Data

Tools

Indexes

Applications

Experiments

Open Source Science

Recent Releases of aflplusplus

aflplusplus - v4.33c

Version ++4.33c (release)

  • afl-fuzz:
    • Use AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT if you use AFL_PRELOAD to disable fork, see docs (thanks to @alexandredoyen29)
    • Fix for FAST power schedules (introduced in 4.32c) (thanks to @kcwu)
    • Colors for NO_UI output (thanks to @smoelius)
    • Fix potential sync issues when resuming sessions and when instances in a campaign are restarted and skip entries that were synced from itself (thanks to @kcwu for raising the issues and providing support!)
    • Fix for when fast resuming failed
    • more 64 bit archicture support by @maribu
  • afl-cc:
    • Added instrumenting hidden edges (approx 5% edges were not instrumented, LLVM sancov overall misses 8% of edges compared to our implementation) Note that is is currently only implemented for our PCGUARD plugin, not LTO, CLASSIC, etc.!
    • Fix to make AFLSANNOINST work with gccplugin
    • MacOS aflpp driver compilation fix (-fsanitize=fuzzer implementation)
    • Make AFLDUMPMAP_SIZE work even if the target has sanitizer issues
  • qemuafl:
    • Better MIPS persistent mode support
    • AFL_EXITPOINT support added
    • AFL_QEMU_BLOCK_COV block coverage support added
  • afl-cmin:
    • New afl-cmin.py which is much faster, will be executed by default via afl-cmin if it executes successfully (thanks to @kcwu!)
    • Nyx mode now fully works for minimizing (with afl-cmin.py which is called by afl-cmin if python is available) - before the map size was fixed and so large targets lost coverage.
  • New desocketing library: utils/libaflppdesock
    • Likely works when all other desocketing options fail
  • nyx_mode:
    • Properly determine map size

- C
Published by vanhauser-thc 8 months ago

aflplusplus - v4.32c

Version ++4.32c (release)

  • Fixed a bug where after a fast restart of a full fuzzed corpus afl-fuzz terminates with "need at least one valid input seed that does not crash"
  • Small improvements to afl-*-config
  • afl-fuzz:
    • memory leak fixes by @kcwu - thanks!
    • many more nits and small memory saves thanks to @kcwu
    • remove deprecated files from queue/.state
    • fix bitmap update function if no current trace is present
    • fix for aflcustomqueue_get
    • various small nits
  • afl-cc:
    • fix pass support for LLVM 20 (passes were run too early)
    • dropped plugin support for LLVM 13
    • fix AFLOLDFORKSERVER
    • various minor fixes
  • frida_mode:
    • fixes for new MacOS + M4 hardware

- C
Published by vanhauser-thc 10 months ago

aflplusplus - v4.31c

Version ++4.31c (release)

  • SAND mode added (docs/SAND.md) for more effecient fuzzing with sanitizers (thanks to @wtdcode !)
  • afl-fuzz:
    • splicing phase is now DISABLED by default because research showed it is counterproductive. New command line parameter -u to enable it. Splicing is auto-enabled if two cycles without finds happen.
    • Python 3.13+ support
    • loose file and shared memory permissions on Android and iPhone
  • afl-cc:
    • LLVM 20 support (again - please don't change the API all the time ...)
    • -fsanitize=fuzzer now inserts libAFLDriver.a addtionally early to help compiling if LLVMFuzzerTestOneOnput is in an .a archive
    • added _sanitizerweakhook* functions (in case that is helpful in weird setups)
    • fix bug with large map sizes when multiple libraries are loaded after the shared memory was obtained.

- C
Published by vanhauser-thc about 1 year ago

aflplusplus - v4.30c

Version ++4.30c (release)

! afl-gcc and afl-clang funcionality is now removed ! - afl-fuzz: - fastresume feature added. if you abort fuzzing and resume fuzzing with -i - or AFL_AUTORESUME=1 and the target binary has not changed then a dump will be loaded and the calibration phase skipped. to disable this feature set AFL_NO_FASTRESUME=1 zlib compression is used if zlib is found at compile time - improved seed selection algorithm - added AFL_CUSTOM_MUTATOR_LATE_SEND=1 to call the custom send() function after the target has been restarted. - because of bad math and undefined behaviour fixes we have to change the CMPLOG map. YOU NEED TO RECOMPILE CMPLOG TARGETS - fixed custompostprocess for calibration - fixes for AFLEXITONTIME and AFLEXITWHENDONE, changed behaviour of AFLEXITWHENDONE to finish when really done :-) - fridamode: - AFLFRIDAPERSISTENTADDR can now be be any reachable address not just a function entry - AFLDEBUG is now the same as AFLFRIDAVERBOSE - AFLFRIDADEBUGMAPS now works as expected - qemumode: - new hooks supported (optional), see qemumode/hookingbridge - thanks to @CowBoy4mH3LL - unicornmode: - fix install and forkserver (thanks aarnav!) - pin unicorn version - nyxmode: - bugfixes - custom mutators: - customsendtcp custom mutator added, thanks to @dergoegge - afl-cc - fix to support pointless changes in LLVM 20 - new runtime (!) variable: AFL_OLD_FORKSERVER to use the old vanilla AFL type forkserver. Useful for symcc/symqemu/nautilus/etc. with AFLLLVMINSTRUMENT=CLASSIC - new compile time variable: AFL_OPT_LEVEL to set a specific optimization level, default is 3 - correctly explain how to get the correct map size for large targets - small fix for weird LLVM defines in redhat - code formatting updated to llvm 18 - improved custommutators/aflpp/standalone/aflpp-standalone - added custommutators/autotokens/standalone/autotokens-standalone - AFL++ headers are now installed to $PREFIX/include/afl

- C
Published by vanhauser-thc about 1 year ago

aflplusplus - v4.21c

Version ++4.21c (release)

  • afl-fuzz
    • fixed a regression in afl-fuzz that resulted in a 5-10% performace loss do a switch from gettimeofday() to clock_gettime() which should be rather three times faster. The reason for this is unknown.
    • new queue selection algorithm based on 2 core years of queue data analysis. gives a noticable improvement on coverage although the results seem counterintuitive :-)
    • added AFLDISABLEREDUNDANT for huge queues
    • added AFL_NO_SYNC environment variable that does what you think it does
    • fix AFLPERSISTENTRECORD
    • run custompostprocess after standard trimming
    • prevent filenames in the queue that have spaces
    • minor fix for FAST schedules
    • more frequent stats update when syncing (todo: check performance impact)
    • now timing of calibration, trimming and syncing is measured seperately, thanks to @eqv!
    • -V timing is now accurately the fuzz time (without syncing), before long calibration times and syncing could result in now fuzzing being made when the time was already run out until then, thanks to @eqv!
    • fix -n uninstrumented mode when ending fuzzing
    • enhanced the ASAN configuration
    • make afl-fuzz use less memory with cmplog and fix a memleak
  • afl-cc:
    • re-enable i386 support that was accidently disabled
    • fixes for LTO and outdated afl-gcc mode for i386
    • fix COMPCOV split compare for old LLVMs
    • disable xml/curl/g_ string transform functions because we do not check for null pointers ... TODO
    • ensure shared memory variables are visible in weird build setups
    • compatability to new LLVM 19 changes
  • afl-cmin
    • work with input files that have a space
  • afl-showmap
    • fix memory leak on shmem testcase usage (thanks to @ndrewh)
    • minor fix to collect coverage -C (thanks to @bet4it)
  • Fixed a shmem mmap bug (that rarely came up on MacOS)
  • libtokencap: script generatelibtokendict.sh added by @a-shvedov

- C
Published by vanhauser-thc over 1 year ago

aflplusplus - 4.20c

Version ++4.20c (release)

