shithub: fuzz

Download patch

ref: bca057e3578a3fab0e7a0e8346a631e598c5b3f4
author: Steven Sleder <ssleder@iastate.edu>
date: Sun Nov 25 03:17:44 EST 2018 

Hacked together a working mut_chararr


--- /dev/null
+++ b/.hgignore
@@ -1,0 +1,4 @@
+syntax: glob
+fuzz.log
+*.[8qkv5967o]
+[8qkv5967o].out
--- /dev/null
+++ b/LICENSE
@@ -1,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 Sean Hinchee, Steven Sleder
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
--- /dev/null
+++ b/README.md
@@ -1,0 +1,45 @@
+# Fuzz -- A kernel fuzzer from Plan 9 space
+
+## Dependencies
+
+fuzz(1) is tested on the [9front](http://9front.org) operating system and as such uses its libraries and runs against its kernels. 
+
+Theoretically fuzz could be ported to unix using [plan9port](https://github.com/9fans/plan9port), but this would require a Plan 9 kernel in user space which doesn't really exist outside of [9vx](https://swtch.com/9vx/) which is untested in this regard.
+
+## Building
+
+	mk
+	
+## Installing
+
+	mk install
+
+## Building in debug mode
+
+	mk debug
+
+## Usage
+
+To perform up to round 5 of fuzzing for the read, write, open, and close calls:
+
+	fuzz -n 5 read write open close
+
+A list of all known system call names can be printed:
+
+	fuzz ?
+
+## Recommended reading for further development
+
+- http://doc.cat-v.org/plan_9/4th_edition/papers/comp
+- http://doc.cat-v.org/plan_9/programming/c_programming_in_plan_9
+- https://lsub.org/who/nemo/9.pdf
+	- http://9.postnix.us/hist/3e/plan9_3e_kernel.tgz
+- http://doc.cat-v.org/plan_9/misc/adding_a_syscall_to_plan_9/plan9_syscall_howto.pdf
+- http://aiju.de/plan_9/plan9-syscalls
+- http://man.cat-v.org/9front/2/intro
+- http://man.cat-v.org/9front/1/syscall
+	- http://mirror.postnix.us/plan9front/sys/src/cmd/syscall/
+- http://mirror.postnix.us/plan9front/sys/src/libc/9syscall/
+- http://lsub.org/who/nemo/9.intro.pdf
+- http://fxr.watson.org/fxr/source/?v=PLAN9
+
--- /dev/null
+++ b/fuzz.h
@@ -1,0 +1,173 @@
+#ifndef FUZZ_H
+#define FUZZ_H
+
+#include <u.h>
+#include <libc.h>
+#include "list.h"
+#include "mutate.h"
+
+
+// Max signed int value
+#define MAXINT 2147483647
+
+// Number of calls in enum calls
+#define NCALLS 67
+#define NTYPES 16
+
+// Global variables
+// In main.c
+extern	int		logfd;
+extern	Lock	loglck;
+extern	Lock	rnglck;
+
+/*
+For full list of syscalls:
+
+If systab doesn't exist, do: cd /sys/src/9/port && mk
+/sys/src/9/port/systab.h
+/sys/src/libc/9syscall/sys.h
+/sys/include/libc.h:537
+*/
+
+// User space syscall definitions as per libc.h with sc_ prefix added
+typedef int call;
+enum call {
+sc__exits, // unused -- here for offset
+sc_abort	,	//	abort(void);
+sc_access	,	//	access(char*, int);
+sc_alarm	,	//	alarm(ulong);
+sc_await	,	//	await(char*, int);
+sc_bind	,		//	bind(char*, char*, int);
+sc_brk	,		//	brk(void*);
+sc_chdir	,	//	chdir(char*);
+sc_close	,	//	close(int);
+sc_create	,	//	create(char*, int, ulong);
+sc_dup	,		//	dup(int, int);
+sc_errstr	,	//	errstr(char*, uint);
+sc_exec	,		//	exec(char*, char*[]);
+sc_execl	,	//	execl(char*, ...);
+sc_exits	,	//	_exits(char*); // unused
+sc_fork	,		//	fork(void);
+sc_rfork	,	//	rfork(int);
+sc_fauth	,	//	fauth(int, char*);
+sc_fstat	,	//	fstat(int, uchar*, int);
+sc_fwstat	,	//	fwstat(int, uchar*, int);
+sc_fversion,	//	fversion(int, int, char*, int);
+sc_mount	,	//	mount(int, int, char*, int, char*);
+sc_unmount,		//	unmount(char*, char*);
+sc_noted	,	//	noted(int);
+sc_notify	,	//	notify(void(*)(void*, char*));
+sc_open	,		//	open(char*, int);
+sc_fd2path,		//	fd2path(int, char*, int);
+sc_pipe	,		//	pipe(int*);
+sc_pread	,	//	pread(int, void*, long, vlong);
+sc_preadv,		//	preadv(int, IOchunk*, int, vlong);
+sc_pwrite	,	//	pwrite(int, void*, long, vlong);
+sc_pwritev,		//	pwritev(int, IOchunk*, int, vlong);
+sc_read	,		//	read(int, void*, long);
+sc_readn	,	//	readn(int, void*, long);
+sc_readv	,	//	readv(int, IOchunk*, int);
+sc_remove,		//	remove(char*);
+sc_sbrk	,		//	sbrk(ulong);
+sc_oseek	,	//	oseek(int, long, int);
+sc_seek,		//	seek(int, vlong, int);
+sc_segattach,	//	segattach(int, char*, void*, ulong);
+sc_segbrk	,	//	segbrk(void*, void*);
+sc_segdetach,	//	segdetach(void*);
+sc_segflush,	//	segflush(void*, ulong);
+sc_segfree,		//	segfree(void*, ulong);
+sc_semacquire,	//	semacquire(long*, int);
+sc_semrelease,	//	semrelease(long*, long);
+sc_sleep,		//	sleep(long);
+sc_stat,		//	stat(char*, uchar*, int);
+sc_tsemacquire,	//	tsemacquire(long*, ulong);
+sc_wait,		//	wait(void);
+sc_waitpid,		//	waitpid(void);
+sc_write,		//	write(int, void*, long);
+sc_writev,		//	writev(int, IOchunk*, int);
+sc_wstat,		//	wstat(char*, uchar*, int);
+sc_rendezvous,	//	rendezvous(void*, void*);
+sc_dirstat,		//	dirstat(char*);
+sc_dirfstat,	//	dirfstat(int);
+sc_dirwstat,	//	dirwstat(char*, Dir*);
+sc_dirfwstat,	//	dirfwstat(int, Dir*);
+sc_dirread,		//	dirread(int, Dir**);
+sc_nulldir,		//	nulldir(Dir*);
+sc_dirreadall,	//	dirreadall(int, Dir**);
+sc_getpid	,	//	getpid(void);
+sc_getppid,		//	getppid(void);
+sc_rerrstr,		//	rerrstr(char*, uint);
+sc_sysname,		//	sysname(void);
+sc_werrstr		//	werrstr(char*, ...);
+};
+
+// Enum to track types of inputs
+typedef int type;
+enum type {
+t_int,          // int
+t_intS,         // int pointer
+t_uint,         // unsigned int
+t_IOchunkS,     // IOChunkS pointer
+t_long,         // long
+t_longS,        // long pointer
+t_ulong,        // unsigned long
