Lines Matching +full:storage +full:- +full:repo +full:- +full:branch +full:- +full:coverage
9 sending a mail to <afl-users+subscribe@googlegroups.com>.
12 - fix */build_...sh scripts to work outside of git
13 - new custom_mutator: libafl with token fuzzing :)
14 - afl-fuzz:
15 - when you just want to compile once and set CMPLOG, then just
16 set -c 0 to tell afl-fuzz that the fuzzing binary is also for
18 - new commandline options -g/G to set min/max length of generated
20 - reintroduced AFL_PERSISTENT and AFL_DEFER_FORKSRV to allow
23 - add AFL_EARLY_FORKSERVER to install the forkserver as earliest as
24 possible in the target (for afl-gcc-fast/afl-clang-fast/
25 afl-clang-lto)
26 - "saved timeouts" was wrong information, timeouts are still thrown
27 away by default even if they have new coverage (hangs are always
29 - AFL never implemented auto token inserts (but user token inserts,
31 - Mopt fix to always select the correct algorithm
32 - fix effector map calculation (deterministic mode)
33 - fix custom mutator post_process functionality
34 - document and auto-activate pizza mode on condition
35 - afl-cc:
36 - due a bug in lld of llvm 15 LTO instrumentation wont work atm :-(
37 - converted all passed to use the new llvm pass manager for llvm 11+
38 - AFL++ PCGUARD mode is not available for 10.0.1 anymore (11+ only)
39 - trying to stay on top on all these #$&§!! changes in llvm 15 ...
40 - frida_mode:
41 - update to new frida release, handles now c++ throw/catch
42 - unicorn_mode:
43 - update unicorn engine, fix C example
47 - complete documentation restructuring, made possible by Google Season
49 - we renamed several UI and fuzzer_stat entries to be more precise,
50 e.g. "unique crashes" -> "saved crashes", "total paths" ->
51 "corpus count", "current path" -> "current item".
53 - Nyx mode (full system emulation with snapshot capability) has been
54 added - thanks to @schumilo and @eqv!
55 - unicorn_mode:
56 - Moved to unicorn2! by Ziqiao Kong (@lazymio)
57 - Faster, more accurate emulation (newer QEMU base), risc-v support
58 - removed indirections in rust callbacks
59 - new binary-only fuzzing mode: coresight_mode for aarch64 CPUs :)
61 - if instrumented libaries are dlopen()'ed after the forkserver you
62 will now see a crash. Before you would have colliding coverage.
66 - afl-fuzz:
67 - cmplog binaries will need to be recompiled for this version
69 - fix a regression introduced in 3.10 that resulted in less
70 coverage being detected. thanks to Collin May for reporting!
71 - ensure all spawned targets are killed on exit
72 - added AFL_IGNORE_PROBLEMS, plus checks to identify and abort on
75 - fix -n dumb mode (nobody should use this mode though)
76 - fix stability issue with LTO and cmplog
77 - better banner
78 - more effective cmplog mode
79 - more often update the UI when in input2stage mode
80 - qemu_mode/unicorn_mode: fixed OOB write when using libcompcov,
82 - frida_mode:
83 - better performance, bug fixes
84 - David Carlier added Android support :)
85 - afl-showmap, afl-tmin and afl-analyze:
86 - honor persistent mode for more speed. thanks to dloffre-snl
88 - fix bug where targets are not killed on timeouts
89 - moved hidden afl-showmap -A option to -H to be used for
91 - Prevent accidentally killing non-afl/fuzz services when aborting
92 afl-showmap and other tools.
93 - afl-cc:
94 - detect overflow reads on initial input buffer for asan
95 - new cmplog mode (incompatible with older afl++ versions)
96 - support llvm IR select instrumentation for default PCGUARD and LTO
97 - fix for shared linking on MacOS
98 - better selective instrumentation AFL_LLVM_{ALLOW|DENY}LIST
100 - fixed a potential crash in targets for LAF string handling
101 - fixed a bad assert in LAF split switches
102 - added AFL_USE_TSAN thread sanitizer support
103 - llvm and LTO mode modified to work with new llvm 14-dev (again.)
104 - fix for AFL_REAL_LD
105 - more -z defs filtering
106 - make -v without options work
107 - added the very good grammar mutator "GramaTron" to the
109 - added optimin, a faster and better corpus minimizer by
111 - added afl-persistent-config script to set perform permanent system
114 - added xml, curl & exotic string functions to llvm dictionary feature
115 - fix AFL_PRELOAD issues on MacOS
116 - removed utils/afl_frida because frida_mode/ is now so much better
117 - added uninstall target to makefile (todo: update new readme!)
120 - afl-fuzz:
121 - fix -F when a '/' was part of the parameter
122 - fixed a crash for cmplog for very slow inputs
123 - fix for AFLfast schedule counting
124 - removed implied -D determinstic from -M main
125 - if the target becomes unavailable check out out/default/error.txt
127 - AFL_CAL_FAST was a dead env, now does the same as AFL_FAST_CAL
128 - reverse read the queue on resumes (more effective)
129 - fix custom mutator trimming
130 - afl-cc:
131 - Update to COMPCOV/laf-intel that speeds up the instrumentation
132 process a lot - thanks to Michael Rodler/f0rki for the PR!
