Skip to main content

AFL++

Coverage-guided fuzzer with mutation engines, LLVM instrumentation plugins, and binary-only modes for finding memory safety bugs.

Technical Architecture & Overview

AFL++ is a community-driven fork of American Fuzzy Lop (AFL). It adds collision-free branch coverage, LLVM and GCC instrumentation plugins, QEMU and Unicorn binary-only modes, custom mutators, and AFLfast++ power schedules with MOpt mutators.

Targeted Technical Use Cases

Testing compiled C/C++, Rust, and Go codebases for memory safety bugs, integer overflows, and parser crashes.

Evaluation & Trade-offs

Core Strengths

  • +High execution speed and path exploration efficiency.
  • +Supports source-level (LLVM/GCC) and binary-only (QEMU/Unicorn/FRIDA/NYX) fuzzing.
  • +Includes mutators like MOpt, Redqueen, and Laf-Intel comparison splitting.

Trade-Offs & Limitations

  • -Primarily built for native binaries; requires extra work when fuzzing stateful network protocols.
  • -Requires writing custom harnesses for non-CLI entry points.

Defensive Security Application

Used in continuous integration (such as OSS-Fuzz) to catch memory corruption bugs before releases.

Frequently Asked Questions

What is AFL++?

AFL++ is a community-driven fork of American Fuzzy Lop (AFL). It adds collision-free branch coverage, LLVM and GCC instrumentation plugins, QEMU and Unicorn binary-only modes, custom mutators, and AFLfast++ power schedules with MOpt mutators.

What is AFL++ used for?

Testing compiled C/C++, Rust, and Go codebases for memory safety bugs, integer overflows, and parser crashes.

What are the strengths of AFL++?
  • +High execution speed and path exploration efficiency.
  • +Supports source-level (LLVM/GCC) and binary-only (QEMU/Unicorn/FRIDA/NYX) fuzzing.
  • +Includes mutators like MOpt, Redqueen, and Laf-Intel comparison splitting.
What are the limitations of AFL++?
  • +Primarily built for native binaries; requires extra work when fuzzing stateful network protocols.
  • +Requires writing custom harnesses for non-CLI entry points.
How is AFL++ used defensively?

Used in continuous integration (such as OSS-Fuzz) to catch memory corruption bugs before releases.