google
Documentation for attaching a java debugger
I was able to reproduce an issue with the instructions at https://google.github.io/oss-fuzz/advanced-topics/reproducing/ But this "jazzer" thing which launches the Java VM is a bit of a black box. I want to provide Java debugger command-line args so I can step through the code to see the input as it's being processed. It would be very helpful if Jazzer could output to stdout a basic java command before it actually calls it itself. This would make it straight-forward for me to call that myself with the pertinent modifications.
In a similar sense, the project provides some python scripts that starts a docker container, and it helpfully prints it such that I can call it myself if I want.
The Jazzer repository is here https://github.com/CodeIntelligenceTesting/jazzer and will likely have some more details on this. I went through the doc but couldn't find stuff about this though. At the moment, OSS-Fuzz focuses primarily on the reproduction as is shown in the page you link, however, it may make sense to have some more language-specific guidance.
@fmeum @kyakdan @bertschneider
It would be very helpful if Jazzer could output to stdout a basic java command before it actually calls it itself
Does Jazzer provide this feature?
OSS-Fuzz uses the native jazzer binary primarily for backwards compatibility. You can just as well use the ordinary jazzer_standalone.jar provided in our release. Since OSS-Fuzz currently uses Jazzer v0.17.1, you can obtain that jar from this release's archive.
Running the jar directly will not use all the JVM flags that the jazzer binary sets, but those should only affect performance and not reproducibility of findings. Note that jazzer does support the JAVA_TOOL_OPTIONS environment variable, so you can also pass custom JVM args into the binary.