133 - Fix for failures for some sized string instrumentations
134 - Fix to instrument global namespace functions in c++
135 - Fix for llvm 13
136 - support partial linking
137 - do honor AFL_LLVM_{ALLOW/DENY}LIST for LTO autodictionary andDICT2FILE
138 - We do support llvm versions from 3.8 to 5.0 again
139 - frida_mode:
140 - several fixes for cmplog
141 - remove need for AFL_FRIDA_PERSISTENT_RETADDR_OFFSET
142 - less coverage collision
143 - feature parity of aarch64 with intel now (persistent, cmplog,
144 in-memory testcases, asan)
145 - afl-cmin and afl-showmap -i do now descend into subdirectories
146 (like afl-fuzz does) - note that afl-cmin.bash does not!
147 - afl_analyze:
148 - fix timeout handling
149 - add forkserver support for better performance
150 - ensure afl-compiler-rt is built for gcc_module
151 - always build aflpp_driver for libfuzzer harnesses
152 - added `AFL_NO_FORKSRV` env variable support to
153 afl-cmin, afl-tmin, and afl-showmap, by @jhertz
154 - removed outdated documents, improved existing documentation
157 - Note: plot_data switched to relative time from unix time in 3.10
158 - frida_mode - new mode that uses frida to fuzz binary-only targets,
161 - create a fuzzing dictionary with the help of CodeQL thanks to
163 - afl-fuzz:
164 - added patch by @realmadsci to support @@ as part of command line
165 options, e.g. `afl-fuzz ... -- ./target --infile=@@`
166 - add recording of previous fuzz attempts for persistent mode
167 to allow replay of non-reproducable crashes, see
169 - fixed a bug when trimming for stdin targets
170 - cmplog -l: default cmplog level is now 2, better efficiency.
172 - better fuzzing strategy yield display for enabled options
173 - ensure one fuzzer sync per cycle
174 - fix afl_custom_queue_new_entry original file name when syncing
176 - fixed a crash when more than one custom mutator was used together
178 - on a crashing seed potentially the wrong input was disabled
179 - added AFL_EXIT_ON_SEED_ISSUES env that will exit if a seed in
180 -i dir crashes the target or results in a timeout. By default
182 - added AFL_EXIT_ON_TIME env that will make afl-fuzz exit fuzzing
184 - when AFL_FAST_CAL is set a variable path will now be calibrated
186 - added AFL_TRY_AFFINITY to try to bind to CPUs but don't error if
188 - afl-cc:
189 - We do not support llvm versions prior 6.0 anymore
190 - added thread safe counters to all modes (`AFL_LLVM_THREADSAFE_INST`),
192 - Fix for -pie compiled binaries with default afl-clang-fast PCGUARD
193 - Leak Sanitizer (AFL_USE_LSAN) added by Joshua Rogers, thanks!
194 - Removed InsTrim instrumentation as it is not as good as PCGUARD
195 - Removed automatic linking with -lc++ for LTO mode
196 - Fixed a crash in llvm dict2file when a strncmp length was -1
197 - added --afl-noopt support
198 - utils/aflpp_driver:
199 - aflpp_qemu_driver_hook fixed to work with qemu_mode
200 - aflpp_driver now compiled with -fPIC
201 - unicornafl:
202 - fix MIPS delay slot caching, thanks @JackGrence
203 - fixed aarch64 exit address
204 - execution no longer stops at address 0x0
205 - updated afl-system-config to support Arch Linux weirdness and increase
207 - updated the grammar custom mutator to the newest version
208 - add -d (add dead fuzzer stats) to afl-whatsup
209 - added AFL_PRINT_FILENAMES to afl-showmap/cmin to print the
211 - afl-showmap/cmin will now process queue items in alphabetical order
214 - afl-fuzz:
215 - added AFL_TARGET_ENV variable to pass extra env vars to the target
217 - fix map detection, AFL_MAP_SIZE not needed anymore for most cases
218 - fix counting favorites (just a display thing)
219 - afl-cc:
220 - fix cmplog rtn (rare crash and not being able to gather ptr data)
221 - fix our own PCGUARD implementation to compile with llvm 10.0.1
222 - link runtime not to shared libs
223 - ensure shared libraries are properly built and instrumented
224 - AFL_LLVM_INSTRUMENT_ALLOW/DENY were not implemented for LTO, added
225 - show correct LLVM PCGUARD NATIVE mode when auto switching to it
226 and keep fsanitize-coverage-*list=...
228 - qemu_mode (thanks @realmadsci):
229 - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace
230 - add AFL_QEMU_CUSTOM_BIN
231 - unicorn_mode
232 - accidently removed the subfolder from github, re-added
233 - added DEFAULT_PERMISSION to config.h for all files created, default
237 - afl-fuzz:
238 - better auto detection of map size
239 - fix sanitizer settings (bug since 3.10c)
240 - fix an off-by-one overwrite in cmplog
241 - add non-unicode variants from unicode-looking dictionary entries
242 - Rust custom mutator API improvements
243 - Imported crash stats painted yellow on resume (only new ones are red)
244 - afl-cc:
245 - added AFL_NOOPT that will just pass everything to the normal
246 gcc/clang compiler without any changes - to pass weird configure
248 - fixed a crash that can occur with ASAN + CMPLOG together plus
250 - fixed a crash in LAF transform for empty strings
251 - handle erroneous setups in which multiple afl-compiler-rt are
255 - the compiler rt was added also in object building (-c) which
257 - Renamed CTX to CALLER, added correct/real CTX implementation to
259 - qemu_mode:
260 - added AFL_QEMU_EXCLUDE_RANGES env by @realmadsci, thanks!