+t_vlong,        // long long
+t_DirS,         // directory pointer
+t_DirSS,        // director pointer to string of chars
+t_char,         // char
+t_uchar,        // unsigned char
+t_ucharS,       // unsigned char pointer
+t_charS,        // string
+t_charSArr,     // char pointer array
+t_void,         // void type
+t_voidS         // void pointer type
+};
+
+// Structure to track an instance of a given type
+typedef struct t_type t_type;
+struct t_type
+{
+	void*	var;	// Variable to track
+	type	t;		// Type of the variable to cast to
+};
+
+// Type names table -- in input.c
+extern char *typenames[NTYPES];
+
+// User space system call names table -- NCALLS length -- in input.c
+extern char *callnames[NCALLS];
+
+// Structure to track state of system calling
+typedef struct caller caller;
+struct caller
+{
+	call		c;			// System call in use
+	char*		name;		// Real name of syscall
+	int			round;		// Last run executed
+	int			seed;		// Seed call was initialized with
+	List		inputs;		// List of input types in order from left→right
+};
+
+// Index of system calls -- one for each enum'd system call
+caller syscalls[NCALLS];
+
+/* == Function prototypes == */
+
+// input.c
+void	fuzz(caller*);
+void	hjsync(void);
+void	log_call(caller*);
+
+// inlist.c
+List*	mkinlist(List*, call);
+
+// list.c → See list.h
+
+// mutate.c → See mutate.h
+
+// main.c
+void	dolog(char*, ...);
+void	debug(char*, ...);
+int		rng(void);
+
+#endif
--- /dev/null
+++ b/fuzz.man
@@ -1,0 +1,51 @@
+.TH FUZZ 1
+
+.SH NAME
+fuzz  \- kernel fuzzer from Plan 9 space
+
+.SH SYNOPSIS
+.B fuzz
+[
+.B -n
+.I rounds
+]
+.B call …
+
+.SH DESCRIPTION
+.I Fuzz
+
+.PP
+The options are:
+.PD
+
+.TP
+.B -n \fIrounds
+Perform fuzzing for \fIrounds\fR iterations.
+
+.PP
+.SH EXAMPLES
+
+To print all system calls known by fuzz:
+.EX
+fuzz ?
+.EE
+
+To fuzz the read and write system calls for two rounds:
+.EX
+fuzz -n 2 read write
+.EE
+
+.PP
+.SH SOURCE
+.B https://bitbucket.org/cpre43121/fuzz-c
+
+.PP
+.SH "SEE ALSO"
+.IR intro (2),
+.IR syscall (1)
+
+.PP
+.SH BUGS
+
+Oh yeah.
+
--- /dev/null
+++ b/inlist.c
@@ -1,0 +1,437 @@
+#include "fuzz.h"
+
+// HERE BE DRAGONS -- this should be moved to a generator
+// Generate the input list for the given syscall
+
+void mk_int(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = malloc(sizeof(int));
+    *(int *)tt->var = 0;
+    tt->t = t_int;
+
+    ladd(l, tt);
+}
+
+void mk_intS(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = nil;
+    tt->t = t_intS;
+
+    ladd(l, tt);
+}
+
+void mk_uint(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = malloc(sizeof(unsigned int));
+    *(unsigned int *)tt->var = 0;
+    tt->t = t_uint;
+
+    ladd(l, tt);
+}
+
+void mk_IOchunkS(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = nil;
+    tt->t = t_IOchunkS;
+
+    ladd(l, tt);
+}
+
+void mk_long(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = malloc(sizeof(long));
+    *(long *)tt->var = 0;
+    tt->t = t_long;
+
+    ladd(l, tt);
+}
+
+void mk_longS(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = nil;
+    tt->t = t_longS;
+
+    ladd(l, tt);
+}
+
+void mk_ulong(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = malloc(sizeof(unsigned long));
+    *(unsigned long *)tt->var = 0;
+    tt->t = t_ulong;
+
+    ladd(l, tt);
+}
+
+void mk_vlong(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = malloc(sizeof(long long));
+    *(long long *)tt->var = 0;
+    tt->t = t_vlong;
+
+    ladd(l, tt);
+}
+
+void mk_DirS(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = nil;
+    tt->t = t_DirS;
+
+    ladd(l, tt);
+}
+
+void mk_DirSS(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = nil;
+    tt->t = t_DirSS;
+
+    ladd(l, tt);
+}
+
+void mk_char(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = malloc(sizeof(char));
+    *(char *)tt->var = '\n';
+    tt->t = t_char;
+
+    ladd(l, tt);
+}
+
+void mk_uchar(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = malloc(sizeof(unsigned char));
+    *(unsigned char *)tt->var = '\n';
+    tt->t = t_uchar;
+
+    ladd(l, tt);
+}
+
+void mk_ucharS(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = nil;
+    tt->t = t_ucharS;
+
+    ladd(l, tt);
+}
+
+void mk_charS(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = malloc(1* sizeof(char*));
+    tt->t = t_charS;
+
+    ladd(l, tt);
+}
+
+void mk_void(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = nil;
+    tt->t = t_void;
+
+    ladd(l, tt);
+}
+
+void mk_voidS(List *l)
+{
+    t_type *tt = malloc(sizeof(t_type));
+    tt->var = nil;
+    tt->t = t_voidS;
+
+    ladd(l, tt);
+}
+
+List*
+mkinlist(List* l, call c)
+{
+	// Iterate through l
+
+	switch(c){
+	case sc_abort:
+        mk_void(l);
+		break;
+	case sc_access:
+        mk_charS(l);
+        mk_int(l);
+		break;
+	case sc_alarm:
+        mk_ulong(l);
+		break;
+	case sc_await:
+        mk_charS(l);
+        mk_int(l);
+		break;
+    case sc_bind:
+        mk_charS(l);
+        mk_charS(l);
+        mk_int(l);
+        break;
+	case sc_brk:
+        mk_voidS(l);
+		break;
+	case sc_chdir:
+		mk_charS(l);
+		break;
+	case sc_close:
+        mk_int(l);
+		break;
+	case sc_create:
+        mk_charS(l);
+        mk_int(l);
+        mk_ulong(l);
+		break;
+	case sc_dup:
+        mk_int(l);
+        mk_int(l);
+		break;
+	case sc_errstr:
+        mk_charS(l);
+        mk_uint(l);
+		break;
+	case sc_exec:
+
+        // wtf?
