Fuzzilli vs Metalware
Fuzzilli
github.comMetalware
product.metalware.comSide by side
| Figure | Fuzzilli | Metalware |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · Fuzz Testing Software | 8.4 (#6) | 7.4 (#17) |
| Deployment | The project says Fuzzilli and supported engines can be built and run inside Docker and on Google Compute Engine. | Metalware is available as a cloud service or on-premise deployment; the on-premise instructions require a modern Linux computer with Docker. |
| Intended users | The project describes Fuzzilli as a tool for fuzzing dynamic language interpreters and invites patches and other contributions. | The maker describes use by product security teams, DevSecOps, reverse engineers and vulnerability researchers, and firmware engineers. |
| Purpose | Fuzzilli is a coverage-guided fuzzer for dynamic language interpreters that mutates programs in FuzzIL and translates them to JavaScript. | Metalware analyzes firmware binaries to find crashes and vulnerabilities using rehosting, fuzz testing, and program analysis. |
Plans
In their own words
Fuzzilli
Fuzzilli is a free, open-source, coverage-guided fuzzer for dynamic language interpreters. It represents test programs in FuzzIL, mutates them, and translates them to JavaScript for execution. Its mutators can change data flow or operation parameters, generate or splice code, and combine corpus programs. Components include a mutation fuzzer, script runner, corpus, environment, minimizer, evaluator, and lifter. A target engine runs repeated scripts in a read-eval-print-reset loop, resetting between cases; multiple instances can synchronize within a process or across machines over TCP. Listed target directories include JavaScriptCore, JerryScript, QuickJS, QtJS, Serenity, SpiderMonkey, V8, XS, Duktape, and njs. Setup requires compiling a supported engine with coverage instrumentation using clang 4.0 or later, then building Fuzzilli with Swift Package Manager. Docker and Google Compute Engine tooling are provided. The project supports Linux, macOS, and self-hosted use and identifies its license as Apache-2.0. Its repository says it is not an officially supported Google product. Contributions require a Contributor License Agreement and are reviewed through GitHub pull requests.
Metalware
Metalware has no write-up on Specifiction yet; its figures are above.