aflplusplus — The Cyber Toolchain

aflplusplus v5.03c

Wed, 02 Sep 2026 09:41:42 GMT

AFL++ v5.03c adds Value Profile fuzzing, four new LLVM instrumentation env vars, starved-mode queue minimization, and POSIX shared memory on macOS. • Adds `AFL_LLVM_VALUE_PROFILE=1` env var to enable Value Profile instrumentation in fuzz targets, paired with the new `afl-fuzz` flag `-r ` to activate value-profile-guided mutation after a delay. • Adds `AFL_LLVM_DENSE=1` env var to disable PCGUARD basic block pruning for denser coverage maps. • Adds `AFL_LLVM_MINMAX=1` env var to score min/max/abs intrinsics (branchless clamps); adds ~10% map entries at a ~20% throughput cost, default off. • Adds `AFL_LLVM_FUSED=1` env var to score both halves of fused conditions (e.g. if (a && b) compiled to a single `and i1`). • Adds `AFL_LLVM_VECTORS=1` env var to instrument vector selects and vector min/max with one guard pair per lane, default off. • Adds `AFL_STARVED_MINIMIZE_QUEUE` env var so that when starved mode fails to find new coverage, `afl-fuzz` minimizes the queue (like `afl-cmin`) and makes removed entries' coverage rediscoverable. • Adds `SIGUSR2` signal handling to `afl-fuzz` to force an immediate sync (AFL internal sync and foreign `-F` directories) after the current queue entry finishes. • Adds `AFL_DUMP_MAP_SIZE` to print the coverage/IJON breakdown to stderr. • Implements a 'starved' mode in `afl-fuzz`: when no new finds occur for an extended period, seed and mutation variability increases automatically (including splicing phase), with visibility in the UI. • Adds `afl-merge` as a symlink tool to merge new files into an existing (non-minimized) corpus. • Switches `afl-cmin.c` to be the default `afl-cmin` implementation; `-T all` (C and Python variants) now counts CPUs the process is actually allowed to run on. • macOS now uses POSIX shared memory instead of SysV, removing the `kern.sysv.shmseg` / `kern.sysv.shmmax` ceiling constraints (CmpLog alone requires a 145 MB segment, far above the 4 MB macOS default). • Removes classic AFL instrumentation (colliding coverage), superseded by `AFL_LLVM_PATH` and `AFL_LLVM_CALLER`. • Trimming stage in `afl-fuzz` now saves crashes, hangs, and new coverage found during input shortening, visible as `op:trim` / `op:ptrim` in output file names. • Mode-switching limits in `afl-fuzz` are now exec-count-based rather than time-based. • `afl-fuzz` `-i` input directory and `afl-showmap` `-i` now follow symlinked test cases and symlinked subdirectories; foreign sync directories (`-F`) also import symlinked test cases. • Unreadable foreign sync (`-F`) directories are now reported once per directory and listed at startup, replacing silent failure. Breaking changes: • macOS targets must be recompiled with the new `afl-cc`: a target built by an older `afl-cc` still expects a SysV id in `__AFL_SHM_ID` and will not work with the new POSIX shared memory. • Classic AFL instrumentation (colliding coverage) has been removed from `afl-cc`; projects relying on it must switch to `AFL_LLVM_PATH` or `AFL_LLVM_CALLER`. • The obsolete `afl-as` assembler wrapper has been removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v5.02c

