aflplusplus

No entries match these filters. Clear filters

1. v5.03c Sep 2, 2026 · issue 062

   AFL++ v5.03c adds Value Profile fuzzing, four new LLVM instrumentation env vars, starved-mode queue minimization, and POSIX shared memoryPOSIX shared memoryA POSIX-standard IPC mechanism letting two or more processes map the same named memory region into their address spaces, giving cyber tools a fast, zero-copy channel for passing large data between components. on macOS.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v5.03c https://github.com/AFLplusplus/AFLplusplus.git
   # already have the repo? check out this version:
   $ git checkout v5.03c

   └──▷ TRY IT
   Enable Value Profile instrumentation to capture comparison operand diversity, then activate it in afl-fuzz after 30 seconds of baseline fuzzing.
   copy

   $ AFL_LLVM_VALUE_PROFILE=1 afl-clang-fast -o target target.c
   afl-fuzz -i seeds/ -o out/ -r 30 -- ./target @@

   Score branchless min/max/abs clamps and fused conditions for deeper coverage of optimizer-transformed code, accepting the throughput trade-off.
   copy

   $ AFL_LLVM_MINMAX=1 AFL_LLVM_FUSED=1 afl-clang-fast -o target target.c
   afl-fuzz -i seeds/ -o out/ -- ./target @@

   When a long-running campaign stalls, trigger queue minimization automatically so stale entries are pruned and their coverage becomes rediscoverable.
   copy

   $ AFL_STARVED_MINIMIZE_QUEUE=1 afl-fuzz -i seeds/ -o out/ -- ./target @@

   • Adds AFL_LLVM_VALUE_PROFILE=1 env var to enable Value Profile instrumentation in fuzz targets, paired with the new afl-fuzz flag -r <seconds> to activate value-profile-guided mutation after a delay.
   • Adds AFL_LLVM_DENSE=1 env var to disable PCGUARD basic block pruning for denser coverage maps.
   • Adds AFL_LLVM_MINMAX=1 env var to score min/max/abs intrinsics (branchless clamps); adds ~10% map entries at a ~20% throughput cost, default off.
   • Adds AFL_LLVM_FUSED=1 env var to score both halves of fused conditions (e.g. if (a && b) compiled to a single and i1).
   • Adds AFL_LLVM_VECTORS=1 env var to instrument vector selects and vector min/max with one guard pair per lane, default off.

   +12 more show less

   • Adds AFL_STARVED_MINIMIZE_QUEUE env var so that when starved mode fails to find new coverage, afl-fuzz minimizes the queue (like afl-cmin) and makes removed entries' coverage rediscoverable.
   • Adds SIGUSR2 signal handling to afl-fuzz to force an immediate sync (AFL internal sync and foreign -F directories) after the current queue entry finishes.
   • Adds AFL_DUMP_MAP_SIZE to print the coverage/IJON breakdown to stderr.
   • Implements a starved mode in afl-fuzz: when no new finds occur for an extended period, seed and mutation variability increases automatically (including splicing phase), with visibility in the UI.
   • Adds afl-merge as a symlink tool to merge new files into an existing (non-minimized) corpus.
   • Switches afl-cmin.c to be the default afl-cmin implementation; -T all (C and Python variants) now counts CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. the process is actually allowed to run on.
   • macOS now uses POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. shared memory instead of SysV, removing the kern.sysv.shmseg / kern.sysv.shmmax ceiling constraints (CmpLog alone requires a 145 MB segment, far above the 4 MB macOS default).
   • Removes classic AFL instrumentation (colliding coverage), superseded by AFL_LLVM_PATH and AFL_LLVM_CALLER.
   • Trimming stage in afl-fuzz now saves crashes, hangs, and new coverage found during input shortening, visible as op:trim / op:ptrim in output file names.
   • Mode-switching limits in afl-fuzz are now exec-count-based rather than time-based.
   • afl-fuzz -i input directory and afl-showmap -i now follow symlinked test cases and symlinked subdirectories; foreign sync directories (-F) also import symlinked test cases.
   • Unreadable foreign sync (-F) directories are now reported once per directory and listed at startup, replacing silent failure.

   17 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !macOS targets must be recompiled with the new afl-cc: a target built by an older afl-cc still expects a SysV id in __AFL_SHM_ID and will not work with the new POSIX shared memory.
   • !Classic AFL instrumentation (colliding coverage) has been removed from afl-cc; projects relying on it must switch to AFL_LLVM_PATH or AFL_LLVM_CALLER.
   • !The obsolete afl-as assembler wrapper has been removed.
2. v5.02c Jun 29, 2026 · issue 001

   AFL++ v5.02c adds afl-health campaign checker, C11 complexity-aware scheduling, and a new crash-on-uninstrumented-entry mode.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v5.02c https://github.com/AFLplusplus/AFLplusplus.git
   # already have the repo? check out this version:
   $ git checkout v5.02c

   └──▷ TRY IT
   Check the health of a running multi-instance AFL++ campaign, including remote fuzzers via SSH.
   copy

   $ afl-health -i /output/sync_dir

   Compile a target with C11 complexity-aware scheduling to improve coverage of deeply nested code paths.
   copy

   $ AFL_LLVM_C11=1 CC=afl-cc CXX=afl-c++ ./configure --disable-shared && make clean all

   Detect when fuzzing input reaches a function intentionally excluded from instrumentation — useful for auditing allowlist completeness.
   copy

   $ AFL_LLVM_CRASHLIST=/path/to/denylist.txt afl-cc -o target target.c && afl-fuzz -i seeds/ -o out/ -- ./target @@

   • New afl-health tool: advanced campaign health checker with tips, analysis, and SSH support — a more powerful replacement for afl-whatsup.
   • New C11 instrumentation mode (AFL_LLVM_C11): afl-cc records per-function local variable counts; afl-fuzz uses this as an extra queue-scheduling signal to favor more complex code paths.
   • New AFL_LLVM_CRASHLIST environment variable: causes the fuzzer to crash immediately when a function marked as uninstrumented is entered via fuzzing input, enabling strict instrumentation boundary enforcement.
   • Allow/deny list fun: entries now matched verbatim via fnmatch() (breaking change: add a leading * manually for the old suffix-match behavior); entries are matched against both mangled and demangled/unqualified names, and fun: entries now permit : so C++ and Rust demangled names can be listed.
   • When -fsanitize-coverage-allowlist=/-fsanitize-coverage-ignorelist= is passed without the corresponding AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST, the supplied list is automatically reused so the optimized PCGUARD pass honors it.

