AFL++
Coverage-guided fuzzer with mutation engines, LLVM instrumentation plugins, and binary-only modes for finding memory safety bugs.
Technical Architecture & Overview
AFL++ is a community-driven fork of American Fuzzy Lop (AFL). It adds collision-free branch coverage, LLVM and GCC instrumentation plugins, QEMU and Unicorn binary-only modes, custom mutators, and AFLfast++ power schedules with MOpt mutators.
Targeted Technical Use Cases
Testing compiled C/C++, Rust, and Go codebases for memory safety bugs, integer overflows, and parser crashes.
Evaluation & Trade-offs
Core Strengths
- +High execution speed and path exploration efficiency.
- +Supports source-level (LLVM/GCC) and binary-only (QEMU/Unicorn/FRIDA/NYX) fuzzing.
- +Includes mutators like MOpt, Redqueen, and Laf-Intel comparison splitting.
Trade-Offs & Limitations
- -Primarily built for native binaries; requires extra work when fuzzing stateful network protocols.
- -Requires writing custom harnesses for non-CLI entry points.
Defensive Security Application
Used in continuous integration (such as OSS-Fuzz) to catch memory corruption bugs before releases.
Frequently Asked Questions
What is AFL++?→
AFL++ is a community-driven fork of American Fuzzy Lop (AFL). It adds collision-free branch coverage, LLVM and GCC instrumentation plugins, QEMU and Unicorn binary-only modes, custom mutators, and AFLfast++ power schedules with MOpt mutators.
What is AFL++ used for?→
Testing compiled C/C++, Rust, and Go codebases for memory safety bugs, integer overflows, and parser crashes.
What are the strengths of AFL++?→
- +High execution speed and path exploration efficiency.
- +Supports source-level (LLVM/GCC) and binary-only (QEMU/Unicorn/FRIDA/NYX) fuzzing.
- +Includes mutators like MOpt, Redqueen, and Laf-Intel comparison splitting.
What are the limitations of AFL++?→
- +Primarily built for native binaries; requires extra work when fuzzing stateful network protocols.
- +Requires writing custom harnesses for non-CLI entry points.
How is AFL++ used defensively?→
Used in continuous integration (such as OSS-Fuzz) to catch memory corruption bugs before releases.