Mon, 29 Jun 2026 09:18:40 GMT

AFL++ v5.02c adds afl-health campaign checker, C11 complexity-aware scheduling, and a new crash-on-uninstrumented-entry mode. • New `afl-health` tool: advanced campaign health checker with tips, analysis, and SSH support — a more powerful replacement for `afl-whatsup`. • New C11 instrumentation mode (`AFL_LLVM_C11`): afl-cc records per-function local variable counts; afl-fuzz uses this as an extra queue-scheduling signal to favor more complex code paths. • New `AFL_LLVM_CRASHLIST` environment variable: causes the fuzzer to crash immediately when a function marked as uninstrumented is entered via fuzzing input, enabling strict instrumentation boundary enforcement. • Allow/deny list `fun:` entries now matched verbatim via fnmatch() (breaking change: add a leading `*` manually for the old suffix-match behavior); entries are matched against both mangled and demangled/unqualified names, and `fun:` entries now permit `:` so C++ and Rust demangled names can be listed. • When `-fsanitize-coverage-allowlist=`/`-fsanitize-coverage-ignorelist=` is passed without the corresponding `AFL_LLVM_ALLOWLIST`/`AFL_LLVM_DENYLIST`, the supplied list is automatically reused so the optimized PCGUARD pass honors it. • Breaking change: persistent-mode / `LLVMFuzzerTestOneInput` targets must be recompiled against this release. Breaking changes: • Persistent mode and `LLVMFuzzerTestOneInput` targets must be recompiled after upgrading to v5.02c • Instrument allow/deny list `fun:` entries in `AFL_LLVM_ALLOWLIST`/`AFL_LLVM_DENYLIST` (and GCC equivalents) are now matched verbatim with fnmatch() instead of having a `*` prepended automatically — existing entries that relied on the implicit leading `*` for suffix matching must be updated to add an explicit leading `*` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v5.01c

Thu, 18 Jun 2026 08:32:47 GMT

AFL++ v5.01c adds adaptive MOpt, non-colliding QEMU coverage, a new qemu_bridge mode, and faster MacOS persistent fuzzing. • New adaptive MOpt mutator in afl-fuzz, replacing the outdated implementation — reportedly outperforms standard havoc in initial testing. • Enforces halt on UBSAN errors in both afl-fuzz and afl-cc (via AFL_USE_UBSAN=1), making undefined-behavior findings actionable during fuzzing. • Non-colliding coverage in qemu_mode for more accurate edge tracking without hash collisions. • Faster persistent fuzzing in qemu_mode. • New qemu_bridge mode backed by the current QEMU version, enabling plugin support and new processor targets (WIP). • MacOS persistent mode now uses futex-based synchronization for higher speed and lower syscall overhead; opt out with AFL_FAST_CHILD_SYNC (requires macOS 2024+). • Improved cmplog instrumentation on MacOS in afl-cc. Breaking changes: • MacOS persistent mode now uses futex mode by default (requires macOS 2024 or later); setups running older macOS versions must opt out with AFL_FAST_CHILD_SYNC or upgrade the OS. • Removed unsupported LLVM version code paths from afl-cc and LLVM passes; builds relying on those code paths will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v5.01c

Thu, 18 Jun 2026 08:32:47 GMT

AFL++ v5.01c adds adaptive MOpt, QEMU non-colliding coverage, a new qemu_bridge mode, and faster macOS persistent fuzzing. • New adaptive MOpt mutator in afl-fuzz, replacing the outdated implementation, with early results outperforming standard havoc. • QEMU mode gains non-colliding coverage, eliminating hash collisions in edge bitmaps and improving precision for binary-only targets. • Faster persistent fuzzing in QEMU mode. • New qemu_bridge mode based on current QEMU version, enabling plugin support and new processor targets (WIP). • macOS persistent mode now uses futex-based synchronization for higher speed and lower syscall overhead (requires macOS 2024+); opt out with AFL_FAST_CHILD_SYNC. • Improved cmplog instrumentation on macOS via afl-cc. Breaking changes: • MacOS persistent mode now requires macOS from 2024 onwards (uses futex mode by default); older macOS versions are no longer supported without opting out via AFL_FAST_CHILD_SYNC) • Removed unsupported LLVM version code paths from afl-cc and LLVM passes, so builds relying on those LLVM versions will no longer work Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v5.00c