   +1 more show less

   • Breaking change: persistent-mode / LLVMFuzzerTestOneInput targets must be recompiled against this release.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Persistent mode and LLVMFuzzerTestOneInput targets must be recompiled after upgrading to v5.02c
   • !Instrument allow/deny list fun: entries in AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST (and GCC equivalents) are now matched verbatim with fnmatch() instead of having a * prepended automatically — existing entries that relied on the implicit leading * for suffix matching must be updated to add an explicit leading *
3. v5.01c Jun 18, 2026 · release notes

   AFL++ v5.01c adds adaptive MOpt, non-colliding QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. coverage, a new qemu_bridge mode, and faster MacOS persistent fuzzing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v5.01c https://github.com/AFLplusplus/AFLplusplus.git
   # already have the repo? check out this version:
   $ git checkout v5.01c

   └──▷ TRY IT
   Opt out of the new futex-based persistent mode on macOS if your host is older than 2024 or you observe compatibility issues.
   copy

   $ AFL_FAST_CHILD_SYNC=1 afl-fuzz -i corpus/ -o findings/ -- ./target @@

   Enable UBSAN instrumentation so afl-fuzz halts immediately on undefined-behavior hits, surfacing UB bugs as distinct crashes.
   copy

   $ AFL_USE_UBSAN=1 afl-cc -o target target.c && afl-fuzz -i corpus/ -o findings/ -- ./target @@

   • New adaptive MOpt mutator in afl-fuzz, replacing the outdated implementation — reportedly outperforms standard havoc in initial testing.
   • Enforces halt on UBSAN errors in both afl-fuzz and afl-cc (via AFL_USE_UBSAN=1), making undefined-behavior findings actionable during fuzzing.
   • Non-colliding coverage in qemu_mode for more accurate edge tracking without hash collisions.
   • Faster persistent fuzzing in qemu_mode.
   • New qemu_bridge mode backed by the current QEMU version, enabling plugin support and new processor targets (WIP).

   +2 more show less

   • MacOS persistent mode now uses futex-based synchronization for higher speed and lower syscall overhead; opt out with AFL_FAST_CHILD_SYNC (requires macOS 2024+).
   • Improved cmplog instrumentation on MacOS in afl-cc.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !MacOS persistent mode now uses futex mode by default (requires macOS 2024 or later); setups running older macOS versions must opt out with AFL_FAST_CHILD_SYNC or upgrade the OS.
   • !Removed unsupported LLVM version code paths from afl-cc and LLVM passes; builds relying on those code paths will break.
4. v5.01c Jun 18, 2026 · issue 001

   AFL++ v5.01c adds adaptive MOpt, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. non-colliding coverage, a new qemu_bridge mode, and faster macOS persistent fuzzing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v5.01c https://github.com/AFLplusplus/AFLplusplus.git
   # already have the repo? check out this version:
   $ git checkout v5.01c

   └──▷ TRY IT
   Fuzz a binary-only target with QEMU mode to take advantage of the new non-colliding coverage for more precise edge tracking.
   copy

   $ afl-fuzz -i seeds_dir -o output_dir -Q -- /path/to/target @@

   Compile a target with UBSAN and enforce halt on errors so AFL++ treats UB as a crash, surfacing memory-safety bugs during fuzzing.
   copy

   $ AFL_USE_UBSAN=1 afl-cc -o target_ubsan target.c && afl-fuzz -i seeds_dir -o output_dir -- ./target_ubsan @@

   Opt out of the new futex-based child sync on macOS if you need compatibility with older kernel behaviour.
   copy

   $ AFL_FAST_CHILD_SYNC=0 afl-fuzz -i seeds_dir -o output_dir -- ./target @@

   • New adaptive MOpt mutator in afl-fuzz, replacing the outdated implementation, with early results outperforming standard havoc.
   • QEMU mode gains non-colliding coverage, eliminating hash collisions in edge bitmaps and improving precision for binary-only targets.
   • Faster persistent fuzzing in QEMU mode.
   • New qemu_bridge mode based on current QEMU version, enabling plugin support and new processor targets (WIP).
   • macOS persistent mode now uses futex-based synchronization for higher speed and lower syscall overhead (requires macOS 2024+); opt out with AFL_FAST_CHILD_SYNC.

   +1 more show less

   • Improved cmplog instrumentation on macOS via afl-cc.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !MacOS persistent mode now requires macOS from 2024 onwards (uses futex mode by default); older macOS versions are no longer supported without opting out via AFL_FAST_CHILD_SYNC)
   • !Removed unsupported LLVM version code paths from afl-cc and LLVM passes, so builds relying on those LLVM versions will no longer work
5. v5.00c Jun 3, 2026 · release notes

   AFL++ v5.00c adds Ball-Larus path coverage, a new bug-oracle instrumentation pass, predicate-tightness scheduling, and macOS/FreeBSD support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v5.00c https://github.com/AFLplusplus/AFLplusplus.git
   # already have the repo? check out this version:
   $ git checkout v5.00c

   └──▷ TRY IT
   Catch arithmetic-bound OOBs that ASan misses by enabling all bug-oracle modes at compile time and running the fuzzer normally.
   copy

   $ AFL_LLVM_BUG=1 afl-cc -o target_fuzz target.c && afl-fuzz -i corpus/ -o findings/ -- ./target_fuzz @@

   Detect tight validation predicates (e.g. CVE-2023-4863-style) by enabling predicate-tightness scheduling alongside SCALAR slice instrumentation.
   copy

   $ AFL_LLVM_BUG_SCALAR_SLICE=1 afl-cc -o target_fuzz target.c && afl-fuzz -i corpus/ -o findings/ -c ./target_fuzz -l M -- ./target_fuzz @@

   • New AFL_LLVM_PATH / AFL_LLVM_LTO_PATH / AFL_LLVM_PATH_MODE env vars enable Ball-Larus per-function path coverage (three strictness levels) on top of edge coverage in LTO and PCGUARD modes.
   • New afl-llvm-bug-pass.so instrumentation provides five runtime bug-detection oracles — SCALAR, BUDGET, SIZEFILL, ALLOCSIZE, and SLACK — catching arithmetic-bound and logical OOB bugs that ASan misses (including the CVE-2023-4863 / libwebp-Huffman class).
   • New -l M scheduling mode in afl-fuzz treats per-site minimum slack on inequality CmpLog comparisons as a coverage event, marking queue entries favoured for predicate-tightness.
   • New -l Z scheduling mode in afl-fuzz, paired with AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1, logs computed allocation sizes and max offsets into CmpLog RTN slots for dictionary mining.
   • Linux persistent mode now uses futex instead of pipes, increasing speed and reducing syscall overhead; opt out with AFL_FAST_CHILD_SYNC.

   +6 more show less

   • Adds LLVM 23 support in afl-cc.
   • macOS support restored for afl-fuzz, afl-cc (including LTO), frida mode, and lib* tools.
   • Refreshed FreeBSD support.
   • -I tool invocations in afl-fuzz now receive the new crash path as a command-line parameter.
   • Nyx mode now works for all afl-cmin minimizer variants.
   • IJON distance reverted to the original IJON implementation: initial matching bytes, max length 1024.

