HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
trailofbits
deepstate
Python2018–2021
trailofbits / deepstate

deepstate

A unit test-like interface for fuzzing and symbolic execution

Science & EngineeringTesting & Quality
Explore on GitHubRead Hacker News discussions
12Distinct people
15Mentions
0Explicit recommenders
866GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A unit test-like interface for fuzzing and symbolic execution

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 2:04:58 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year15 dated mentions

Observed mentions: 2018-02-18 21:40:23 UTC to 2021-09-09 02:48:36 UTC.

02462018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 7 mentions; 2 submissions, 5 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments2021

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC725
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC404
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC101
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC312

What Hacker News says

15 sources
pag·Sep 9, 2021
Can you explain how your offering compares with open-source alternatives, such as KLEE [1] and DeepState [2]? P.S. your logo is surprisingly similar to that of ForAllSecure [3], which also provides a symbolic execution engine called Mayhem [4]. [1] https://klee.github.io/ (online example: http://klee.doc.ic.ac.uk/) [2] https://github.com/trailofbits/deepstate#readme [3] https://forallsecure.com/ [4] https://users.ece.cmu.edu/~aavgerin/papers/mayhem-oakland-12...
In Show HN: Symbolica – Try our symbolic code executor in the browser
matt_d·Aug 29, 2019
"Generating Software Tests" (https://www.fuzzingbook.org/) is pretty great (independent of your programming language) - arguably a must read for anyone interested in software testing. John Regehr (the author of the blog post) has written more great posts: - How to Fuzz an ADT Implementation - https://blog.regehr.org/archives/896 - Better Random Testing by Leaving Features Out - https://blog.regehr.org/archives/591 - Tricking a Whitebox Testcase Generator - https://blog.regehr.org/archives/672 - Fuzzers Need Taming - https://blog.regehr.org/archives/925 - Levels of Fuzzing - https://blog.regehr.org/archives/1039 - API Fuzzing vs. File Fuzzing: A Cautionary Tale - https://blog.regehr.org/archives/1269 - Reducers are Fuzzers - https://blog.regehr.org/archives/1284 In terms of software, DeepState (https://github.com/trailofbits/deepstate) may
Read the rest
be a good place to start for C and C++. Relevant links: - Fuzzing an API with DeepState: https://blog.trailofbits.com/2019/01/22/fuzzing-an-api-with-..., https://blog.trailofbits.com/2019/01/23/fuzzing-an-api-with-... - NDSS 18 paper, "DeepState: Symbolic Unit Testing for C and C++": https://www.cefns.nau.edu/~adg326/bar18.pdf In terms of choosing among fuzzing solutions, https://blog.trailofbits.com/2018/10/05/how-to-spot-good-fuz... is also worth a read -- as well as the article it refers to, http://www.pl-enthusiast.net/2018/08/23/evaluating-empirical.... For a broad survey, see "The Art, Science, and Engineering of Fuzzing": https://arxiv.org/abs/1812.00140, https://jiliac.com/pdf/fuzzing_survey19.pdf More resources: - Effective File Format Fuzzing – Thoughts, Techniques and Results (Black Hat Europe 2016): https://j00ru.vexillium.org/talks/blackhat-eu-effective-file... - libFuzzer – a library for coverage-guided fuzz testing: http://tutorial.libFuzzer.info, http://llvm.org/docs/LibFuzzer.html, https://github.com/ouspg/libfuzzerfication - Materials of "Modern fuzzing of C/C++ Projects" workshop: https://github.com/Dor1s/libfuzzer-workshop - Introduction to using libFuzzer with llvm-toolset: https://developers.redhat.com/blog/2019/03/05/introduction-t... - Fuzzing workflows - a fuzz job from start to finish: https://foxglovesecurity.com/2016/03/15/fuzzing-workflows-a-... - Materials from "Fuzzing with AFL" workshop (SteelCon 2017, BSides London and Bristol 2019): https://github.com/ThalesIgnite/afl-training - Making Your Library More Reliable with Fuzzing (C++Now 2018; Marshall Clow): https://www.youtube.com/watch?v=LlLJRHToyUk, https://github.com/boostcon/cppnow_presentations_2018/blob/m... - C++ Weekly - Ep 85 - Fuzz Testing - https://www.youtube.com/watch?v=gO0KBoqkOoU - The Art of Fuzzing – Slides and Demos: https://sec-consult.com/en/blog/2017/11/the-art-of-fuzzing-s...
In Write Fuzzable Code
touisteur·May 21, 2019
This is my guess also. Even in large engineering-driven companies, you often discover during your very proud (internal) talk about Shiny New Tech that other people in the group have been doing it for some time... But you never know, maybe I looked in the wrong parts of the Internet. I'm genuinely curious though: since most of those projects are open-source you'd expect to see some traces of some activity/problems on GitHub or on mailing-lists, and... well... Not much to be seen. I've seen some rare papers with CBMC and I know the tech has been ported to Java, javascript and apparently something is in progress for Ada ? angr I tried very hard to use on Ada programs but it seems the VEX lifter and CFG builder couldn't handle simple Ada programs (wasn't patient enough to submit this on GitHub...). But for C programs it's very fun and all scr
Read the rest
iptable ! There is also this nice of a 'pluggable test environment' (deepstate from Trail of Bits https://github.com/trailofbits/deepstate) that allows to switch between hand-written unit tests, fuzzers, and symbolic execution (letting you decide which variables are Symbolic, which are concrete...) with angr. Also some cool stuff mixing AFL and angr (driller) and another project mixing Intel PT and angr. KLEE seems to have the most papers (quantity and quality), just landed support for C++ and upgraded to a recent llvm...
In A Survey of Symbolic Execution Techniques (2018)
evmunro·Feb 27, 2019
We don't support protocol fuzzing yet, but it's definitely on our roadmap - we wanted to start in an area that we felt was lacking the most, and then move into other types of fuzzing. We do have some novel REST API fuzzing techniques in mind that we're really looking forward to implementing as well. We're also thinking about extending to property-based testing. There are some really awesome hybrid testing tools out there, such as DeepState (https://github.com/trailofbits/deepstate) which combines Symbolic Execution and Fuzzing behind one clean interface, and we'd really like to push the boundaries of that type of testing. And yep, we do! Everything is written in Go, which is part of the reason it's one of the first languages we support.
In Launch HN: Fuzzbuzz (YC W19) – Fuzzing as a Service
k4st·Nov 5, 2018
I work on a Google Test-like unit testing framework called DeepState [1] that gives you access to fuzzing and symbolic execution from your C or C++ unit tests. We have a tutorial [2] describing how to use it. It's new and still under development, but shows massive potential, and really brings these software security tools into a more developer-centric workflow. [1] https://github.com/trailofbits/deepstate [2] http://www.petergoodman.me/docs/secdev-2018-slides.pdf
In Generating Software Tests: Breaking Software for Fun and Profit
pag·May 20, 2018
If you're an everyday C/C++ programmer and can't imagine how Angr could fit into your workflow, then check out DeepState (https://github.com/trailofbits/deepstate). It is a Google Test-compatible unit testing framework that lets you write parameterized unit tests, using Angr to perform the state space exploration. What that means is that you can write a unit test, e.g. that addition of two integers doesn't overflow (it can), and using the power of Angr, DeepState will evaluate your test for all possible integers, not hard-coded ones, and not just some randomly chosen ones.
In Angr – User-friendly binary analysis platform

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.