Open-source alternatives to Aflgo

Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)

Syzkaller is an unsupervised, coverage-guided kernel fuzzer that automatically generates and mutates system call sequences to find bugs in operating system kernels. It operates without human intervention, using a closed feedback loop of input generation, execution, crash detection, and corpus refinement to continuously explore kernel code paths. The fuzzer distinguishes itself by supporting multiple operating system kernels, including Linux, FreeBSD, and Windows, through per-platform syscall harnesses that abstract system call interfaces behind a common driver. It uses declarative description

Bug hunting through fuzzer/*-sanitizer/etc...

RetroWrite -- Retrofitting compiler passes through binary rewriting

SOSP'25 Automatic checker synthesis for system-level static analysis

Linux kernel source tree

Peach is a fuzzing framework which uses a DSL for building fuzzers and an observer based architecture to execute and monitor them.

AFL/QEMU fuzzing with full-system emulation.

MCP agent for Linux kernel PATCH, syzkaller

Cloudfuzzer is a cloud fuzzing framework. Purpose of cloudfuzzer is to make it possible to easily run automated fuzz-testing in cloud environment.

ISSTA 2025 Unlocking Low Frequency Syscalls in Kernel Fuzzing with Dependency-Based RAG

Ph.D. student in the Department of Computer Science & Engineering, at the University of Minnesota (Twin Cities)

Dynamic Race Detection with LLVM compiler (Runtime Verification 2011, co-authored with Kostya Serebryany, Timur Iskhodzhanov, Dmitriy Vyukov)

ANTLR v4 grammar-based test generator

The companion repository for the 39C3 talk: Build a Fake Phone, Find Real Bugs: Qualcomm GPU Emulation and Fuzzing with LibAFL QEMU

🌪️ Application fuzzer

Coverage based JVM Fuzz testing tool.

StepStone contains two main components for GPU syscall fuzzing:

BoKASAN: Binary-only Kernel Address Sanitizer for Effective Kernel Fuzzing

Agamotto: Accelerating Kernel Driver Fuzzing with Lightweight Virtual Machine Checkpoints

VirtFuzz is a Linux Kernel Fuzzer that uses VirtIO to provide inputs into the kernels subsystem. It is built with LibAFL.

MoonShine selects compact and diverse seeds for OS fuzzers from system call traces of real world programs. Please see our USENIX'18 paper MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation for more details. Currently, MoonShine can only generate seeds for Syzkaller on Linux.