AFLplusplus/AFLplusplus
AFLplusplus
AFL++ is a coverage-guided fuzzing framework that discovers crashes and hangs in software by mutating inputs while tracking which code paths are exercised. It functions as both a fuzzing engine and a campaign manager, supporting targets with or without source code through compile-time instrumentation, dynamic binary instrumentation, and emulation. The framework includes tools for crash triage and analysis, test case minimization, and campaign deployment across local or distributed environments.
The framework distinguishes itself through its breadth of instrumentation backends, allowing users to fuzz binary-only targets via QEMU user-mode emulation, Frida runtime instrumentation, static binary rewriting, Unicorn emulation, or full-system emulation with KVM. For source-available programs, it inserts coverage-tracking code at compile time using LLVM or GCC plugins, with options for selective instrumentation, comparison-guided instrumentation, and LAF-INTEL byte-splitting. AFL++ also supports fuzzing Windows PE binaries through Wine and QEMU, shared libraries, network services, GUI programs, and structured data with custom mutators.
Beyond core fuzzing, AFL++ provides utilities for seed collection and deduplication, corpus minimization, crash exploration, and stability measurement. It integrates with continuous integration pipelines for short, randomized runs and supports multi-core scaling with one main and multiple secondary instances, as well as multi-machine synchronization for distributed campaigns. The framework can activate sanitizers during compilation and offers persistent-mode harnesses for increased throughput.
Features
- Coverage-Guided Fuzzing - Drives programs with mutated inputs while tracking code coverage to discover crashes and hangs.
- Fuzzing Campaign Managers - Deploys, monitors, and manages multiple fuzzer instances across local or distributed environments.
- Edge-Coverage Bitmaps - Records control-flow edges into a compact bitmap to guide the fuzzer toward new code paths.
- Coverage-Tracking Injections - Injects coverage-tracking hooks into closed-source binaries using QEMU, Frida, or Unicorn emulation.
- Coverage-Guided Fuzzers - AFL++ guides users through setting up and running coverage-guided fuzzing on a target C or C++ application to discover bugs.
- Coverage-Tracking Insertions - Inserts coverage-tracking code into binaries at compile time using LLVM or GCC plugins for fuzzing.
- Instrumentation - Intercepts compiler invocations to insert coverage-tracking instrumentation into C/C++ programs for fuzzing.
- Fuzz Target Compilation - Compiles target programs with a custom compiler to insert coverage-tracking instrumentation for fuzzing.
- Binary Fuzzing - AFL++ drives a program with mutated inputs while tracking code coverage to discover crashes and hangs.
- Binary-Only Fuzzing Frameworks - Applies dynamic binary instrumentation or emulation to fuzz programs without source code.
- Emulation-Based Fuzzings - Runs coverage-guided fuzzing on compiled programs without source code using emulation techniques.
- Source-Available Program Fuzzings - AFL++ compiles the target with a custom compiler and runs a coverage-guided fuzzer to find crashes and hangs.
- Forkserver - Launches a single instrumented process that forks repeatedly to execute test cases efficiently.
- Multi-Strategy Mutation Engines - Combines deterministic, havoc, and custom mutators with power schedules to maximize coverage.
- Parallel Fuzzing Distributions - Distributes fuzzing campaigns across multiple machines to accelerate vulnerability discovery.
- Fuzzing Test Case Transports - Passes input data between fuzzer and target through shared memory to reduce per-execution overhead.
- Selective Instrumentations - Restricts coverage instrumentation to specified source files or functions, focusing fuzzing on relevant code.
- Fuzzing Campaign Managers - Provides utilities for deploying, monitoring, and managing multiple fuzzer instances across environments.
- Campaign Resumption & Seed Injections - AFL++ resumes a stopped fuzzing session or injects new seed files into an ongoing campaign without losing progress.
- Network Service Fuzzings - AFL++ feeds mutated inputs to a remote service over a network protocol to discover crashes or hangs.
