- updated to 4.35c
- GUIFuzz++ merged: Unleashing Grey-box Fuzzing on Desktop Graphical User
Interfacing Applications
https://futures.cs.utah.edu/papers/25ASE.pdf
- afl-fuzz:
- fix syncing issues with crashes and custom mutators by @AndyH-1
- another attempt to kill every client, thanks to @leonasdev
- afl-cc:
- Huge refactor for default pcguard instrumentation, several minor and
medium bug fixes, complete hidden decision coverage
- LTO: also added complete hidden decision coverage
- Various small fixes by @nbars, thanks!
- IJON fix to search for the necessary include
- Allow compiling the gcc plugin with clang++, thanks to @exoosh
- Fix for unusual bit sizes in cmplog-instructions-pass by @forzafedor
- qemu_mode:
- IJON support, thanks to @nj00001! see qemu_mode/README.md
- leaner, less warnings, thanks to @McSinyx!
- afl-tmin
- fix custom trimmings, thanks to @renatahodovan!
- custom mutators:
- Gramatron: fixes + cjson switch by @CarvedCoder, fix by @jubnzv (forwarded request 1324709 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1324710
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=94
- updated to 4.35c
- GUIFuzz++ merged: Unleashing Grey-box Fuzzing on Desktop Graphical User
Interfacing Applications
https://futures.cs.utah.edu/papers/25ASE.pdf
- afl-fuzz:
- fix syncing issues with crashes and custom mutators by @AndyH-1
- another attempt to kill every client, thanks to @leonasdev
- afl-cc:
- Huge refactor for default pcguard instrumentation, several minor and
medium bug fixes, complete hidden decision coverage
- LTO: also added complete hidden decision coverage
- Various small fixes by @nbars, thanks!
- IJON fix to search for the necessary include
- Allow compiling the gcc plugin with clang++, thanks to @exoosh
- Fix for unusual bit sizes in cmplog-instructions-pass by @forzafedor
- qemu_mode:
- IJON support, thanks to @nj00001! see qemu_mode/README.md
- leaner, less warnings, thanks to @McSinyx!
- afl-tmin
- fix custom trimmings, thanks to @renatahodovan!
- custom mutators:
- Gramatron: fixes + cjson switch by @CarvedCoder, fix by @jubnzv
OBS-URL: https://build.opensuse.org/request/show/1324709
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=200
- updated to 4.34c
- IJON integration by @vi3tL0u1s - thanks a lot!!
- see docs/IJON.md on how to use it
- unicorn_mode:
- UnicornAFL v3!! thanks to @wtdcode!
- qemu_mode:
- fix compilation for a few platforms
- afl-fuzz
- larger improvements to CMPLOG, thanks to @am009
- scroll down before clearing the screen to not loose content
- minor bug fixes
- afl-showmap
- fix -C parameter breakage introduced in v4.33c
- afl-cc:
- enabled LLVM 22
- new env: AFL_COMPILER_LAUNCHER to allow ccache usage (thanks to @nbars)
- fix a offset calculation bug in AFL++ PCGUARD
- make AFL_DUMP_MAP_SIZE work for CLASSIC modes
- fix a crash when running with LLVM 20 when compiling PCGUARD with LTO
- fix deprecation warnings for LLVM 20+
- fix 128 bit support for cmplog-switches pass
- fix 32 bit cmplog support
- skip blocks for instrumentation that are already instrumented
- Building:
- new NO_UNICORN and NO_QEMU and NO_FRIDA build options
- build fixes for FreeBSD
- custom_mutators:
- added AIXCC Team Atlanta's zero-mq plugin to add testcases from remote (forwarded request 1309618 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1309626
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=92
- updated to 4.34c
- IJON integration by @vi3tL0u1s - thanks a lot!!
- see docs/IJON.md on how to use it
- unicorn_mode:
- UnicornAFL v3!! thanks to @wtdcode!
- qemu_mode:
- fix compilation for a few platforms
- afl-fuzz
- larger improvements to CMPLOG, thanks to @am009
- scroll down before clearing the screen to not loose content
- minor bug fixes
- afl-showmap
- fix -C parameter breakage introduced in v4.33c
- afl-cc:
- enabled LLVM 22
- new env: AFL_COMPILER_LAUNCHER to allow ccache usage (thanks to @nbars)
- fix a offset calculation bug in AFL++ PCGUARD
- make AFL_DUMP_MAP_SIZE work for CLASSIC modes
- fix a crash when running with LLVM 20 when compiling PCGUARD with LTO
- fix deprecation warnings for LLVM 20+
- fix 128 bit support for cmplog-switches pass
- fix 32 bit cmplog support
- skip blocks for instrumentation that are already instrumented
- Building:
- new NO_UNICORN and NO_QEMU and NO_FRIDA build options
- build fixes for FreeBSD
- custom_mutators:
- added AIXCC Team Atlanta's zero-mq plugin to add testcases from remote
OBS-URL: https://build.opensuse.org/request/show/1309618
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=196
- updated to 4.33c
- afl-fuzz:
- Use `AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT` if you use AFL_PRELOAD
to disable fork, see docs (thanks to @alexandredoyen29)
- Fix for FAST power schedules (introduced in 4.32c) (thanks to @kcwu)
- Colors for NO_UI output (thanks to @smoelius)
- Fix potential sync issues when resuming sessions and when instances in a
campaign are restarted and skip entries that were synced from itself
(thanks to @kcwu for raising the issues and providing support!)