Wed, 03 Jun 2026 15:52:43 GMT

AFL++ v5.00c adds Ball-Larus path coverage, a new bug-oracle instrumentation pass, predicate-tightness scheduling, and macOS/FreeBSD support. • New `AFL_LLVM_PATH` / `AFL_LLVM_LTO_PATH` / `AFL_LLVM_PATH_MODE` env vars enable Ball-Larus per-function path coverage (three strictness levels) on top of edge coverage in LTO and PCGUARD modes. • New `afl-llvm-bug-pass.so` instrumentation provides five runtime bug-detection oracles — SCALAR, BUDGET, SIZEFILL, ALLOCSIZE, and SLACK — catching arithmetic-bound and logical OOB bugs that ASan misses (including the CVE-2023-4863 / libwebp-Huffman class). • New `-l M` scheduling mode in `afl-fuzz` treats per-site minimum slack on inequality CmpLog comparisons as a coverage event, marking queue entries favoured for predicate-tightness. • New `-l Z` scheduling mode in `afl-fuzz`, paired with `AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1`, logs computed allocation sizes and max offsets into CmpLog RTN slots for dictionary mining. • Linux persistent mode now uses futex instead of pipes, increasing speed and reducing syscall overhead; opt out with `AFL_FAST_CHILD_SYNC`. • Adds LLVM 23 support in `afl-cc`. • macOS support restored for `afl-fuzz`, `afl-cc` (including LTO), frida mode, and lib* tools. • Refreshed FreeBSD support. • `-I tool` invocations in `afl-fuzz` now receive the new crash path as a command-line parameter. • Nyx mode now works for all `afl-cmin` minimizer variants. • IJON distance reverted to the original IJON implementation: initial matching bytes, max length 1024. Breaking changes: • AFL++ is now licensed under AGPL 3.0 (files where the license could be switched); files under Apache 2.0 with third-party contributions remain on that license. Commercial use requires a separate commercial license. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v5.00c

Wed, 03 Jun 2026 15:52:43 GMT

AFL++ v5.00c adds AGPL license, Ball-Larus path coverage, a 6-mode bug-detection pass, new cmplog scheduling, and macOS/futex speed gains. • Relicenses AFL++ to AGPL 3.0 (with optional commercial license for organizations that cannot use AGPL); Apache 2.0 files with external contributions remain on that license. • Adds Ball-Larus per-function path coverage (`AFL_LLVM_PATH`) on top of edge coverage for LTO and PCGUARD, with three strictness levels (`=1` relaxed, `=2` restricted, `=3` strict), optionally composed with `AFL_LLVM_LTO_CALLER`. • Introduces `afl-llvm-bug-pass.so` with six runtime oracle modes (SCALAR, BUDGET, SIZEFILL, ALLOCSIZE, SLACK, and SCALAR_SLICE) that catch arithmetic-bound and logical OOB bugs ASan misses — including the CVE-2023-4863 libwebp-Huffman class. • Adds `AFL_LLVM_BUG_ALLOCSIZE_FUNCS` and `AFL_LLVM_BUG_ALLOCSIZE_FREE_FUNCS` to extend allocation tracking to user-defined custom allocators and their matching free functions. • New `-l M` afl-fuzz cmplog scheduling mode: treats any new per-site minimum slack on inequality comparisons as a coverage event and marks the queue entry favoured (predicate-tightness scheduling). • New `-l Z` afl-fuzz cmplog scheduling mode combined with `AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1`: logs (computed_size, max_observed_offset) per freed allocation into CmpLog RTN slots for dictionary mining of magic size constants. • Linux persistent mode now uses futex instead of pipes, reducing syscall overhead; opt out with `AFL_FAST_CHILD_SYNC`. • Adds `-I tool` crash notification: the specified tool now receives the new crash file as a command-line parameter. • Adds LLVM 23 support in `afl-cc`. • Restores and expands macOS support for `afl-fuzz`, `afl-cc` (including LTO), frida mode, and lib* tools. • Refreshes FreeBSD support. • Enables Nyx mode for all `afl-cmin` minimizer variants. • Switches coverage analysis companion from deprecated `afl-cov` to `cov-analysis`. • Updates IJON distance implementation to the original IJON model (initial matching bytes, max length 1024). Breaking changes: • AFL++ is now licensed under AGPL 3.0 (previously Apache 2.0 for many files); commercial use requires a separate commercial license Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.40c

