syz-extract-constants
Defining and extracting kernel constants for syzkaller syzlang descriptions
Best for Syzkaller usersWorks with GitHubLow risk
⌘source
- author
@benchflow-ai- language
- PDDL
★1kstars
252forks
Apr 20, 2026
✦overview.md
Key Features
- ·Extract kernel constants from source headers
- ·Define constants manually in .const files
- ·Support for architecture-specific constant values
- ·Calculate Linux ioctl numbers using standard formulas
Use Cases
- →Providing constant values for syzkaller fuzzing programs when kernel source is unavailable
- →Extracting ioctl numbers and flags from kernel headers for fuzzing
- →Defining architecture-specific constants for multi-architecture fuzzing
Best for
- ✓Syzkaller users
- ✓Kernel fuzzing projects
Not ideal for
- !Non-Linux systems
- !Projects without syzkaller integration
FAQs
name
syz-extract-constants
description
Defining and extracting kernel constants for syzkaller syzlang descriptions
Defining Constants in Syzlang
Overview
Syzkaller needs to know the actual values of kernel constants (ioctl numbers, flags, etc.) to generate valid fuzzing programs. There are two ways to provide these values:
- Manual
.constfile - Define constants directly in a companion file syz-extracttool - Extract values from kernel source headers (requires kernel source)
Method 1: Manual Constants File (Recommended when no kernel source)
Create a .const file alongside your .txt file with the constant values:
File naming
- Syzlang description:
sys/linux/dev_ppdev.txt - Constants file:
sys/linux/dev_ppdev.txt.const
Constants file format
# Constants for your syzlang descriptions
arches = 386, amd64, arm, arm64, mips64le, ppc64le, riscv64, s390x
PPCLAIM = 28811
PPRELEASE = 28812
IEEE1284_MODE_NIBBLE = 0
IEEE1284_MODE_BYTE = 1
The arches line declares which architectures these constants are valid for. For architecture-independent constants (like ioctls), list all architectures.
Calculating ioctl values
Linux ioctl numbers are encoded as:
_IO(type, nr)=(type << 8) | nr
$install
1-click copynpx skills add benchflow-ai/skillsbench --skill syz-extract-constantsSafety assessment
★
Clarity score
How clear and easy to understand the SKILL.md instructions are, rated from 1 to 5.
4/ 5
very goodClear and well structured, with only minor parts that might need a second read.
◎
Actionability score
How directly an agent can act on the SKILL.md instructions, rated from 1 to 5.
4/ 5
highMostly actionable with clear steps; only a few small gaps remain.