+
+		break;
+	case sc_execl:
+        mk_charS(l);
+		break;
+	case sc_exits:
+        mk_charS(l);
+	    break;
+    case sc_fork:
+        mk_void(l);
+		break;
+	case sc_rfork:
+        mk_int(l);
+		break;
+	case sc_fauth:
+        mk_int(l);
+        mk_charS(l);
+		break;
+	case sc_fstat:
+        mk_int(l);
+        mk_ucharS(l);
+        mk_int(l);
+		break;
+	case sc_fwstat:
+        mk_int(l);
+        mk_ucharS(l);
+        mk_int(l);
+		break;
+	case sc_fversion:
+        mk_int(l);
+        mk_int(l);
+        mk_charS(l);
+        mk_int(l);
+		break;
+	case sc_mount:
+        mk_int(l);
+        mk_int(l);
+        mk_charS(l);
+        mk_int(l);
+        mk_charS(l);
+		break;
+	case sc_unmount:
+        mk_charS(l);
+        mk_charS(l);
+		break;
+	case sc_noted:
+        mk_int(l);
+		break;
+	case sc_notify:
+
+        // wtf?
+
+		break;
+	case sc_open:
+        mk_charS(l);
+        mk_int(l);
+		break;
+	case sc_fd2path:
+        mk_int(l);
+        mk_charS(l);
+        mk_int(l);
+		break;
+	case sc_pipe:
+        mk_intS(l);
+		break;
+	case sc_pread:
+        mk_int(l);
+        mk_voidS(l);
+        mk_long(l);
+        mk_vlong(l);
+		break;
+	case sc_preadv:
+        mk_int(l);
+        mk_IOchunkS(l);
+        mk_int(l);
+        mk_vlong(l);
+		break;
+	case sc_pwrite:
+        mk_int(l);
+        mk_voidS(l);
+        mk_long(l);
+        mk_vlong(l);
+		break;
+	case sc_pwritev:
+        mk_int(l);
+        mk_IOchunkS(l);
+        mk_int(l);
+        mk_vlong(l);
+		break;
+	case sc_read:
+        mk_int(l);
+        mk_voidS(l);
+        mk_long(l);
+		break;
+	case sc_readn:
+        mk_int(l);
+        mk_voidS(l);
+        mk_long(l);
+		break;
+	case sc_readv:
+        mk_int(l);
+        mk_IOchunkS(l);
+        mk_int(l);
+		break;
+	case sc_remove:
+        mk_charS(l);
+		break;
+	case sc_sbrk:
+        mk_ulong(l);
+		break;
+	case sc_oseek:
+        mk_int(l);
+        mk_long(l);
+        mk_int(l);
+		break;
+	case sc_seek:
+        mk_int(l);
+        mk_vlong(l);
+        mk_int(l);
+		break;
+	case sc_segattach:
+        mk_int(l);
+        mk_charS(l);
+        mk_voidS(l);
+        mk_ulong(l);
+		break;
+	case sc_segbrk:
+        mk_voidS(l);
+        mk_voidS(l);
+		break;
+	case sc_segdetach:
+        mk_voidS(l);
+		break;
+	case sc_segflush:
+        mk_voidS(l);
+        mk_ulong(l);
+		break;
+	case sc_segfree:
+        mk_voidS(l);
+        mk_ulong(l);
+		break;
+	case sc_semacquire:
+        mk_longS(l);
+        mk_int(l);
+		break;
+	case sc_semrelease:
+        mk_longS(l);
+        mk_long(l);
+		break;
+	case sc_sleep:
+        mk_long(l);
+		break;
+	case sc_stat:
+        mk_charS(l);
+        mk_ucharS(l);
+        mk_int(l);
+		break;
+	case sc_tsemacquire:
+        mk_longS(l);
+        mk_ulong(l);
+		break;
+	case sc_wait:
+        mk_void(l);
+		break;
+	case sc_waitpid:
+        mk_void(l);
+		break;
+	case sc_write:
+        mk_int(l);
+        mk_voidS(l);
+        mk_long(l);
+		break;
+	case sc_writev:
+        mk_int(l);
+        mk_IOchunkS(l);
+        mk_int(l);
+		break;
+	case sc_wstat:
+        mk_charS(l);
+        mk_ucharS(l);
+        mk_int(l);
+		break;
+	case sc_rendezvous:
+        mk_voidS(l);
+        mk_voidS(l);
+		break;
+	case sc_dirstat:
+        mk_charS(l);
+		break;
+	case sc_dirfstat:
+        mk_int(l);
+		break;
+	case sc_dirwstat:
+        mk_charS(l);
+        mk_DirS(l);
+		break;
+	case sc_dirfwstat:
+        mk_int(l);
+        mk_DirS(l);
+		break;
+	case sc_dirread:
+        mk_int(l);
+        mk_DirSS(l);
+		break;
+	case sc_nulldir:
+        mk_DirS(l);
+		break;
+	case sc_dirreadall:
+        mk_int(l);
+        mk_DirSS(l);
+		break;
+	case sc_getpid	:
+        mk_void(l);
+		break;
+	case sc_getppid:
+        mk_void(l);
+		break;
+	case sc_rerrstr:
+        mk_charS(l);
+        mk_uint(l);
+		break;
+	case sc_sysname:
+        mk_void(l);
+		break;
+	case sc_werrstr:
+        mk_charS(l);
+		break;
+	}
+
+	return nil;
+}
--- /dev/null
+++ b/input.c
@@ -1,0 +1,1199 @@
+#include "fuzz.h"
+
+// Procedurally generate input to syscall
+void
+fuzz(caller *sc)
+{
+	// increment the round counter
+	(sc->round)++;
+
+	debug("DEBUG: sc_c = %d\n", sc->c);
+
+	// TODO
+	switch(sc->c) {
+		case sc_exits :			//	_exits(char*);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			exits( *(char**)((t_type*)lget(&(sc->inputs), 0))->var );
+
+			break;
+		case sc_abort :			//	abort(void);
+			dolog("!! Someone called abort, don't do that.\n");
+			/* NOPE
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			abort();
+			*/
+
+			break;
+		case sc_access : ;		//	access(char* : int);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			access(	*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_alarm :			//	alarm(ulong);
+			// mutate the input
+			mut_ulong((ulong*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			alarm( *(ulong*)((t_type*)lget(&(sc->inputs), 0))->var );
+
+			break;
+		case sc_await :			//	await(char* : int);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			await(	*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_bind :			//	bind(char* : char* : int);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			*(char**)(((t_type*)lget(&(sc->inputs), 1))->var) = mut_charstar();
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			bind(	*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(char**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_brk :			//	brk(void*);
+			break;
+		case sc_chdir :			//	chdir(char*);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			chdir( *(char**)((t_type*)lget(&(sc->inputs), 0))->var );
+
+			break;
+		case sc_close :			//	close(int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			close(*(int*)((t_type*)lget(&(sc->inputs), 0))->var);
+
+			break;
+		case sc_create :		//	create(char* : int : ulong);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			// Segfaults when fuzzing close() ↓
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_ulong((ulong*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			create(	*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(ulong*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_dup :			//	dup(int : int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			dup(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 1))->var);
+
+			break;
+		case sc_errstr :;		//	errstr(char* : uint);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			mut_uint((uint*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			//errstr(	*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+			//	*(uint*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_exec :			//	exec(char* : char*[]);
+			//TODO - mut_char_star_arr not implemented
+			/*mut_charstar((char**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			int len = mut_charstararr((char***)((t_type*)lget(&(sc->inputs), 1))->var);
+
+			// compute the hash
+			log_call(sc);
+
+			hjsync();
+
+			exec(*(char**)((t_type*)lget(&(sc->inputs), 0))->var, *(char***)((t_type*)lget(&(sc->inputs), 1))->var);
+	
+			free_charstararr((char***)((t_type*)lget(&(sc->inputs), 1))->var, len);
