# thejh/syzkaller architecture

> Architecture diagram of the GitHub repository thejh/syzkaller, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/thejh/syzkaller
- Repository: https://github.com/thejh/syzkaller

## Overview

syzkaller is a coverage-guided kernel fuzzer. Its principal workflow is to manage virtual machines, run fuzzers that generate and execute syscall programs, collect execution feedback and crashes, and minimize/reproduce failures. Target syscall descriptions and the shared executor support that work; reporting and dashboard services handle discovered bugs. The repository also includes CI management and a distributed hub. Some links are documented only at the product level because relevant implementation excerpts were not provided.

Main entry points: [`syz-manager/manager.go`](https://github.com/thejh/syzkaller/blob/master/syz-manager/manager.go) (Fuzz manager), [`syz-fuzzer/fuzzer.go`](https://github.com/thejh/syzkaller/blob/master/syz-fuzzer/fuzzer.go) (Fuzzer process), [`prog/prog.go`](https://github.com/thejh/syzkaller/blob/master/prog/prog.go) (Program model), [`vm/vm.go`](https://github.com/thejh/syzkaller/blob/master/vm/vm.go) (VM pool)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_fuzzing["Fuzzing runtime"]
  node_manager["Fuzz manager<br/>[manager.go]"]
  node_fuzzer["Fuzzer process<br/>[fuzzer.go]"]
  node_programs["Program model<br/>[prog.go]"]
  node_ipc["Executor IPC<br/>[ipc.go]"]
  node_executor["Target executor<br/>[executor.cc]"]
  node_linux_executor["Linux support<br/>[common_linux.h]"]
  node_vm["VM pool<br/>[vm.go]"]
end

subgraph group_targets["Target support"]
  node_syscalls["Syscall descriptions<br/>[amd64.go]"]
  node_target_registry["Target registry<br/>[targets.go]"]
  node_compiler["Description checker<br/>[check.go]"]
  node_manager_config["Manager configuration<br/>[config.go]"]
end

subgraph group_triage["Crash triage"]
  node_crash_monitor["Crash monitor<br/>[vm.go]"]
  node_repro["Reproducer<br/>[repro.go]"]
  node_report_parser["Kernel report parser<br/>[linux.go]"]
end

subgraph group_services["Operations and reporting"]
  node_dashboard["Bug dashboard<br/>[main.go]"]
  node_dashboard_api["Dashboard API<br/>[dashapi.go]"]
  node_ci["CI manager<br/>[manager.go]"]
  node_hub["Fuzzer hub<br/>[hub.go]"]
  node_database[("Corpus database<br/>[db.go]")]
end

node_operator(("Fuzzer operator"))

node_operator -.->|"configures"| node_manager
node_manager -->|"creates VMs"| node_vm
node_manager -.->|"stores corpus"| node_database
node_manager -->|"requests reproduction"| node_repro
node_manager -->|"sends stats"| node_dashboard_api
node_fuzzer -->|"exchanges RPC"| node_manager
node_fuzzer -->|"generates programs"| node_programs
node_fuzzer -->|"executes through"| node_ipc
node_ipc -.->|"controls execution"| node_executor
node_executor -->|"uses support"| node_linux_executor
node_programs -.->|"uses descriptions"| node_syscalls
node_compiler -->|"checks targets"| node_target_registry
node_compiler -->|"checks programs"| node_programs
node_manager -.->|"loads config"| node_manager_config
node_vm -->|"monitors output"| node_crash_monitor
node_crash_monitor -.->|"parses reports"| node_report_parser
node_repro -->|"tests candidates"| node_vm
node_ci -->|"restarts process"| node_manager
node_ci -.->|"reports builds"| node_dashboard_api
node_dashboard_api -.->|"serves bug data"| node_dashboard
node_fuzzer -.->|"shares inputs"| node_hub

