Skip to content

Target Support Matrix

Mayhem combines multiple analysis techniques, including fuzz testing and symbolic execution to maximize code coverage when testing binary executables (Mayhem targets). Mayhem supports instrumented and un-instrumented targets across a variety of architectures, operating systems and languages.

Here we will detail the technical specifications for targets supported by Mayhem and the system requirements for using Mayhem.

Overview

Mayhem analysis supports the following:

  • Base-executable Targets: Binary executables compiled without special compilation options or modifications (i.e. uninstrumented).
  • Instrumented Targets: Binary executables compiled with instrumentation using fuzzers such as AFL, libFuzzer, or honggfuzz.
  • Triage & Diagnosis: The process of identifying defects in targets triggered by test cases input via fuzzing.

Base-executable Windows Targets

Mayhem analyzes unmodified Linux or Windows binary targets (machine code) that are runnable within user-space and take inputs from a single file descriptor or TCP/UDP socket.

Base-executable Target Support
Architectures x86_64, x86, ARM (ARMv4t through ARMv8), MIPS, PowerPC
Reads from stdin, file, TCP, UDP, Unix domain sockets
Defects Mayhem detects when a test case triggers a defect arising from:
  1. assert violations
  2. memory safety violations
  3. uncaught unix signals
See the Triage & Diagnosis section for a list of CWE
(Common Weakness Enumeration) defect types Mayhem finds.
Special Support Mayhem auto-detects targets written in Golang and Rust to find unhandled panics.

Instrumented Targets

Mayhem supports existing instrumentation created with AFL/AFL++, honggfuzz, and libFuzzer. Mayhem supports Windows targets instrumented with libFuzzer as well. Languages supported by these fuzzers include clang-supported languages, Golang, and Rust.

Info

The minimum supported libFuzzer version required by Mayhem is LLVM 5.0.

Instrumented Target Support
Architectures x86_64, x86
Fuzzer Base-executable3 AFL/AFL++4 honggfuzz5 libFuzzer6
dictionary ✓ ✓7 ✓ ✓
max_length ✓ ✓ ✓ ✓
sanitizers ✓ ✓ ✓ ✓

Triage & Diagnosis

All test cases discovered by Mayhem go through a triaging phase.

Basic Triage

Basic Triage always runs on a target. It ensures reported defects are reproducible and attaches metadata such as a stack trace, disassembly, signal number and crash type to each defect. Mayhem is also able to recognize many common crash types and attach a CWE (Common Weakness Enumeration) number, if applicable.

CWEs detected by Basic Triage:

Advanced Triage

Advanced Triage, when enabled, runs additional analysis to find defects that do not raise a UNIX signal, such as memory leaks or using an uninitialized variable.

In order to support Advanced Triage, a target must be linked against glibc. Targets that link against other libc variants (or no libc at all) are not supported. In addition, Advanced Triage requires a target that has no instrumentation.

Advanced Triage Support
Architectures Support
x86_64, x86 ✓
ARM
MIPS
PowerPC

CWEs detected by Advanced Triage (In addition to Basic Triage):

Important

Make sure the advanced_triage option for the Mayhemfile is set to true.

Sanitizers

Sanitizers (such as ASAN) can be added to a program at compile time. They add checks that allow Mayhem to detect many more kinds of defects including defects that may not result in an immediate crash.

Mayhem works with targets compiled with the ASAN, UBSAN, LSAN, and MSAN sanitizer flags.

Note

MSAN sanitizer targets may allocate memory at ranges not permitted by our memory sandbox. If you are affected by such an issue and are unable to move the memory allocation, please reach out to support@forallsecure.com.

CWEs detected by Sanitizers (In addition to Basic Triage):

Full CWE Hierarchy

Info

The following hierarchical CWE list is classified accordingly:

Full CWE Hierarchy

Web Console

The Mayhem Web Console supports Chrome, Firefox, and Microsoft Edge browsers.

CLI

The mayhem CLI is the main tool for programmatically interacting with a Mayhem installation. Below is a list of all supported environments where the mayhem command can be run:

CLI Support Matrix
Operating System Architectures System Requirements
Linux x86_64 None (statically linked binary)
macOS x86_64 macOS >= 10.13
Windows x86_64 Windows 10+

API

Mayhem releases are backwards compatible for API users of the same major release (e.g. Mayhem 1.x clients of the API should not break when used with a Mayhem 1.x server). The Mayhem API uses semantic versioning.

In the event of a new major release (e.g., Mayhem 2.x), we will advertise in advance any changes that may affect compatibility for API users.