+			*/
+			break;
+		case sc_execl :			//	execl(char* : ...);
+			//TODO - not sure what to do with variable # of parameters
+			fprint(2, "Error: Syscall not implemented!\n");
+			exits("SYSCALL NOT IMPLEMENTED");
+			break;
+		case sc_fork :			//	fork(void);
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			fork();
+
+			break;
+		case sc_rfork :			//	rfork(int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			rfork(*(int*)((t_type*)lget(&(sc->inputs), 0))->var);
+
+			break;
+		case sc_fauth :			//	fauth(int : char*);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			*(char**)(((t_type*)lget(&(sc->inputs), 1))->var) = mut_charstar();
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			fauth(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(char**)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_fstat :			//	fstat(int : uchar* : int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_ucharstar((unsigned char**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			fstat(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(unsigned char**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_fwstat :		//	fwstat(int : uchar* : int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_ucharstar((unsigned char**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			fwstat(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(unsigned char**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_fversion :		//	fversion(int : int : char* : int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			*(char**)(((t_type*)lget(&(sc->inputs), 2))->var) = mut_charstar();
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 3))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			fversion(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(int*)((t_type*)lget(&(sc->inputs), 1))->var,
+					*(char**)((t_type*)lget(&(sc->inputs), 2))->var,
+					*(int*)((t_type*)lget(&(sc->inputs), 3))->var );
+
+			break;
+		case sc_mount :			//	mount(int : int : char* : int : char*);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			*(char**)(((t_type*)lget(&(sc->inputs), 2))->var) = mut_charstar();
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 3))->var, &sc->round);
+			*(char**)(((t_type*)lget(&(sc->inputs), 4))->var) = mut_charstar();
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			mount(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(char**)((t_type*)lget(&(sc->inputs), 2))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 3))->var,
+				*(char**)((t_type*)lget(&(sc->inputs), 4))->var );
+
+			break;
+		case sc_unmount :		//	unmount(char* : char*);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			*(char**)(((t_type*)lget(&(sc->inputs), 1))->var) = mut_charstar();
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			unmount(*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(char**)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_noted :			//	noted(int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			noted(*(int*)((t_type*)lget(&(sc->inputs), 0))->var);
+
+			break;
+		case sc_notify :		//	notify(void(*)(void* : char*));
+			//TODO - this sc takes a function pointer, we don't have infrastructure for that
+			fprint(2, "Error: Syscall not implemented!\n");
+			exits("SYSCALL NOT IMPLEMENTED");
+			break;
+		case sc_open :			//	open(char* : int);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			open(	*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_fd2path :		//	fd2path(int : char* : int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			*(char**)(((t_type*)lget(&(sc->inputs), 1))->var) = mut_charstar();
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			fd2path(*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(char**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_pipe :			//	pipe(int*);
+			mut_intstar((int**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			log_call(sc);
+
+			hjsync();
+
+			pipe(*(int**)((t_type*)lget(&(sc->inputs), 0))->var);
+
+			break;
+		case sc_pread :			//	pread(int : void* : long : vlong);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_long((long*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+			mut_vlong((long long*)((t_type*)lget(&(sc->inputs), 3))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			pread(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(void**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(long*)((t_type*)lget(&(sc->inputs), 2))->var,
+				*(long long*)((t_type*)lget(&(sc->inputs), 3))->var );
+
+			break;
+		case sc_preadv :		//	preadv(int : IOchunk* : int : vlong);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_IOchunkstar((IOchunk**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+			mut_vlong((long long*)((t_type*)lget(&(sc->inputs), 3))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			preadv(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(IOchunk**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var,
+				*(long long*)((t_type*)lget(&(sc->inputs), 3))->var );
+
+			break;
+		case sc_pwrite :		//	pwrite(int : void* : long : vlong);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_long((long*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+			mut_vlong((long long*)((t_type*)lget(&(sc->inputs), 3))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			pwrite(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(void**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(long*)((t_type*)lget(&(sc->inputs), 2))->var,
+				*(long long*)((t_type*)lget(&(sc->inputs), 3))->var );
+
+			break;
+		case sc_pwritev :		//	pwritev(int : IOchunk* : int : vlong);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_IOchunkstar((IOchunk**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+			// Segfaults on fuzzing read() ↓
+			mut_vlong((long long*)((t_type*)lget(&(sc->inputs), 3))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			pwritev(*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(IOchunk**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var,
+				*(long long*)((t_type*)lget(&(sc->inputs), 3))->var );
+
+			break;
+		case sc_read :			//	read(int : void* : long);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_long((long*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			read(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(void**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(long*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_readn :			//	readn(int : void* : long);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_long((long*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			readn(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(void**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(long*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_readv :			//	readv(int : IOchunk* : int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_IOchunkstar((IOchunk**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			readv(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(IOchunk**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_remove :		//	remove(char*);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			remove( *(char**)((t_type*)lget(&(sc->inputs), 0))->var );