! A new forkserver communication model is now introduced. afl-fuzz is backward compatible to old compiled targets if they are not built for CMPLOG/Redqueen, but new compiled targets will not work with old afl-fuzz versions! ! Recompile all targets that are instrumented for CMPLOG/Redqueen! - AFL++ now supports up to 4 billion coverage edges, up from 6 million. - New compile option: make PERFORMANCE=1 - this will enable special CPU dependent optimizations that make everything more performant - but the binaries will likely won't work on different platforms. Also enables a faster hasher if the CPU requirements are met. - The persistent record feature (see config.h) was expanded to also support replay, thanks to @quarta-qti ! - afl-fuzz: - the new deterministic fuzzing feature is now activated by default, deactivate with -z. Parameters -d and -D are ignored. - small improvements to CMPLOG/redqueen - workround for a bug with MOpt -L when used with -M - in the future we will either remove or rewrite MOpt. - fix for -t xxx+ feature - -e extension option now saves the queue items, crashes, etc. with the extension too - fixes for trimmming, correct -V time and reading stats on resume by eqv thanks a lot! - afl-cc: - added collision free caller instrumentation to LTO mode. activate with AFL_LLVM_LTO_CALLER=1. You can set a max depth to go through single block functions with AFL_LLVM_LTO_CALLER_DEPTH (default 0) - fixes for COMPCOV/LAF and most other modules - fix for GCC_PLUGIN cmplog that broke on std::strings - afl-whatsup: - now also displays current average speed - small bugfixes - Fixes for aflpp custom mutator and standalone tool - Minor edits to afl-persistent-config - Prevent temporary files being left behind on aborted afl-whatsup - More CPU benchmarks added to benchmark/

- C
Published by vanhauser-thc almost 2 years ago

aflplusplus - 4.10c

Version ++4.10c (release)

  • afl-fuzz:
    • default power schedule is now EXPLORE, due a fix in fast schedules explore is slightly better now.
    • fixed minor issues in the mutation engine, thanks to @futhewo for reporting!
    • better deterministic fuzzing is now available, benchmarks have shown to improve fuzzing. Enable with -D. Thanks to @kdsjZh for the PR!
  • afl-cc:
    • large rewrite by @SonicStark which fixes a few corner cases, thanks!
    • LTO mode now requires llvm 12+
    • workaround for ASAN with gcc_plugin mode
  • instrumentation:
    • LLVM 18 support, thanks to @devnexen!
    • Injection (SQL, LDAP, XSS) fuzzing feature now available, see instrumentation/README.injections.md how to activate/use/expand.
    • compcov/LAF-intel:
      • floating point splitting bug fix by @hexcoder
      • due a bug in LLVM 17 integer splitting is disabled there!
      • when splitting floats was selected, integers were always split as well, fixed to require AFLLLVMLAFSPLITCOMPARES or _ALL as it should
    • dynamic instrumentation filtering for LLVM NATIVE, thanks @Mozilla! see utils/dynamic_covfilter/README.md
  • qemu_mode:
    • plugins are now activated by default and a new module is included that produces drcov compatible traces for lighthouse/lightkeeper/... thanks to @JRomainG to submitting!
  • updated Nyx checkout (fixes a bug) and some QOL
  • updated the custom grammar mutator
  • document afl-cmin does not work on macOS (but afl-cmin.bash does)

- C
Published by vanhauser-thc about 2 years ago

aflplusplus - 4.09c

Version ++4.09c (release)

  • afl-fuzz:
    • fixed the new mutation implementation for two bugs
    • added AFL_FINAL_SYNC which forces a final fuzzer sync (also for -F) before terminating.
    • added AFLIGNORESEED_PROBLEMS to skip over seeds that time out instead of exiting with an error message
    • allow -S/-M naming up to 50 characters (from 24)
    • CMPLOG:
      • added scale support (-l S)
      • skip unhelpful insertions (u8)
    • added --version and --help command line parameters
    • fixed endless loop when reading malformed dictionaries
    • new custom mutator function: post_run - thanks to yangzao!
  • afl-whatsup:
    • detect instanced that are starting up and show them as such as not dead
    • now also shows coverage reached
    • option -m shows only very relevant stats
    • option -n will not use color in the output
  • instrumentation:
    • fix for a few string compare transform functions for LAF
    • we are instrumenting __cxx internal functions again. this might break a few targets, please report if so.
  • frida_mode:
    • fixes support for large map offsets
  • support for AFLFUZZERLOOPCOUNT for afl.rs and LLVMFuzzerTestOneInput
  • afl-cmin/afl-cmin.bash: prevent unneeded file errors
  • added new tool afl-addseeds that adds new seeds to a running campaign
  • added benchmark/benchmark.py if you want to see how good your fuzzing speed is in comparison to other setups.

- C
Published by vanhauser-thc about 2 years ago

aflplusplus - 4.08c

Version ++4.08c (release)

  • afl-fuzz:

    • new mutation engine: mutations that favor discovery more paths are prefered until no new finds for 10 minutes then switching to mutations that favor triggering crashes. Modes and switch time can be configured with -P. Also input mode for the target can be defined with -a to be text or binary (defaults to generic)
    • new custom mutator that has the new afl++ engine (so it can easily incorporated into new custom mutators), and also comes with a standalone command line tool! See custom_mutators/aflpp/standalone/
    • display the state of the fuzzing run in the UI :-)
    • fix timeout setting if '+' is used or a session is restarted
    • -l X option to enable base64 transformation solving
    • allow to disable CMPLOG with '-c -' (e.g. afl.rs enforces '-c 0' on every instance which is counterproductive).

  • afl-cmin/afl-cmin.bash:

    • fixed a bug inherited from vanilla AFL where a coverage of map[123] = 11 would be the same as map[1123] = 1
    • warn on crashing inputs
    • adjust threads if less inputs than threads specified

  • afl-cc:

    • fixed an off-by-one instrumentation of iselect, hurting coverage a bit. Thanks to @amykweon for spotting and fixing!
    • @toka fixed a bug in laf-intel signed integer comparison splitting, thanks a lot!!
    • more LLVM compatability

  • frida_mode:

    • support for long form instrumentation on x86_x64 and arm64
    • renamed utils/getsymboladdr.sh to utils/fridagetsymbol_addr.sh

  • qemu_mode:

    • added qemumode/utils/qemugetsymboladdr.sh

- C
Published by vanhauser-thc over 2 years ago

aflplusplus - 4.07c

Version ++4.07c (release)

  • afl-fuzz:
    • reverse reading the seeds only on restarts (increases performance)
    • new env AFL_POST_PROCESS_KEEP_ORIGINAL to keep the orignal data before post process on finds (for atnwalk custom mutator)
    • new env AFL_IGNORE_PROBLEMS_COVERAGE to ignore coverage from loaded libs after forkserver initialization (required by Mozilla)
  • afl-cc:
    • added @responsefile support
    • new env AFL_LLVM_LTO_SKIPINIT to support the AFL++ based WASM (https://github.com/fgsect/WAFL) project
    • error and print help if afl-clan-lto is used with lto=thin
    • rewrote our PCGUARD pass to be compatible with LLVM 15+ shenanigans, requires LLVM 13+ now instead of 10.0.1+
    • fallback to native LLVM PCGUARD if our PCGUARD is unavailable
    • fixed a crash in GCC CMPLOG
  • afl-showmap:
    • added custom mutator post_process and send support
    • add -I filelist option, an alternative to -i in_dir
  • afl-cmin + afl-cmin.bash:
    • -T threads parallel task support, can be a huge speedup!
  • qemu_mode:
    • Persistent mode + QASAN support for ppc32 targets by @worksbutnottested
  • a new grammar custom mutator atnwalk was submitted by @voidptr127 !
  • two new custom mutators are now available:
    • TritonDSE in custommutators/aflpptritondse
    • SymQEMU in custom_mutators/symqemu

- C
Published by vanhauser-thc over 2 years ago

aflplusplus - 4.06c

Version ++4.06c (release)