261 - if no new/updated checkout is wanted, build with:
263 - we no longer perform a "git drop"
264 - afl-cmin: support filenames with spaces
267 - Mac OS ARM64 support
268 - Android support fixed and updated by Joey Jiaojg - thanks!
269 - New selective instrumentation option with __AFL_COVERAGE_* commands
272 - afl-fuzz
273 - Making AFL_MAP_SIZE (mostly) obsolete - afl-fuzz now learns on
275 - upgraded cmplog/redqueen: solving for floating point, solving
278 `-l` that sets the intensity (values 1 to 3). Recommended is 2.
279 - added `AFL_CMPLOG_ONLY_NEW` to not use cmplog on initial seeds
280 from `-i` or resumes (these have most likely already been done)
281 - fix crash for very, very fast targets+systems (thanks to mhlakhani
283 - on restarts (`-i`)/autoresume (AFL_AUTORESUME) the stats are now
285 - changed the meaning of '+' of the '-t' option, it now means to
286 auto-calculate the timeout with the value given being the max
288 abort is now inherent to the -t option.
289 - if deterministic mode is active (`-D`, or `-M` without `-d`) then
292 - added minimum SYNC_TIME to include/config.h (30 minutes default)
293 - better detection if a target needs a large shared map
294 - fix for `-Z`
295 - fixed a few crashes
296 - switched to an even faster RNG
297 - added hghwng's patch for faster trace map analysis
298 - printing suggestions for mistyped `AFL_` env variables
299 - added Rust bindings for custom mutators (thanks @julihoh)
300 - afl-cc
301 - allow instrumenting LLVMFuzzerTestOneInput
302 - fixed endless loop for allow/blocklist lines starting with a
304 - cmplog/redqueen now also tracks floating point, _ExtInt() + 128bit
305 - cmplog/redqueen can now process basic libc++ and libstdc++
307 - added support for __afl_coverage_interesting() for LTO and our
309 selective coverage in instrumentation/README.instrument_list.md
310 - added AFL_LLVM_INSTRUMENT option NATIVE for native clang pc-guard
311 support (less performant than our own), GCC for old afl-gcc and
312 CLANG for old afl-clang
313 - fixed a potential crash in the LAF feature
314 - workaround for llvm bitcast lto bug
315 - workaround for llvm 13
316 - qemuafl
317 - QASan (address sanitizer for Qemu) ported to qemuafl!
319 - solved some persistent mode bugs (thanks Dil4rd)
320 - solved an issue when dumping the memory maps (thanks wizche)
321 - Android support for QASan
322 - unicornafl
323 - Substantial speed gains in python bindings for certain use cases
324 - Improved rust bindings
325 - Added a new example harness to compare python, c and rust bindings
326 - afl-cmin and afl-showmap now support the -f option
327 - afl_plot now also generates a graph on the discovered edges
328 - changed default: no memory limit for afl-cmin and afl-cmin.bash
329 - warn on any _AFL and __AFL env vars.
330 - set AFL_IGNORE_UNKNOWN_ENVS to not warn on unknown AFL_... env vars
331 - added dummy Makefile to instrumentation/
332 - Updated utils/afl_frida to be 5% faster, 7% on x86_x64
333 - Added `AFL_KILL_SIGNAL` env variable (thanks @v-p-b)
334 - @Edznux added a nice documentation on how to use rpc.statsd with
338 - llvm_mode/ and gcc_plugin/ moved to instrumentation/
339 - examples/ renamed to utils/
340 - moved libdislocator, libtokencap and qdbi_mode to utils/
341 - all compilers combined to afl-cc which emulates the previous ones
342 - afl-llvm/gcc-rt.o merged into afl-compiler-rt.o
343 - afl-fuzz
344 - not specifying -M or -S will now auto-set "-S default"
345 - deterministic fuzzing is now disabled by default and can be enabled with
346 -D. It is still enabled by default for -M.
347 - a new seed selection was implemented that uses weighted randoms based on
349 walk the whole queue approach. Select the old mode with -Z (auto enabled
350 with -M)
351 - Marcel Boehme submitted a patch that improves all AFFast schedules :)
352 - the default schedule is now FAST
353 - memory limits are now disabled by default, set them with -m if required
354 - rpc.statsd support, for stats and charts, by Edznux, thanks a lot!
