Tools
scadafuzz.
scadafuzz is a set of coverage-guided, in-process fuzz harnesses built under AddressSanitizer, for open-source industrial control protocol stacks. Each harness links a library’s own parser and drives it directly, and pairs a reproducible build recipe with a self-healing runner for long unattended campaigns on one workstation.
Source on GitHub, Apache-2.0Targets
Each row is one protocol family and the library its harness drives. Six families, each fuzzed in process.
| Protocol family | Library | Harness reach |
|---|---|---|
| EtherNet/IP and CIP | CIPster | CIP router entry plus the encapsulation envelope |
| KNX | knxd | cEMI and APDU depth plus the envelope |
| M-Bus | libmbus | frame and data-record parser |
| Modbus TCP | nanomodbus | server request parser |
| BACnet | bacnet-stack | APDU parser, deep |
| Telecontrol | A telecontrol protocol library | frame and state-machine depth |
How it is built
harnesses/
Each target has an in-process harness whose build.sh clones the upstream source, so every library keeps its own licence. A seed corpus ships alongside to start coverage.
runner/
A multi-node AFL++ launcher runs the campaign and a self-healing health check keeps the nodes up across days. Crash dedupe groups findings for triage.
A campaign
The EtherNet/IP harness · as of 2026-09-01 · running
- 12AFL++ nodes, one CMPLOG-guided main and eleven secondaries
- 1,079edges reached
- 464inputs in the corpus
- ~370,000executions a second
- 23sources compiled into the harness
- 0crashes and hangs, at the same read
These figures are a point-in-time read from the campaign’s first days, and they move as it keeps running. A clean read at this depth says the harness is exercising the router rather than the envelope; the coverage is the result until a crash lands.
Scope
scadafuzz is a defensive research tool. Every packet on the wire comes from the fuzzer. Run it against your own copy on loopback, on equipment you own. Treat every crash as a claim until it passes triage and a novelty check, and send a novel finding privately to the maintainer.