Fri, 13 Mar 2026 09:24:49 GMT

AFL++ v4.40c ships FrameShift mutation by default, LLVM 22 support, expanded COMPCOV strings, and multi-directory afl-plot. • Integrates FrameShift mutation engine by default, improving time-to-coverage and total coverage; tune or disable via `AFL_FRAMESHIFT_DISABLE` and `AFL_FRAMESHIFT_MAX_OVERHEAD`. • Adds `AFL_FORCE_FASTRESUME` to skip saved target-hash validation on resume (requires unchanged coverage map size). • Adds `AFL_LLVM_DENY_EXEC` to abort common exec calls from instrumented binaries, preventing fuzz-target child processes from polluting coverage. • Adds LLVM 22 support in afl-cc. • Extends COMPCOV string comparison coverage to `g_`, `curl_`, and `xml_` prefixed string functions in afl-cc. • Adds `-f` flag support to afl-showmap. • Adds faster stream mode to afl-showmap. • afl-cmin and afl-cmin.py now honor `AFL_SHA1_FILENAMES` for filename hashing. • afl-plot now supports multiple AFL++ output directories simultaneously. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.35c

Fri, 26 Dec 2025 12:05:18 GMT

AFL++ v4.35c adds GUIFuzz++ for desktop GUI fuzzing and IJON support in QEMU mode • Adds GUIFuzz++ integration, enabling grey-box fuzzing of desktop graphical user interface applications. • Adds IJON support in qemu_mode for enhanced coverage-guided feedback in binary-only targets. • Adds complete hidden decision coverage to default pcguard instrumentation in afl-cc. • Adds complete hidden decision coverage to LTO instrumentation in afl-cc. • Enables compiling the GCC plugin with clang++. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.34c

Wed, 01 Oct 2025 07:46:04 GMT

AFL++ v4.34c adds IJON integration, UnicornAFL v3, LLVM 22 support, ccache launcher, ZeroMQ remote testcase plugin, and new build options. • Adds IJON integration for structure-aware fuzzing guided by user annotations (see docs/IJON.md). • Upgrades unicorn_mode to UnicornAFL v3. • Enables LLVM 22 support in afl-cc. • New `AFL_COMPILER_LAUNCHER` env var in afl-cc to allow ccache and similar compiler launchers. • Makes `AFL_DUMP_MAP_SIZE` work for CLASSIC instrumentation modes. • Adds `NO_UNICORN`, `NO_QEMU`, and `NO_FRIDA` build options to selectively disable optional backends. • Adds AIXCC Team Atlanta's ZeroMQ plugin for custom_mutators to ingest testcases from a remote source. • Larger improvements to CMPLOG handling in afl-fuzz. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.33c

Sat, 28 Jun 2025 20:32:42 GMT

AFL++ v4.33c adds hidden edge instrumentation, a faster afl-cmin.py, QEMU block coverage, and a new desocketing library. • Adds `AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT` env var to selectively disable fork when using AFL_PRELOAD. • Adds color output for NO_UI mode in afl-fuzz. • Instruments previously missed hidden edges in PCGUARD plugin (~5% more edges covered vs prior AFL++; ~8% more vs LLVM sancov). • Adds `AFL_EXITPOINT` support in qemuafl for controlling exit points in QEMU mode. • Adds `AFL_QEMU_BLOCK_COV` block coverage support in qemuafl. • Adds improved MIPS persistent mode support in qemuafl. • Introduces new faster `afl-cmin.py` script, now invoked automatically by `afl-cmin` when Python is available. • Enables full Nyx mode support in `afl-cmin` for corpus minimization of large targets (previously lost coverage due to fixed map size). • Introduces new desocketing library `utils/libaflppdesock` for targets where other desocketing approaches fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.31c