  • afl-fuzz:
    • ensure temporary file descriptor is closed when not used
    • added AFL_NO_WARN_INSTABILITY
    • added timewofinds to fuzzer_stats
    • fixed a crash in pizza (1st april easter egg) mode. Sorry for everyone who was affected!
    • allow pizza mode to be disabled when AFLPIZZAMODE is set to -1
    • option -p mmopt now also selects new queue items more often
    • fix bug in post_process custom mutator implementation
    • print name of custom mutator in UI
    • slight changes that improve fuzzer performance
  • afl-cc:
    • add CFI sanitizer variant to gcc targets
    • llvm 16 + 17 support (thanks to @devnexen!)
    • support llvm 15 native pcguard changes
    • support for LLVMFuzzerTestOneInput -1 return
    • LTO autoken and llvmmode: added AFLLLVMDICT2FILENO_MAIN support
  • qemu_mode:
    • fix _RANGES envs to allow hyphens in the filenames
    • basic riscv support
  • frida_mode:
    • added AFL_FRIDA_STATS_INTERVAL
    • fix issue on MacOS
  • unicorn_mode:
    • updated and minor issues fixed
  • nyx_mode support for all tools
  • better sanitizer default options support for all tools
  • new custom module: autotoken, a grammar free fuzzer for text inputs
  • fixed custom mutator C examples
  • more minor fixes and cross-platform support

- C
Published by vanhauser-thc almost 3 years ago

aflplusplus - 4.05c

Version ++4.05c (release)

  • MacOS: libdislocator, libtokencap etc. do not work with modern MacOS anymore, but could be patched to work, see this issue if you want to make the effort and send a PR: https://github.com/AFLplusplus/AFLplusplus/issues/1594
  • afl-fuzz:
    • added aflcustomfuzz_send custom mutator feature. Now your can send fuzz data to the target as you need, e.g. via IPC.
    • cmplog mode now has a -l R option for random colorization, thanks to guyf2010 for the PR!
    • queue statistics are written every 30 minutes to out/NAME/queue_data if compiled with INTROSPECTION
    • new env: AFLFORKSERVERKILLSIGNAL
  • afl-showmap/afl-cmin
    • -t none now translates to -t 120000 (120 seconds)
  • unicorn_mode updated
  • updated rust custom mutator dependencies and LibAFL custom mutator
  • several minor bugfixes

- C
Published by vanhauser-thc about 3 years ago

aflplusplus - 4.04c

Version ++4.04c (release)

  • fix gramatron and grammar_mutator build scripts
  • enhancements to the afl-persistent-config and afl-system-config scripts
  • afl-fuzz:
    • force writing all stats on exit
  • afl-cc:
    • make gcc_mode (afl-gcc-fast) work with gcc down to version 3.6
  • qemu_mode:
    • fixed 10x speed degredation in v4.03c, thanks to @ele7enxxh for reporting!
    • added qemu_mode/fastexit helper library
  • unicorn_mode:
    • Enabled tricore arch (by @jma-qb)
    • Updated Capstone version in Rust bindings
  • llvm-mode:
    • AFL runtime will always pass inputs via shared memory, when possible, ignoring the command line.

- C
Published by vanhauser-thc over 3 years ago

aflplusplus - 4.03c

Version ++4.03c (release)

  • Building now gives a build summary what succeeded and what not
  • afl-fuzz:
    • added AFLNOSTARTUP_CALIBRATION to start fuzzing at once instead of calibrating all initial seeds first. Good for large queues and long execution times, especially in CIs.
    • default calibration cycles set to 7 from 8, and only add 5 cycles to variables queue items instead of 12.
  • afl-cc:
    • fixed off-by-one bug in our pcguard implemenation, thanks for @tokatoka for reporting
    • fix for llvm 15 and reenabling LTO, thanks to nikic for the PR!
    • better handling of -fsanitize=..,...,.. lists
    • support added for LLVMFuzzerRunDriver()
    • fix gcc_mode cmplog
    • obtain the map size of a target with setting AFLDUMPMAP_SIZE=1 note that this will exit the target before main()
  • qemu_mode:
    • added AFLQEMUTRACKUNSTABLE to log the addresses of unstable edges (together with AFLDEBUG=1 afl-fuzz). thanks to worksbutnottested!
  • afl-analyze broke at some point, fix by CodeLogicError, thank you!
  • afl-cmin/afl-cmin.bash now have an -A option to allow also crashing and timeout inputs
  • unicorn_mode:
    • updated upstream unicorn version
    • fixed builds for aarch64
    • build now uses all available cores

- C
Published by vanhauser-thc over 3 years ago

aflplusplus - 4.02c

Version ++4.02c (release)

  • afl-cc:
    • important fix for the default pcguard mode when LLVM IR vector selects are produced, thanks to @juppytt for reporting!
  • gcc_plugin:
    • Adacore submitted CMPLOG support to the gcc_plugin! :-)
  • llvm_mode:
    • laf cmp splitting fixed for more comparison types
  • frida_mode:
    • now works on Android!
  • afl-fuzz:
    • change post_process hook to allow returning NULL and 0 length to tell afl-fuzz to skip this mutated input

- C
Published by vanhauser-thc over 3 years ago

aflplusplus - 4.01c

Version ++4.01c (release)

  • fixed */build_...sh scripts to work outside of git
  • new custom_mutator: libafl with token fuzzing :)
  • afl-fuzz:
    • when you just want to compile once and set CMPLOG, then just set -c 0 to tell afl-fuzz that the fuzzing binary is also for CMPLOG.
    • new commandline options -g/G to set min/max length of generated fuzz inputs
    • you can set the time for syncing to other fuzzer now with AFLSYNCTIME
    • reintroduced AFLPERSISTENT and AFLDEFER_FORKSRV to allow persistent mode and manual forkserver support if these are not in the target binary (e.g. are in a shared library)
    • add AFLEARLYFORKSERVER to install the forkserver as earliest as possible in the target (for afl-gcc-fast/afl-clang-fast/ afl-clang-lto)
    • "saved timeouts" was wrong information, timeouts are still thrown away by default even if they have new coverage (hangs are always kept), unless AFLKEEPTIMEOUTS are set
    • AFL never implemented auto token inserts (but user token inserts, user token overwrite and auto token overwrite), added now!
    • fixed a mutation type in havoc mode
    • Mopt fix to always select the correct algorithm
    • fix effector map calculation (deterministic mode)
    • fix custom mutator post_process functionality
    • document and auto-activate pizza mode on condition
  • afl-cc:
    • due a bug in lld of llvm 15 LTO instrumentation wont work atm :-(
    • converted all passed to use the new llvm pass manager for llvm 11+
    • AFL++ PCGUARD mode is not available for 10.0.1 anymore (11+ only)
    • trying to stay on top on all these #$&§!! changes in llvm 15 ...
  • frida_mode:
    • update to new frida release, handles now c++ throw/catch
  • unicorn_mode:
    • update unicorn engine, fix C example
  • utils:
    • removed optimin because it looses coverage due to a bug and is unmaintained :-(

- C
Published by vanhauser-thc over 3 years ago

aflplusplus - 4.00c

Version ++4.00c (release)