+
+			break;
+		case sc_sbrk :			//	sbrk(ulong);
+			// mutate the input
+			mut_ulong((ulong*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			sbrk( *(ulong*)((t_type*)lget(&(sc->inputs), 0))->var );
+
+			break;
+		case sc_oseek :			//	oseek(int : long : int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_long((long*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			oseek(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(long*)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_seek :			//	seek(int : vlong : int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_vlong((long long*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			seek(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(long long*)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_segattach :		//	segattach(int : char* : void* : ulong);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			*(char**)(((t_type*)lget(&(sc->inputs), 1))->var) = mut_charstar();
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+			mut_ulong((unsigned long*)((t_type*)lget(&(sc->inputs), 3))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			segattach(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(char**)((t_type*)lget(&(sc->inputs), 1))->var,
+					*(void**)((t_type*)lget(&(sc->inputs), 2))->var,
+					*(unsigned long*)((t_type*)lget(&(sc->inputs), 3))->var );
+
+			break;
+		case sc_segbrk	 :		//	segbrk(void* : void*);
+			// mutate the input
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			segbrk(	*(void**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(void**)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_segdetach :		//	segdetach(void*);
+			// mutate the input
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			segdetach( *(void**)((t_type*)lget(&(sc->inputs), 0))->var );
+
+			break;
+		case sc_segflush :		//	segflush(void* : ulong);
+			// mutate the input
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_ulong((unsigned long*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			segflush(	*(void**)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(unsigned long*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_segfree :		//	segfree(void* : ulong);
+			// mutate the input
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_ulong((unsigned long*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			segfree(*(void**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(unsigned long*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_semacquire :		//	semacquire(long* : int);
+			// mutate the input
+			mut_longstar((long**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			semacquire(	*(long**)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(int*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_semrelease :		//	semrelease(long* : long);
+			// mutate the input
+			mut_longstar((long**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_long((long*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			semrelease(	*(long**)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(long*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_sleep :			//	sleep(long);
+			// mutate the input
+			mut_long((long*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			sleep( *(long*)((t_type*)lget(&(sc->inputs), 0))->var );
+
+			break;
+		case sc_stat :			//	stat(char* : uchar* : int);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			mut_ucharstar((unsigned char**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			stat(	*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(unsigned char**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_tsemacquire :		//	tsemacquire(long* : ulong);
+			// mutate the input
+			mut_longstar((long**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_ulong((ulong*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			tsemacquire(	*(long**)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(ulong*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_wait :			//	wait(void);
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			wait();
+
+			break;
+		case sc_waitpid :		//	waitpid(void);
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			waitpid();
+
+			break;
+		case sc_write :			//	write(int : void* : long);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_long((long*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			write(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(void**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(long*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_writev :		//	writev(int : IOchunk* : int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_IOchunkstar((IOchunk**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			writev(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(IOchunk**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_wstat :			//	wstat(char* : uchar* : int);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			mut_ucharstar((unsigned char**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 2))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			wstat(	*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(unsigned char**)((t_type*)lget(&(sc->inputs), 1))->var,
+				*(int*)((t_type*)lget(&(sc->inputs), 2))->var );
+
+			break;
+		case sc_rendezvous :		//	rendezvous(void* : void*);
+			// mutate the input
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_voidstar((void**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			rendezvous(	*(void**)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(void**)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_dirstat :		//	dirstat(char*);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			dirstat( *(char**)((t_type*)lget(&(sc->inputs), 0))->var );
+
+			break;
+		case sc_dirfstat :		//	dirfstat(int);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			dirfstat(*(int*)((t_type*)lget(&(sc->inputs), 0))->var);
+
+			break;
+		case sc_dirwstat :		//	dirwstat(char* : Dir*);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			mut_dirstar((Dir**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			dirwstat(	*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(Dir**)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_dirfwstat :		//	dirfwstat(int : Dir*);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_dirstar((Dir**)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			dirfwstat(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(Dir**)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_dirread :		//	dirread(int : Dir**);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_dirstar_star((Dir***)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			dirread(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(Dir***)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_nulldir :		//	nulldir(Dir*);
+			// mutate the input
+			mut_dirstar((Dir**)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			nulldir( *(Dir**)((t_type*)lget(&(sc->inputs), 0))->var );
+
+			break;
+		case sc_dirreadall :		//	dirreadall(int : Dir**);