- Fix for when fast resuming failed
- more 64 bit archicture support by @maribu
- afl-cc:
- Added instrumenting hidden edges (approx 5% edges were not instrumented,
LLVM sancov overall misses 8% of edges compared to our implementation)
Note that is is currently only implemented for our PCGUARD plugin, not
LTO, CLASSIC, etc.!
- Fix to make AFL_SAN_NO_INST work with gcc_plugin
- MacOS aflpp driver compilation fix (-fsanitize=fuzzer implementation)
- Make AFL_DUMP_MAP_SIZE work even if the target has sanitizer issues
- qemuafl:
- Better MIPS persistent mode support
- `AFL_EXITPOINT` support added
- `AFL_QEMU_BLOCK_COV` block coverage support added
- afl-cmin:
- New afl-cmin.py which is much faster, will be executed by default via
afl-cmin if it executes successfully (thanks to @kcwu!)
- Nyx mode now fully works for minimizing (with afl-cmin.py which is
called by afl-cmin if python is available) - before the map size was
fixed and so large targets lost coverage.
- New desocketing library: utils/libaflppdesock (forwarded request 1289313 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1289314
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=88
- updated to 4.33c
- afl-fuzz:
- Use `AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT` if you use AFL_PRELOAD
to disable fork, see docs (thanks to @alexandredoyen29)
- Fix for FAST power schedules (introduced in 4.32c) (thanks to @kcwu)
- Colors for NO_UI output (thanks to @smoelius)
- Fix potential sync issues when resuming sessions and when instances in a
campaign are restarted and skip entries that were synced from itself
(thanks to @kcwu for raising the issues and providing support!)
- Fix for when fast resuming failed
- more 64 bit archicture support by @maribu
- afl-cc:
- Added instrumenting hidden edges (approx 5% edges were not instrumented,
LLVM sancov overall misses 8% of edges compared to our implementation)
Note that is is currently only implemented for our PCGUARD plugin, not
LTO, CLASSIC, etc.!
- Fix to make AFL_SAN_NO_INST work with gcc_plugin
- MacOS aflpp driver compilation fix (-fsanitize=fuzzer implementation)
- Make AFL_DUMP_MAP_SIZE work even if the target has sanitizer issues
- qemuafl:
- Better MIPS persistent mode support
- `AFL_EXITPOINT` support added
- `AFL_QEMU_BLOCK_COV` block coverage support added
- afl-cmin:
- New afl-cmin.py which is much faster, will be executed by default via
afl-cmin if it executes successfully (thanks to @kcwu!)
- Nyx mode now fully works for minimizing (with afl-cmin.py which is
called by afl-cmin if python is available) - before the map size was
fixed and so large targets lost coverage.
- New desocketing library: utils/libaflppdesock
OBS-URL: https://build.opensuse.org/request/show/1289313
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=188
- updated to 4.32c
- Fixed a bug where after a fast restart of a full fuzzed corpus afl-fuzz
terminates with "need at least one valid input seed that does not crash"
Small improvements to afl-*-config
- afl-fuzz:
- memory leak fixes by @kcwu - thanks!
- many more nits and small memory saves thanks to @kcwu
- remove deprecated files from queue/.state
- fix bitmap update function if no current trace is present
- fix for afl_custom_queue_get
- various small nits
- afl-cc:
- fix pass support for LLVM 20 (passes were run too early)
- dropped plugin support for LLVM 13
- fix AFL_OLD_FORKSERVER
- various minor fixes
- frida_mode:
- fixes for new MacOS + M4 hardware
- 0001-fix-32-bit-compile.patch: upstream
- updated to 4.31c
- SAND mode added (docs/SAND.md) for more effecient fuzzing with sanitizers
(thanks to @wtdcode !)
- afl-fuzz:
- splicing phase is now DISABLED by default because research showed
it is counterproductive. New command line parameter `-u` to enable
it. Splicing is auto-enabled if two cycles without finds happen.
- Python 3.13+ support
- loose file and shared memory permissions on Android and iPhone
- afl-cc: (forwarded request 1273087 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1273088
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=86
- updated to 4.32c
- Fixed a bug where after a fast restart of a full fuzzed corpus afl-fuzz
terminates with "need at least one valid input seed that does not crash"
Small improvements to afl-*-config
- afl-fuzz:
- memory leak fixes by @kcwu - thanks!
- many more nits and small memory saves thanks to @kcwu
- remove deprecated files from queue/.state
- fix bitmap update function if no current trace is present
- fix for afl_custom_queue_get
- various small nits
- afl-cc:
- fix pass support for LLVM 20 (passes were run too early)
- dropped plugin support for LLVM 13
- fix AFL_OLD_FORKSERVER
- various minor fixes
- frida_mode:
- fixes for new MacOS + M4 hardware
- 0001-fix-32-bit-compile.patch: upstream
- updated to 4.31c
- SAND mode added (docs/SAND.md) for more effecient fuzzing with sanitizers
(thanks to @wtdcode !)