  • complete documentation restructuring, made possible by Google Season of Docs :) thank you Jana!
  • we renamed several UI and fuzzer_stat entries to be more precise, e.g. "unique crashes" -> "saved crashes", "total paths" -> "corpus count", "current path" -> "current item". This might need changing custom scripting!
  • Nyx mode (full system emulation with snapshot capability) has been added - thanks to @schumilo and @eqv!
  • unicorn_mode:
    • Moved to unicorn2! by Ziqiao Kong (@lazymio)
    • Faster, more accurate emulation (newer QEMU base), risc-v support
    • removed indirections in rust callbacks
  • new binary-only fuzzing mode: coresight_mode for aarch64 CPUs :) thanks to RICSecLab submitting!
  • if instrumented libaries are dlopen()'ed after the forkserver you will now see a crash. Before you would have colliding coverage. We changed this to force fixing a broken setup rather then allowing ineffective fuzzing. See docs/best_practices.md how to fix such setups.
  • afl-fuzz:
    • cmplog binaries will need to be recompiled for this version (it is better!)
    • fix a regression introduced in 3.10 that resulted in less coverage being detected. thanks to Collin May for reporting!
    • ensure all spawned targets are killed on exit
    • added AFLIGNOREPROBLEMS, plus checks to identify and abort on incorrect LTO usage setups and enhanced the READMEs for better information on how to deal with instrumenting libraries
    • fix -n dumb mode (nobody should use this mode though)
    • fix stability issue with LTO and cmplog
    • better banner
    • more effective cmplog mode
    • more often update the UI when in input2stage mode
  • qemumode/unicornmode: fixed OOB write when using libcompcov, thanks to kotee4ko for reporting!
  • frida_mode:
    • better performance, bug fixes
    • David Carlier added Android support :)
  • afl-showmap, afl-tmin and afl-analyze:
    • honor persistent mode for more speed. thanks to dloffre-snl for reporting!
    • fix bug where targets are not killed on timeouts
    • moved hidden afl-showmap -A option to -H to be used for coresight_mode
  • Prevent accidentaly killing non-afl/fuzz services when aborting afl-showmap and other tools.
  • afl-cc:
    • detect overflow reads on initial input buffer for asan
    • new cmplog mode (incompatible with older afl++ versions)
    • support llvm IR select instrumentation for default PCGUARD and LTO
    • fix for shared linking on MacOS
    • better selective instrumentation AFLLLVM{ALLOW|DENY}LIST on filename matching (requires llvm 11 or newer)
    • fixed a potential crash in targets for LAF string handling
    • fixed a bad assert in LAF split switches
    • added AFLUSETSAN thread sanitizer support
    • llvm and LTO mode modified to work with new llvm 14-dev (again.)
    • fix for AFLREALLD
    • more -z defs filtering
    • make -v without options work
  • added the very good grammar mutator "GramaTron" to the custom_mutators
  • added optimin, a faster and better corpus minimizer by Adrian Herrera. Thank you!
  • added afl-persistent-config script to set perform permanent system configuration settings for fuzzing, for Linux and Macos. thanks to jhertz!
  • added xml, curl & exotic string functions to llvm dictionary feature
  • fix AFL_PRELOAD issues on MacOS
  • removed utils/aflfrida because fridamode/ is now so much better
  • added uninstall target to makefile (todo: update new readme!)

- C
Published by vanhauser-thc about 4 years ago

aflplusplus - 3.14c

Version ++3.14c (release)

  • afl-fuzz:
    • fix -F when a '/' was part of the parameter
    • fixed a crash for cmplog for very slow inputs
    • fix for AFLfast schedule counting
    • removed implied -D determinstic from -M main
    • if the target becomes unavailable check out out/default/error.txt for an indicator why
    • AFLCALFAST was a dead env, now does the same as AFLFASTCAL
    • reverse read the queue on resumes (more effective)
    • fix custom mutator trimming
  • afl-cc:
    • Update to COMPCOV/laf-intel that speeds up the instrumentation process a lot - thanks to Michael Rodler/f0rki for the PR!
    • Fix for failures for some sized string instrumentations
    • Fix to instrument global namespace functions in c++
    • Fix for llvm 13
    • support partial linking
    • do honor AFLLLVM{ALLOW/DENY}LIST for LTO autodictionary and DICT2FILE
    • We do support llvm versions from 3.8 to 5.0 again
  • frida_mode:
    • several fixes for cmplog
    • remove need for AFLFRIDAPERSISTENTRETADDROFFSET
    • less coverage collision
    • feature parity of aarch64 with intel now (persistent, cmplog, in-memory testcases, asan)
  • afl-cmin and afl-showmap -i do now descend into subdirectories (like afl-fuzz does) - note that afl-cmin.bash does not!
  • afl_analyze:
    • fix timeout handling
    • add forkserver support for better performance
  • ensure afl-compiler-rt is built for gcc_module
  • always build aflpp_driver for libfuzzer harnesses
  • added AFL_NO_FORKSRV env variable support to afl-cmin, afl-tmin, and afl-showmap, by @jhertz
  • removed outdated documents, improved existing documentation

- C
Published by vanhauser-thc over 4 years ago

aflplusplus - 3.13c

Version ++3.13c (release)

  • Note: plot_data switched to relative time from unix time in 3.10
  • frida_mode - new mode that uses frida to fuzz binary-only targets, it currently supports persistent mode and cmplog. thanks to @WorksButNotTested!
  • create a fuzzing dictionary with the help of CodeQL thanks to @microsvuln! see utils/autodict_ql
  • afl-fuzz:
    • added patch by @realmadsci to support @@ as part of command line options, e.g. afl-fuzz ... -- ./target --infile=@@
    • add recording of previous fuzz attempts for persistent mode to allow replay of non-reproducable crashes, see AFLPERSISTENTRECORD in config.h and docs/envs.h
    • fixed a bug when trimming for stdin targets
    • cmplog -l: default cmplog level is now 2, better efficiency. level 3 now performs redqueen on everything. use with care.
    • better fuzzing strategy yield display for enabled options
    • ensure one fuzzer sync per cycle
    • fix aflcustomqueuenewentry original file name when syncing from fuzzers
    • fixed a crash when more than one custom mutator was used together with aflcustompost_process
    • on a crashing seed potentially the wrong input was disabled
    • added AFLEXITONSEEDISSUES env that will exit if a seed in -i dir crashes the target or results in a timeout. By default afl++ ignores these and uses them for splicing instead.
    • added AFLEXITON_TIME env that will make afl-fuzz exit fuzzing after no new paths have been found for n seconds
    • when AFLFASTCAL is set a variable path will now be calibrated 8 times instead of originally 40. Long calibration is now 20.
    • added AFLTRYAFFINITY to try to bind to CPUs but don't error if it fails
  • afl-cc:
    • We do not support llvm versions prior 6.0 anymore
    • added thread safe counters to all modes (AFL_LLVM_THREADSAFE_INST), note that this disables NeverZero counters.
    • Fix for -pie compiled binaries with default afl-clang-fast PCGUARD
    • Leak Sanitizer (AFLUSELSAN) added by Joshua Rogers, thanks!
    • Removed InsTrim instrumentation as it is not as good as PCGUARD
    • Removed automatic linking with -lc++ for LTO mode
    • Fixed a crash in llvm dict2file when a strncmp length was -1
    • added --afl-noopt support
  • utils/aflpp_driver:
    • aflppqemudriverhook fixed to work with qemumode
    • aflpp_driver now compiled with -fPIC
  • unicornafl:
    • fix MIPS delay slot caching, thanks @JackGrence
    • fixed aarch64 exit address
    • execution no longer stops at address 0x0
  • updated afl-system-config to support Arch Linux weirdness and increase MacOS shared memory
  • updated the grammar custom mutator to the newest version
  • add -d (add dead fuzzer stats) to afl-whatsup
  • added AFLPRINTFILENAMES to afl-showmap/cmin to print the current filename
  • afl-showmap/cmin will now process queue items in alphabetical order

- C
Published by vanhauser-thc over 4 years ago

aflplusplus - 3.12c

Version ++3.12c (release)

  • afl-fuzz:
    • added AFLTARGETENV variable to pass extra env vars to the target (for things like LDLIBRARYPATH)
    • fix map detection, AFLMAPSIZE not needed anymore for most cases
    • fix counting favorites (just a display thing)
  • afl-cc:
    • fix cmplog rtn (rare crash and not being able to gather ptr data)
    • fix our own PCGUARD implementation to compile with llvm 10.0.1
    • link runtime not to shared libs
    • ensure shared libraries are properly built and instrumented
    • AFLLLVMINSTRUMENT_ALLOW/DENY were not implemented for LTO, added
    • show correct LLVM PCGUARD NATIVE mode when auto switching to it and keep fsanitize-coverage-*list=... Short mnemnonic NATIVE is now also accepted.
  • qemu_mode (thanks @realmadsci):
    • move AFLPRELOAD and AFLUSE_QASAN logic inside afl-qemu-trace
    • add AFLQEMUCUSTOM_BIN
  • unicorn_mode
    • accidently removed the subfolder from github, re-added
  • added DEFAULT_PERMISSION to config.h for all files created, default to 0600