Mon, 10 Feb 2025 12:43:11 GMT

AFL++ v4.31c adds SAND mode for sanitizer-efficient fuzzing, disables splicing by default, and gains LLVM 20 support. • New SAND mode for more efficient fuzzing with sanitizers (see docs/SAND.md). • Splicing phase is now disabled by default; new `-u` flag re-enables it manually (auto-enables after two cycles with no finds). • Adds LLVM 20 support in afl-cc. • afl-cc now inserts `libAFLDriver.a` early when `-fsanitize=fuzzer` is used, supporting `LLVMFuzzerTestOneInput` in `.a` archives. • Adds `__sanitizer_weak_hook_*` functions in afl-cc for compatibility with non-standard setups. • Python 3.13+ support in afl-fuzz. • Loose file and shared memory permissions support for Android and iPhone targets. Breaking changes: • The splicing phase is now DISABLED by default; workflows relying on splicing being active must add the `-u` flag to restore previous behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.30c

Tue, 03 Dec 2024 14:48:51 GMT

AFL++ v4.30c adds fast-resume, QEMU hooks, custom TCP mutator, and new afl-cc runtime/compile-time knobs. • Adds fastresume: when resuming with `-i -` or `AFL_AUTORESUME=1` and the target binary is unchanged, AFL skips calibration by loading a saved dump (zlib-compressed if available); disable with `AFL_NO_FASTRESUME=1`. • Adds `AFL_CUSTOM_MUTATOR_LATE_SEND=1` to invoke the custom send() function after the target has been restarted. • Adds optional hooking-bridge support in qemu_mode for new hook types (see `qemu_mode/hooking_bridge`). • Adds `custom_send_tcp` custom mutator for TCP-based fuzzing targets. • New afl-cc runtime variable `AFL_OLD_FORKSERVER` to use the classic AFL forkserver — useful with symcc, symqemu, nautilus, and similar tools when combined with `AFL_LLVM_INSTRUMENT=CLASSIC`. • New afl-cc compile-time variable `AFL_OPT_LEVEL` to set a specific optimization level (default: 3). • Adds `autotokens-standalone` binary (`custom_mutators/autotokens/standalone/`). • AFL++ headers are now installed to `$PREFIX/include/afl`. Breaking changes: • `afl-gcc` and `afl-clang` have been removed and are no longer available. • The CMPLOG map layout has changed — all CMPLOG targets must be recompiled before use. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.21c

Sun, 09 Jun 2024 17:10:27 GMT

AFL++ v4.21c adds `AFL_NO_SYNC` env var, `AFL_DISABLE_REDUNDANT`, new queue selection algorithm and libtokencap script • Adds `AFL_NO_SYNC` environment variable to skip input syncing between parallel fuzzers • Adds `AFL_DISABLE_REDUNDANT` environment variable for huge queues in `afl-fuzz` • Implements new queue selection algorithm based on 2 core years of analysis to improve coverage • Adds `generate_libtoken_dict.sh` script in `libtokencap` via @a-shvedov Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.20c

Sat, 13 Apr 2024 09:51:52 GMT

AFL++ v4.20c introduces 4B coverage edges, new deterministic fuzzing default, and LTO caller instrumentation • AFL++ now supports up to 4 billion coverage edges, up from 6 million. • Adds `PERFORMANCE=1` make option to enable CPU-specific optimizations in `afl-fuzz`. • Activates new deterministic fuzzing by default in `afl-fuzz` (control with `-z`). • Adds `-e` extension option to `afl-fuzz` to save queue items and crashes with file extensions. • Adds `AFL_LLVM_LTO_CALLER=1` and `AFL_LLVM_LTO_CALLER_DEPTH` env vars in `afl-cc` LTO mode for collision-free caller instrumentation. Breaking changes: • New compiled targets instrumented for CMPLOG/Redqueen will not work with old afl-fuzz versions. • The `-d` and `-D` parameters for deterministic fuzzing are now ignored in `afl-fuzz` as the feature is active by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.10c

