This repository provides the source code for PROGnosticator: a construct-oriented prototype fuzzer for source-to-source code translators.
This work is presented in our paper PROGnosticator: Testing Source-to-Source Code Translators via Construct-oriented Fuzzing, appearing in the 2026 ACM International Conference on the Foundations of Software Engineering (FSE’26).
| Citing this repository: |
@article{arafat:PROGnosticator, title = {PROGnosticator: Testing Source-to-Source Code Translators via Construct-oriented Fuzzing}, author = {Yeaseen Arafat and Stefan Nagy}, year = {2026}, issue_date = {July 2026}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, volume = {3}, number = {FSE}, journal = {Proc. ACM Softw. Eng.}}
|
| Maintainers: | Yeaseen Arafat (y.arafat@utah.edu) and Stefan Nagy (snagy@cs.utah.edu) |
| License: | MIT License |
| Disclaimer: | This software is provided as-is with no warranty. |
Install prerequisite packages by running setup.sh.
We provide example transpiler fuzzing setups in transpilers (e.g. c2rust, go2hx, etc.). Each folder contains sample programs, a PROGnosticatoring.py launcher, and a short README.
Replicating a per-transpiler fuzzing setup generally requires the following:
- Ensure the transpiler binary itself (e.g.,
c2rust) and any other necessary binaries (e.g.,clang) are all accessible from your$PATHenvironment (details in each correspondingREADME). - Use the matching PROGnosticator-generated dataset from dataset, e.g., dataset/c_dataset.zip for C-input transpilers.
- From the target transpiler folder, run:
python3 PROGnosticatoring.py <input_program_folder> <campaign_id>. - Fuzzing campaign outputs are written to a local campaign directory:
campaign_<campaign_id>.
Below are instructions for extending PROGnosticator:
Supported language keys are: c, go, js, rust, python, and java. To try Rust:
- Set your OpenAI API key
export OPENAI_API_KEY="your_openai_api_key_here" - Run:
cd core && python main.py -F rust 0.2 2 10 --model gpt-4. - See core/README.md for command options and parameter meanings.
- Generated Rust programs are saved under:
core/construct_oriented_program_generator/language/rust/programs/. - Enumerated Rust constructs are saved under:
core/construct_storage/rust/.
For setting up a new language, such as C++, follow core/support_new_language.md.
Follow any existing example in transpilers. Each transpiler folder contains a Python launcher script and sample seeds.
If you find new bugs using PROGnosticator, please let us know!
This material is based upon work supported by the National Science Foundation (NSF) under Award No. 2419798, and by the Defense Advanced Research Projects Agency (DARPA) under Award No. FA8750-24-2-0002, Subaward No. GR105409-SUB00001384.