- C
Published by vanhauser-thc almost 5 years ago

aflplusplus - 3.11c

Version ++3.11c (release)

  • afl-fuzz:
    • better auto detection of map size
    • fix sanitizer settings (bug since 3.10c)
    • fix an off-by-one overwrite in cmplog
    • add non-unicode variants from unicode-looking dictionary entries
    • Rust custom mutator API improvements
    • Imported crash stats painted yellow on resume (only new ones are red)
  • afl-cc:
    • added AFL_NOOPT that will just pass everything to the normal gcc/clang compiler without any changes - to pass weird configure scripts
    • fixed a crash that can occur with ASAN + CMPLOG together plus better support for unicode (thanks to @stbergmann for reporting!)
    • fixed a crash in LAF transform for empty strings
    • handle erroneous setups in which multiple afl-compiler-rt are compiled into the target. This now also supports dlopen() instrumented libs loaded before the forkserver and even after the forkserver is started (then with collisions though)
    • the compiler rt was added also in object building (-c) which should have been fixed years ago but somewhere got lost :(
    • Renamed CTX to CALLER, added correct/real CTX implementation to CLASSIC
  • qemu_mode:
    • added AFLQEMUEXCLUDE_RANGES env by @realmadsci, thanks!
    • if no new/updated checkout is wanted, build with: NOCHECKOUT=1 ./buildqemu_support.sh
    • we no longer perform a "git drop"
  • afl-cmin: support filenames with spaces

- C
Published by vanhauser-thc almost 5 years ago

aflplusplus - 3.10c

Version ++3.10c (release)

  • Mac OS ARM64 support
  • Android support fixed and updated by Joey Jiaojg - thanks!
  • New selective instrumentation option with _AFLCOVERAGE* commands to be placed in the source code. Check out instrumentation/README.instrumentlist.md
  • afl-fuzz
    • Making AFLMAPSIZE (mostly) obsolete - afl-fuzz now learns on start the target map size
    • upgraded cmplog/redqueen: solving for floating point, solving transformations (e.g. toupper, tolower, to/from hex, xor, arithmetics, etc.). This is costly hence new command line option -l that sets the intensity (values 1 to 3). Recommended is 2.
    • added AFL_CMPLOG_ONLY_NEW to not use cmplog on initial seeds from -i or resumes (these have most likely already been done)
    • fix crash for very, very fast targets+systems (thanks to mhlakhani for reporting)
    • on restarts (-i)/autoresume (AFL_AUTORESUME) the stats are now reloaded and used, thanks to Vimal Joseph for this patch!
    • changed the meaning of '+' of the '-t' option, it now means to auto-calculate the timeout with the value given being the max timeout. The original meaning of skipping timeouts instead of abort is now inherent to the -t option.
    • if deterministic mode is active (-D, or -M without -d) then we sync after every queue entry as this can take very long time otherwise
    • added minimum SYNC_TIME to include/config.h (30 minutes default)
    • better detection if a target needs a large shared map
    • fix for -Z
    • fixed a few crashes
    • switched to an even faster RNG
    • added hghwng's patch for faster trace map analysis
    • printing suggestions for mistyped AFL_ env variables
    • added Rust bindings for custom mutators (thanks @julihoh)
  • afl-cc
    • allow instrumenting LLVMFuzzerTestOneInput
    • fixed endless loop for allow/blocklist lines starting with a comment (thanks to Zherya for reporting)
    • cmplog/redqueen now also tracks floating point, _ExtInt() + 128bit
    • cmplog/redqueen can now process basic libc++ and libstdc++ std::string comparisons (no position or length type variants)
    • added support for _aflcoverageinteresting() for LTO and our own PCGUARD (llvm 10.0.1+), read more about this function and selective coverage in instrumentation/README.instrumentlist.md
    • added AFLLLVMINSTRUMENT option NATIVE for native clang pc-guard support (less performant than our own), GCC for old afl-gcc and CLANG for old afl-clang
    • fixed a potential crash in the LAF feature
    • workaround for llvm bitcast lto bug
    • workaround for llvm 13
  • qemuafl
    • QASan (address sanitizer for Qemu) ported to qemuafl! See qemu_mode/libqasan/README.md
    • solved some persistent mode bugs (thanks Dil4rd)
    • solved an issue when dumping the memory maps (thanks wizche)
    • Android support for QASan
  • unicornafl
    • Substantial speed gains in python bindings for certain use cases
    • Improved rust bindings
    • Added a new example harness to compare python, c and rust bindings
  • afl-cmin and afl-showmap now support the -f option
  • afl_plot now also generates a graph on the discovered edges
  • changed default: no memory limit for afl-cmin and afl-cmin.bash
  • warn on any AFL and _AFL env vars.
  • set AFLIGNOREUNKNOWNENVS to not warn on unknown AFL... env vars
  • added dummy Makefile to instrumentation/
  • Updated utils/aflfrida to be 5% faster, 7% on x86x64
  • Added AFL_KILL_SIGNAL env variable (thanks @v-p-b)
  • @Edznux added a nice documentation on how to use rpc.statsd with afl++ in docs/rpc_statsd.md, thanks!

- C
Published by vanhauser-thc almost 5 years ago

aflplusplus - 3.00c

Version ++3.00c (release)

  • llvmmode/ and gccplugin/ moved to instrumentation/
  • examples/ renamed to utils/
  • moved libdislocator, libtokencap and qdbi_mode to utils/
  • all compilers combined to afl-cc which emulates the previous ones
  • afl-llvm/gcc-rt.o merged into afl-compiler-rt.o
  • afl-fuzz
    • not specifying -M or -S will now auto-set "-S default"
    • deterministic fuzzing is now disabled by default and can be enabled with -D. It is still enabled by default for -M.
    • a new seed selection was implemented that uses weighted randoms based on a schedule performance score, which is much better that the previous walk the whole queue approach. Select the old mode with -Z (auto enabled with -M)
    • Marcel Boehme submitted a patch that improves all AFFast schedules :)
    • the default schedule is now FAST
    • memory limits are now disabled by default, set them with -m if required
    • rpc.statsd support, for stats and charts, by Edznux, thanks a lot!
    • reading testcases from -i now descends into subdirectories
    • allow the -x command line option up to 4 times
    • loaded extras now have a duplication protection
    • If test cases are too large we do a partial read on the maximum supported size
    • longer seeds with the same trace information will now be ignored for fuzzing but still be used for splicing
    • crashing seeds are now not prohibiting a run anymore but are skipped - they are used for splicing, though
    • update MOpt for expanded havoc modes
    • setting the env var AFLNOAUTODICT will not load an LTO autodictionary
    • added NO_SPLICING compile option and makefile define
    • added INTROSPECTION make target that writes all mutations to out/NAME/introspection.txt
    • print special compile time options used in help output
    • when using -c cmplog, one of the childs was not killed, fixed
    • somewhere we broke -n dumb fuzzing, fixed
    • added aflcustomdescribe to the custom mutator API to allow for easy mutation reproduction on crashing inputs
  • instrumentation
    • We received an enhanced gcc_plugin module from AdaCore, thank you very much!!
    • not overriding -Ox or -fno-unroll-loops anymore
    • we now have our own trace-pc-guard implementation. It is the same as -fsanitize-coverage=trace-pc-guard from llvm 12, but: it is a) inline and b) works from llvm 10.0.1 + onwards :)
    • new llvm pass: dict2file via AFLLLVMDICT2FILE, create afl-fuzz -x dictionary of string comparisons found during compilation
    • LTO autodict now also collects interesting cmp comparisons, std::string compare + find + ==, bcmp
    • fix crash in dict2file for integers > 64 bit
  • custom mutators
    • added a new custom mutator: symcc -> https://github.com/eurecom-s3/symcc/
    • added a new custom mutator: libfuzzer that integrates libfuzzer mutations
    • Our afl++ Grammar-Mutator is now better integrated into custom_mutators/
    • added INTROSPECTION support for custom modules
    • python fuzz function was not optional, fixed
    • some python mutator speed improvements
  • afl-cmin/afl-cmin.bash now search first in PATH and last in AFL_PATH
  • unicornafl synced with upstream version 1.02 (fixes, better rust bindings)
  • renamed AFLDEBUGCHILDOUTPUT to AFLDEBUG_CHILD
  • added AFLCRASHEXITCODE env variable to treat a child exitcode as crash