- afl-fuzz:
- splicing phase is now DISABLED by default because research showed
it is counterproductive. New command line parameter `-u` to enable
it. Splicing is auto-enabled if two cycles without finds happen.
- Python 3.13+ support
- loose file and shared memory permissions on Android and iPhone
- afl-cc:
OBS-URL: https://build.opensuse.org/request/show/1273087
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=184
- updated to 4.30c
- afl-gcc and afl-clang funcionality is now removed
- afl-fuzz:
- fastresume feature added. if you abort fuzzing and resume fuzzing
with `-i -` or `AFL_AUTORESUME=1` and the target binary has not changed
then a dump will be loaded and the calibration phase skipped.
to disable this feature set `AFL_NO_FASTRESUME=1`
zlib compression is used if zlib is found at compile time
- improved seed selection algorithm
- added `AFL_CUSTOM_MUTATOR_LATE_SEND=1` to call the custom send()
function after the target has been restarted.
- because of bad math and undefined behaviour fixes we have to change
the CMPLOG map. **YOU NEED TO RECOMPILE CMPLOG TARGETS**
- fixed custom_post_process for calibration
- fixes for AFL_EXIT_ON_TIME and AFL_EXIT_WHEN_DONE, changed behaviour of
AFL_EXIT_WHEN_DONE to finish when really done :-)
- frida_mode:
- AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just
a function entry
- AFL_DEBUG is now the same as AFL_FRIDA_VERBOSE
- AFL_FRIDA_DEBUG_MAPS now works as expected
- qemu_mode:
- new hooks supported (optional), see qemu_mode/hooking_bridge - thanks to
@CowBoy4mH3LL
- unicorn_mode:
- fix install and forkserver (thanks aarnav!)
- pin unicorn version
- nyx_mode:
- bugfixes
- custom mutators:
OBS-URL: https://build.opensuse.org/request/show/1228226
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=84
- updated to 4.30c
- afl-gcc and afl-clang funcionality is now removed
- afl-fuzz:
- fastresume feature added. if you abort fuzzing and resume fuzzing
with `-i -` or `AFL_AUTORESUME=1` and the target binary has not changed
then a dump will be loaded and the calibration phase skipped.
to disable this feature set `AFL_NO_FASTRESUME=1`
zlib compression is used if zlib is found at compile time
- improved seed selection algorithm
- added `AFL_CUSTOM_MUTATOR_LATE_SEND=1` to call the custom send()
function after the target has been restarted.
- because of bad math and undefined behaviour fixes we have to change
the CMPLOG map. **YOU NEED TO RECOMPILE CMPLOG TARGETS**
- fixed custom_post_process for calibration
- fixes for AFL_EXIT_ON_TIME and AFL_EXIT_WHEN_DONE, changed behaviour of
AFL_EXIT_WHEN_DONE to finish when really done :-)
- frida_mode:
- AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just
a function entry
- AFL_DEBUG is now the same as AFL_FRIDA_VERBOSE
- AFL_FRIDA_DEBUG_MAPS now works as expected
- qemu_mode:
- new hooks supported (optional), see qemu_mode/hooking_bridge - thanks to
@CowBoy4mH3LL
- unicorn_mode:
- fix install and forkserver (thanks aarnav!)
- pin unicorn version
- nyx_mode:
- bugfixes
- custom mutators:
OBS-URL: https://build.opensuse.org/request/show/1228108
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=179
- updated to 4.21c
* afl-fuzz
- fixed a regression in afl-fuzz that resulted in a 5-10% performace loss
do a switch from gettimeofday() to clock_gettime() which should be rather
three times faster. The reason for this is unknown.
- new queue selection algorithm based on 2 core years of queue data
analysis. gives a noticable improvement on coverage although the results
seem counterintuitive :-)
- added AFL_DISABLE_REDUNDANT for huge queues
- added `AFL_NO_SYNC` environment variable that does what you think it does
- fix AFL_PERSISTENT_RECORD
- run custom_post_process after standard trimming
- prevent filenames in the queue that have spaces
- minor fix for FAST schedules
- more frequent stats update when syncing (todo: check performance impact)
- now timing of calibration, trimming and syncing is measured seperately,
thanks to @eqv!
- -V timing is now accurately the fuzz time (without syncing), before
long calibration times and syncing could result in now fuzzing being
made when the time was already run out until then, thanks to @eqv!
- fix -n uninstrumented mode when ending fuzzing
- enhanced the ASAN configuration
- make afl-fuzz use less memory with cmplog and fix a memleak
* afl-cc:
- re-enable i386 support that was accidently disabled
- fixes for LTO and outdated afl-gcc mode for i386
- fix COMPCOV split compare for old LLVMs
- disable xml/curl/g_ string transform functions because we do not check
for null pointers ... TODO
- ensure shared memory variables are visible in weird build setups (forwarded request 1179645 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1179646
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=83
- updated to 4.21c
* afl-fuzz
- fixed a regression in afl-fuzz that resulted in a 5-10% performace loss
do a switch from gettimeofday() to clock_gettime() which should be rather
three times faster. The reason for this is unknown.