   11 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !AFL++ is now licensed under AGPL 3.0 (files where the license could be switched); files under Apache 2.0 with third-party contributions remain on that license. Commercial use requires a separate commercial license.
6. v5.00c Jun 3, 2026 · issue 001

   AFL++ v5.00c adds AGPL license, Ball-Larus path coverage, a 6-mode bug-detection pass, new cmplog scheduling, and macOS/futex speed gains.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v5.00c https://github.com/AFLplusplus/AFLplusplus.git
   # already have the repo? check out this version:
   $ git checkout v5.00c

   └──▷ TRY IT
   Compile a target with Ball-Larus strict path coverage on top of edge coverage to get finer-grained path feedback during fuzzing.
   copy

   $ AFL_LLVM_PATH=3 afl-clang-lto -o target_instrumented target.c -lz

   Enable the full bug-detection pass (all six oracle modes) to surface arithmetic-bound and OOB bugs that ASan misses, then fuzz with predicate-tightness scheduling to chase tight-comparison edges like CVE-2023-4863.
   copy

   $ AFL_LLVM_BUG=1 afl-clang-fast -o target_bug target.c && afl-fuzz -i seeds/ -o out/ -l M -- ./target_bug @@

   Track custom allocators and derive size constants into CmpLog for havoc, helping break magic-size checks in targets with non-standard allocators.
   copy

   $ AFL_LLVM_BUG_ALLOCSIZE_FUNCS=my_alloc AFL_LLVM_BUG_ALLOCSIZE_FREE_FUNCS=my_free AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1 afl-clang-fast -o target_alloc target.c && afl-fuzz -i seeds/ -o out/ -l Z -- ./target_alloc @@

   • Relicenses AFL++ to AGPL 3.0 (with optional commercial license for organizations that cannot use AGPL); Apache 2.0 files with external contributions remain on that license.
   • Adds Ball-Larus per-function path coverage (AFL_LLVM_PATH) on top of edge coverage for LTO and PCGUARD, with three strictness levels (=1 relaxed, =2 restricted, =3 strict), optionally composed with AFL_LLVM_LTO_CALLER.
   • Introduces afl-llvm-bug-pass.so with six runtime oracle modes (SCALAR, BUDGET, SIZEFILL, ALLOCSIZE, SLACK, and SCALAR_SLICE) that catch arithmetic-bound and logical OOB bugs ASan misses — including the CVE-2023-4863 libwebp-Huffman class.
   • Adds AFL_LLVM_BUG_ALLOCSIZE_FUNCS and AFL_LLVM_BUG_ALLOCSIZE_FREE_FUNCS to extend allocation tracking to user-defined custom allocators and their matching free functions.
   • New -l M afl-fuzz cmplog scheduling mode: treats any new per-site minimum slack on inequality comparisons as a coverage event and marks the queue entry favoured (predicate-tightness scheduling).

   +9 more show less

   • New -l Z afl-fuzz cmplog scheduling mode combined with AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1: logs (computed_size, max_observed_offset) per freed allocation into CmpLog RTN slots for dictionary mining of magic size constants.
   • Linux persistent mode now uses futex instead of pipes, reducing syscall overhead; opt out with AFL_FAST_CHILD_SYNC.
   • Adds -I tool crash notification: the specified tool now receives the new crash file as a command-line parameter.
   • Adds LLVM 23 support in afl-cc.
   • Restores and expands macOS support for afl-fuzz, afl-cc (including LTO), frida mode, and lib* tools.
   • Refreshes FreeBSD support.
   • Enables Nyx mode for all afl-cmin minimizer variants.
   • Switches coverage analysis companion from deprecated afl-cov to cov-analysis.
   • Updates IJON distance implementation to the original IJON model (initial matching bytes, max length 1024).

   14 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !AFL++ is now licensed under AGPL 3.0 (previously Apache 2.0 for many files); commercial use requires a separate commercial license
7. v4.40c Mar 13, 2026 · release notes

   AFL++ v4.40c ships FrameShift mutation by default, LLVM 22 support, expanded COMPCOV strings, and multi-directory afl-plot.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.40c https://github.com/AFLplusplus/AFLplusplus.git
   # already have the repo? check out this version:
   $ git checkout v4.40c

   └──▷ TRY IT
   Limit FrameShift overhead on a resource-constrained fuzzer instance while keeping it active.
   copy

   $ AFL_FRAMESHIFT_MAX_OVERHEAD=10 afl-fuzz -i corpus/ -o out/ -- ./target @@

   Resume a campaign quickly when you know the binary changed but the coverage map size did not.
   copy

   $ AFL_FORCE_FASTRESUME=1 afl-fuzz -i- -o out/ -- ./target @@

   • Integrates FrameShift mutation engine by default, improving time-to-coverage and total coverage; tune or disable via AFL_FRAMESHIFT_DISABLE and AFL_FRAMESHIFT_MAX_OVERHEAD.
   • Adds AFL_FORCE_FASTRESUME to skip saved target-hash validation on resume (requires unchanged coverage map size).
   • Adds AFL_LLVM_DENY_EXEC to abort common exec calls from instrumented binaries, preventing fuzz-target child processes from polluting coverage.
   • Adds LLVM 22 support in afl-cc.
   • Extends COMPCOV string comparison coverage to g_, curl_, and xml_ prefixed string functions in afl-cc.

   +4 more show less

   • Adds -f flag support to afl-showmap.
   • Adds faster stream mode to afl-showmap.
   • afl-cmin and afl-cmin.py now honor AFL_SHA1_FILENAMES for filename hashing.
   • afl-plot now supports multiple AFL++ output directories simultaneously.

   9 details in Everything

8. v4.35c Dec 26, 2025 · release notes

   AFL++ v4.35c adds GUIFuzz++ for desktop GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. fuzzing and IJON support in QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. mode

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.35c https://github.com/AFLplusplus/AFLplusplus.git
   # already have the repo? check out this version:
   $ git checkout v4.35c

   • Adds GUIFuzz++ integration, enabling grey-box fuzzing of desktop graphical user interfacegraphical user interfaceA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. applications.
   • Adds IJON support in qemu_mode for enhanced coverage-guided feedback in binary-only targets.
   • Adds complete hidden decision coverage to default pcguard instrumentation in afl-cc.
   • Adds complete hidden decision coverage to LTO instrumentation in afl-cc.
   • Enables compiling the GCC plugin with clang++.

   5 details in Everything

9. v4.34c Oct 1, 2025 · release notes

   AFL++ v4.34c adds IJON integration, UnicornAFL v3, LLVM 22 support, ccache launcher, ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. remote testcase plugin, and new build options.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.34c https://github.com/AFLplusplus/AFLplusplus.git
   # already have the repo? check out this version:
   $ git checkout v4.34c

   └──▷ TRY IT
   Skip rebuilding unchanged objects and speed up repeated instrumented builds in CI by delegating compilation to ccache.
   copy

   $ AFL_COMPILER_LAUNCHER=ccache afl-cc -o target target.c

   Build AFL++ without Unicorn, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., and Frida backends to reduce build time and dependencies on minimal environments.
   copy

   $ make NO_UNICORN=1 NO_QEMU=1 NO_FRIDA=1

   • Adds IJON integration for structure-aware fuzzing guided by user annotations (see docs/IJON.md).
   • Upgrades unicorn_mode to UnicornAFL v3.
   • Enables LLVM 22 support in afl-cc.
   • New AFL_COMPILER_LAUNCHER env var in afl-cc to allow ccache and similar compiler launchers.
   • Makes AFL_DUMP_MAP_SIZE work for CLASSIC instrumentation modes.

   +3 more show less

   • Adds NO_UNICORN, NO_QEMU, and NO_FRIDA build options to selectively disable optional backends.
   • Adds AIXCC Team Atlanta's ZeroMQ plugin for custom_mutators to ingest testcases from a remote source.
   • Larger improvements to CMPLOG handling in afl-fuzz.