355 - reading testcases from -i now descends into subdirectories
356 - allow the -x command line option up to 4 times
357 - loaded extras now have a duplication protection
358 - If test cases are too large we do a partial read on the maximum
360 - longer seeds with the same trace information will now be ignored
362 - crashing seeds are now not prohibiting a run anymore but are
363 skipped - they are used for splicing, though
364 - update MOpt for expanded havoc modes
365 - setting the env var AFL_NO_AUTODICT will not load an LTO autodictionary
366 - added NO_SPLICING compile option and makefile define
367 - added INTROSPECTION make target that writes all mutations to
369 - print special compile time options used in help output
370 - when using -c cmplog, one of the childs was not killed, fixed
371 - somewhere we broke -n dumb fuzzing, fixed
372 - added afl_custom_describe to the custom mutator API to allow for easy
374 - new env. var. AFL_NO_COLOR (or AFL_NO_COLOUR) to suppress colored
376 - instrumentation
377 - We received an enhanced gcc_plugin module from AdaCore, thank you
379 - not overriding -Ox or -fno-unroll-loops anymore
380 - we now have our own trace-pc-guard implementation. It is the same as
381 -fsanitize-coverage=trace-pc-guard from llvm 12, but: it is a) inline
383 - new llvm pass: dict2file via AFL_LLVM_DICT2FILE, create afl-fuzz
384 -x dictionary of string comparisons found during compilation
385 - LTO autodict now also collects interesting cmp comparisons,
387 - fix crash in dict2file for integers > 64 bit
388 - custom mutators
389 - added a new custom mutator: symcc -> https://github.com/eurecom-s3/symcc/
390 - added a new custom mutator: libfuzzer that integrates libfuzzer mutations
391 - Our AFL++ Grammar-Mutator is now better integrated into custom_mutators/
392 - added INTROSPECTION support for custom modules
393 - python fuzz function was not optional, fixed
394 - some python mutator speed improvements
395 - afl-cmin/afl-cmin.bash now search first in PATH and last in AFL_PATH
396 - unicornafl synced with upstream version 1.02 (fixes, better rust bindings)
397 - renamed AFL_DEBUG_CHILD_OUTPUT to AFL_DEBUG_CHILD
398 - added AFL_CRASH_EXITCODE env variable to treat a child exitcode as crash
402 - added the GSoC excellent AFL++ grammar mutator by Shengtuo to our
403 custom_mutators/ (see custom_mutators/README.md) - or get it here:
404 https://github.com/AFLplusplus/Grammar-Mutator
405 - a few QOL changes for Apple and its outdated gmake
406 - afl-fuzz:
407 - fix for auto dictionary entries found during fuzzing to not throw out
408 a -x dictionary
409 - added total execs done to plot file
410 - AFL_MAX_DET_EXTRAS env variable added to control the amount of
412 - AFL_FORKSRV_INIT_TMOUT env variable added to control the time to wait
415 - bugfix for cmplog that results in a heap overflow based on target data
417 - write fuzzing setup into out/fuzzer_setup (environment variables and
419 - custom mutators:
420 - added afl_custom_fuzz_count/fuzz_count function to allow specifying
422 - llvm_mode:
423 - ported SanCov to LTO, and made it the default for LTO. better
425 - Further llvm 12 support (fast moving target like AFL++ :-) )
426 - deprecated LLVM SKIPSINGLEBLOCK env environment
430 - Support for improved AFL++ snapshot module:
431 https://github.com/AFLplusplus/AFL-Snapshot-LKM
432 - Due to the instrumentation needing more memory, the initial memory sizes
433 for -m have been increased
434 - afl-fuzz:
435 - added -F option to allow -M main fuzzers to sync to foreign fuzzers,
437 - added -b option to bind to a specific CPU
438 - eliminated CPU affinity race condition for -S/-M runs
439 - expanded havoc mode added, on no cycle finds add extra splicing and
441 - fixed a bug in redqueen for strings and made deterministic with -s
442 - Compiletime autodictionary fixes
443 - llvm_mode:
444 - now supports llvm 12
445 - support for AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST (previous
449 - added neverzero counting to trace-pc/pcgard
450 - fixes for laf-intel float splitting (thanks to mark-griffin for
452 - fixes for llvm 4.0
453 - skipping ctors and ifuncs for instrumentation
454 - LTO: switch default to the dynamic memory map, set AFL_LLVM_MAP_ADDR
456 - LTO: improved stability for persistent mode, no other instrumentation
458 - LTO: fixed autodict for long strings
459 - LTO: laf-intel and redqueen/cmplog are now applied at link time
461 - LTO: autodictionary mode is a fixed default now
462 - LTO: instrim instrumentation disabled, only classic support used
464 - LTO: env var AFL_LLVM_DOCUMENT_IDS=file will document which edge ID
466 - LTO: single block functions were not implemented by default, fixed
467 - LTO: AFL_LLVM_SKIP_NEVERZERO behaviour was inversed, fixed
468 - setting AFL_LLVM_LAF_SPLIT_FLOATS now activates
470 - support for -E and -shared compilation runs
471 - added honggfuzz mangle as a custom mutator in custom_mutators/honggfuzz
472 - added afl-frida gum solution to examples/afl_frida (mostly imported
474 - small fixes to afl-plot, afl-whatsup and man page creation
475 - new README, added FAQ
479 - renamed the main branch on Github to "stable"
480 - renamed master/slave to main/secondary
481 - renamed blacklist/whitelist to ignorelist/instrumentlist ->
483 - warn on deprecated environment variables
484 - afl-fuzz:
485 - -S secondary nodes now only sync from the main node to increase
486 performance, the -M main node still syncs from everyone. Added checks
488 - Add -D after -S to force a secondary to perform deterministic fuzzing
489 - If no main node is present at a sync one secondary node automatically
491 - Fixed a mayor performance issue we inherited from AFLfast
492 - switched murmur2 hashing and random() for xxh3 and xoshiro256**,
494 - Resizing the window does not crash afl-fuzz anymore
495 - Ensure that the targets are killed on exit
496 - fix/update to MOpt (thanks to arnow117)
497 - added MOpt dictionary support from repo
498 - added experimental SEEK power schedule. It is EXPLORE with ignoring
500 - llvm_mode:
501 - the default instrumentation is now PCGUARD if the llvm version is >= 7,
502 as it is faster and provides better coverage. The original afl
505 - PCGUARD mode is now even better because we made it collision free - plus
507 - some targets want a ld variant for LD that is not gcc/clang but ld,
508 added afl-ld-lto to solve this
509 - lowered minimum required llvm version to 3.4 (except LLVMInsTrim, which
511 - instrument_file list feature now supports wildcards (thanks to sirmc)
512 - small change to cmplog to make it work with current llvm 11-dev
513 - added AFL_LLVM_LAF_ALL, sets all laf-intel settings
514 - LTO instrument_files functionality rewritten, now main, _init etc functions
516 - fixed crash in compare-transform-pass when strcasecmp/strncasecmp was
518 - fixed crash in cmplog with LTO
519 - enable snapshot lkm also for persistent mode
520 - Unicornafl
521 - Added powerPC support from unicorn/next
522 - rust bindings!