- C
Published by vanhauser-thc about 5 years ago

aflplusplus - 2.68c

Version ++2.68c (release)

  • added the GSoC excellent afl++ grammar mutator by Shengtuo to our custommutators/ (see custommutators/README.md) - or get it here: https://github.com/AFLplusplus/Grammar-Mutator
  • a few QOL changes for Apple and its outdated gmake
  • afl-fuzz:
    • fix for auto dictionary entries found during fuzzing to not throw out a -x dictionary
    • added total execs done to plot file
    • AFLMAXDET_EXTRAS env variable added to control the amount of deterministic dict entries without recompiling.
    • AFLFORKSRVINIT_TMOUT env variable added to control the time to wait for the forkserver to come up without the need to increase the overall timeout.
    • bugfix for cmplog that results in a heap overflow based on target data (thanks to the magma team for reporting!)
    • write fuzzing setup into out/fuzzer_setup (environment variables and command line)
  • custom mutators:
    • added aflcustomfuzzcount/fuzzcount function to allow specifying the number of fuzz attempts for custom_fuzz
  • llvm_mode:
    • ported SanCov to LTO, and made it the default for LTO. better instrumentation locations
    • Further llvm 12 support (fast moving target like afl++ :-) )
    • deprecated LLVM SKIPSINGLEBLOCK env environment

- C
Published by vanhauser-thc over 5 years ago

aflplusplus - 2.67c

Version ++2.67c (release)

  • Support for improved afl++ snapshot module: https://github.com/AFLplusplus/AFL-Snapshot-LKM
  • Due to the instrumentation needing more memory, the initial memory sizes for -m have been increased
  • afl-fuzz:
    • added -F option to allow -M main fuzzers to sync to foreign fuzzers, e.g. honggfuzz or libfuzzer
    • added -b option to bind to a specific CPU
    • eliminated CPU affinity race condition for -S/-M runs
    • expanded havoc mode added, on no cycle finds add extra splicing and MOpt into the mix
    • fixed a bug in redqueen for strings and made deterministic with -s
  • llvm_mode:
    • now supports llvm 12
    • support for AFLLLVMALLOWLIST/AFLLLVMDENYLIST (previous AFLLLVMWHITELIST and AFLLLVMINSTRUMENTFILE are deprecated and are matched to AFLLLVM_ALLOWLIST). The format is compatible to llvm sancov, and also supports function matching :)
    • added neverzero counting to trace-pc/pcgard
    • fixes for laf-intel float splitting (thanks to mark-griffin for reporting)
    • fixes for llvm 4.0
    • skipping ctors and ifuncs for instrumentation
    • LTO: switch default to the dynamic memory map, set AFLLLVMMAP_ADDR for a fixed map address (eg. 0x10000)
    • LTO: improved stability for persistent mode, no other instrumentation has that advantage
    • LTO: fixed autodict for long strings
    • LTO: laf-intel and redqueen/cmplog are now applied at link time to prevent llvm optimizing away the splits
    • LTO: autodictionary mode is a fixed default now
    • LTO: instrim instrumentation disabled, only classic support used as it is always better
    • LTO: env var AFLLLVMDOCUMENT_IDS=file will document which edge ID was given to which function during compilation
    • LTO: single block functions were not implemented by default, fixed
    • LTO: AFLLLVMSKIP_NEVERZERO behaviour was inversed, fixed
    • setting AFLLLVMLAFSPLITFLOATS now activates AFLLLVMLAFSPLITCOMPARES
    • support for -E and -shared compilation runs
  • added honggfuzz mangle as a custom mutator in custom_mutators/honggfuzz
  • added afl-frida gum solution to examples/afl_frida (mostly imported from https://github.com/meme/hotwax/)
  • small fixes to afl-plot, afl-whatsup and man page creation
  • new README, added FAQ

- C
Published by vanhauser-thc over 5 years ago

aflplusplus - 2.66c

Version ++2.66c (release)

  • renamed the main branch on Github to "stable"
  • renamed master/slave to main/secondary
  • renamed blacklist/whitelist to ignorelist/instrumentlist -> AFLLLVMINSTRUMENTFILE and AFLGCCINSTRUMENTFILE
  • warn on deprecated environment variables
  • afl-fuzz:
    • -S secondary nodes now only sync from the main node to increase performance, the -M main node still syncs from everyone. Added checks that ensure exactly one main node is present and warn otherwise
    • Add -D after -S to force a secondary to perform deterministic fuzzing
    • If no main node is present at a sync one secondary node automatically becomes a temporary main node until a real main nodes shows up
    • Fixed a mayor performance issue we inherited from AFLfast
    • switched murmur2 hashing and random() for xxh3 and xoshiro256**, resulting in an up to 5.5% speed increase
    • Resizing the window does not crash afl-fuzz anymore
    • Ensure that the targets are killed on exit
    • fix/update to MOpt (thanks to arnow117)
    • added MOpt dictionary support from repo
    • added experimental SEEK power schedule. It is EXPLORE with ignoring the runtime and less focus on the length of the test case
  • llvm_mode:
    • the default instrumentation is now PCGUARD if the llvm version is >= 7, as it is faster and provides better coverage. The original afl instrumentation can be set via AFLLLVMINSTRUMENT=AFL. This is automatically done when the instrument_file list feature is used.
    • PCGUARD mode is now even better because we made it collision free - plus it has a fixed map size, so it is also faster! :)
    • some targets want a ld variant for LD that is not gcc/clang but ld, added afl-ld-lto to solve this
    • lowered minimum required llvm version to 3.4 (except LLVMInsTrim, which needs 3.8.0)
    • instrument_file list feature now supports wildcards (thanks to sirmc)
    • small change to cmplog to make it work with current llvm 11-dev
    • added AFLLLVMLAF_ALL, sets all laf-intel settings
    • LTO instrument_files functionality rewritten, now main, _init etc functions need not to be listed anymore
    • fixed crash in compare-transform-pass when strcasecmp/strncasecmp was tried to be instrumented with LTO
    • fixed crash in cmplog with LTO
    • enable snapshot lkm also for persistent mode
  • Unicornafl
    • Added powerPC support from unicorn/next
    • rust bindings!
  • CMPLOG/Redqueen now also works for MMAP sharedmem
  • ensure shmem is released on errors
  • we moved radamsa to be a custom mutator in ./custom_mutators/. It is not compiled by default anymore.
  • allow running in /tmp (only unsafe with umask 0)
  • persistent mode shared memory testcase handover (instead of via files/stdin) - 10-100% performance increase
  • General support for 64 bit PowerPC, RiscV, Sparc etc.
  • fix afl-cmin.bash
  • slightly better performance compilation options for afl++ and targets
  • fixed afl-gcc/afl-as that could break on fast systems reusing pids in the same second
  • added lots of dictionaries from oss-fuzz, go-fuzz and Jakub Wilk
  • added former postlibrary examples to examples/custommutators/
  • Dockerfile upgraded to Ubuntu 20.04 Focal and installing llvm 11 and gcc 10 so afl-clang-lto can be build

- C
Published by vanhauser-thc over 5 years ago

aflplusplus - 2.65c

Version ++2.65c (release):