Sat, 03 Feb 2024 11:11:08 GMT

AFL++ v4.10c adds injection fuzzing, `-D` for deterministic fuzzing and LLVM 18 support • Adds `instrumentation/README.injections.md` documentation and support for SQL, LDAP, and XSS injection fuzzing • Enables better deterministic fuzzing with the new `-D` flag • Adds LLVM 18 support in the instrumentation layer • QEMU mode now activates plugins by default and includes a module to produce drcov compatible traces Breaking changes: • LTO mode now requires llvm 12+ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.09c

Fri, 15 Dec 2023 08:38:03 GMT

AFL++ v4.09c adds `afl-addseeds` tool, `post_run` mutator hooks, `AFL_FINAL_SYNC`, and scale support to CMPLOG. • Adds `afl-addseeds` CLI tool for injecting new seeds into a running campaign • Adds `--version` and `--help` command line parameters to `afl-fuzz` • Adds `post_run` custom mutator function hook in `afl-fuzz` • Adds scale support to CMPLOG via `-l S` flag • Adds `-S`/`-M` naming length up to 50 characters (from 24) • Adds `AFL_FINAL_SYNC` environment variable to force fuzzer sync before termination • Adds `AFL_IGNORE_SEED_PROBLEMS` environment variable to skip seeding timeouts • Adds `-n` option to `afl-whatsup` to disable colored output • Adds `-m` option to `afl-whatsup` to show only relevant stats Breaking changes: • Instrumentation of `__cxx` internal functions is re-enabled, which may break some targets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus v4.08c

Thu, 10 Aug 2023 08:44:05 GMT

AFL++ v4.08c adds `-P` path-finding mode, `-a` input type, `-l` base64 solve, and a standalone custom mutator. • `-P` flag for new mutation engine that favors path discovery then switches to crash triggering after 10 minutes • `-l X` option to enable base64 transformation solving • CLI option `-c -` to disable CMPLOG Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus 4.07c

Mon, 12 Jun 2023 07:04:10 GMT

Adds `-T` parallelism to afl-cmin, new env vars for coverage/post-processing control, and new WASM/grammar mutators • Adds `-T ` flag to `afl-cmin` for parallel task support • Adds `AFL_POST_PROCESS_KEEP_ORIGINAL` environment variable to preserve original input data on finds • Adds `AFL_IGNORE_PROBLEMS_COVERAGE` environment variable to ignore coverage from loaded libs after forkserver init • Adds `AFL_LLVM_LTO_SKIPINIT` environment variable for AFL++ based WASM support • Adds `-I ` option to `afl-showmap` as an alternative to `-i ` • Adds new grammar custom mutator `atnwalk` • Adds `TritonDSE` custom mutator in `custom_mutators/aflpp_tritondse` • Adds `SymQEMU` custom mutator in `custom_mutators/symqemu` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus 4.06c

Mon, 17 Apr 2023 08:29:05 GMT

AFL++ 4.06c adds nyx_mode, basic RISC-V, new `autotoken` module, and several environment variables • Adds `nyx_mode` support across all tools • Adds basic RISC-V support in `qemu_mode` • Adds new `autotoken` custom module for grammar-free text fuzzing • Adds `AFL_NO_WARN_INSTABILITY` environment variable to suppress instability warnings • Adds `AFL_FRIDA_STATS_INTERVAL` environment variable to control Frida stats sampling frequency • Adds support for LLVM 15 native pcguard changes • Adds CFI sanitizer variant to gcc targets in `afl-cc` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus 4.05c

Thu, 05 Jan 2023 12:52:09 GMT

Adds afl_custom_fuzz_send for IPC data sending, AFL_FORK_SERVER_KILL_SIGNAL env var, and cmplog random colorization to afl-fuzz • Adds `AFL_FORK_SERVER_KILL_SIGNAL` environment variable to control which signal kills the fork server child in `afl-fuzz` • Adds `-l R` option to `afl-fuzz` for random colorization in cmplog mode • Adds `afl_custom_fuzz_send` custom mutator API hook to send fuzz data to targets via IPC or other means Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus 4.04c

