afl++ for Mac

American Fuzzy Lop plus plus (AFL++)

Release version: 5.03c

GitHub version: 5.04a

Repository:

AFL++ is maintained by:

Marc "van Hauser" Heuse Dominik Maier Andrea Fioraldi Heiko "hexcoder-" Eissfeldt frida_mode is maintained by @Worksbutnottested

Originally developed by Michal "lcamtuf" Zalewski.

AFL++ is a superior fork to Google's AFL - more speed, more and better mutations, more and better instrumentation, custom module support, etc.

AFL++ is licensed under the AGPL-3.0-or-later, and it also contains files under the Apache-2.0 License. Everything compiled into a fuzzing harness is and will stay Apache 2.0 licensed. Each file states its own license in its SPDX-License-Identifier header — that is the license you must follow for that file. An optional commercial license is available for organizations that cannot use the AGPL (obtained by donating to a good cause — the project and its maintainers receive no money). See LICENSING.md for a plain-language overview and the License section below for details.

Getting started

Here is some information to get you started:

For an overview of the AFL++ documentation and a very helpful graphical guide, please visit docs/README.md. To get you started with tutorials, go to docs/tutorials.md. For releases, see the Releases tab and branches. The best branches to use are, however, stable or dev - depending on your risk appetite. Also take a look at the list of important changes in AFL++ and the list of features. If you want to use AFL++ for your academic work, check the papers page on the website. To cite our work, look at the Cite section. For comparisons, use the fuzzbench aflplusplus setup, or use afl-clang-fast with AFL_LLVM_CMPLOG=1. You can find the aflplusplus default configuration on Google's fuzzbench.

Building and installing AFL++

To have AFL++ easily available with everything compiled, pull the image directly from the Docker Hub (available for both x86_64 and arm64):

This image is automatically published when a push to the stable branch happens (see branches). If you use the command above, you will find your target source code in /src in the container.

Note: you can also pull aflplusplus/aflplusplus:dev which is the most current development state of AFL++.

To build AFL++ yourself - which we recommend - continue at docs/INSTALL.md.

Quick start: Fuzzing with AFL++

NOTE: Before you start, please read about the common sense risks of fuzzing.

This is a quick start for fuzzing targets with the source code available. To read about the process in detail, see docs/fuzzing_in_depth.md.

To learn about fuzzing other targets, see: Binary-only targets:

Network services:

GUI programs:

Step-by-step quick start: Compile the program or library to be fuzzed using afl-cc. A common way to do this would be: Get a small but valid input file that makes sense to the program. When fuzzing verbose syntax (SQL, HTTP, etc.), create a dictionary as described in