  • afl-fuzz:
    • AFLMAPSIZE was not working correctly
    • better python detection
    • an old, old bug in afl that would show negative stability in rare circumstances is now hopefully fixed
    • AFLPOSTLIBRARY was deprecated, use AFLCUSTOMMUTATORLIBRARY instead (see docs/custommutators.md)
  • llvm_mode:
    • afl-clang-fast/lto now do not skip single block functions. This behaviour can be reactivated with AFLLLVMSKIPSINGLEBLOCK
    • if LLVM 11 is installed the posix shm_open+mmap is used and a fixed address for the shared memory map is used as this increases the fuzzing speed
    • InsTrim now has an LTO version! :-) That is the best and fastest mode!
    • fixes to LTO mode if instrumented edges > MAP_SIZE
    • CTX and NGRAM can now be used together
    • CTX and NGRAM are now also supported in CFG/INSTRIM mode
    • AFLLLVMLAFTRANSFORMCOMPARES could crash, fixed
    • added AFLLLVMSKIP_NEVERZERO to skip the never zero coverage counter implementation. For targets with few or no loops or heavily called functions. Gives a small performance boost.
  • qemu_mode:
    • add information on PIE/PIC load addresses for 32 bit
    • better dependency checks
  • gcc_plugin:
    • better dependency checks
  • unicorn_mode:
    • validatecrashcallback can now count non-crashing inputs as crash as well
    • better submodule handling
  • afl-showmap: fix for -Q mode
  • added examples/aflnetworkproxy which allows to fuzz a target over the network (not fuzzing tcp/ip services but running afl-fuzz on one system and the target being on an embedded device)
  • added examples/afl_untracer which does a binary-only fuzzing with the modifications done in memory (intel32/64 and aarch64 support)
  • added examples/afl_proxy which can be easily used to fuzz and instrument non-standard things
  • all:
    • forkserver communication now also used for error reporting
    • fix 32 bit build options
    • make clean now leaves qemu-3.1.1.tar.xz and the unicornafl directory intact if in a git/svn checkout - unless "deepclean" is used

- C
Published by vanhauser-thc almost 6 years ago

aflplusplus - 2.64c

Version ++2.64c (release):

  • llvm_mode LTO mode:
    • now requires llvm11 - but compiles all targets! :)
    • autodictionary feature added, enable with AFL_LLVM_LTO_AUTODICTIONARY
    • variable map size usage
  • afl-fuzz:
    • variable map size support added (only LTO mode can use this)
    • snapshot feature usage now visible in UI
    • Now setting -L -1 will enable MOpt in parallel to normal mutation. Additionally, this allows to run dictionaries, radamsa and cmplog.
    • fix for cmplog/redqueen mode if stdin was used
    • fix for writing a better plot_data file
  • qemu_mode: fix for persistent mode (which would not terminate or get stuck)
  • compare-transform/AFLLLVMLAFTRANSFORMCOMPARES now transforms also static global and local variable comparisons (cannot find all though)
  • extended forkserver: map_size and more information is communicated to afl-fuzz (and afl-fuzz acts accordingly)
  • new environment variable: AFLMAPSIZE to specify the size of the shared map
  • if AFLCC/AFLCXX is set but empty afl compilers did fail, fixed (this bug is in vanilla afl too)
  • added NO_PYTHON flag to disable python support when building afl-fuzz
  • more refactoring

- C
Published by vanhauser-thc almost 6 years ago

aflplusplus - 2.63c

Version ++2.63c (release):

  • all:
    • big code changes to make afl-fuzz thread-safe so afl-fuzz can spawn multiple fuzzing threads in the future or even become a library
    • afl basic tools now report on the environment variables picked up
    • more tools get environment variable usage info in the help output
    • force all output to stdout (some OK/SAY/WARN messages were sent to stdout, some to stderr)
    • uninstrumented mode uses an internal forkserver ("fauxserver")
    • now builds with -D_FORTIFY_SOURCE=2
    • drastically reduced number of (de)allocations during fuzzing
  • afl-fuzz:
    • python mutator modules and custom mutator modules now use the same interface and hence the API changed
    • AFL_AUTORESUME will resume execution without the need to specify -i -
    • added experimental power schedules (-p):
      • mmopt: ignores runtime of queue entries, gives higher weighting to the last 5 queue entries
      • rare: puts focus on queue entries that hits rare branches, also ignores runtime
  • llvm_mode:
    • added SNAPSHOT feature (using https://github.com/AFLplusplus/AFL-Snapshot-LKM)
    • added Control Flow Integrity sanitizer (AFLUSECFISAN)
    • added AFLLLVMINSTRUMENT option to control the instrumentation type easier: DEFAULT, CFG (INSTRIM), LTO, CTX, NGRAM-x (x=2-16)
    • made USETRACEPC compile obsolete
  • LTO collision free instrumented added in llvm_mode with afl-clang-lto - note that this mode is amazing, but quite some targets won't compile
  • Added llvmmode NGRAM prevloc coverage by Adrean Herrera (https://github.com/adrianherrera/afl-ngram-pass/), activate by setting AFLLLVMINSTRUMENT=NGRAM- or AFLLLVMNGRAM_SIZE=
  • Added llvmmode context sensitive branch coverage, activated by setting AFLLLVMINSTRUMENT=CTX or AFLLLVM_CTX=1
  • llvm_mode InsTrim mode:
    • removed workaround for bug where paths were not instrumented and imported fix by author
    • made skipping 1 block functions an option and is disabled by default, set AFLLLVMINSTRIM_SKIPSINGLEBLOCK=1 to re-enable this
  • qemu_mode:
    • qemu_mode now uses solely the internal capstone version to fix builds on modern Linux distributions
    • QEMU now logs routine arguments for CmpLog when the target is x86
  • afl-tmin:
    • now supports hang mode -H to minimize hangs
    • fixed potential afl-tmin missbehavior for targets with multiple hangs
  • Pressing Control-c in afl-cmin did not terminate it for some OS
  • the custom API was rewritten and is now the same for Python and shared libraries.

- C
Published by vanhauser-thc almost 6 years ago

aflplusplus - 2.62c

Version ++2.62c (release):

  • Important fix for memory allocation functions that result in afl-fuzz not identifying crashes - UPDATE!
  • Small fix for -E/-V to release the CPU
  • CmpLog does not need sancov anymore

- C
Published by vanhauser-thc almost 6 years ago

aflplusplus - 2.61c

-> DO NOT USE THIS RELEASE <-

Version ++2.61c (release):

  • use -march=native if available
  • most tools now check for mistyped environment variables
  • gcc 10 is now supported
  • the memory safety checks are now disabled for a little more speed during fuzzing (only affects creating queue entries), can be toggled in config.h
  • afl-fuzz:
    • MOpt out of bounds writing crash fixed
    • now prints the real python version support compiled in
    • set stronger performance compile options and little tweaks
    • Android: prefer bigcores when selecting a CPU
    • CmpLog forkserver
    • Redqueen input-2-state mutator (cmp instructions only ATM)
    • all Python 2+3 versions supported now
    • changed execspersec in fuzzer_stats from "current" execs per second (which is pointless) to total execs per second
    • bugfix for dictionary insert stage count (fix via Google repo PR)
    • added warning if -M is used together with custom mutators with _ONLY option
    • AFL_TMPDIR checks are now later and better explained if they fail
  • llvm_mode
    • InsTrim: three bug fixes:
      1. (minor) no pointless instrumentation of 1 block functions
      2. (medium) path bug that leads a few blocks not instrumented that should be
      3. (major) incorrect prev_loc was written, fixed!
  • afl-clang-fast:
    • show in the help output for which llvm version it was compiled for
    • now does not need to be recompiled between trace-pc and pass instrumentation. compile normally and set AFLLLVMUSETRACEPC :)
    • LLVM 11 is supported
    • CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog)
  • afl-gcc, afl-clang-fast, afl-gcc-fast:
    • experimental support for undefined behaviour sanitizer UBSAN (set AFLUSEUBSAN=1)
    • the instrumentation summary output now also lists activated sanitizers
    • afl-as: added isatty(2) check back in
    • added AFL_DEBUG (for upcoming merge)
  • qemu_mode:
    • persistent mode is now also available for arm and aarch64
    • CmpLog instrumentation for QEMU (-c afl-fuzz command line option) for x86, x86_64, arm and aarch64
    • AFLPERSISTENTHOOK callback module for persistent QEMU (see examples/qemupersistenthook)
    • added qemu_mode/README.persistent.md documentation
    • AFL_ENTRYPOINT noew has instruction granularity
  • afl-cmin is now a sh script (invoking awk) instead of bash for portability the original script is still present as afl-cmin.bash
  • afl-showmap: -i dir option now allows processing multiple inputs using the forkserver. This is for enhanced speed in afl-cmin.
  • added blacklist and whitelisting function check in all modules of llvm_mode
  • added fix from Debian project to compile libdislocator and libtokencap
  • libdislocator: AFLALIGNEDALLOC to force size alignment to maxalignt

