oxfuzz

FUZZING, WITH A HUMAN IN CONTROL

Find the crash.
Keep the evidence.

A desktop workbench for discovering targets, reviewing harnesses and running isolated fuzzing campaigns. From the first input to a crash you can investigate.

Get oxfuzz Explore the workflow

v0.9.4 · macOS, Linux & Windows · Experimental release

CAMPAIGN WORKFLOW+
  1. 01
    Choose a targetC · C++ · Rust · Linux kernels
  2. 02
    Review the harnessModel review + human approval
    REVIEW
  3. 03
    Run inside the sandboxTime, memory and CPU limits
  4. 04
    Investigate the resultCoverage · crashes · retained artifacts
Your approval moves the campaign forward.
FOUR ENGINE ADAPTERSlibFuzzerAFL++honggfuzzsyzkaller

FROM SOURCE TO EVIDENCE

One place to follow
the whole campaign.

01 / PREPARE

Know what you are running.

Discover promising targets, inspect generated harnesses, and approve the exact revision before a full campaign.

02 / OBSERVE

Stay close to the run.

Follow live engine metrics, set resource limits, and stop a campaign while retaining its results.

03 / INVESTIGATE

Work from retained evidence.

Scan crashes with progress and cancellation. Generate AI reports separately, when you want interpretation.

THE CURRENT RELEASE

Make room for better testing.

v0.9.4

Choose your desktop package, then build the sandbox below. Downloads are hosted here and do not require a GitHub account.

Local candidate preview. Downloads are disabled until release verification finishes.

macOS

macOS 10.15 or later. Ad-hoc signed; not notarized.

Apple siliconCandidate build · not yet availableIntelCandidate build · not yet available

Linux

x86_64 desktop. Docker Engine required.

AppImageCandidate build · not yet availableDebian / UbuntuCandidate build · not yet availableFedora / RHELCandidate build · not yet available

Windows

64-bit Windows. Unsigned installers. Docker Desktop with WSL 2.

InstallerCandidate build · not yet availableSetupCandidate build · not yet available

Sandbox

Build the isolated engine environment locally. Docker required.

Sandbox build kitCandidate build · not yet available

Experimental distribution. macOS packages are ad-hoc signed and not notarized. Windows packages are unsigned. Your operating system may warn or block installation. Live release qualification covers macOS Apple silicon; other packages are built and checked in CI.

BEFORE YOUR FIRST CAMPAIGN

Desktop app.
Isolated engines.

Install Docker and keep its daemon running. The sandbox kit builds the pinned engine toolchain locally; it does not include the application source.

1

Install the desktop app

Open the package for your system. On macOS, move oxfuzz to Applications. On Linux, install the DEB/RPM or make the AppImage executable. On Windows, run the installer.

2

Build the sandbox

Download and extract the sandbox kit. Run these commands from its directory using Bash, Python 3 and Docker. Windows users need a WSL 2 shell with Docker integration. The first build downloads toolchains and needs several GB of disk space.

tar -xzf oxfuzz-sandbox-kit-0.9.4.tar.gz
cd oxfuzz-sandbox-kit-0.9.4
./scripts/build-sandbox.sh

Keep the resulting image tag oxfuzz/fuzz-sandbox:0.2.2. The desktop app uses this local image.

3

Connect a provider and open a project

Configure your chosen AI provider in Settings. Provider access is required for AI assistance and normal harness review. Confirm sandbox readiness, discover a target, and review the harness before approving execution.

Kernel fuzzing with syzkaller also needs a compatible instrumented kernel, root filesystem and guest SSH key. These are not included in the desktop download. Physical automotive testing requires separate setup and approval.

RELEASE NOTES / 0.9.4

A clearer view of the work.

  • Bounded fuzzing runs and improved live engine metrics.
  • Crash scanning separated from AI reports, with progress and cancellation.
  • Provider and language selection fixes for the assistant.
  • Improved Settings, Knowledge, Skills and Agents behavior.
  • Icon controls for Dark, Light and System themes.
  • Sandbox SSH/SCP support and retained syzkaller campaign output.

VERIFY YOUR DOWNLOAD

Check the bytes.

Compare the SHA-256 of your download with the published checksums before installing.

Checksums appear with the verified release.

# macOS
shasum -a 256 your-download.dmg
# Linux
sha256sum your-download.AppImage
# Windows PowerShell
Get-FileHash .\your-download.msi -Algorithm SHA256

Checksums detect incomplete or altered files. They are not a substitute for a trusted publisher signature.