523 - CMPLOG/Redqueen now also works for MMAP sharedmem
524 - ensure shmem is released on errors
525 - we moved radamsa to be a custom mutator in ./custom_mutators/. It is not
527 - allow running in /tmp (only unsafe with umask 0)
528 - persistent mode shared memory testcase handover (instead of via
529 files/stdin) - 10-100% performance increase
530 - General support for 64 bit PowerPC, RiscV, Sparc etc.
531 - fix afl-cmin.bash
532 - slightly better performance compilation options for AFL++ and targets
533 - fixed afl-gcc/afl-as that could break on fast systems reusing pids in
535 - added lots of dictionaries from oss-fuzz, go-fuzz and Jakub Wilk
536 - added former post_library examples to examples/custom_mutators/
537 - Dockerfile upgraded to Ubuntu 20.04 Focal and installing llvm 11 and
538 gcc 10 so afl-clang-lto can be build
542 - afl-fuzz:
543 - AFL_MAP_SIZE was not working correctly
544 - better python detection
545 - an old, old bug in AFL that would show negative stability in rare
547 - AFL_POST_LIBRARY was deprecated, use AFL_CUSTOM_MUTATOR_LIBRARY
549 - llvm_mode:
550 - afl-clang-fast/lto now do not skip single block functions. This
552 - if LLVM 11 is installed the posix shm_open+mmap is used and a fixed
555 - InsTrim now has an LTO version! :-) That is the best and fastest mode!
556 - fixes to LTO mode if instrumented edges > MAP_SIZE
557 - CTX and NGRAM can now be used together
558 - CTX and NGRAM are now also supported in CFG/INSTRIM mode
559 - AFL_LLVM_LAF_TRANSFORM_COMPARES could crash, fixed
560 - added AFL_LLVM_SKIP_NEVERZERO to skip the never zero coverage counter
563 - qemu_mode:
564 - add information on PIE/PIC load addresses for 32 bit
565 - better dependency checks
566 - gcc_plugin:
567 - better dependency checks
568 - unicorn_mode:
569 - validate_crash_callback can now count non-crashing inputs as crash as well
570 - better submodule handling
571 - afl-showmap: fix for -Q mode
572 - added examples/afl_network_proxy which allows to fuzz a target over the
573 network (not fuzzing tcp/ip services but running afl-fuzz on one system
575 - added examples/afl_untracer which does a binary-only fuzzing with the
577 - added examples/afl_proxy which can be easily used to fuzz and instrument
578 non-standard things
579 - all:
580 - forkserver communication now also used for error reporting
581 - fix 32 bit build options
582 - make clean now leaves qemu-3.1.1.tar.xz and the unicornafl directory
583 intact if in a git/svn checkout - unless "deepclean" is used
587 - llvm_mode LTO mode:
588 - now requires llvm11 - but compiles all targets! :)
589 - autodictionary feature added, enable with `AFL_LLVM_LTO_AUTODICTIONARY`
590 - variable map size usage
591 - afl-fuzz:
592 - variable map size support added (only LTO mode can use this)
593 - snapshot feature usage now visible in UI
594 - Now setting `-L -1` will enable MOpt in parallel to normal mutation.
596 - fix for cmplog/redqueen mode if stdin was used
597 - fix for writing a better plot_data file
598 - qemu_mode: fix for persistent mode (which would not terminate or get stuck)
599 - compare-transform/AFL_LLVM_LAF_TRANSFORM_COMPARES now transforms also
601 - extended forkserver: map_size and more information is communicated to
602 afl-fuzz (and afl-fuzz acts accordingly)
603 - new environment variable: AFL_MAP_SIZE to specify the size of the shared map
604 - if AFL_CC/AFL_CXX is set but empty AFL compilers did fail, fixed
606 - added NO_PYTHON flag to disable python support when building afl-fuzz
607 - more refactoring
612 ! the repository was moved from vanhauser-thc to AFLplusplus. It is now
614 ! development and acceptance of PRs now happen only in the dev branch
616 - all:
617 - big code changes to make afl-fuzz thread-safe so afl-fuzz can spawn
619 - AFL basic tools now report on the environment variables picked up
620 - more tools get environment variable usage info in the help output
621 - force all output to stdout (some OK/SAY/WARN messages were sent to
623 - uninstrumented mode uses an internal forkserver ("fauxserver")
624 - now builds with `-D_FORTIFY_SOURCE=2`
625 - drastically reduced number of (de)allocations during fuzzing
626 - afl-fuzz:
627 - python mutator modules and custom mutator modules now use the same
629 - AFL_AUTORESUME will resume execution without the need to specify `-i -`
630 - added experimental power schedules (-p):
631 - mmopt: ignores runtime of queue entries, gives higher weighting to
633 - rare: puts focus on queue entries that hits rare branches, also ignores
635 - llvm_mode:
636 - added SNAPSHOT feature (using https://github.com/AFLplusplus/AFL-Snapshot-LKM)
637 - added Control Flow Integrity sanitizer (AFL_USE_CFISAN)
638 - added AFL_LLVM_INSTRUMENT option to control the instrumentation type
639 easier: DEFAULT, CFG (INSTRIM), LTO, CTX, NGRAM-x (x=2-16)
640 - made USE_TRACE_PC compile obsolete
641 - LTO collision free instrumented added in llvm_mode with afl-clang-lto -
643 - Added llvm_mode NGRAM prev_loc coverage by Adrean Herrera
644 (https://github.com/adrianherrera/afl-ngram-pass/), activate by setting
645 AFL_LLVM_INSTRUMENT=NGRAM-<value> or AFL_LLVM_NGRAM_SIZE=<value>
646 - Added llvm_mode context sensitive branch coverage, activated by setting
648 - llvm_mode InsTrim mode:
649 - removed workaround for bug where paths were not instrumented and
651 - made skipping 1 block functions an option and is disabled by default,
652 set AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK=1 to re-enable this
653 - qemu_mode:
654 - qemu_mode now uses solely the internal capstone version to fix builds
656 - QEMU now logs routine arguments for CmpLog when the target is x86
657 - afl-tmin:
658 - now supports hang mode `-H` to minimize hangs
659 - fixed potential afl-tmin missbehavior for targets with multiple hangs
660 - Pressing Control-c in afl-cmin did not terminate it for some OS
661 - the custom API was rewritten and is now the same for Python and shared
667 - Important fix for memory allocation functions that result in afl-fuzz
668 not identifying crashes - UPDATE!