- new queue selection algorithm based on 2 core years of queue data
analysis. gives a noticable improvement on coverage although the results
seem counterintuitive :-)
- added AFL_DISABLE_REDUNDANT for huge queues
- added `AFL_NO_SYNC` environment variable that does what you think it does
- fix AFL_PERSISTENT_RECORD
- run custom_post_process after standard trimming
- prevent filenames in the queue that have spaces
- minor fix for FAST schedules
- more frequent stats update when syncing (todo: check performance impact)
- now timing of calibration, trimming and syncing is measured seperately,
thanks to @eqv!
- -V timing is now accurately the fuzz time (without syncing), before
long calibration times and syncing could result in now fuzzing being
made when the time was already run out until then, thanks to @eqv!
- fix -n uninstrumented mode when ending fuzzing
- enhanced the ASAN configuration
- make afl-fuzz use less memory with cmplog and fix a memleak
* afl-cc:
- re-enable i386 support that was accidently disabled
- fixes for LTO and outdated afl-gcc mode for i386
- fix COMPCOV split compare for old LLVMs
- disable xml/curl/g_ string transform functions because we do not check
for null pointers ... TODO
- ensure shared memory variables are visible in weird build setups
OBS-URL: https://build.opensuse.org/request/show/1179645
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=177
- updated to 4.20c
+ A new forkserver communication model is now introduced. afl-fuzz is
backward compatible to old compiled targets if they are not built
for CMPLOG/Redqueen, but new compiled targets will not work with
old afl-fuzz versions!
+ Recompile all targets that are instrumented for CMPLOG/Redqueen!
- AFL++ now supports up to 4 billion coverage edges, up from 6 million.
- New compile option: `make PERFORMANCE=1` - this will enable special
CPU dependent optimizations that make everything more performant - but
the binaries will likely won't work on different platforms. Also
enables a faster hasher if the CPU requirements are met.
- The persistent record feature (see config.h) was expanded to also
support replay, thanks to @quarta-qti !
- afl-fuzz:
- the new deterministic fuzzing feature is now activated by default,
deactivate with -z. Parameters -d and -D are ignored.
- small improvements to CMPLOG/redqueen
- workround for a bug with MOpt -L when used with -M - in the future
we will either remove or rewrite MOpt.
- fix for `-t xxx+` feature
- -e extension option now saves the queue items, crashes, etc. with the
extension too
- fixes for trimmming, correct -V time and reading stats on resume by eqv
thanks a lot!
- afl-cc:
- added collision free caller instrumentation to LTO mode. activate with
`AFL_LLVM_LTO_CALLER=1`. You can set a max depth to go through single
block functions with `AFL_LLVM_LTO_CALLER_DEPTH` (default 0)
- fixes for COMPCOV/LAF and most other modules
- fix for GCC_PLUGIN cmplog that broke on std::strings (forwarded request 1167801 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1167802
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=82
- updated to 4.20c
+ A new forkserver communication model is now introduced. afl-fuzz is
backward compatible to old compiled targets if they are not built
for CMPLOG/Redqueen, but new compiled targets will not work with
old afl-fuzz versions!
+ Recompile all targets that are instrumented for CMPLOG/Redqueen!
- AFL++ now supports up to 4 billion coverage edges, up from 6 million.
- New compile option: `make PERFORMANCE=1` - this will enable special
CPU dependent optimizations that make everything more performant - but
the binaries will likely won't work on different platforms. Also
enables a faster hasher if the CPU requirements are met.
- The persistent record feature (see config.h) was expanded to also
support replay, thanks to @quarta-qti !
- afl-fuzz:
- the new deterministic fuzzing feature is now activated by default,
deactivate with -z. Parameters -d and -D are ignored.
- small improvements to CMPLOG/redqueen
- workround for a bug with MOpt -L when used with -M - in the future
we will either remove or rewrite MOpt.
- fix for `-t xxx+` feature
- -e extension option now saves the queue items, crashes, etc. with the
extension too
- fixes for trimmming, correct -V time and reading stats on resume by eqv
thanks a lot!
- afl-cc:
- added collision free caller instrumentation to LTO mode. activate with
`AFL_LLVM_LTO_CALLER=1`. You can set a max depth to go through single
block functions with `AFL_LLVM_LTO_CALLER_DEPTH` (default 0)
- fixes for COMPCOV/LAF and most other modules
- fix for GCC_PLUGIN cmplog that broke on std::strings
OBS-URL: https://build.opensuse.org/request/show/1167801
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=175
- updated to 4.10c
- afl-fuzz:
- default power schedule is now EXPLORE, due a fix in fast schedules
explore is slightly better now.
- fixed minor issues in the mutation engine, thanks to @futhewo for
reporting!
- better deterministic fuzzing is now available, benchmarks have shown
to improve fuzzing. Enable with -D. Thanks to @kdsjZh for the PR!
- afl-cc:
- large rewrite by @SonicStark which fixes a few corner cases, thanks!
- LTO mode now requires llvm 12+
- workaround for ASAN with gcc_plugin mode
- instrumentation:
- LLVM 18 support, thanks to @devnexen!
- Injection (SQL, LDAP, XSS) fuzzing feature now available, see
`instrumentation/README.injections.md` how to activate/use/expand.
- compcov/LAF-intel:
- floating point splitting bug fix by @hexcoder
- due a bug in LLVM 17 integer splitting is disabled there!