+			// mutate the input
+			mut_int((int*)((t_type*)lget(&(sc->inputs), 0))->var, &sc->round);
+			mut_dirstar_star((Dir***)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			dirreadall(	*(int*)((t_type*)lget(&(sc->inputs), 0))->var,
+					*(Dir***)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_getpid :		//	getpid(void);
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			getpid();
+
+			break;
+		case sc_getppid	:		//	getppid(void);
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			getppid();
+
+			break;
+		case sc_rerrstr :		//	rerrstr(char* : uint);
+			// mutate the input
+			*(char**)(((t_type*)lget(&(sc->inputs), 0))->var) = mut_charstar();
+			mut_uint((uint*)((t_type*)lget(&(sc->inputs), 1))->var, &sc->round);
+
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			rerrstr(*(char**)((t_type*)lget(&(sc->inputs), 0))->var,
+				*(uint*)((t_type*)lget(&(sc->inputs), 1))->var );
+
+			break;
+		case sc_sysname :		//	sysname(void);
+			// log the variables
+			log_call(sc);
+
+			// sync the disk
+			hjsync();
+
+			// execute the call
+			sysname();
+
+			break;
+		case sc_werrstr :		//	werrstr(char* : ...);
+			//TODO - not sure what to do with variable # of parameters
+			fprint(2, "Error: Syscall not implemented!\n");
+			exits("SYSCALL NOT IMPLEMENTED");
+			break;
+		default:
+			fprint(2, "Error: Unknown system call encountered!\n");
+			exits("Unknown system call");
+		
+	}
+}
+
+// Logs the syscall arguments
+void
+log_call(caller *sc)
+{
+	dolog("\nSystem Call: %s\n", sc->name);
+	// legacy since this is printed elsewhere
+	//dolog("\n\tRound #: %d\n", sc->round);
+	dolog("Arguments:\n");
+	int x;
+	for (x = 0; x < (sc->inputs.size); x++) {
+		t_type* ele = lget(&(sc->inputs), x);
+
+		dolog("\t\t%s : ", typenames[ele->t]);
+
+		switch(ele->t) {
+			case t_int :
+				dolog("%d\n", *(int*) ele->var);
+				break;
+			case t_intS :
+				if (sc->round == 0)
+				    dolog("NIL");
+				else
+				    dolog("%d\n", *(int*) ele->var);
+				break;
+			case t_uint :
+				dolog("%d\n", *(unsigned int*) ele->var);
+				break;
+			case t_long :
+				dolog("%ld\n", *(long*) ele->var);
+				break;
+			case t_ulong :
+				dolog("%lud\n", *(unsigned long*) ele->var);
+				break;
+			case t_vlong :
+				dolog("%lld\n", *(long long*) ele->var);
+				break;
+			case t_longS :
+				if (sc->round == 0)
+				    dolog("NIL");
+				else
+				    dolog("%ld\n", *(long*) ele->var);
+				break;
+			case t_DirS :  //TODO : verify that this works; compiler warns against
+				// It doesn't, Dir* is a pointer to a struct Dir; see libc.h:621
+				// dolog("%s\n", (Dir*) ele->var);
+				break;
+			case t_charS :
+				// TODO -- segfaults
+				debug("ele->var ptr is: %p\n", ele->var);
+				if (ele->var == nil)	
+				    dolog("Is nil\n");
+				else
+				    dolog("%s\n", *(char**) ele->var);
+				break;
+			case t_charSArr :
+				//dolog("%s\n", (char**) ele->var);
+				break;
+			case t_char :
+				dolog("%c\n", *(char*) ele->var);
+				break;
+			case t_uchar :
+				dolog("%c\n", *(unsigned char*) ele->var);
+				break;
+			case t_void:
+				dolog("skipping over…\n");
+				break;
+			default :
+				fprint(2, "Error: Encountered unknown input variable type!\n");
+				exits("Unknown input variable type!");
+		}
+		dolog("\n");
+	}
+}
+
+// Syncs the disk in hjfs
+void
+hjsync()
+{
+	// open file and write to sync disk
+	int hjfs = open("/srv/hjfs.cmd", OWRITE);
+	fprint(hjfs, "sync\n");
+	close(hjfs);
+}
+
+// Init callnames here, is extern in fuzz.h
+char *callnames[NCALLS]= {
+"_exits",
+"abort",
+"access",
+"alarm",
+"await",
+"bind",
+"brk",
+"chdir",
+"close",
+"create",
+"dup",
+"errstr",
+"exec",
+"execl",
+"exits",
+"fork",
+"rfork",
+"fauth",
+"fstat",
+"fwstat",
+"fversion",
+"mount",
+"unmount",
+"noted",
+"notify",
+"open",
+"fd2path",
+"pipe",
+"pread",
+"preadv",
+"pwrite",
+"pwritev",
+"read",
+"readn",
+"readv",
+"remove",
+"sbrk",
+"oseek",
+"seek",
+"segattach",
+"segbrk",
+"segdetach",
+"segflush",
+"segfree",
+"semacquire",
+"semrelease",
+"sleep",
+"stat",
+"tsemacquire",
+"wait",
+"waitpid",
+"write",
+"writev",
+"wstat",
+"rendezvous",
+"dirstat",
+"dirfstat",
+"dirwstat",
+"dirfwstat",
+"dirread",
+"nulldir",
+"dirreadall",
+"getpid",
+"getppid",
+"rerrstr",
+"sysname",
+"werrstr"
+};
+
+// Init callnames here, is extern in fuzz.h
+char *typenames[NTYPES]= {
+"int",
+"int*",
+"uint",
+"IOchunk*",
+"long",
+"long*",
+"ulong",
+"vlong",
+"Dir*",
+"Dir**",
+"char"
+"uchar",
+"uchar*",
+"char*",
+"char*[]",
+"void",
+"void*"
+};
--- /dev/null
+++ b/list.c
@@ -1,0 +1,105 @@
+#include <u.h>
+#include <libc.h>
+#include "list.h"
+
+// Create a new list
+List
+mklist()
+{
+	return (List){nil, 0};
+}
+
+// Append to a list
+void
+ladd(List* l, void* p)
+{
+	int i;
+	Node* new = malloc(sizeof(Node));
+	new->dat = p;
+	new->next = nil;
+	Node* n = l->root;
+	
+	if(l->size == 0){
+		l->root = new;
+		new->next = nil;
+		l->size++;
+		return;
+	}
+
+	for(i = 0; i < l->size; i++){
+		if(i != l->size-1)
+			n = n->next;
+	}
+	
+	n->next = new;
+	new->next = nil;
+	l->size++;
+	return;
+	
+}
+
+// Search → delete from a list
+void*
+ldel(List* l, void* tofind, int(*comp)(void *, void *))
+{
+	int i;
+	void* dat = nil;
+	Node* n = l->root;
+	Node* prev = nil;
+	
+	if(l->size == 0){
+		return dat;
+	}
+
+	for(i = 0; i < l->size; i++){
+		if((*comp)(n->dat, tofind)){
+			if(l->size == 1){
+				// 1 node
+				dat = n->dat;
+				free(n);
+				l->root = nil;
+			}else if(i == 0){
+				// 0 nodes
+				l->root = n->next;
+				dat = n->dat;
+				free(n);
+			}else if(i == l->size-1){
+				// We are the last node
+				prev->next = nil;
+				dat = n->dat;
+				free(n);
+			}else{
+				// this is probably unsafe
+				prev->next = n->next;
+				dat = n->dat;
+				free(n);
+			}
+			l->size--;
+			return dat;
+		}
+		
+		prev = n;
+		if(i != l->size-1)
+			n = n->next;
+			
+	}
+	return dat;
+}
+
+// Gets a list element by "index" -- ArrayList style
+void*
+lget(List *l, int index)
+{
+	// Out of bounds check
+	if(index < 0 || index >= l->size)
+		return nil;
+
+	int i;
+	Node* n = l->root;
+	for(i = 0; i < l->size; i++, n = n->next)
+		if(i == index)
+			return n->dat;
+
+	// Should never happen
+	return nil;
+}
--- /dev/null
+++ b/list.h
@@ -1,0 +1,30 @@
+#ifndef LIST_H
+#define LIST_H
+
+/* List (Queue) Architecture */
+typedef struct Node Node;
+typedef struct List List;
+
+struct Node {
+	Node*	next;
+	void*	dat;
+};
+
+struct List {
+	Node*	root;
+	int		size;
+};
+
+// Create a new list
+List mklist(void);
+
+// Append to a list
+void ladd(List*, void*);
+
+// Search → delete from a list
+void* ldel(List*, void*, int(*comp)(void *, void *));
+
+// Access elements of a list by 'index'
+void* lget(List*, int);
+
+#endif
--- /dev/null
+++ b/main.c
@@ -1,0 +1,166 @@
+#include "fuzz.h"
+
+// Global variables are bad
+int		logfd = -1; // fd of the log file, initialized in main
+Lock	loglck;		// Lock for logger
+Lock	rnglck;		// Lock for rng
+
+// Commandline usage warning
+void
+usage(void)
+{
+	fprint(2, "usage: %s [-n rounds] calls\n", argv0);
+	exits("usage");
+}
+
+// Perform locked logging operation -- wraps print
+void
+dolog(char *fmt, ...)