669 - Small fix for -E/-V to release the CPU
670 - CmpLog does not need sancov anymore
675 - use -march=native if available
676 - most tools now check for mistyped environment variables
677 - gcc 10 is now supported
678 - the memory safety checks are now disabled for a little more speed during
680 - afl-fuzz:
681 - MOpt out of bounds writing crash fixed
682 - now prints the real python version support compiled in
683 - set stronger performance compile options and little tweaks
684 - Android: prefer bigcores when selecting a CPU
685 - CmpLog forkserver
686 - Redqueen input-2-state mutator (cmp instructions only ATM)
687 - all Python 2+3 versions supported now
688 - changed execs_per_sec in fuzzer_stats from "current" execs per second
690 - bugfix for dictionary insert stage count (fix via Google repo PR)
691 - added warning if -M is used together with custom mutators with _ONLY option
692 - AFL_TMPDIR checks are now later and better explained if they fail
693 - llvm_mode
694 - InsTrim: three bug fixes:
699 - afl-clang-fast:
700 - show in the help output for which llvm version it was compiled for
701 - now does not need to be recompiled between trace-pc and pass
703 - LLVM 11 is supported
704 - CmpLog instrumentation using SanCov (see llvm_mode/README.cmplog.md)
705 - afl-gcc, afl-clang-fast, afl-gcc-fast:
706 - experimental support for undefined behaviour sanitizer UBSAN
708 - the instrumentation summary output now also lists activated sanitizers
709 - afl-as: added isatty(2) check back in
710 - added AFL_DEBUG (for upcoming merge)
711 - qemu_mode:
712 - persistent mode is now also available for arm and aarch64
713 - CmpLog instrumentation for QEMU (-c afl-fuzz command line option)
715 - AFL_PERSISTENT_HOOK callback module for persistent QEMU
717 - added qemu_mode/README.persistent.md documentation
718 - AFL_ENTRYPOINT now has instruction granularity
719 - afl-cmin is now a sh script (invoking awk) instead of bash for portability
720 the original script is still present as afl-cmin.bash
721 - afl-showmap: -i dir option now allows processing multiple inputs using the
722 forkserver. This is for enhanced speed in afl-cmin.
723 - added blacklist and instrument_filesing function check in all modules of llvm_mode
724 - added fix from Debian project to compile libdislocator and libtokencap
725 - libdislocator: AFL_ALIGNED_ALLOC to force size alignment to max_align_t
730 - fixed a critical bug in afl-tmin that was introduced during ++2.53d
731 - added test cases for afl-cmin and afl-tmin to test/test.sh
732 - added ./examples/argv_fuzzing ld_preload library by Kjell Braden
733 - added preeny's desock_dup ld_preload library as
735 - added AFL_AS_FORCE_INSTRUMENT environment variable for afl-as - this is
737 - we now set QEMU_SET_ENV from AFL_PRELOAD when qemu_mode is used
742 - qbdi_mode: fuzz android native libraries via QBDI framework
743 - unicorn_mode: switched to the new unicornafl, thanks domenukk
744 (see https://github.com/vanhauser-thc/unicorn)
745 - afl-fuzz:
746 - added radamsa as (an optional) mutator stage (-R[R])
747 - added -u command line option to not unlink the fuzz input file
748 - Python3 support (autodetect)
749 - AFL_DISABLE_TRIM env var to disable the trim stage
750 - CPU affinity support for DragonFly
751 - llvm_mode:
752 - float splitting is now configured via AFL_LLVM_LAF_SPLIT_FLOATS
753 - support for llvm 10 included now (thanks to devnexen)
754 - libtokencap:
755 - support for *BSD/OSX/Dragonfly added
756 - hook common *cmp functions from widely used libraries
757 - compcov:
758 - hook common *cmp functions from widely used libraries
759 - floating point splitting support for QEMU on x86 targets
760 - qemu_mode: AFL_QEMU_DISABLE_CACHE env to disable QEMU TranslationBlocks caching
761 - afl-analyze: added AFL_SKIP_BIN_CHECK support
762 - better random numbers for gcc_plugin and llvm_mode (thanks to devnexen)
763 - Dockerfile by courtesy of devnexen
764 - added regex.dictionary
765 - qemu and unicorn download scripts now try to download until the full
767 - more support for Android (please test!)