- when splitting floats was selected, integers were always split as well,
fixed to require AFL_LLVM_LAF_SPLIT_COMPARES or _ALL as it should
- dynamic instrumentation filtering for LLVM NATIVE, thanks @Mozilla!
see utils/dynamic_covfilter/README.md
- qemu_mode:
- plugins are now activated by default and a new module is included that
produces drcov compatible traces for lighthouse/lightkeeper/...
thanks to @JRomainG to submitting!
- updated Nyx checkout (fixes a bug) and some QOL
- updated the custom grammar mutator
- document afl-cmin does not work on macOS (but afl-cmin.bash does) (forwarded request 1144629 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1144630
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=81
- updated to 4.10c
- afl-fuzz:
- default power schedule is now EXPLORE, due a fix in fast schedules
explore is slightly better now.
- fixed minor issues in the mutation engine, thanks to @futhewo for
reporting!
- better deterministic fuzzing is now available, benchmarks have shown
to improve fuzzing. Enable with -D. Thanks to @kdsjZh for the PR!
- afl-cc:
- large rewrite by @SonicStark which fixes a few corner cases, thanks!
- LTO mode now requires llvm 12+
- workaround for ASAN with gcc_plugin mode
- instrumentation:
- LLVM 18 support, thanks to @devnexen!
- Injection (SQL, LDAP, XSS) fuzzing feature now available, see
`instrumentation/README.injections.md` how to activate/use/expand.
- compcov/LAF-intel:
- floating point splitting bug fix by @hexcoder
- due a bug in LLVM 17 integer splitting is disabled there!
- when splitting floats was selected, integers were always split as well,
fixed to require AFL_LLVM_LAF_SPLIT_COMPARES or _ALL as it should
- dynamic instrumentation filtering for LLVM NATIVE, thanks @Mozilla!
see utils/dynamic_covfilter/README.md
- qemu_mode:
- plugins are now activated by default and a new module is included that
produces drcov compatible traces for lighthouse/lightkeeper/...
thanks to @JRomainG to submitting!
- updated Nyx checkout (fixes a bug) and some QOL
- updated the custom grammar mutator
- document afl-cmin does not work on macOS (but afl-cmin.bash does)
OBS-URL: https://build.opensuse.org/request/show/1144629
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=173
- updated to 4.09c
- afl-fuzz:
- fixed the new mutation implementation for two bugs
- added `AFL_FINAL_SYNC` which forces a final fuzzer sync (also for `-F`)
before terminating.
- added AFL_IGNORE_SEED_PROBLEMS to skip over seeds that time out instead
of exiting with an error message
- allow -S/-M naming up to 50 characters (from 24)
- CMPLOG:
- added scale support (-l S)
- skip unhelpful insertions (u8)
- added --version and --help command line parameters
- fixed endless loop when reading malformed dictionaries
- new custom mutator function: post_run - thanks to yangzao!
- afl-whatsup:
- detect instanced that are starting up and show them as such as not dead
- now also shows coverage reached
- option -m shows only very relevant stats
- option -n will not use color in the output
- instrumentation:
- fix for a few string compare transform functions for LAF
- we are instrumenting __cxx internal functions again. this might break
a few targets, please report if so.
- frida_mode:
- fixes support for large map offsets
- support for AFL_FUZZER_LOOPCOUNT for afl.rs and LLVMFuzzerTestOneInput
- afl-cmin/afl-cmin.bash: prevent unneeded file errors
- added new tool afl-addseeds that adds new seeds to a running campaign
- added benchmark/benchmark.py if you want to see how good your fuzzing
speed is in comparison to other setups. (forwarded request 1133736 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1133737
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=80
- updated to 4.09c
- afl-fuzz:
- fixed the new mutation implementation for two bugs
- added `AFL_FINAL_SYNC` which forces a final fuzzer sync (also for `-F`)
before terminating.
- added AFL_IGNORE_SEED_PROBLEMS to skip over seeds that time out instead
of exiting with an error message
- allow -S/-M naming up to 50 characters (from 24)
- CMPLOG:
- added scale support (-l S)
- skip unhelpful insertions (u8)
- added --version and --help command line parameters
- fixed endless loop when reading malformed dictionaries
- new custom mutator function: post_run - thanks to yangzao!
- afl-whatsup:
- detect instanced that are starting up and show them as such as not dead
- now also shows coverage reached
- option -m shows only very relevant stats
- option -n will not use color in the output
- instrumentation:
- fix for a few string compare transform functions for LAF
- we are instrumenting __cxx internal functions again. this might break
a few targets, please report if so.
- frida_mode:
- fixes support for large map offsets
- support for AFL_FUZZER_LOOPCOUNT for afl.rs and LLVMFuzzerTestOneInput
- afl-cmin/afl-cmin.bash: prevent unneeded file errors
- added new tool afl-addseeds that adds new seeds to a running campaign
- added benchmark/benchmark.py if you want to see how good your fuzzing
speed is in comparison to other setups.
