# Autarkie - Instant Grammar Fuzzing Using Rust Macros
 <img align="right" src="image.jpeg" alt="LibAFL logo" width="250" heigh="250">

Autarkie is a native grammar fuzzer built in Rust. Using procedural macros, it (almost completely) automatically creates a grammar fuzzer. 
Autarkie is heavily inspired by [nautilus](https://github.com/nautilus-fuzz/nautilus).

# Features
- Essentially a drop-in replacement for [arbitrary](https://github.com/rust-fuzz/arbitrary)
- Actual grammar fuzzing - not "structure aware"
- Supports both AFL++ (Forkserver) and cargo-fuzz (Inprocess).
- As long as the grammar is defined using Rust, you can fuzz C/C++ too (using AFL++ forkserver)
- Really easy to use, complexity is abstracted for you.
- Trivial to integrate with other fuzzers.

# Niche features
Autarkie has several features that other grammar fuzzers do not have:
- No grammar maintenance; because the grammar is part of the code, if the project is updated, the grammar updates too.
- Grammar is completely exhaustive; the compiler will make sure that every necessary type is included. No more guesswork.
- Corpus is re-usable. If you stop the fuzzer, you can re-start it and it will be able to re-use the corpus!
- Can learn from other fuzzers! ``use -F to sync``
- Has native [cmplog](https://www.ndss-symposium.org/ndss-paper/redqueen-fuzzing-with-input-to-state-correspondence/) support.

# How to Use
There are two main walkthroughs:
1. Fuzz AFL++ instrumented C/C++ project

This example fuzzes ``sqlite3`` by using grammar defined in [datafusion-sqlparser-rs](https://github.com/apache/datafusion-sqlparser-rs). 
Personal favourite as it shows Autarkie's magic: you can build a highly sophisticated grammar fuzzer covering a language as complex as SQL in under 5 minutes.
This example also shows how you can render the internal structure into a different format for the harness

[Go to the walkthrough](guides/sql.md)


2. Fuzz a Rust project using cargo-fuzz

This example fuzzes Solana's ``sbpf`` interpreter which is implemented in Rust. Autarkie has ``cargo-fuzz`` integration, so it is trivial to fuzz native Rust projects.

[Go to the walkthrough](guides/rbpf.md)


# Limitations and Caveats
### Beta
Autarkie is in beta - expect issues, do not tread lightly. 

### Static Lifetimes
The type MUST own all it's data; it cannot use lifetimes. This is due to the use of ``std::any::type_id`` which require types to have a ``'static`` lifetime.

Note: that you can simply write a wrapper type that owns all the data and converts it to the native type

# Contributions
Contributions, questions and feedback welcome. 
Please engage!
