PATH') \\\n    ruby test_tracer.rb\n```\n\n## Troubleshooting\n\n| Problem | Cause | Solution |\n|---------|-------|----------|\n| Installation fails | Wrong clang version or path | Verify clang path, use clang 14.0.0+ |\n| `cannot open shared object file` | LD_PRELOAD not set | Set LD_PRELOAD inline with ruby command |\n| Fuzzer immediately exits | Missing corpus directory | Create corpus directory or pass as argument |\n| No coverage progress | Pure Ruby needs tracer | Use tracer script for pure Ruby code |\n| Leak detection spam | Ruby interpreter leaks | Set `ASAN_OPTIONS=detect_leaks=0` |\n| Installation debug needed | Compilation errors | Use `RUZZY_DEBUG=1 gem install --verbose ruzzy` |\n\n## Related Skills\n\n### Technique Skills\n\n| Skill | Use Case |\n|-------|----------|\n| **fuzz-harness-writing** | Detailed guidance on writing effective harnesses |\n| **address-sanitizer** | Memory error detection during fuzzing |\n| **undefined-behavior-sanitizer** | Detecting undefined behavior in C extensions |\n| **libfuzzer** | Understanding libFuzzer options (Ruzzy is built on libFuzzer) |\n\n### Related Fuzzers\n\n| Skill | When to Consider |\n|-------|------------------|\n| **libfuzzer** | When fuzzing Ruby C extension code directly in C\u002FC++ |\n| **aflpp** | Alternative approach for fuzzing Ruby by instrumenting Ruby interpreter |\n\n## Resources\n\n### Key External Resources\n\n**[Introducing Ruzzy, a coverage-guided Ruby fuzzer](https:\u002F\u002Fblog.trailofbits.com\u002F2024\u002F03\u002F29\u002Fintroducing-ruzzy-a-coverage-guided-ruby-fuzzer\u002F)**\nOfficial Trail of Bits blog post announcing Ruzzy, covering motivation, architecture, and initial results.\n\n**[Ruzzy GitHub Repository](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy)**\nSource code, additional examples, and development instructions.\n\n**[libFuzzer Documentation](https:\u002F\u002Fllvm.org\u002Fdocs\u002FLibFuzzer.html)**\nSince Ruzzy is built on libFuzzer, understanding libFuzzer options and behavior is valuable.\n\n**[Fuzzing Ruby C extensions](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy#fuzzing-ruby-c-extensions)**\nDetailed guide on fuzzing C extensions with compilation flags and examples.\n\n**[Fuzzing pure Ruby code](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fruzzy#fuzzing-pure-ruby-code)**\nDetailed guide on the tracer pattern required for pure Ruby fuzzing.\n",{"name":5,"type":18,"description":7},"master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fsecurity\u002Fruzzy",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill ruzzy",{"tool":43,"command":44},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill ruzzy",{"tool":46,"command":47},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill ruzzy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fruzzy\u002FSKILL.md",true,[],[52,77,91,106,119,132],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":71,"publishedAt":25},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[58,63,66],{"categoryNo":59,"categoryName":60,"taxonomyType":61,"taxonomyTypeDesc":62},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":64,"categoryName":65,"taxonomyType":61,"taxonomyTypeDesc":62},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":67,"categoryName":68,"taxonomyType":69,"taxonomyTypeDesc":70},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[72,73,24,74,75,76],"writing skills","writing","editing","work","deployment",{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":85,"publishedAt":25},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[83,84],{"categoryNo":64,"categoryName":65,"taxonomyType":61,"taxonomyTypeDesc":62},{"categoryNo":67,"categoryName":68,"taxonomyType":69,"taxonomyTypeDesc":70},[86,87,73,88,89,24,20,90],"plans","writing plans","requirements","task","spec",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":99,"publishedAt":25},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[97,98],{"categoryNo":64,"categoryName":65,"taxonomyType":61,"taxonomyTypeDesc":62},{"categoryNo":67,"categoryName":68,"taxonomyType":69,"taxonomyTypeDesc":70},[100,101,102,103,104,105,73],"docs:write concisely","write","docs","read","Rules","documentation",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":25},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[108,113,114,115,116,117,118],"why","kaizen","issue","five whys","analysis","root cause analysis",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":25},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[126,127,128,129,20,130,131],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":138,"publishedAt":25},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[139,127,140,75,24,141,142,143],"verification before completion","commands","evidence","claim","complete"]