OBS-URL: https://build.opensuse.org/request/show/1133736
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=171
- updated to 4.08c
- afl-fuzz:
- new mutation engine: mutations that favor discovery more paths are
prefered until no new finds for 10 minutes then switching to mutations
that favor triggering crashes. Modes and switch time can be configured
with `-P`. Also input mode for the target can be defined with `-a` to
be `text` or `binary` (defaults to `generic`)
- new custom mutator that has the new afl++ engine (so it can easily
incorporated into new custom mutators), and also comes with a standalone
command line tool! See custom_mutators/aflpp/standalone/
- display the state of the fuzzing run in the UI :-)
- fix timeout setting if '+' is used or a session is restarted
- -l X option to enable base64 transformation solving
- allow to disable CMPLOG with '-c -' (e.g. afl.rs enforces '-c 0' on
every instance which is counterproductive).
- afl-cmin/afl-cmin.bash:
- fixed a bug inherited from vanilla AFL where a coverage of
map[123] = 11 would be the same as map[1123] = 1
- warn on crashing inputs
- adjust threads if less inputs than threads specified
- afl-cc:
- fixed an off-by-one instrumentation of iselect, hurting coverage a bit.
Thanks to @amykweon for spotting and fixing!
- @toka fixed a bug in laf-intel signed integer comparison splitting,
thanks a lot!!
- more LLVM compatability
- frida_mode:
- support for long form instrumentation on x86_x64 and arm64
- renamed utils/get_symbol_addr.sh to utils/frida_get_symbol_addr.sh
- qemu_mode:
OBS-URL: https://build.opensuse.org/request/show/1103819
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=79
- updated to 4.08c
- afl-fuzz:
- new mutation engine: mutations that favor discovery more paths are
prefered until no new finds for 10 minutes then switching to mutations
that favor triggering crashes. Modes and switch time can be configured
with `-P`. Also input mode for the target can be defined with `-a` to
be `text` or `binary` (defaults to `generic`)
- new custom mutator that has the new afl++ engine (so it can easily
incorporated into new custom mutators), and also comes with a standalone
command line tool! See custom_mutators/aflpp/standalone/
- display the state of the fuzzing run in the UI :-)
- fix timeout setting if '+' is used or a session is restarted
- -l X option to enable base64 transformation solving
- allow to disable CMPLOG with '-c -' (e.g. afl.rs enforces '-c 0' on
every instance which is counterproductive).
- afl-cmin/afl-cmin.bash:
- fixed a bug inherited from vanilla AFL where a coverage of
map[123] = 11 would be the same as map[1123] = 1
- warn on crashing inputs
- adjust threads if less inputs than threads specified
- afl-cc:
- fixed an off-by-one instrumentation of iselect, hurting coverage a bit.
Thanks to @amykweon for spotting and fixing!
- @toka fixed a bug in laf-intel signed integer comparison splitting,
thanks a lot!!
- more LLVM compatability
- frida_mode:
- support for long form instrumentation on x86_x64 and arm64
- renamed utils/get_symbol_addr.sh to utils/frida_get_symbol_addr.sh
- qemu_mode:
OBS-URL: https://build.opensuse.org/request/show/1103817
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=169
- updated to 4.07c
- afl-fuzz:
- reverse reading the seeds only on restarts (increases performance)
- new env `AFL_POST_PROCESS_KEEP_ORIGINAL` to keep the orignal
data before post process on finds (for atnwalk custom mutator)
- new env `AFL_IGNORE_PROBLEMS_COVERAGE` to ignore coverage from
loaded libs after forkserver initialization (required by Mozilla)
- afl-cc:
- added @responsefile support
- new env `AFL_LLVM_LTO_SKIPINIT` to support the AFL++ based WASM
(https://github.com/fgsect/WAFL) project
- error and print help if afl-clan-lto is used with lto=thin
- rewrote our PCGUARD pass to be compatible with LLVM 15+ shenanigans,
requires LLVM 13+ now instead of 10.0.1+
- fallback to native LLVM PCGUARD if our PCGUARD is unavailable
- fixed a crash in GCC CMPLOG
- afl-showmap:
- added custom mutator post_process and send support
- add `-I filelist` option, an alternative to `-i in_dir`
- afl-cmin + afl-cmin.bash:
- `-T threads` parallel task support, can be a huge speedup!
- qemu_mode:
- Persistent mode + QASAN support for ppc32 targets by @worksbutnottested
- a new grammar custom mutator atnwalk was submitted by @voidptr127 !
- two new custom mutators are now available:
- TritonDSE in custom_mutators/aflpp_tritondse
- SymQEMU in custom_mutators/symqemu
- removed ppc64le condition (failed parsing), we have no 32bit ppc64le
OBS-URL: https://build.opensuse.org/request/show/1092592
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=78
- updated to 4.07c
- afl-fuzz:
- reverse reading the seeds only on restarts (increases performance)
- new env `AFL_POST_PROCESS_KEEP_ORIGINAL` to keep the orignal
data before post process on finds (for atnwalk custom mutator)
- new env `AFL_IGNORE_PROBLEMS_COVERAGE` to ignore coverage from
loaded libs after forkserver initialization (required by Mozilla)
- afl-cc:
- added @responsefile support
- new env `AFL_LLVM_LTO_SKIPINIT` to support the AFL++ based WASM
(https://github.com/fgsect/WAFL) project
- error and print help if afl-clan-lto is used with lto=thin
- rewrote our PCGUARD pass to be compatible with LLVM 15+ shenanigans,
requires LLVM 13+ now instead of 10.0.1+
- fallback to native LLVM PCGUARD if our PCGUARD is unavailable
- fixed a crash in GCC CMPLOG
- afl-showmap:
- added custom mutator post_process and send support
- add `-I filelist` option, an alternative to `-i in_dir`
- afl-cmin + afl-cmin.bash:
- `-T threads` parallel task support, can be a huge speedup!
