AFL++
Coverage-guided fuzzer with mutation engines, LLVM instrumentation plugins, and binary-only modes for finding memory safety bugs.
Technical Architecture & Overview
AFL++ is a fork of American Fuzzy Lop (AFL). It adds non-colliding edge coverage, LLVM and GCC instrumentation plugins, QEMU, Unicorn, FRIDA, and Nyx binary-only modes, custom mutators, AFLfast power schedules, and a MOpt-inspired mutation scheduler.
Targeted Technical Use Cases
Testing compiled C/C++ and Rust codebases for memory safety bugs, integer overflows, and parser crashes.
Evaluation & Trade-offs
Core Strengths
- +High execution speed and path exploration efficiency.
- +Supports source-level (LLVM/GCC) and binary-only (QEMU/Unicorn/FRIDA/NYX) fuzzing.
- +Includes CmpLog (a Redqueen implementation), LAF-Intel comparison splitting, and a MOpt-inspired mutation scheduler.
Trade-Offs & Limitations
- -Primarily built for native binaries; requires extra work when fuzzing stateful network protocols.
- -Requires writing custom harnesses for non-CLI entry points.
Defensive Security Application
Used in continuous integration (such as OSS-Fuzz) to catch memory corruption bugs before releases.
Frequently Asked Questions
What is AFL++?→
AFL++ is a fork of American Fuzzy Lop (AFL). It adds non-colliding edge coverage, LLVM and GCC instrumentation plugins, QEMU, Unicorn, FRIDA, and Nyx binary-only modes, custom mutators, AFLfast power schedules, and a MOpt-inspired mutation scheduler.
What is AFL++ used for?→
Testing compiled C/C++ and Rust codebases for memory safety bugs, integer overflows, and parser crashes.
What are the strengths of AFL++?→
- +High execution speed and path exploration efficiency.
- +Supports source-level (LLVM/GCC) and binary-only (QEMU/Unicorn/FRIDA/NYX) fuzzing.
- +Includes CmpLog (a Redqueen implementation), LAF-Intel comparison splitting, and a MOpt-inspired mutation scheduler.
What are the limitations of AFL++?→
- +Primarily built for native binaries; requires extra work when fuzzing stateful network protocols.
- +Requires writing custom harnesses for non-CLI entry points.
How is AFL++ used defensively?→
Used in continuous integration (such as OSS-Fuzz) to catch memory corruption bugs before releases.