Tue, 11 Oct 2022 13:43:29 GMT

Adds `AFL_FORK_SERVER_KILL_SIGNAL` env var to control AFL++ fork server exit behavior • `AFL_FORK_SERVER_KILL_SIGNAL` environment variable added to allow customizing the signal sent to kill the fork server. • AFL runtime now always passes inputs via shared memory when possible in llvm-mode, ignoring command line settings for this path. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus 4.03c

Tue, 20 Sep 2022 15:38:15 GMT

aflplusplus 4.03c adds AFL_NO_STARTUP_CALIBRATION, AFL_QEMU_TRACK_UNSTABLE, AFL_DUMP_MAP_SIZE, LLVMFuzzerRunDriver() support, -A option to cmin • Add `AFL_NO_STARTUP_CALIBRATION` environment variable to bypass initial seed calibration and start fuzzing immediately. • Add `AFL_QEMU_TRACK_UNSTABLE` environment variable to log addresses of unstable edges in QEMU mode when combined with `AFL_DEBUG=1`. • Add `AFL_DUMP_MAP_SIZE=1` setting to dump the target's map size and exit before main(). • Add `-A` option to `afl-cmin` and `afl-cmin.bash` to include crashing and timeout inputs during corpus minimization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus 4.02c

Mon, 08 Aug 2022 13:29:40 GMT

AFL++ 4.02c adds Android support for Frida mode and post-process hook control • Allows `post_process` hooks to return NULL and 0 length to skip mutated inputs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus 4.01c

Tue, 28 Jun 2022 12:19:51 GMT

AFL++ 4.01c adds AFL_SYNC_TIME, -g/-G input length limits, token mutation, and persistent mode env vars • Adds `-g` and `-G` command-line options to set the minimum and maximum length of generated fuzz inputs • Introduces `AFL_SYNC_TIME` environment variable to configure the time allocated for syncing state with other fuzzer instances • Reintroduces `AFL_PERSISTENT` and `AFL_DEFER_FORKSRV` environment variables to enable persistent mode and manual forkserver support externally • Adds `AFL_EARLY_FORKSERVER` environment variable to install the forkserver as early as possible in the target for afl-gcc-fast, afl-clang-fast, and afl-clang-lto • Adds auto token insert, user token insert, and auto token overwrite mutation capabilities (previously only user token overwrite was supported) • Updates frida_mode to handle C++ throw/catch scenarios via the new Frida release • Reintroduces support for `libafl` as a custom_mutator with token fuzzing Breaking changes: • AFL++ PCGUARD mode is no longer available for LLVM 10.0.1 (requires LLVM 11+) • The `-c 0` flag is now used to indicate the fuzzing binary also handles CMPLOG compilation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus

aflplusplus 4.00c

Wed, 26 Jan 2022 10:02:27 GMT

AFL++ 4.00c adds Nyx full-system emulation with snapshots, aarch64 coresight_mode, and GramaTron grammar mutator • Support for `coresight_mode` provides new binary-only fuzzing capabilities on aarch64 CPUs. • New `GramaTron` grammar mutator added to `custom_mutators` for structured input generation. • `afl-persistent-config` script added to apply permanent system configuration settings for fuzzing on Linux and MacOS. • `unicorn_mode` updated to `unicorn2`, enabling faster emulation and RISC-V support. • New `AFL_LLVM_USE_TSAN` environment variable enables ThreadSanitizer support in the instrumentation layer. Breaking changes: • `unicorn_mode` now depends on `unicorn2` instead of the previous unicorn library, requiring updated system dependencies. • UI and `fuzzer_stat` entries renamed: 'unique crashes' to 'saved crashes', 'total paths' to 'corpus count', 'current path' to 'current item', which may break custom scripts parsing these strings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aflplusplus