768 - added the few Android stuff we didnt have already from Google AFL repository
769 - removed unnecessary warnings
774 - reverted patch to not unlink and recreate the input file, it resulted in
776 - added test/test-performance.sh script
777 - (re)added gcc_plugin, fast inline instrumentation is not yet finished,
778 however it includes the instrument_filesing and persistance feature! by hexcoder-
779 - gcc_plugin tests added to testing framework
782 ### Version ++2.54d-2.57c (release):
784 - we jump to 2.57 instead of 2.55 to catch up with Google's versioning
785 - persistent mode for QEMU (see qemu_mode/README.md)
786 - custom mutator library is now an additional mutator, to exclusivly use it
788 - new library qemu_mode/unsigaction which filters sigaction events
789 - afl-fuzz: new command line option -I to execute a command on a new crash
790 - no more unlinking the input file, this way the input file can also be a
792 - setting LLVM_CONFIG for llvm_mode will now again switch to the selected
794 - fuzzing strategy yields for custom mutator were missing from the UI, added them :)
795 - added "make tests" which will perform checks to see that all functionality
797 - added mutation documentation feature ("make document"), creates afl-fuzz-document
799 - libtokencap and libdislocator now compile to the afl_root directory and are
801 - more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen)
802 - reducing duplicate code in afl-fuzz
803 - added "make help"
804 - removed compile warnings from python internal stuff
805 - added man page for afl-clang-fast[++]
806 - updated documentation
807 - Wine mode to run Win32 binaries with the QEMU instrumentation (-W)
808 - CompareCoverage for ARM target in QEMU/Unicorn
809 - laf-intel in llvm_mode now also handles floating point comparisons
814 - big code refactoring:
816 * all AFL sources are now in src/ - see src/README.md
817 * afl-fuzz was split up in various individual files for including
821 - auto-generating man pages for all (main) tools
822 - added AFL_FORCE_UI to show the UI even if the terminal is not detected
823 - llvm 9 is now supported (still needs testing)
824 - Android is now supported (thank to JoeyJiao!) - still need to modify the Makefile though
825 - fix building qemu on some Ubuntus (thanks to floyd!)
826 - custom mutator by a loaded library is now supported (thanks to kyakdan!)
827 - added PR that includes peak_rss_mb and slowest_exec_ms in the fuzzer_stats report
828 - more support for *BSD (thanks to devnexen!)
829 - fix building on *BSD (thanks to tobias.kortkamp for the patch)
830 - fix for a few features to support different map sized than 2^16
831 - afl-showmap: new option -r now shows the real values in the buckets (stock
833 - small docu updates
834 - NeverZero counters for QEMU
835 - NeverZero counters for Unicorn
836 - CompareCoverage Unicorn
837 - immediates-only instrumentation for CompareCoverage
842 - README is now README.md
843 - imported the few minor changes from the 2.53b release
844 - unicorn_mode got added - thanks to domenukk for the patch!
845 - fix llvm_mode AFL_TRACE_PC with modern llvm
846 - fix a crash in qemu_mode which also exists in stock afl
847 - added libcompcov, a laf-intel implementation for qemu! :)
849 - afl-fuzz now displays the selected core in the status screen (blue {#})
850 - updated afl-fuzz and afl-system-config for new scaling governor location
852 - using the old ineffective afl-gcc will now show a deprecation warning
853 - all queue, hang and crash files now have their discovery time in their name
854 - if llvm_mode was compiled, afl-clang/afl-clang++ will point to these
855 instead of afl-gcc
856 - added instrim, a much faster llvm_mode instrumentation at the cost of
858 - added MOpt (github.com/puppet-meteor/MOpt-AFL) mode, see docs/README.MOpt.md
859 - added code to make it more portable to other platforms than Intel Linux
860 - added never zero counters for afl-gcc and optionally (because of an
862 - added a new doc about binary only fuzzing: docs/binaryonly_fuzzing.txt
863 - more cpu power for afl-system-config
864 - added forkserver patch to afl-tmin, makes it much faster (originally from
866 - added instrument_files support for llvm_mode via AFL_LLVM_WHITELIST to allow
869 - added Python Module mutator support, python2.7-dev is autodetected.
871 - added AFL_CAL_FAST for slow applications and AFL_DEBUG_CHILD_OUTPUT for
873 - added -V time and -E execs option to better comparison runs, runs afl-fuzz
875 - added a -s seed switch to allow AFL run with a fixed initial
878 - llvm_mode LAF_... env variables can now be specified as AFL_LLVM_LAF_...
882 ### Version ++2.52c (2019-06-05):
884 - Applied community patches. See docs/PATCHES for the full list.
887 afl-fuzz: -e EXTENSION commandline option
888 llvm_mode: LAF-intel performance (needs activation, see llvm/README.laf-intel.md)
889 a few new environment variables for afl-fuzz, llvm and qemu, see docs/env_variables.md
890 - Added the power schedules of AFLfast by Marcel Boehme, but set the default
892 you use the new -p option :-) - see docs/power_schedules.md
893 - added afl-system-config script to set all system performance options for fuzzing
894 - llvm_mode works with llvm 3.9 up to including 8 !
895 - qemu_mode got upgraded from 2.1 to 3.1 - incorporated from
899 ### Version 2.52b (2017-11-04):
901 - Upgraded QEMU patches from 2.3.0 to 2.10.0. Required troubleshooting
904 - Added setsid to afl-showmap. See the notes for 2.51b.