- qemu_mode:
- Persistent mode + QASAN support for ppc32 targets by @worksbutnottested
- a new grammar custom mutator atnwalk was submitted by @voidptr127 !
- two new custom mutators are now available:
- TritonDSE in custom_mutators/aflpp_tritondse
- SymQEMU in custom_mutators/symqemu
OBS-URL: https://build.opensuse.org/request/show/1092575
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=166
- updated to 4.06c
- afl-fuzz:
- ensure temporary file descriptor is closed when not used
- added `AFL_NO_WARN_INSTABILITY`
- added time_wo_finds to fuzzer_stats
- fixed a crash in pizza (1st april easter egg) mode. Sorry for
everyone who was affected!
- allow pizza mode to be disabled when AFL_PIZZA_MODE is set to -1
- option `-p mmopt` now also selects new queue items more often
- fix bug in post_process custom mutator implementation
- print name of custom mutator in UI
- slight changes that improve fuzzer performance
- afl-cc:
- add CFI sanitizer variant to gcc targets
- llvm 16 + 17 support (thanks to @devnexen!)
- support llvm 15 native pcguard changes
- support for LLVMFuzzerTestOneInput -1 return
- LTO autoken and llvm_mode: added AFL_LLVM_DICT2FILE_NO_MAIN support
- qemu_mode:
- fix _RANGES envs to allow hyphens in the filenames
- basic riscv support
- frida_mode:
- added `AFL_FRIDA_STATS_INTERVAL`
- fix issue on MacOS
- unicorn_mode:
- updated and minor issues fixed
- nyx_mode support for all tools
- better sanitizer default options support for all tools
- new custom module: autotoken, a grammar free fuzzer for text inputs
- fixed custom mutator C examples (forwarded request 1079878 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1079879
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=77
- updated to 4.06c
- afl-fuzz:
- ensure temporary file descriptor is closed when not used
- added `AFL_NO_WARN_INSTABILITY`
- added time_wo_finds to fuzzer_stats
- fixed a crash in pizza (1st april easter egg) mode. Sorry for
everyone who was affected!
- allow pizza mode to be disabled when AFL_PIZZA_MODE is set to -1
- option `-p mmopt` now also selects new queue items more often
- fix bug in post_process custom mutator implementation
- print name of custom mutator in UI
- slight changes that improve fuzzer performance
- afl-cc:
- add CFI sanitizer variant to gcc targets
- llvm 16 + 17 support (thanks to @devnexen!)
- support llvm 15 native pcguard changes
- support for LLVMFuzzerTestOneInput -1 return
- LTO autoken and llvm_mode: added AFL_LLVM_DICT2FILE_NO_MAIN support
- qemu_mode:
- fix _RANGES envs to allow hyphens in the filenames
- basic riscv support
- frida_mode:
- added `AFL_FRIDA_STATS_INTERVAL`
- fix issue on MacOS
- unicorn_mode:
- updated and minor issues fixed
- nyx_mode support for all tools
- better sanitizer default options support for all tools
- new custom module: autotoken, a grammar free fuzzer for text inputs
- fixed custom mutator C examples
OBS-URL: https://build.opensuse.org/request/show/1079878
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=164
- updated to 4.05c
- afl-fuzz:
- added afl_custom_fuzz_send custom mutator feature. Now your can
send fuzz data to the target as you need, e.g. via IPC.
- cmplog mode now has a -l R option for random colorization, thanks
to guyf2010 for the PR!
- queue statistics are written every 30 minutes to
out/NAME/queue_data if compiled with INTROSPECTION
- new env: AFL_FORK_SERVER_KILL_SIGNAL
- afl-showmap/afl-cmin
- `-t none` now translates to `-t 120000` (120 seconds)
- unicorn_mode updated
- updated rust custom mutator dependencies and LibAFL custom mutator
- several minor bugfixes (forwarded request 1056232 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1056233
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=75
- updated to 4.05c
- afl-fuzz:
- added afl_custom_fuzz_send custom mutator feature. Now your can
send fuzz data to the target as you need, e.g. via IPC.
- cmplog mode now has a -l R option for random colorization, thanks
to guyf2010 for the PR!