+{
+	va_list args;
+	va_start(args, fmt);
+
+	lock(&loglck);
+	vfprint(logfd, fmt, args);
+	unlock(&loglck);
+
+	va_end(args);
+}
+
+// Perform a debug mode print (if built with -DDEBUG)
+void
+debug(char *fmt, ...)
+{
+	#ifdef DEBUG
+	va_list args;
+	va_start(args, fmt);
+
+	vfprint(1, fmt, args);
+
+	va_end(args);
+	#endif
+}
+
+// Thread-safe sleepable random number generator
+int
+rng(void)
+{
+	ulong x;
+	lock(&rnglck);
+	// Generate a number: 0 ≤ x ≤ MAXINT
+	x = nrand(MAXINT);
+	//debug("DEBUG: Generated num is: %d\n", x);
+	unlock(&rnglck);
+	return x;
+}
+
+/* Prototypes */
+void	initsctable(void);
+int		name2index(char*);
+
+
+// A kernel fuzzer for the Plan 9 kernel
+void
+main(int argc, char *argv[])
+{
+	int nrounds = -1, i;
+	List tofuzz = mklist() ; // List of syscall table ID's to fuzz
+
+	ARGBEGIN{
+		case 'n':
+			// Number of rounds to iterate fuzzing for
+			nrounds = atoi(ARGF());
+			break;
+		default:
+			usage();
+	}ARGEND
+
+	// Initialize the table of all system calls
+	initsctable();
+	
+	// If no system calls are specified, throw usage()
+	if(argc == 0)
+		usage();
+
+	// If the call name '?' is specified as the first argument, print all call names
+	if(strcmp(*argv, "?") == 0){
+		int i;
+		for(i = 0; i < NCALLS; i++)
+			print("%s\n", callnames[i]);
+		exits("Listing all known system calls");
+	}
+	
+	// Acquire a list of calls specified by spaces (fuzz -n 1 read write seek)
+	for(;*argv;argv++){
+		int index;
+		if((index = name2index(*argv)) > 0){
+		
+			debug("DEBUG index %d matched to \"%s\"\n", index, *argv);
+			
+			dolog("Loading call: %s\n", *argv);
+			ladd(&tofuzz, &syscalls[index]); // Might be dangerous, pls fix
+		}else{
+			fprint(2, "Error: Invalid system call: %s\n", *argv);
+			exits("Encountered invalid syscall");
+		}
+	}
+	
+	logfd = create("./fuzz.log", OWRITE, 0777);
+	if(logfd < 0){
+		fprint(2, "Error: Failed to create/open log file.");
+		exits("log file create fail");
+	}
+
+	int fuzz_seed = truerand();
+	srand(fuzz_seed);
+	dolog("== Seed Value: %d ==\n", fuzz_seed);
+
+	// Operate for the desired number of rounds, -1 is infinite
+	for(i = 0; i < nrounds || nrounds < 0; i++){
+		int j;
+		dolog("== Begin round %d ==\n", i);
+		
+		debug("DEBUG: i: %d nrounds: %d\n", i, nrounds);
+		
+		for(j = 0; j < tofuzz.size; j++){
+		
+			debug("DEBUG: tofuzz.size: %d\n", tofuzz.size);
+			
+			caller *fcall = (caller*) lget(&tofuzz, j);
+			dolog("­­ Fuzzing: %s ­­\n", fcall->name);
+			
+			fuzz(fcall); // Fuzz, syncs the disk
+		}	
+	}
+
+	fprint(2, "Fuzz ending…\n");
+	close(logfd);
+	exits(nil);
+}
+
+
+// Initialize the syscall table -- hopefully deprecated by a lex/yacc builder
+void
+initsctable(void)
+{
+	int i;
+	for(i = 0; i < NCALLS; i++){
+		syscalls[i].c = (call)i;
+		syscalls[i].name = callnames[i]; // Pointer points to callnames
+		syscalls[i].round = -1;
+		syscalls[i].seed = -1;
+		mkinlist(&(syscalls[i].inputs), (call)i);
+	}
+}
+
+// Given a syscall name, return the index it occurs -- or -1 if not found
+int
+name2index(char* name)
+{
+	int i;
+	for(i = 0; i < NCALLS; i++){
+		if(strcmp(syscalls[i].name, name) == 0)
+			return i;
+	}
+	return -1;
+}
--- /dev/null
+++ b/mkfile
@@ -1,0 +1,22 @@
+</$objtype/mkfile
+
+TARG = fuzz
+
+BIN = /$objtype/bin
+
+OFILES = main.$O \
+		input.$O \
+		mutate.$O \
+		list.$O \
+		inlist.$O
+
+HFILES = fuzz.h list.h mutate.h
+
+MAN = fuzz.man
+
+</sys/src/cmd/mkone
+
+# Add things after this line
+
+debug: nuke
+	 mk all 'CFLAGS=$CFLAGS -DDEBUG'
--- /dev/null
+++ b/mutate.c
@@ -1,0 +1,320 @@
+#include "fuzz.h"
+
+#ifndef ROUND_NUM
+#define ROUND_NUM 1
+#endif // ROUND_NUM
+
+void
+mut_int(int* in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        *in_val = rng();
+    }
+    else
+    {
+        *in_val = *in_val << (rng() % (4 + 1 - 0) + 0);
+        // Segfaults when fuzzing close() ↓
+        *in_val = *in_val |= (rng() % (15 + 1 - 0) + 0);
+    }
+}
+
+void
+mut_intstar(int** in_val, int* round)
+{
+	if(*round == ROUND_NUM)
+	{
+		in_val = (int**) malloc(sizeof(int*));
+		*in_val = (int*) malloc(sizeof(int));
+		**in_val = rng();
+	}
+	else
+	{
+	    **in_val = **in_val << (rng() % (4 + 1 - 0) + 0);
+        **in_val = **in_val |= (rng() % (15 + 1 - 0) + 0);
+	}
+}
+
+void
+mut_uint(unsigned int* in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        *in_val = rng();
+    }
+    else
+    {
+        *in_val = *in_val << (rng() % (4 + 1 - 0) + 0);
+        *in_val = *in_val |= (rng() % (15 + 1 - 0) + 0);
+    }
+}
+
+char*
+mut_charstar()
+{
+	int size = (rng() % (256 + 1 - 2) + 2);
+	char* val = calloc(size, sizeof(char));
+	int i;
+	for(i = 0; i < size - 1; i++)
+	{
+	    val[i] = rng() % 255;
+	}    
+	return val;
+/*
+    // if not round 1, free the previously malloc-ed memory
+    if(in_val != nil)//*round != ROUND_NUM && *round != 0)
+    {
+    //    free(*in_val);
+	debug("mut_charstar: in_val != nil\n");
+    }
+    if (*round == 1)
+    {
+        in_val = malloc(1 * sizeof(char*));
+    }
+
+    if(*round > 0){
+	    const int MAX_SIZE = 256;
+	    int size = rng() % MAX_SIZE + 1;
+
+	    debug("inside mut, round: %d in_val: %p\n", *round, in_val);
