SatFuzz

SatFuzz is a command-aware greybox fuzzing framework for flight software (FSW). It includes reproducible SatFuzz and AFL++ experiments for cFS, SUCHAI, and C2A.

Directory Layout

satfuzz/                    shared Python package
  fuzzer/
    cfs/                    cFS target fuzzer
    suchai/                 SUCHAI target fuzzer
    c2a/                    C2A target fuzzer
specs/
  <target>/                 canonical target spec used by runs
output/
  <target>/<run-tag>/       one fuzzing experiment directory
    coverage/               lcov trace, summary, and HTML report
    spec/                   spec files used for the run
    metadata/               target settings and coverage collection status
    satfuzz-status.json
run_existing_target_fuzz.py  SatFuzz target-fuzzing entrypoint
run_aflpp_experiment.py      AFL++ experiment entrypoint
scripts/                     supporting utilities

Target versions:

cFS     7.0.0
SUCHAI  3.0.0.rc-2
C2A     4.5.1

Default runtime roots:

cFS     Input/cfs/source/cFS
SUCHAI  Input/suchai/source/suchai-flight-software
C2A     Input/c2a/source/c2a-core

Override them with SATFUZZ_CFS_DIR, SATFUZZ_SUCHAI_DIR, or SATFUZZ_C2A_DIR only when using an equivalent gcov-built runtime tree. cFS requires build/coverage_base.info and .gcno files under its runtime root before fuzzing starts.

Install

Install the Python command from the repository root. Editable installation is recommended because target sources and specifications remain in this checkout.

python3 -m pip install -e .

Verify the installed command:

satfuzz --help

If a user-level installation reports satfuzz: command not found, add the user scripts directory to PATH and start a new shell:

export PATH="$HOME/.local/bin:$PATH"

python3 -m satfuzz --help is an equivalent fallback that does not depend on PATH.

Install host tools used by the target fuzzers:

sudo apt-get install -y python3 python3-pip cmake lcov gcovr gcc g++ \
  gcc-multilib g++-multilib libc6-dev-i386 docker.io pkg-config libzmq3-dev \
  afl++

C2A also needs Docker and pnpm available on PATH. Build the local target images once after submodules are available:

./scripts/build_target_images.sh

SUCHAI needs libzmq3-dev and its Python dependencies:

python3 -m pip install --target satfuzz/fuzzer/suchai/build/python-deps \
  -r satfuzz/fuzzer/suchai/requirements.txt

Run

The included specifications were generated with GPT-5.5 through the Codex CLI. Regenerate one with an authenticated codex executable on PATH:

satfuzz spec generate --target cfs --model gpt-5.5

When --seconds is omitted, target campaigns and experiments run each target for 43,200 seconds (12 hours).

Run SatFuzz only:

satfuzz experiment run --targets cfs suchai c2a --seconds 600 \
  --run-tag satfuzz-10m --backend satfuzz

Run AFL++ only:

satfuzz experiment run --targets cfs suchai c2a --seconds 600 \
  --run-tag aflpp-10m --backend aflpp

Run both for a matched comparison:

satfuzz experiment run --targets cfs suchai c2a --seconds 600 \
  --run-tag comparison-10m --backend both

Outputs

Each run writes to:

output/<target>/<date>-<run-tag>/

Important files:

coverage/summary.txt       line, function, and branch coverage summary
coverage/coverage_total.info
coverage/html/index.html
metadata/spec.json         spec copied for this exact run
metadata/                  target settings and coverage collection status
satfuzz-status.json        machine-readable run status
logs/satfuzz-runner.log    wrapper and target-runner log

Citation

You can cite our paper with the following bibtex entry. The page field will be updated later.

@INPROCEEDINGS{park:wisa:2026,
  author = {Geonwoo Park and Junhak Lee and Sang Kil Cha},
  title = {LLM-Assisted Command Syntax Extraction for Flight Software Fuzzing},
  booktitle = {Proceedings of the World Conference on Information Security Applications},
  year = 2026
}