ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-12 18:18:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

move to feature

Browse Source
This commit is contained in:
Han Zheng
2025-02-17 09:40:58 +01:00
parent bd5ccc6977
commit 68f5c4811e
2 changed files with 1 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/features.md
View File

@ -106,6 +106,7 @@ Among others, the following features and patches have been integrated:
* Win32 PE binary-only fuzzing with QEMU and Wine * Win32 PE binary-only fuzzing with QEMU and Wine
* AFLfast's power schedules by Marcel Böhme: * AFLfast's power schedules by Marcel Böhme:
[https://github.com/mboehme/aflfast](https://github.com/mboehme/aflfast) [https://github.com/mboehme/aflfast](https://github.com/mboehme/aflfast)
* The new deterministic mode [MendelFuzz](https://mpi-softsec.github.io/papers/FSE25-mendelfuzz.pdf)
* The MOpt mutator: * The MOpt mutator:
[https://github.com/puppet-meteor/MOpt-AFL](https://github.com/puppet-meteor/MOpt-AFL) [https://github.com/puppet-meteor/MOpt-AFL](https://github.com/puppet-meteor/MOpt-AFL)
* LLVM mode Ngram coverage by Adrian Herrera * LLVM mode Ngram coverage by Adrian Herrera

29
docs/skipdet_mode.md
View File

@ -1,29 +0,0 @@
# MendelFuzz: The Return of the Deterministic Stage.
* Authors: Han Zheng, Flavio Toffalini, Marcel Böhme, and Mathias Payer.
* Maintainer: [Han Zheng](https://github.com/kdsjZh)
* Preprint: Accepted by [FSE 2025](https://mpi-softsec.github.io/papers/FSE25-mendelfuzz.pdf)
* Artifact: https://github.com/hexhive/mendelFuzz-Artifact/
## Motivation
Prior works observed that the deterministic stage is not efficient in real-world fuzzing practice.
Therefore, AFL++ disabled it by default since `++3.00c`. While the setup notably boosts the exploration, it is not always the best option.
In this work, we analyze the overhead and the contributions of the deterministic stage. Our observations suggest that 1) deterministic stage can contribute to coverage, but consumes too much (> 90%) time
in the campaign. 2) mutating a small percentage of (0.5%) bytes and (20%) seeds contributes to >80% of new paths found in the deterministic stage.
Inspired by these takeaways, we developed MendelFuzz to identify these critical bytes and seeds to boost the deterministic stage. MendelFuzz retains the benefits of the classic deterministic stage by
only enumerating a tiny part of the total deterministic state space.
## Usage
MendelFuzz is the default mode in AFL++. Just follow the standard fuzzing practice!
## Code Structure
The implementation is mainly available at `src/afl-fuzz-skipdet.c`.