- Fuzzer Instance Synchronizations - Coordinates multiple fuzzer instances by sharing coverage bitmaps and test case queues across processes.
- Fuzzing - Emulates entire x86_64 systems using KVM and QEMU with snapshot support for binary-only fuzzing in a controlled environment.
- Frida Fuzzing Instrumentations - Injects runtime instrumentation via Frida to fuzz binary-only targets on macOS and remote devices like iPhones or Android.
- Comparison-Guided Instrumentations - AFL++ instruments the target to record comparison operands, allowing the fuzzer to solve constraints by placing observed values into input data.
- Comparison Splitting Instrumentations - AFL++ splits integer, string, float, and switch comparisons into byte-by-byte checks so the fuzzer can solve them incrementally.
- Mode Selectors - AFL++ chooses between LTO, LLVM, or GCC_PLUGIN compiler backends to balance instrumentation speed, coverage detail, and compatibility with the target's build system.
- Language Sanitizers - Compiles targets with Address, Memory, Undefined Behavior, or other sanitizers to detect specific bug classes during fuzzing.
- Grammar-Aware Input Generations - AFL++ generates inputs that follow a defined syntax so the fuzzer exercises structured parsers more effectively.
- Sanitizer-Enhanced Fuzzings - AFL++ instruments the target with memory or behaviour sanitizers to catch deeper bugs like buffer overflows.
- Static Binary Rewritings - Rewrites x86-64 or arm64 binaries statically to insert instrumentation for near-compiler-level fuzzing performance.
- Unicorn Emulation Fuzzings - Emulates arbitrary non-Linux binaries using Unicorn with custom runtime scripts for loading and execution.
- Binary Corpus Distillation - Removes seed files that do not add new coverage, reducing corpus bloat and speeding up fuzzing.
- Library Fuzzings - Instruments dynamic libraries by writing a small harness and applying library-specific configuration through QEMU or Frida mode.
- Windows Library Fuzzers for Linux - Emulates Win32 executables through Wine and QEMU to apply instrumentation for fuzzing Windows binaries on Linux.
- Crash Reproduction - AFL++ feeds a saved crash input back to the target program to reproduce and debug the failure.
- Crash Analysis Workflows - Automates the processing, minimization, and analysis of crashing inputs to reduce manual effort.
- Delta Debugging Minimizations - Reduces crashing inputs to minimal forms using the ddmin delta debugging algorithm.
- Execution Resource Limiters - AFL++ sets per-run memory limits and timeout values to prevent the target from hanging or exhausting system resources during fuzzing.
- Seed File Minimizations - Shrinks each seed file to the smallest size that still exercises the same code path, improving fuzzing efficiency.
- Code Coverage Analysis - Provides afl-showmap to report which control-flow edges in the target have been exercised by the current corpus.
- Fuzzing Coverage Analyses - Generates source-based coverage reports from a fuzzing corpus to measure which code paths were exercised.
- Fuzzing Persistent-Mode Harnesses - Writes custom harnesses that reuse a single process to call the target function repeatedly, dramatically increasing fuzzing throughput.
- Continuous Fuzzing - Integrates with CI pipelines for short, randomized fuzzing runs using fast calibration and skipped startup calibration.
- CI/CD Fuzzing Integrations - Configures fuzzing for short, randomized runs in continuous integration pipelines to test new code.
- Data-Dependency Guided Mutations - AFL++ uses information about how input bytes flow through the program to guide mutation toward deeper code.
- Structured Data Mutations - AFL++ defines input structure via protobuf or Superion and applies custom mutators to fuzz targets that expect structured data.
- Test Case Minimization - Applies the ddmin algorithm to reduce test cases to their minimal form.
- Fuzzing and Testing - Community-enhanced fuzzer with coverage support.
- General Purpose Fuzzers - High-performance fuzzer with advanced mutation and instrumentation capabilities.
- Security Tools - Fuzzer based on AFL with community-driven patches.