   8 details in Everything

10. v4.33c Jun 28, 2025 · release notes

    AFL++ v4.33c adds hidden edge instrumentation, a faster afl-cmin.py, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. block coverage, and a new desocketing library.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.33c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout v4.33c

    • Adds AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT env var to selectively disable fork when using AFL_PRELOAD.
    • Adds color output for NO_UI mode in afl-fuzz.
    • Instruments previously missed hidden edges in PCGUARD plugin (~5% more edges covered vs prior AFL++; ~8% more vs LLVM sancov).
    • Adds AFL_EXITPOINT support in qemuafl for controlling exit points in QEMU mode.
    • Adds AFL_QEMU_BLOCK_COV block coverage support in qemuafl.

    +4 more show less

    • Adds improved MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware. persistent mode support in qemuafl.
    • Introduces new faster afl-cmin.py script, now invoked automatically by afl-cmin when Python is available.
    • Enables full Nyx mode support in afl-cmin for corpus minimization of large targets (previously lost coverage due to fixed map size).
    • Introduces new desocketing library utils/libaflppdesock for targets where other desocketing approaches fail.

    9 details in Everything

11. v4.31c Feb 10, 2025 · release notes

    AFL++ v4.31c adds SAND mode for sanitizer-efficient fuzzing, disables splicing by default, and gains LLVM 20 support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.31c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout v4.31c

    └──▷ TRY IT
    Re-enable splicing explicitly when you want the old default behavior that includes the splicing phase from the start.
    copy

    $ afl-fuzz -u -i corpus/ -o findings/ -- ./target_fuzz @@

    • New SAND mode for more efficient fuzzing with sanitizers (see docs/SAND.md).
    • Splicing phase is now disabled by default; new -u flag re-enables it manually (auto-enables after two cycles with no finds).
    • Adds LLVM 20 support in afl-cc.
    • afl-cc now inserts libAFLDriver.a early when -fsanitize=fuzzer is used, supporting LLVMFuzzerTestOneInput in .a archives.
    • Adds __sanitizer_weak_hook_* functions in afl-cc for compatibility with non-standard setups.

    +2 more show less

    • Python 3.13+ support in afl-fuzz.
    • Loose file and shared memory permissions support for Android and iPhone targets.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The splicing phase is now DISABLED by default; workflows relying on splicing being active must add the -u flag to restore previous behavior.
12. v4.30c Dec 3, 2024 · release notes

    AFL++ v4.30c adds fast-resume, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. hooks, custom TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. mutator, and new afl-cc runtime/compile-time knobs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.30c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout v4.30c

    └──▷ TRY IT
    Resume a long fuzzing session without re-running calibration when the binary hasn't changed, saving time on large corpora.
    copy

    $ afl-fuzz -i - -o /out -- ./target @@

    Use the classic AFL forkserver for compatibility with symcc or nautilus instrumentation pipelines.
    copy

    $ AFL_LLVM_INSTRUMENT=CLASSIC AFL_OLD_FORKSERVER=1 afl-cc -o target_fuzz target.c

    Compile a target with a lower optimization level to improve instrumentation coverage or debug reproducibility.
    copy

    $ AFL_OPT_LEVEL=1 afl-cc -o target_fuzz target.c

    • Adds fastresume: when resuming with -i - or AFL_AUTORESUME=1 and the target binary is unchanged, AFL skips calibration by loading a saved dump (zlib-compressed if available); disable with AFL_NO_FASTRESUME=1.
    • Adds AFL_CUSTOM_MUTATOR_LATE_SEND=1 to invoke the custom send() function after the target has been restarted.
    • Adds optional hooking-bridge support in qemu_mode for new hook types (see qemu_mode/hooking_bridge).
    • Adds custom_send_tcp custom mutator for TCP-based fuzzing targets.
    • New afl-cc runtime variable AFL_OLD_FORKSERVER to use the classic AFL forkserver — useful with symcc, symqemu, nautilus, and similar tools when combined with AFL_LLVM_INSTRUMENT=CLASSIC.

    +3 more show less

    • New afl-cc compile-time variable AFL_OPT_LEVEL to set a specific optimization level (default: 3).
    • Adds autotokens-standalone binary (custom_mutators/autotokens/standalone/).
    • AFL++ headers are now installed to $PREFIX/include/afl.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !afl-gcc and afl-clang have been removed and are no longer available.
    • !The CMPLOG map layout has changed — all CMPLOG targets must be recompiled before use.
13. v4.21c Jun 9, 2024 · release notes

    AFL++ v4.21c adds AFL_NO_SYNC env var, AFL_DISABLE_REDUNDANT, new queue selection algorithm and libtokencap script

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.21c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout v4.21c

    └──▷ USE IT
    Run parallel fuzzers where syncing input files between instances is unnecessary or costly for your workflow.
    shell copy

    AFL_NO_SYNC=1 afl-fuzz -i in -o out ./target

    Optimize afl-fuzz performance when the corpus has grown very large.
    shell copy

    AFL_DISABLE_REDUNDANT=1 afl-fuzz -i in -o out ./target

    • Adds AFL_NO_SYNC environment variable to skip input syncing between parallel fuzzers
    • Adds AFL_DISABLE_REDUNDANT environment variable for huge queues in afl-fuzz
    • Implements new queue selection algorithm based on 2 core years of analysis to improve coverage
    • Adds generate_libtoken_dict.sh script in libtokencap via @a-shvedov

    4 details in Everything

14. v4.20c Apr 13, 2024 · release notes

    AFL++ v4.20c introduces 4B coverage edges, new deterministic fuzzing default, and LTO caller instrumentation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.20c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout v4.20c

    └──▷ TRY IT
    Enable CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware.-specific performance optimizations when compiling targets.
    copy

    $ make PERFORMANCE=1

    Instrument C/C++ code with collision-free caller tracing and a depth of 2.
    copy

    $ AFL_LLVM_LTO_CALLER=1 AFL_LLVM_LTO_CALLER_DEPTH=2 afl-cc target.c -o target

    • AFL++ now supports up to 4 billion coverage edges, up from 6 million.
    • Adds PERFORMANCE=1 make option to enable CPU-specific optimizations in afl-fuzz.
    • Activates new deterministic fuzzing by default in afl-fuzz (control with -z).
    • Adds -e extension option to afl-fuzz to save queue items and crashes with file extensions.
    • Adds AFL_LLVM_LTO_CALLER=1 and AFL_LLVM_LTO_CALLER_DEPTH env vars in afl-cc LTO mode for collision-free caller instrumentation.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !New compiled targets instrumented for CMPLOG/Redqueen will not work with old afl-fuzz versions.
    • !The -d and -D parameters for deterministic fuzzing are now ignored in afl-fuzz as the feature is active by default.
15. v4.10c Feb 3, 2024 · release notes

    AFL++ v4.10c adds injection fuzzing, -D for deterministic fuzzing and LLVM 18 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.10c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout v4.10c

    └──▷ USE IT
    Enable deterministic fuzzing to improve coverage in a session
    shell copy

    afl-fuzz -i in -o out -D -- ./fuzz_target

    • Adds instrumentation/README.injections.md documentation and support for SQL, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., and XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. injection fuzzing
    • Enables better deterministic fuzzing with the new -D flag
    • Adds LLVM 18 support in the instrumentation layer
    • QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. mode now activates plugins by default and includes a module to produce drcov compatible traces

