You've already forked AFLplusplus
mirror of
https://github.com/AdaCore/AFLplusplus.git
synced 2026-02-12 13:08:19 -08:00
9544b3dbf2
When we started using AFL, it did not have an integrated GCC plugin. There was one proposed by Austin Seipp, but for various reasons we ended up using some of its infrastructure (runtime and wrapper), but writing the GCC plugin proper from scratch. With AFL++'s renewed interest in a GCC plugin, we rebased ours, with some features that are or were missing in the one that was integrated: * efficient, fully-functional inline and out-of-line instrumentation Inline instrumentation was work in progress in the original plugin. Controlled by AFL_GCC_OUT_OF_LINE. * reproducible instrumentation Obey -frandom-seed for pseudorandom number generation. * licensing clarity and strict compliance GPLv3+ for the plugin, that uses GCC internals; add a copy of the license, as required. * allow/deny list support Copied and adjusted from the LLVM plugin implementation. * neverZero support Not as compact as the asm-wrapper version, but likely more efficient. Both are quite thread-unsafe, with different caveats. Controlled with AFL_GCC_SKIP_NEVERZERO.
AFL++ snapshot feature
Snapshotting is a feature that makes a snapshot from a process and then restores its state, which is faster then forking it again.
All targets compiled with llvm_mode are automatically enabled for the snapshot feature.
To use the snapshot feature for fuzzing compile and load this kernel module: https://github.com/AFLplusplus/AFL-Snapshot-LKM
Note that is has little value for persistent (__AFL_LOOP) fuzzing.
Notes
Snapshot does not work with multithreaded targets yet. Still in WIP, it is now usable only for single threaded applications.