click node_manager "https://github.com/thejh/syzkaller/blob/master/syz-manager/manager.go"
click node_fuzzer "https://github.com/thejh/syzkaller/blob/master/syz-fuzzer/fuzzer.go"
click node_programs "https://github.com/thejh/syzkaller/blob/master/prog/prog.go"
click node_ipc "https://github.com/thejh/syzkaller/blob/master/pkg/ipc/ipc.go"
click node_executor "https://github.com/thejh/syzkaller/blob/master/executor/executor.cc"
click node_linux_executor "https://github.com/thejh/syzkaller/blob/master/executor/common_linux.h"
click node_vm "https://github.com/thejh/syzkaller/blob/master/vm/vm.go"
click node_syscalls "https://github.com/thejh/syzkaller/blob/master/sys/linux/gen/amd64.go"
click node_target_registry "https://github.com/thejh/syzkaller/blob/master/sys/targets/targets.go"
click node_compiler "https://github.com/thejh/syzkaller/blob/master/pkg/compiler/check.go"
click node_manager_config "https://github.com/thejh/syzkaller/blob/master/pkg/mgrconfig/config.go"
click node_crash_monitor "https://github.com/thejh/syzkaller/blob/master/vm/vm.go"
click node_repro "https://github.com/thejh/syzkaller/blob/master/pkg/repro/repro.go"
click node_report_parser "https://github.com/thejh/syzkaller/blob/master/pkg/report/linux.go"
click node_dashboard "https://github.com/thejh/syzkaller/blob/master/dashboard/app/main.go"
click node_dashboard_api "https://github.com/thejh/syzkaller/blob/master/dashboard/dashapi/dashapi.go"
click node_ci "https://github.com/thejh/syzkaller/blob/master/syz-ci/manager.go"
click node_hub "https://github.com/thejh/syzkaller/blob/master/syz-hub/hub.go"
click node_database "https://github.com/thejh/syzkaller/blob/master/pkg/db/db.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_manager,node_fuzzer,node_programs,node_ipc,node_executor,node_linux_executor,node_vm toneBlue
class node_syscalls,node_target_registry,node_compiler,node_manager_config toneAmber
class node_crash_monitor,node_repro,node_report_parser toneMint
class node_dashboard,node_dashboard_api,node_ci,node_hub,node_database toneRose
class node_operator toneIndigo
```

## Components

### Fuzzing runtime

- [Fuzz manager](https://github.com/thejh/syzkaller/blob/master/syz-manager/manager.go): `syz-manager/manager.go`
- [Fuzzer process](https://github.com/thejh/syzkaller/blob/master/syz-fuzzer/fuzzer.go): `syz-fuzzer/fuzzer.go`
- [Program model](https://github.com/thejh/syzkaller/blob/master/prog/prog.go): `prog/prog.go`
- [Executor IPC](https://github.com/thejh/syzkaller/blob/master/pkg/ipc/ipc.go): `pkg/ipc/ipc.go`
- [Target executor](https://github.com/thejh/syzkaller/blob/master/executor/executor.cc): `executor/executor.cc`
- [Linux support](https://github.com/thejh/syzkaller/blob/master/executor/common_linux.h): `executor/common_linux.h`
- [VM pool](https://github.com/thejh/syzkaller/blob/master/vm/vm.go): `vm/vm.go`

### Target support

- [Syscall descriptions](https://github.com/thejh/syzkaller/blob/master/sys/linux/gen/amd64.go): `sys/linux/gen/amd64.go`
- [Target registry](https://github.com/thejh/syzkaller/blob/master/sys/targets/targets.go): `sys/targets/targets.go`
- [Description checker](https://github.com/thejh/syzkaller/blob/master/pkg/compiler/check.go): `pkg/compiler/check.go`
- [Manager configuration](https://github.com/thejh/syzkaller/blob/master/pkg/mgrconfig/config.go): `pkg/mgrconfig/config.go`

### Crash triage

- [Crash monitor](https://github.com/thejh/syzkaller/blob/master/vm/vm.go): `vm/vm.go`
- [Reproducer](https://github.com/thejh/syzkaller/blob/master/pkg/repro/repro.go): `pkg/repro/repro.go`
- [Kernel report parser](https://github.com/thejh/syzkaller/blob/master/pkg/report/linux.go): `pkg/report/linux.go`

### Operations and reporting

- [Bug dashboard](https://github.com/thejh/syzkaller/blob/master/dashboard/app/main.go): `dashboard/app/main.go`
- [Dashboard API](https://github.com/thejh/syzkaller/blob/master/dashboard/dashapi/dashapi.go): `dashboard/dashapi/dashapi.go`
- [CI manager](https://github.com/thejh/syzkaller/blob/master/syz-ci/manager.go): `syz-ci/manager.go`
- [Fuzzer hub](https://github.com/thejh/syzkaller/blob/master/syz-hub/hub.go): `syz-hub/hub.go`
- [Corpus database](https://github.com/thejh/syzkaller/blob/master/pkg/db/db.go): `pkg/db/db.go`

### Other components

- **Fuzzer operator**

## Connections

- Fuzzer operator → Fuzz manager: configures
- Fuzz manager → VM pool: creates VMs (evidence: `syz-manager/manager.go`)
- Fuzz manager → Corpus database: stores corpus
- Fuzz manager → Reproducer: requests reproduction (evidence: `syz-manager/manager.go`)
- Fuzz manager → Dashboard API: sends stats (evidence: `syz-manager/manager.go`)
- Fuzzer process → Fuzz manager: exchanges RPC (evidence: `syz-fuzzer/fuzzer.go`)
- Fuzzer process → Program model: generates programs (evidence: `syz-fuzzer/fuzzer.go`)
- Fuzzer process → Executor IPC: executes through (evidence: `syz-fuzzer/fuzzer.go`)
- Executor IPC → Target executor: controls execution
- Target executor → Linux support: uses support (evidence: `executor/common_linux.h`)
- Program model → Syscall descriptions: uses descriptions
- Description checker → Target registry: checks targets (evidence: `pkg/compiler/check.go`)
- Description checker → Program model: checks programs (evidence: `pkg/compiler/check.go`)
- Fuzz manager → Manager configuration: loads config
- VM pool → Crash monitor: monitors output (evidence: `vm/vm.go`)
- Crash monitor → Kernel report parser: parses reports
- Reproducer → VM pool: tests candidates (evidence: `pkg/repro/repro.go`)
- CI manager → Fuzz manager: restarts process (evidence: `syz-ci/manager.go`)
- CI manager → Dashboard API: reports builds
- Dashboard API → Bug dashboard: serves bug data
- Fuzzer process → Fuzzer hub: shares inputs