- C
Published by vanhauser-thc about 6 years ago

aflplusplus - 2.60c

Version ++2.60c (release):

  • fixed a critical bug in afl-tmin that was introduced during ++2.53d
  • added test cases for afl-cmin and afl-tmin to test/test.sh
  • added ./experimental/argvfuzzing ldpreload library by Kjell Braden
  • added preeny's desockdup ldpreload library as ./experimental/socket_fuzzing for network fuzzing
  • added AFLASFORCE_INSTRUMENT environment variable for afl-as - this is for the retrorewrite project
  • we now set QEMUSETENV from AFLPRELOAD when qemumode is used

- C
Published by vanhauser-thc about 6 years ago

aflplusplus - 2.59c

Version ++2.59c (release):

  • qbdi_mode: fuzz android native libraries via QBDI framework
  • unicorn_mode: switched to the new unicornafl, thanks domenukk (see https://github.com/vanhauser-thc/unicorn)
  • afl-fuzz:
    • added radamsa as (an optional) mutator stage (-R[R])
    • added -u command line option to not unlink the fuzz input file
    • Python3 support (autodetect)
    • AFLDISABLETRIM env var to disable the trim stage
    • CPU affinity support for DragonFly
  • llvm_mode:
    • float splitting is now configured via AFLLLVMLAFSPLITFLOATS
    • support for llvm 10 included now (thanks to devnexen)
  • libtokencap:
    • support for *BSD/OSX/Dragonfly added
    • hook common *cmp functions from widely used libraries
  • compcov:
    • hook common *cmp functions from widely used libraries
    • floating point splitting support for QEMU on x86 targets
  • qemumode: AFLQEMUDISABLECACHE env to disable QEMU TranslationBlocks caching
  • afl-analyze: added AFLSKIPBIN_CHECK support
  • better random numbers for gccplugin and llvmmode (thanks to devnexen)
  • Dockerfile by courtesy of devnexen
  • added regex.dictionary
  • qemu and unicorn download scripts now try to download until the full download succeeded. f*ckin travis fails downloading 40% of the time!
  • more support for Android (please test!)
  • added the few Android stuff we didnt have already from Google afl repository
  • removed unnecessary warnings

- C
Published by vanhauser-thc about 6 years ago

aflplusplus - 2.58c

Version ++2.58c (release):

  • reverted patch to not unlink and recreate the input file, it resulted in performance loss of ~10%
  • added test/test-performance.sh script
  • (re)added gcc_plugin, fast inline instrumentation is not yet finished, however it includes the whitelisting and persistance feature! by hexcoder-
  • gcc_plugin tests added to testing framework

- C
Published by vanhauser-thc over 6 years ago

aflplusplus - 2.57c

Note: we jump to 2.57 instead of 2.55 to catch up with Google's versioning

Changelog: - persistent mode for QEMU (see qemumode/README.md) - custom mutator library is now an additional mutator, to exclusivly use it add AFLCUSTOMMUTATORONLY (that will trigger the previous behaviour) - new library qemumode/unsigaction which filters sigaction events - afl-fuzz: new command line option -I to execute a command on a new crash - no more unlinking the input file, this way the input file can also be a FIFO or disk partition - setting LLVMCONFIG for llvmmode will now again switch to the selected llvm version. If your setup is correct. - fuzzing strategy yields for custom mutator were missing from the UI, added them :) - added "make tests" which will perform checks to see that all functionality is working as expected. this is currently the starting point, its not complete :) - added mutation documentation feature ("make document"), creates afl-fuzz-document and saves all mutations of the first run on the first file into out/queue/mutations - libtokencap and libdislocator now compile to the aflroot directory and are installed to the .../lib/afl directory when present during make install - more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen) - reducing duplicate code in afl-fuzz - added "make help" - removed compile warnings from python internal stuff - added man page for afl-clang-fast[++] - updated documentation - Wine mode to run Win32 binaries with the QEMU instrumentation (-W) - CompareCoverage for ARM target in QEMU/Unicorn

- C
Published by vanhauser-thc over 6 years ago

aflplusplus - 2.54c

Changelog for 2.54c: - big code refactoring: * all includes are now in include/ * all afl sources are now in src/ - see src/README.src * afl-fuzz was splitted up in various individual files for including functionality in other programs (e.g. forkserver, memory map, etc.) for better readability. * new code indention everywhere - auto-generating man pages for all (main) tools - added AFLFORCEUI to show the UI even if the terminal is not detected - llvm 9 is now supported (still needs testing) - Android is now supported (thank to JoeyJiao!) - still need to modify the Makefile though - fix building qemu on some Ubuntus (thanks to floyd!) - custom mutator by a loaded library is now supported (thanks to kyakdan!) - added PR that includes peakrssmb and slowestexecms in the fuzzer_stats report - more support for *BSD (thanks to devnexen!) - fix building on *BSD (thanks to tobias.kortkamp for the patch) - fix for a few features to support different map sized than 2^16 - afl-showmap: new option -r now shows the real values in the buckets (stock afl never did), plus shows tuple content summary information now - small docu updates - NeverZero counters for QEMU - NeverZero counters for Unicorn - CompareCoverage Unicorn - immediates-only instrumentation for CompareCoverage

- C
Published by vanhauser-thc over 6 years ago

aflplusplus - 2.53c

Second release of afl++ which besides the new features from the previous version has the following important changes:

  • imported the few minor changes from the 2.53b release
  • unicorn_mode got added - thanks to domenukk for the patch!
  • fix llvmmode AFLTRACE_PC with modern llvm
  • fix a crash in qemu_mode which also exists in stock afl
  • added libcompcov, a laf-intel implementation for qemu! :) see qemu_mode/libcompcov/README.libcompcov
  • updated afl-fuzz and afl-system-config for new scaling governor location in modern kernels
  • all queue, hang and crash files now have their discovery time in their name
  • if llvm_mode was compiled, afl-clang/afl-clang++ will point to these instead of afl-gcc
  • added instrim, a much faster llvmmode instrumentation at the cost of path discovery. See llvmmode/README.instrim (https://github.com/csienslab/instrim)
  • added MOpt (github.com/puppet-meteor/MOpt-AFL) mode, see docs/README.MOpt
  • added code to make it more portable to other platforms than Intel Linux
  • added never zero counters for afl-gcc and optionally (because of an optimization issue in llvm < 9) for llvmmode (AFLLLVMNEVERZERO=1)
  • added a new doc about binary only fuzzing: docs/binaryonly_fuzzing.txt
  • more cpu power for afl-system-config
  • added forkserver patch to afl-tmin, makes it much faster (originally from github.com/nccgroup/TriforceAFL)
  • added whitelist support for llvmmode via AFLLLVM_WHITELIST to allow only to instrument what is actually interesting. Gives more speed and less map pollution (originally by choller@mozilla)
  • added Python Module mutator support, python2.7-dev is autodetected. see docs/python_mutators.txt (originally by choller@mozilla)
  • added AFLCALFAST for slow applications and AFLDEBUGCHILD_OUTPUT for debugging
  • added -V time and -E execs option to better comparison runs, runs afl-fuzz for a specific time/executions.
  • added a -s seed switch to allow afl run with a fixed initial seed that is not updated. This is good for performance and path discovery tests as the random numbers are deterministic then

- C
Published by vanhauser-thc over 6 years ago

aflplusplus - 2.52c

First release of afl++ based on afl 2.52b with: * community patches to make llvmmode and qemumode faster, plus new features and bugfixes * qemu upgraded to 3.1 * aflfast powerschedules added * llvm_mode now supports llvm up to version 8

- C
Published by vanhauser-thc over 6 years ago