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !LTO mode now requires llvm 12+
16. v4.09c Dec 15, 2023 · release notes

    AFL++ v4.09c adds afl-addseeds tool, post_run mutator hooks, AFL_FINAL_SYNC, and scale support to CMPLOG.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.09c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout v4.09c

    └──▷ TRY IT
    Inject new seeds into a live fuzzing campaign using the new tool.
    copy

    $ ./afl-addseeds -i /path/to/new/seeds /path/to/campaign

    Force a final synchronization before the fuzzer terminates using the new environment variable.
    copy

    $ AFL_FINAL_SYNC=1 ./afl-fuzz -i in -o out ./target

    Use a wider naming capacity for -S/-M instances up to 50 characters.
    copy

    $ ./afl-fuzz -M fuzz_instance_with_long_custom_name_1234567890 ./target

    • Adds afl-addseeds CLI tool for injecting new seeds into a running campaign
    • Adds --version and --help command line parameters to afl-fuzz
    • Adds post_run custom mutator function hook in afl-fuzz
    • Adds scale support to CMPLOG via -l S flag
    • Adds -S/-M naming length up to 50 characters (from 24)

    +4 more show less

    • Adds AFL_FINAL_SYNC environment variable to force fuzzer sync before termination
    • Adds AFL_IGNORE_SEED_PROBLEMS environment variable to skip seeding timeouts
    • Adds -n option to afl-whatsup to disable colored output
    • Adds -m option to afl-whatsup to show only relevant stats

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Instrumentation of __cxx internal functions is re-enabled, which may break some targets
17. v4.08c Aug 10, 2023 · release notes

    AFL++ v4.08c adds -P path-finding mode, -a input type, -l base64 solve, and a standalone custom mutator.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.08c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout v4.08c

    • -P flag for new mutation engine that favors path discovery then switches to crash triggering after 10 minutes
    • -l X option to enable base64 transformation solving
    • CLI option -c - to disable CMPLOG

    3 details in Everything

18. 4.07c Jun 12, 2023 · release notes

    Adds -T parallelism to afl-cmin, new env vars for coverage/post-processing control, and new WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers./grammar mutators

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.07c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 4.07c

    └──▷ USE IT
    Run corpus minimization with full CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. utilization to speed up the process.
    shell copy

    afl-cmin -F -T $(nproc) -i input_dir -o output_dir fuzz_target

    Preserve the original seed data before mutation for debugging post-processing steps.
    shell copy

    AFL_POST_PROCESS_KEEP_ORIGINAL=1 ./afl-fuzz -i seeds -o out ./target

    Suppress coverage errors from libraries that fork after instrumentation is active.
    shell copy

    AFL_IGNORE_PROBLEMS_COVERAGE=1 ./afl-fuzz -i in -o out ./my_app

    • Adds -T <threads> flag to afl-cmin for parallel task support
    • Adds AFL_POST_PROCESS_KEEP_ORIGINAL environment variable to preserve original input data on finds
    • Adds AFL_IGNORE_PROBLEMS_COVERAGE environment variable to ignore coverage from loaded libs after forkserver init
    • Adds AFL_LLVM_LTO_SKIPINIT environment variable for AFL++ based WASM support
    • Adds -I <filelist> option to afl-showmap as an alternative to -i <in_dir>

    +3 more show less

    • Adds new grammar custom mutator atnwalk
    • Adds TritonDSE custom mutator in custom_mutators/aflpp_tritondse
    • Adds SymQEMU custom mutator in custom_mutators/symqemu

    8 details in Everything

19. 4.06c Apr 17, 2023 · release notes

    AFL++ 4.06c adds nyx_mode, basic RISC-V, new autotoken module, and several environment variables

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.06c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 4.06c

    • Adds nyx_mode support across all tools
    • Adds basic RISC-V support in qemu_mode
    • Adds new autotoken custom module for grammar-free text fuzzing
    • Adds AFL_NO_WARN_INSTABILITY environment variable to suppress instability warnings
    • Adds AFL_FRIDA_STATS_INTERVAL environment variable to control Frida stats sampling frequency

    +2 more show less

    • Adds support for LLVM 15 native pcguard changes
    • Adds CFI sanitizer variant to gcc targets in afl-cc

    7 details in Everything

20. 4.05c Jan 5, 2023 · release notes

    Adds afl_custom_fuzz_send for IPCIPCInter-process communication, ways for separate programs to exchange data or signals. Examples include pipes, sockets and shared memory. data sending, AFL_FORK_SERVER_KILL_SIGNAL env var, and cmplog random colorization to afl-fuzz

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.05c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 4.05c

    └──▷ USE IT
    Customize the signal sent to the fork server process for controlled termination behavior
    shell copy

    AFL_FORK_SERVER_KILL_SIGNAL=9 afl-fuzz -i input -o output ./target

    Enable random colorization in cmplog mode for broader mutation coverage
    shell copy

    afl-fuzz -l R -i input -o output ./target

    • Adds AFL_FORK_SERVER_KILL_SIGNAL environment variable to control which signal kills the fork server child in afl-fuzz
    • Adds -l R option to afl-fuzz for random colorization in cmplog mode
    • Adds afl_custom_fuzz_send custom mutator API hook to send fuzz data to targets via IPC or other means

    3 details in Everything

21. 4.04c Oct 11, 2022 · release notes

    Adds AFL_FORK_SERVER_KILL_SIGNAL env var to control AFL++ fork server exit behavior

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.04c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 4.04c

    • AFL_FORK_SERVER_KILL_SIGNAL environment variable added to allow customizing the signal sent to kill the fork server.
    • AFL runtime now always passes inputs via shared memory when possible in llvm-mode, ignoring command line settings for this path.

    2 details in Everything

22. 4.03c Sep 20, 2022 · release notes

    aflplusplus 4.03c adds AFL_NO_STARTUP_CALIBRATION, AFL_QEMU_TRACK_UNSTABLE, AFL_DUMP_MAP_SIZE, LLVMFuzzerRunDriver() support, -A option to cmin

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.03c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 4.03c

    └──▷ USE IT
    Start fuzzing large queues immediately in CI without waiting for calibration cycles.
    shell copy

    AFL_NO_STARTUP_CALIBRATION=1 afl-fuzz -i in -o out ./target

    Identify unstable coverage edges in QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. mode for debugging.
    shell copy

    AFL_QEMU_TRACK_UNSTABLE=1 AFL_DEBUG=1 afl-fuzz -i in -o out ./target

    • Add AFL_NO_STARTUP_CALIBRATION environment variable to bypass initial seed calibration and start fuzzing immediately.
    • Add AFL_QEMU_TRACK_UNSTABLE environment variable to log addresses of unstable edges in QEMU mode when combined with AFL_DEBUG=1.
    • Add AFL_DUMP_MAP_SIZE=1 setting to dump the target's map size and exit before main().
    • Add -A option to afl-cmin and afl-cmin.bash to include crashing and timeout inputs during corpus minimization.

