Radamsa
General-purpose mutational fuzzer that generates malformed test samples to test parser resilience and file format handlers.
Technical Architecture & Overview
Radamsa is a general-purpose, black-box mutational fuzzer developed at OUSPG. It uses sample inputs and applies heuristic mutations to generate malformed data, making it suitable for testing parsers and file consumers without requiring source code or coverage instrumentation.
Targeted Technical Use Cases
Black-box fuzzing of file parsers, protocol implementations, and proprietary software without source access.
Evaluation & Trade-offs
Core Strengths
- +Works as a black-box fuzzer without requiring source code or instrumentation.
- +Format-agnostic: needs no information about the program or the format of the data.
- +Ships as a single binary with no external dependencies.
Trade-Offs & Limitations
- -No coverage feedback, so mutation is not guided by code path discovery.
- -Requires representative sample inputs to be effective.
Defensive Security Application
Robustness testing of third-party parsers and file consumers against malformed inputs.
Frequently Asked Questions
What is Radamsa?→
Radamsa is a general-purpose, black-box mutational fuzzer developed at OUSPG. It uses sample inputs and applies heuristic mutations to generate malformed data, making it suitable for testing parsers and file consumers without requiring source code or coverage instrumentation.
What is Radamsa used for?→
Black-box fuzzing of file parsers, protocol implementations, and proprietary software without source access.
What are the strengths of Radamsa?→
- +Works as a black-box fuzzer without requiring source code or instrumentation.
- +Format-agnostic: needs no information about the program or the format of the data.
- +Ships as a single binary with no external dependencies.
What are the limitations of Radamsa?→
- +No coverage feedback, so mutation is not guided by code path discovery.
- +Requires representative sample inputs to be effective.
How is Radamsa used defensively?→
Robustness testing of third-party parsers and file consumers against malformed inputs.