+
+	    *in_val = malloc(sizeof(char) * size);
+	    // in_val = malloc(size * sizeof(char));
+
+	    int i;
+	    for(i = 0; i < size; i++)
+	    {
+		(*in_val)[i] = rng() % 255;
+	    }
+	    (*in_val)[size - 1] = '\0';
+    debug("mut_charstar: *in_val : %s\n", *in_val);
+    debug("mut_charstar: in_val : %p\n", in_val);
+	
+    }
+*/
+/*	if (*round == 1)
+	{
+		char** c = malloc(1 * sizeof(char*));
+		in_val = c;
+	}
+	if (*round > 0)
+	{
+		const int MAX_SIZE = 256;
+	    	int size = rng() % MAX_SIZE + 1;
+
+	    	debug("inside mut, round: %d in_val: %p\n", *round, in_val);
+
+		char** c = (char**) in_val;
+		*c = malloc(size * sizeof(char));
+		debug("inside mut, round %d c: %p in_val: %p\n", *round, c, in_val);
+		int i;
+		for(i = 0; i < size; i++)
+		{
+			(*c)[i] = rng() % 255;
+		}
+		(*c)[size - 1] = '\0';
+
+	}*/
+}
+
+void
+mut_ucharstar(unsigned char** in_val, int *round)
+{
+    // if not round 1, free the previously malloc-ed memory
+    if(*round != ROUND_NUM)
+        free(*in_val);
+
+    const int MAX_SIZE = 2048;
+    int size = rng() % MAX_SIZE + 1;
+
+    *in_val = malloc(sizeof(char) * size);
+
+    int i;
+    for(i = 0; i < size; i++)
+    {
+        (*in_val)[i] = rng() % 255;
+    }
+    (*in_val)[size - 1] = '\0';
+}
+
+int
+mut_charstararr(char*** in_val)
+{
+    int length = (rng() % (16 + 1 - 1) + 1);
+	dolog("Length: %d", length);
+	hjsync();
+    // malloc the pointer to the array
+    in_val = malloc(sizeof(char*));
+    // malloc the pointer to the char arrays
+    *in_val = malloc(length * sizeof(char*));
+
+    int y, z;
+    for (y = 0; y < length; y++)
+    {
+        // malloc the char arrays
+	int size = (rng() % (64 + 1 - 2) + 2);
+	*in_val[y] = calloc(size, sizeof(char));
+	// init the chars to rng values
+	for (z = 0; z < size - 1; z++)
+	{
+	    *in_val[y][z] = (rng() % (255 + 1 - 1) + 1);
+	}
+    }
+
+    return length;
+}
+
+void free_charstararr(char*** in_val, int len)
+{
+	int x;
+	for (x = 0; x < len; x++)
+	{
+		free(*in_val[x]);
+	}
+	free(*in_val);
+	free(in_val);
+}
+
+void
+mut_long(long* in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        *in_val = (rng() << 16) | rng();
+    }
+    else
+    {
+        *in_val = *in_val << (rng() % (4 + 1 - 0) + 0);
+        *in_val = *in_val |= (rng() % (15 + 1 - 0) + 0);
+    }
+}
+
+void
+mut_longstar(long** in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+	// TODO -- check that this is correct
+	in_val = (long**) malloc(sizeof(long*));
+	*in_val = (long*) malloc(sizeof(long));
+	**in_val = (rng() << 16) | rng();
+    }
+    else
+    {
+        **in_val = **in_val << (rng() % (4 + 1 - 0) + 0);
+	// Segfaults when fuzzing sleep ↓
+        **in_val = **in_val |= (rng() % (15 + 1 - 0 ) + 0);
+    }
+}
+
+void
+mut_ulong(unsigned long* in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        *in_val = (rng() << 16) | rng();
+    }
+    else
+    {
+        *in_val = *in_val << (rng() % (4 + 1 - 0) + 0);
+        *in_val = *in_val |= (rng() % (15 + 1 - 0) + 0);
+    }
+}
+
+void
+mut_vlong(long long* in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        *in_val = (rng() << 48) | (rng() << 32) | (rng() << 16) | rng();
+    }
+    else
+    {
+        *in_val = *in_val << (rng() % (4 + 1 - 0) + 0);
+        *in_val = *in_val |= (rng() % (15 + 1 - 0) + 0);
+    }
+}
+
+void
+mut_void(void* in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        //*in_val = rng();
+    }
+    else
+    {
+    }
+}
+
+void
+mut_voidstar(void** in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        //*in_val = rng();
+    }
+    else
+    {
+    }
+}
+
+void
+mut_IOchunk(IOchunk* in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        //*in_val = rng();
+    }
+    else
+    {
+    }
+}
+
+void
+mut_IOchunkstar(IOchunk** in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        //*in_val = rng();
+    }
+    else
+    {
+    }
+}
+
+void
+mut_dir(Dir* in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        //*in_val = rng();
+    }
+    else
+    {
+    }
+}
+
+void
+mut_dirstar(Dir** in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        //*in_val = rng();
+    }
+    else
+    {
+    }
+}
+
+void
+mut_dirstar_star(Dir*** in_val, int *round)
+{
+    if(*round == ROUND_NUM)
+    {
+        //*in_val = rng();
+    }
+    else
+    {
+    }
+}
--- /dev/null
+++ b/mutate.h
@@ -1,0 +1,42 @@
+#ifndef MUT_H
+#define MUT_H
+
+void mut_int(int*, int*);
+
+void mut_intstar(int**, int*);
+
+void mut_uint(uint*, int*);
+
+void mut_char(char*, int*);
+
+char* mut_charstar(void);
+
+void mut_ucharstar(unsigned char**, int*);
+
+int mut_charstararr(char***);
+
+void free_charstararr(char***, int);
+
+void mut_long(long*, int*);
+
+void mut_longstar(long**, int*);
+
+void mut_ulong(unsigned long*, int*);
+
+void mut_vlong(long long*, int*);
+
+void mut_void(void*, int*);
+
+void mut_voidstar(void**, int*);
+
+void mut_IOchunk(IOchunk*, int*);
+
+void mut_IOchunkstar(IOchunk**, int*);
+
+void mut_dir(Dir*, int*);
+
+void mut_dirstar(Dir**, int*);
+
+void mut_dirstar_star(Dir***, int*);
+
+#endif