    4 details in Everything

23. 4.02c Aug 8, 2022 · release notes

    AFL++ 4.02c adds Android support for Frida mode and post-process hook control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.02c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 4.02c

    • Allows post_process hooks to return NULL and 0 length to skip mutated inputs

    1 detail in Everything

24. 4.01c Jun 28, 2022 · release notes

    AFL++ 4.01c adds AFL_SYNC_TIME, -g/-G input length limits, token mutation, and persistent mode env vars

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.01c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 4.01c

    └──▷ USE IT
    Limit generated input size between 50 and 200 bytes during fuzzing
    shell copy

    afl-fuzz -i in_dir -o out_dir -g 50 -G 200 ./target @@

    Sync state with other fuzzers every 10 seconds using a custom timeout
    shell copy

    AFL_SYNC_TIME=10 afl-fuzz -i in_dir -o out_dir ./target @@

    Enable manual forkserver and persistent mode when not baked into the target binary
    shell copy

    AFL_PERSISTENT=1 AFL_DEFER_FORKSRV=1 afl-fuzz -i in_dir -o out_dir ./target @@

    • Adds -g and -G command-line options to set the minimum and maximum length of generated fuzz inputs
    • Introduces AFL_SYNC_TIME environment variable to configure the time allocated for syncing state with other fuzzer instances
    • Reintroduces AFL_PERSISTENT and AFL_DEFER_FORKSRV environment variables to enable persistent mode and manual forkserver support externally
    • Adds AFL_EARLY_FORKSERVER environment variable to install the forkserver as early as possible in the target for afl-gcc-fast, afl-clang-fast, and afl-clang-lto
    • Adds auto token insert, user token insert, and auto token overwrite mutation capabilities (previously only user token overwrite was supported)

    +2 more show less

    • Updates frida_mode to handle C++ throw/catch scenarios via the new Frida release
    • Reintroduces support for libafl as a custom_mutator with token fuzzing

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !AFL++ PCGUARD mode is no longer available for LLVM 10.0.1 (requires LLVM 11+)
    • !The -c 0 flag is now used to indicate the fuzzing binary also handles CMPLOG compilation
25. 4.00c Jan 26, 2022 · release notes

    AFL++ 4.00c adds Nyx full-system emulation with snapshots, aarch64 coresight_mode, and GramaTron grammar mutator

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.00c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 4.00c

    • Support for coresight_mode provides new binary-only fuzzing capabilities on aarch64 CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware..
    • New GramaTron grammar mutator added to custom_mutators for structured input generation.
    • afl-persistent-config script added to apply permanent system configuration settings for fuzzing on Linux and MacOS.
    • unicorn_mode updated to unicorn2, enabling faster emulation and RISC-V support.
    • New AFL_LLVM_USE_TSAN environment variable enables ThreadSanitizer support in the instrumentation layer.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !unicorn_mode now depends on unicorn2 instead of the previous unicorn library, requiring updated system dependencies.
    • !UI and fuzzer_stat entries renamed: unique crashes to saved crashes, total paths to corpus count, current path to current item, which may break custom scripts parsing these strings.
26. 3.14c Jul 19, 2021 · release notes

    aflplusplus 3.14c adds AFL_NO_FORKSRV to core tools and AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. frida_mode parity

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.14c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 3.14c

    • Added support for the AFL_NO_FORKSRV environment variable in afl-cmin, afl-tmin, and afl-showmap to disable the forkserver mechanism.

    1 detail in Everything

27. 3.13c Jun 1, 2021 · release notes

    AFL++ 3.13c adds frida_mode for binary-only targets, CodeQL autodict generation, and several new environment variables.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.13c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 3.13c

    • frida_mode - new mode that uses frida to fuzz binary-only targets, it currently supports persistent mode and cmplog.
    • create a fuzzing dictionary with the help of CodeQL thanks to @microsvuln! see utils/autodict_ql
    • added patch by @realmadsci to support @@ as part of command line options, e.g. afl-fuzz ... -- ./target --infile=@@
    • add recording of previous fuzz attempts for persistent mode to allow replay of non-reproducable crashes, see AFL_PERSISTENT_RECORD in config.h and docs/envs.h
    • added AFL_EXIT_ON_SEED_ISSUES env that will exit if a seed in -i dir crashes the target or results in a timeout.

    +7 more show less

    • added AFL_EXIT_ON_TIME env that will make afl-fuzz exit fuzzing after no new paths have been found for n seconds
    • added AFL_TRY_AFFINITY to try to bind to CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. but don't error if it fails
    • added -d (add dead fuzzer stats) to afl-whatsup
    • added AFL_PRINT_FILENAMES to afl-showmap/cmin to print the current filename
    • Leak Sanitizer (AFL_USE_LSAN) added by Joshua Rogers, thanks!
    • added --afl-noopt support
    • updated the grammar custom mutator to the newest version

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !We do not support llvm versions prior 6.0 anymore
    • !Removed InsTrim instrumentation as it is not as good as PCGUARD
28. 3.12c Mar 24, 2021 · release notes

    AFL++ 3.12c adds AFL_TARGET_ENV and AFL_QEMU_CUSTOM_BIN env vars for better target isolation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.12c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 3.12c

    • AFL_TARGET_ENV variable added to afl-fuzz to pass extra environment variables (e.g., LD_LIBRARY_PATH) to the fuzzed target.
    • AFL_QEMU_CUSTOM_BIN variable added to qemu_mode (via afl-qemu-trace) to specify a custom binary for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. instrumentation.
    • DEFAULT_PERMISSION config setting added to config.h allowing control over file permissions for files created by the tool, defaulting to 0600.

    3 details in Everything

29. 3.11c Mar 15, 2021 · release notes

    AFL++ 3.11c adds AFL_NOOPT flag, AFL_QEMU_EXCLUDE_RANGES env var, and support for filenames with spaces in afl-cmin.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.11c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 3.11c

    └──▷ USE IT
    Minimize a corpus where inputs are in directories with spaces in their names.
    shell copy

    afl-cmin -i in_dir -o out_dir -- ./fuzz_target @@ 'file name.txt'

    • afl-cc supports the new AFL_NOOPT environment variable to bypass instrumentation
    • qemu_mode respects the new AFL_QEMU_EXCLUDE_RANGES environment variable
    • afl-cmin now correctly handles filenames containing spaces

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The CTX macro has been renamed to CALLER, and the CLASSIC implementation now uses a different context handling mechanism.
30. 3.10c Mar 1, 2021 · release notes

    AFL++ 3.10c adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead./Android support, selective instrumentation APIs, cmplog intensity control, QASan integration, and several new environment variables.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.10c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 3.10c

    └──▷ USE IT
    Control cmplog intensity during fuzzing to balance speed and effectiveness.
    shell copy

    afl-fuzz -i in -o out -l 2 ./target

    Skip cmplog analysis on initial seeds to save time if they are likely already explored.
    shell copy

    AFL_CMPLOG_ONLY_NEW=1 afl-fuzz -i in -o out ./target

    Use the new native clang pc-guard instrumentation mode for compiling targets.
    shell copy

    AFL_LLVM_INSTRUMENT=NATIVE afl-clang ./main.c -o main

    • Adds __AFL_COVERAGE_* commands for selective instrumentation in source code
    • Adds -l CLI option to afl-fuzz to set cmplog/redqueen intensity (1-3)
    • Adds AFL_CMPLOG_ONLY_NEW environment variable to skip cmplog on initial seeds
    • Adds qemuafl support for QASan (address sanitizer for Qemu)
    • Adds AFL_LLVM_INSTRUMENT=NATIVE option to afl-cc for native clang pc-guard support

