mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-08 16:21:32 +00:00
95b794744b
Changes: - Move advanced content to docs/. - Add links. - Fix links. - Restructure content.
46 lines
4.0 KiB
Markdown
46 lines
4.0 KiB
Markdown
# Important features of AFL++
|
|
|
|
AFL++ supports llvm from 3.8 up to version 12, very fast binary fuzzing with QEMU 5.1
|
|
with laf-intel and redqueen, frida mode, unicorn mode, gcc plugin, full *BSD,
|
|
Mac OS, Solaris and Android support and much, much, much more.
|
|
|
|
| Feature/Instrumentation | afl-gcc | llvm | gcc_plugin | frida_mode | qemu_mode |unicorn_mode |
|
|
| -------------------------|:-------:|:---------:|:----------:|:----------------:|:----------------:|:----------------:|
|
|
| Threadsafe counters | | x(3) | | | | |
|
|
| NeverZero | x86[_64]| x(1) | x | x | x | x |
|
|
| Persistent Mode | | x | x | x86[_64]/arm64 | x86[_64]/arm[64] | x |
|
|
| LAF-Intel / CompCov | | x | | | x86[_64]/arm[64] | x86[_64]/arm[64] |
|
|
| CmpLog | | x | | x86[_64]/arm64 | x86[_64]/arm[64] | |
|
|
| Selective Instrumentation| | x | x | x | x | |
|
|
| Non-Colliding Coverage | | x(4) | | | (x)(5) | |
|
|
| Ngram prev_loc Coverage | | x(6) | | | | |
|
|
| Context Coverage | | x(6) | | | | |
|
|
| Auto Dictionary | | x(7) | | | | |
|
|
| Snapshot LKM Support | | (x)(8) | (x)(8) | | (x)(5) | |
|
|
| Shared Memory Testcases | | x | x | x86[_64]/arm64 | x | x |
|
|
|
|
1. default for LLVM >= 9.0, env var for older version due an efficiency bug in previous llvm versions
|
|
2. GCC creates non-performant code, hence it is disabled in gcc_plugin
|
|
3. with `AFL_LLVM_THREADSAFE_INST`, disables NeverZero
|
|
4. with pcguard mode and LTO mode for LLVM 11 and newer
|
|
5. upcoming, development in the branch
|
|
6. not compatible with LTO instrumentation and needs at least LLVM v4.1
|
|
7. automatic in LTO mode with LLVM 11 and newer, an extra pass for all LLVM versions that write to a file to use with afl-fuzz' `-x`
|
|
8. the snapshot LKM is currently unmaintained due to too many kernel changes coming too fast :-(
|
|
|
|
Among others, the following features and patches have been integrated:
|
|
|
|
* NeverZero patch for afl-gcc, instrumentation, qemu_mode and unicorn_mode which prevents a wrapping map value to zero, increases coverage
|
|
* Persistent mode, deferred forkserver and in-memory fuzzing for qemu_mode
|
|
* Unicorn mode which allows fuzzing of binaries from completely different platforms (integration provided by domenukk)
|
|
* The new CmpLog instrumentation for LLVM and QEMU inspired by [Redqueen](https://www.syssec.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2018/12/17/NDSS19-Redqueen.pdf)
|
|
* Win32 PE binary-only fuzzing with QEMU and Wine
|
|
* AFLfast's power schedules by Marcel Böhme: [https://github.com/mboehme/aflfast](https://github.com/mboehme/aflfast)
|
|
* The MOpt mutator: [https://github.com/puppet-meteor/MOpt-AFL](https://github.com/puppet-meteor/MOpt-AFL)
|
|
* LLVM mode Ngram coverage by Adrian Herrera [https://github.com/adrianherrera/afl-ngram-pass](https://github.com/adrianherrera/afl-ngram-pass)
|
|
* LAF-Intel/CompCov support for instrumentation, qemu_mode and unicorn_mode (with enhanced capabilities)
|
|
* Radamsa and honggfuzz mutators (as custom mutators).
|
|
* QBDI mode to fuzz android native libraries via Quarkslab's [QBDI](https://github.com/QBDI/QBDI) framework
|
|
* Frida and ptrace mode to fuzz binary-only libraries, etc.
|
|
|
|
So all in all this is the best-of AFL that is out there :-) |