- queue statistics are written every 30 minutes to
out/NAME/queue_data if compiled with INTROSPECTION
- new env: AFL_FORK_SERVER_KILL_SIGNAL
- afl-showmap/afl-cmin
- `-t none` now translates to `-t 120000` (120 seconds)
- unicorn_mode updated
- updated rust custom mutator dependencies and LibAFL custom mutator
- several minor bugfixes
OBS-URL: https://build.opensuse.org/request/show/1056232
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=160
- updated to 4.04c
- fix gramatron and grammar_mutator build scripts
- enhancements to the afl-persistent-config and afl-system-config
- scripts
- afl-fuzz:
- force writing all stats on exit
- afl-cc:
- make gcc_mode (afl-gcc-fast) work with gcc down to version 3.6
- qemu_mode:
- fixed 10x speed degredation in v4.03c
- added qemu_mode/fastexit helper library
- unicorn_mode:
- Enabled tricore arch (by @jma-qb)
- Updated Capstone version in Rust bindings
- llvm-mode:
- AFL runtime will always pass inputs via shared memory, when possible,
ignoring the command line. (forwarded request 1030428 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1030429
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=73
- updated to 4.04c
- fix gramatron and grammar_mutator build scripts
- enhancements to the afl-persistent-config and afl-system-config
- scripts
- afl-fuzz:
- force writing all stats on exit
- afl-cc:
- make gcc_mode (afl-gcc-fast) work with gcc down to version 3.6
- qemu_mode:
- fixed 10x speed degredation in v4.03c
- added qemu_mode/fastexit helper library
- unicorn_mode:
- Enabled tricore arch (by @jma-qb)
- Updated Capstone version in Rust bindings
- llvm-mode:
- AFL runtime will always pass inputs via shared memory, when possible,
ignoring the command line.
OBS-URL: https://build.opensuse.org/request/show/1030428
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=156
- updated to 4.03c
- Building now gives a build summary what succeeded and what not
- afl-fuzz:
- added AFL_NO_STARTUP_CALIBRATION to start fuzzing at once instead
of calibrating all initial seeds first. Good for large queues
and long execution times, especially in CIs.
- default calibration cycles set to 7 from 8, and only add 5 cycles
to variables queue items instead of 12.
- afl-cc:
- fixed off-by-one bug in our pcguard implemenation, thanks for
@tokatoka for reporting
- fix for llvm 15 and reenabling LTO, thanks to nikic for the PR!
- better handling of -fsanitize=..,...,.. lists
- support added for LLVMFuzzerRunDriver()
- fix gcc_mode cmplog
- obtain the map size of a target with setting AFL_DUMP_MAP_SIZE=1
note that this will exit the target before main()
- qemu_mode:
- added AFL_QEMU_TRACK_UNSTABLE to log the addresses of unstable
edges (together with AFL_DEBUG=1 afl-fuzz). thanks to
worksbutnottested!
- afl-analyze broke at some point, fix by CodeLogicError, thank you!
- afl-cmin/afl-cmin.bash now have an -A option to allow also crashing
and timeout inputs
- unicorn_mode:
- updated upstream unicorn version
- fixed builds for aarch64
- build now uses all available cores (forwarded request 1005008 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/1005009
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=72
- updated to 4.03c
- Building now gives a build summary what succeeded and what not
- afl-fuzz:
- added AFL_NO_STARTUP_CALIBRATION to start fuzzing at once instead
of calibrating all initial seeds first. Good for large queues
and long execution times, especially in CIs.
- default calibration cycles set to 7 from 8, and only add 5 cycles
to variables queue items instead of 12.
- afl-cc:
- fixed off-by-one bug in our pcguard implemenation, thanks for
@tokatoka for reporting
- fix for llvm 15 and reenabling LTO, thanks to nikic for the PR!
- better handling of -fsanitize=..,...,.. lists
- support added for LLVMFuzzerRunDriver()
- fix gcc_mode cmplog
- obtain the map size of a target with setting AFL_DUMP_MAP_SIZE=1
note that this will exit the target before main()
- qemu_mode:
- added AFL_QEMU_TRACK_UNSTABLE to log the addresses of unstable
edges (together with AFL_DEBUG=1 afl-fuzz). thanks to
worksbutnottested!
- afl-analyze broke at some point, fix by CodeLogicError, thank you!
- afl-cmin/afl-cmin.bash now have an -A option to allow also crashing
and timeout inputs
- unicorn_mode:
- updated upstream unicorn version
- fixed builds for aarch64
- build now uses all available cores
OBS-URL: https://build.opensuse.org/request/show/1005008
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=154
- updated to 4.02c
- afl-cc:
- important fix for the default pcguard mode when LLVM IR vector
selects are produced, thanks to @juppytt for reporting!
- gcc_plugin:
- Adacore submitted CMPLOG support to the gcc_plugin! :-)
- llvm_mode:
- laf cmp splitting fixed for more comparison types
- frida_mode:
- now works on Android!
- afl-fuzz:
- change post_process hook to allow returning NULL and 0 length to
tell afl-fuzz to skip this mutated input (forwarded request 998343 from msmeissn)
OBS-URL: https://build.opensuse.org/request/show/998344
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/afl?expand=0&rev=71
- updated to 4.02c
- afl-cc:
- important fix for the default pcguard mode when LLVM IR vector
selects are produced, thanks to @juppytt for reporting!
- gcc_plugin:
- Adacore submitted CMPLOG support to the gcc_plugin! :-)
- llvm_mode:
- laf cmp splitting fixed for more comparison types
- frida_mode:
- now works on Android!
- afl-fuzz:
- change post_process hook to allow returning NULL and 0 length to
tell afl-fuzz to skip this mutated input
OBS-URL: https://build.opensuse.org/request/show/998343
OBS-URL: https://build.opensuse.org/package/show/devel:tools/afl?expand=0&rev=152