    +4 more show less

    • Adds AFL_KILL_SIGNAL environment variable
    • Adds AFL_IGNORE_UNKNOWN_ENVS environment variable to suppress warnings on unknown AFL_ variables
    • Adds improved Android support with QASan coverage
    • Adds new rpc.statsd documentation and integration via docs/rpc_statsd.md

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The meaning of '+' in the -t option now means to auto-calculate the timeout (max value), whereas previously it skipped timeouts instead of aborting; the original skip behavior is now inherent to -t alone
31. 3.0c Dec 15, 2020 · release notes

    AFL++ 3.0c adds weighted seed selection, RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. statsd, custom mutators, and multiple config flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 3.0c

    • Adds -Z flag to revert seed selection to the previous queue-walk mode instead of the new weighted random schedule.
    • Adds -D flag to enable deterministic fuzzing when not running in master mode (-M).
    • Adds support for loading custom mutators via symcc and libfuzzer integration.
    • Adds AFL_LLVM_DICT2FILE environment variable to export string comparison dictionaries during compilation via the new dict2file LLVM pass.
    • Adds AFL_CRASH_EXITCODE environment variable to define a specific exit code that signifies a crash.

    +1 more show less

    • Adds INTROSPECTION make target and afl_custom_describe API hook for mutation reproduction.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Renamed AFL_DEBUG_CHILD_OUTPUT environment variable to AFL_DEBUG_CHILD.
32. 2.68c Sep 5, 2020 · release notes

    AFL++ 2.68c adds AFL_MAX_DET_EXtras and AFL_FORKSRV_INIT_TMOUT env vars, total execs to plots, and custom fuzz count support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.68c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.68c

    └──▷ USE IT
    Limit deterministic dictionary extras to 50 without recompiling afl-fuzz.
    shell copy

    AFL_MAX_DET_EXTRAS=50 afl-fuzz -i in -o out ./target

    Wait up to 10 seconds for the forkserver to start without affecting other timeouts.
    shell copy

    AFL_FORKSRV_INIT_TMOUT=10000 afl-fuzz -i in -o out ./target

    • AFL_MAX_DET_EXTRAS environment variable controls the max number of deterministic dictionary entries at runtime.
    • AFL_FORKSRV_INIT_TMOUT environment variable sets the forkserver startup timeout independently of the global timeout.
    • Fuzzing setup (environment variables and command line) is written to out/fuzzer_setup.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !LLVM_SKIPSINGLEBLOCK environment variable is deprecated.
33. 2.67c Aug 18, 2020 · release notes

    AFL++ 2.67c adds AFL_LLVM_ALLOWLIST/DENYLIST, foreign fuzzer sync (-F), CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. binding (-b), and honggfuzz custom mutator

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.67c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.67c

    • llvm_mode now supports AFL_LLVM_ALLOWLIST and AFL_LLVM_DENYLIST environment variables (compatible with llvm sancov format) replacing the deprecated whitelists
    • afl-fuzz gains -F option to allow main fuzzers (-M) to sync coverage from foreign fuzzers such as honggfuzz or libfuzzer
    • afl-fuzz accepts -b <cpu_id> flag to bind the fuzzer instance to a specific CPU core
    • Custom mutator honggfuzz mangle is available in custom_mutators/honggfuzz for direct integration into fuzzing workflows
    • afl-frida gum solution example added at examples/afl_frida supporting Frida-based instrumentation

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !AFL_LLVM_WHITELIST and AFL_LLVM_INSTRUMENT_FILE environment variables are deprecated in favor of AFL_LLVM_ALLOWLIST and AFL_LLVM_DENYLIST
34. 2.66c Jul 1, 2020 · release notes

    AFL++ 2.66c adds -D flag for secondary node deterministic fuzzing, PCGUARD collision-free mode, and powerPC support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.66c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.66c

    • Adds -D flag to afl-fuzz -S to force secondary nodes to perform deterministic fuzzing instead of just queue-finding
    • Introduces collision-free PCGUARD instrumentation with fixed map size for faster coverage when LLVM >= 7 is used

    2 details in Everything

35. 2.65c May 15, 2020 · release notes

    Adds afl_network_proxy, afl_untracer, and afl_proxy; CTX/NGRAM integration; LTO support for InsTrim

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.65c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.65c

    └──▷ USE IT
    Fuzz an embedded device target remotely by running the fuzzer on one system and the instrumented target on another
    shell copy

    ./examples/afl_network_proxy <target_ip> <target_port>

    Perform binary-only fuzzing with in-memory modifications for x86_64 targets using AFL++'s tracer
    shell copy

    ./examples/afl_untracer <binary_path>

    • Adds examples/afl_network_proxy to enable fuzzing targets on embedded devices over the network
    • Adds examples/afl_untracer for binary-only fuzzing with in-memory modifications on intel32/64 and aarch64
    • Adds examples/afl_proxy for easy fuzzing and instrumentation of non-standard things
    • Enables using CTX and NGRAM together in LLVM mode
    • Supports CTX and NGRAM in CFGCFGControl Flow Graph — a directed graph representing all paths execution can take through a program, used by analysis tools to reason about reachability, dead code, and vulnerability patterns without running the code./INSTRIM mode

    +3 more show less

    • Adds LTO version to InsTrim
    • Adds AFL_LLVM_SKIP_NEVERZERO flag to skip never zero coverage counter implementation
    • Deprecates AFL_POST_LIBRARY in favor of AFL_CUSTOM_MUTATOR_LIBRARY

    8 details in Everything

36. 2.64c Apr 17, 2020 · release notes

    AFL++ 2.64c adds autodictionary for LLVM LTO, variable map size support, and AFL_MAP_SIZE env var.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.64c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.64c

    └──▷ USE IT
    Enable autodictionary in an LLVM LTO build to automatically generate dictionary entries.
    shell copy

    AFL_LLVM_LTO_AUTODICTIONARY=1 afl-fuzz -i input -o output ./target_fuzz

    Specify the shared memory map size to accommodate larger corpora or specific target needs.
    shell copy

    AFL_MAP_SIZE=262144 afl-fuzz -i input -o output ./target_fuzz

    Disable Python support during build to reduce dependencies or binary size.
    shell copy

    make NO_PYTHON=1

    • Adds AFL_LLVM_LTO_AUTODICTIONARY environment variable to enable autodictionary in llvm_mode LTO builds
    • Adds AFL_MAP_SIZE environment variable to specify the size of the shared map
    • Enables -L -1 flag in afl-fuzz to run MOpt in parallel with normal mutation and support dictionaries, radamsa, and cmplog
    • Adds NO_PYTHON build-time flag to disable python support when building afl-fuzz

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !llvm_mode LTO now requires llvm11
37. 2.63c Apr 9, 2020 · release notes

    AFL++ 2.63c adds experimental power schedules (mmopt, rare), CFI sanitizer, LTO instrumentation, and context-sensitive coverage via AFL_LLVM_INSTRUMENT

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.63c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.63c

