A fuzzer for Apple's iOS (Darwin) Operating System.

The fuzzer talks to several endpoints accessible from within the sandbox and can attack both userland and kernelspace interfaces.

The fuzzer is written in C, Objective-C and inline assembly.

• TODO

• System calls
• MACH (MUCK) traps
• IOKit and it's children (Kexts and drivers)

• Logs to either Xcode or an in-app view
• Logs processor registers in real-time

• Jake James (Mach-O parser for the kernelcache)
• Willem Hengeveld (lzss decompression algorithm)
• OSXFuzz (generic fuzzing functionality)
• Apple Inc. (private headers and frameworks, they might be licensed)
• liblorgnette
• Capstone