    └──▷ USE IT
    Run afl-fuzz with the new rare branch weighting schedule to prioritize inputs that hit obscure control flow paths.
    shell copy

    afl-fuzz -p rare -i in -o out -- ./target_fuzzed

    Compile with the new Control Flow Integrity sanitizer to detect control-flow violations during fuzzing.
    shell copy

    export AFL_USE_CFISAN=1 && afl-clang-fast input.c -o target

    • Adds -p mmopt and -p rare experimental power schedule modes to afl-fuzz
    • Enables Control Flow Integrity detection via the new AFL_USE_CFISAN compile-time flag
    • Adds LLVM LTO instrumentation support through afl-clang-lto in llvm_mode
    • Extends afl-tmin to minimize hangs using the new -H flag
    • Enables AFL_AUTORESUME to auto-resume fuzzing sessions without specifying -i -

    +1 more show less

    • Adds AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK=1 environment variable to control single-block function skipping in InsTrim mode

    6 details in Everything

38. 2.61c Feb 24, 2020 · release notes

    AFL++ 2.61c adds CmpLog input-2-state mutator, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. persistent mode support, and UBSAN instrumentation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.61c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.61c

    • Adds persistent mode support for arm and aarch64 targets in qemu_mode
    • Adds AFL_PERSISTENT_HOOK callback module for persistent QEMU execution
    • Adds experimental UBSAN instrumentation via AFL_USE_UBSAN=1 environment variable
    • Enables compiling afl-clang-fast with LLVM 11

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The execs_per_sec field in fuzzer_stats now reports total execs per second instead of current execs per second
39. 2.60c Dec 31, 2019 · release notes

    AFL++ 2.60c introduces new environment variable and socket fuzzing example for cyber toolchain.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.60c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.60c

    • Adds AFL_AS_FORCE_INSTRUMENT environment variable to control afl-as behavior
    • Adds ./examples/socket_fuzzing example using preeny's desock_dup library for network fuzzing

    2 details in Everything

40. 2.59c Dec 18, 2019 · release notes

    AFL++ 2.59c adds QBDI mode for Android native libraries, radamsa mutator, and several new environment variables

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.59c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.59c

    • Fuzz android native libraries via QBDI framework with qbdi_mode
    • Use radamsa as an optional mutator stage via -R[R] flag in afl-fuzz
    • Disable the trim stage using the new AFL_DISABLE_TRIM environment variable
    • Prevent unlinking of fuzz input files with the new -u command-line option for afl-fuzz
    • Disable QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. TranslationBlocks caching via the new AFL_QEMU_DISABLE_CACHE environment variable

    +2 more show less

    • Skip binary check in afl-analyze using the new AFL_SKIP_BIN_CHECK support
    • Configure float splitting via the new AFL_LLVM_LAF_SPLIT_FLOATS environment variable in llvm_mode

    7 details in Everything

41. 2.57c Oct 15, 2019 · release notes

    AFL++ 2.57c adds persistent mode for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., Wine support, -I flag, and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.57c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.57c

    └──▷ USE IT
    Force the fuzzer to ONLY use your custom mutation library and ignore all default mutation logic
    shell copy

    AFL_CUSTOM_MUTATOR_ONLY=1 afl-fuzz -i in -o out -- ./target_fuzzed

    Generate documentation of how the fuzzer mutates the first input file by running make document
    shell copy

    make document

    • Adds make document target to create mutation documentation by saving mutations of the first file run
    • Adds -I <cmd> option to afl-fuzz to execute a custom command on every new crash found
    • Adds support for Wine mode via -W flag to fuzz Win32 binaries using QEMU instrumentation
    • Adds environment variable AFL_CUSTOM_MUTATOR_ONLY to exclusively use the custom mutator library instead of combining it

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The behavior of custom mutators changed: previously it replaced all other mutations; now it is an additional mutator unless AFL_CUSTOM_MUTATOR_ONLY is set
42. 2.54c Sep 5, 2019 · release notes

    AFL++ 2.54c adds AFL_FORCE_UI env var, custom library mutators, and compare coverage via Unicorn.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.54c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.54c

    └──▷ TRY IT
    Use a custom mutation logic from a shared library without recompiling the fuzzer.
    copy

    $ AFL_CUSTOM_MUTATOR_LIBRARY=./my_lib.so afl-fuzz -i in -o out ./target

    Inspect raw coverage values to see exactly which bytes changed, rather than just the binary map state.
    copy

    $ afl-showmap -r -i testcase_dir -o /tmp/cov ./target

    • Supports loading a custom fuzzer mutator from an external shared library
    • Adds AFL_FORCE_UI environment variable to force the fuzzing UI even when isatty returns false
    • Enables CompareCoverage instrumentation using Unicorn via immediates-only mode
    • Adds -r option to afl-showmap to display raw byte values in the coverage map buckets
    • Includes peak_rss_mb and slowest_exec_ms metrics in the fuzzer_stats output file

    5 details in Everything

43. 2.53c Jul 26, 2019 · release notes

    Adds unicorn_mode, instrim instrumentation, MOpt mode, Python mutators, libcompcov for QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware., and fixed-seed -s flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.53c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.53c

    └──▷ USE IT
    Run a deterministic fuzzing campaign with a fixed seed to analyze path discovery without random mutation variance.
    shell copy

    afl-fuzz -i input_dir -o output_dir -s 12345 ./target_fuzz

    Use the new Python mutator extension to customize mutation strategies via a custom script.
    shell copy

    export AFL_CUSTOM_MUTATOR_LIBRARY=/path/to/mutator.so && afl-fuzz -i input_dir -o output_dir ./target_fuzz

    Enable non-zero counters in LLVM mode to handle edge cases where zero values indicate important execution paths.
    shell copy

    export AFL_LLVM_NEVER_ZERO=1 && afl-fuzz -i input_dir -o output_dir ./target_fuzz

    • Introduces unicorn_mode support via imported patches
    • Adds instrim, a faster LLVM instrumentation path (see llvm_mode/README.instrim)
    • Adds MOpt mutation mode (see docs/README.MOpt)
    • Adds Python Module mutator support with autodetection of python2.7-dev (see docs/python_mutators.txt)
    • Adds libcompcov, a QEMU-specific coverage extension (see qemu_mode/libcompcov/README.libcompcov)

    +6 more show less

    • Adds -s <seed> flag to afl-fuzz for deterministic runs with a fixed initial seed
    • Adds AFL_LLVM_NEVER_ZERO=1 environment variable for non-zero counters in LLVM mode
    • Adds AFL_LLVM_WHITELIST environment variable to restrict LLVM instrumentation scope
    • Adds -V time and -E execs options to afl-fuzz for constrained comparison runs
    • Adds AFL_CAL_FAST environment variable for optimizing slow applications
    • Adds AFL_DEBUG_CHILD_OUTPUT environment variable for debugging child process output

    11 details in Everything

44. 2.52c Jun 4, 2019 · release notes

    afl++ 2.52c adds aflfast powerschedules support and LLVM 8 compatibility

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.52c https://github.com/AFLplusplus/AFLplusplus.git
    # already have the repo? check out this version:
    $ git checkout 2.52c

    • Adds aflfast powerschedules to the fuzzer configuration options
    • Updates llvm_mode to support LLVM versions up to 8

    2 details in Everything