906 - Added target mode (deferred, persistent, qemu, etc) to fuzzer_stats.
909 - afl-tmin should now save a partially minimized file when Ctrl-C
912 - Added an option for afl-analyze to dump offsets in hex. Suggested by
915 - Added support for parameters in triage_crashes.sh. Patch by Adam of
918 ### Version 2.51b (2017-08-30):
920 - Made afl-tmin call setsid to prevent glibc traceback junk from showing
923 ### Version 2.50b (2017-08-19):
925 - Fixed an interesting timing corner case spotted by Jakub Wilk.
927 - Addressed a libtokencap / pthreads incompatibility issue. Likewise, spotted
930 - Added a mention of afl-kit and Pythia.
932 - Added AFL_FAST_CAL.
934 - In-place resume now preserves .synced. Suggested by Jakub Wilk.
936 ### Version 2.49b (2017-07-18):
938 - Added AFL_TMIN_EXACT to allow path constraint for crash minimization.
940 - Added dates for releases (retroactively for all of 2017).
942 ### Version 2.48b (2017-07-17):
944 - Added AFL_ALLOW_TMP to permit some scripts to run in /tmp.
946 - Fixed cwd handling in afl-analyze (similar to the quirk in afl-tmin).
948 - Made it possible to point -o and -f to the same file in afl-tmin.
950 ### Version 2.47b (2017-07-14):
952 - Fixed cwd handling in afl-tmin. Spotted by Jakub Wilk.
954 ### Version 2.46b (2017-07-10):
956 - libdislocator now supports AFL_LD_NO_CALLOC_OVER for folks who do not
959 - Made a minor fix to libtokencap. Reported by Daniel Stender.
961 - Added a small JSON dictionary, inspired on a dictionary done by Jakub Wilk.
963 ### Version 2.45b (2017-07-04):
965 - Added strstr, strcasestr support to libtokencap. Contributed by
968 - Fixed a resumption offset glitch spotted by Jakub Wilk.
970 - There are definitely no bugs in afl-showmap -c now.
972 ### Version 2.44b (2017-06-28):
974 - Added a visual indicator of ASAN / MSAN mode when compiling. Requested
977 - Added support for afl-showmap coredumps (-c). Suggested by Jakub Wilk.
979 - Added LD_BIND_NOW=1 for afl-showmap by default. Although not really useful,
982 - Added a note about allocator_may_return_null=1 not always working with
985 ### Version 2.43b (2017-06-16):
987 - Added AFL_NO_ARITH to aid in the fuzzing of text-based formats.
990 ### Version 2.42b (2017-06-02):
992 - Renamed the R() macro to avoid a problem with llvm_mode in the latest
995 ### Version 2.41b (2017-04-12):
997 - Addressed a major user complaint related to timeout detection. Timing out
1001 ### Version 2.40b (2017-04-02):
1003 - Fixed a minor oversight in the insertion strategy for dictionary words.
1006 - Made a small improvement to the havoc block insertion strategy.
1008 - Adjusted color rules for "is it done yet?" indicators.
1010 ### Version 2.39b (2017-02-02):
1012 - Improved error reporting in afl-cmin. Suggested by floyd.
1014 - Made a minor tweak to trace-pc-guard support. Suggested by kcc.
1016 - Added a mention of afl-monitor.
1018 ### Version 2.38b (2017-01-22):
1020 - Added -mllvm -sanitizer-coverage-block-threshold=0 to trace-pc-guard
1023 ### Version 2.37b (2017-01-22):
1025 - Fixed a typo. Spotted by Jakub Wilk.
1027 - Fixed support for make install when using trace-pc. Spotted by
1030 - Switched trace-pc to trace-pc-guard, which should be considerably
1035 "vanilla" afl-clang-fast / afl-clang.
1037 ### Version 2.36b (2017-01-14):
1039 - Fixed a cosmetic bad free() bug when aborting -S sessions. Spotted
1042 - Made a small change to afl-whatsup to sort fuzzers by name.
1044 - Fixed a minor issue with malloc(0) in libdislocator. Spotted by
1047 - Changed the clobber pattern in libdislocator to a slightly more
1050 - Added a note about THP performance. Suggested by Sergey Davidoff.
1052 - Added a somewhat unofficial support for running afl-tmin with a
1057 - "Fixed" a getPassName() problem with newer versions of clang.
1065 - Fixed a minor cmdline reporting glitch, spotted by Leo Barnes.
1067 - Fixed a silly bug in libdislocator. Spotted by Johannes Schultz.
1071 - Added a note about afl-tmin to technical_details.txt.
1073 - Added support for AFL_NO_UI, as suggested by Leo Barnes.
1077 - Added code to strip -Wl,-z,defs and -Wl,--no-undefined for afl-clang-fast,
1078 since they interfere with -shared. Spotted and diagnosed by Toby Hutton.
1080 - Added some fuzzing tips for Android.
1084 - Added a check for AFL_HARDEN combined with AFL_USE_*SAN. Suggested by
1087 - Made several other cosmetic adjustments to cycle timing in the wake of the
1092 - Changed havoc cycle counts for a marked performance boost, especially
1093 with -S / -d. See the discussion of FidgetyAFL in:
1095 https://groups.google.com/forum/#!topic/afl-users/fOPeb62FZUg
1104 - Made minor improvements to persistent mode to avoid the remote
1108 - Fixed a minor glitch with a leftover process in persistent mode.
1111 - Made persistent mode bitmaps a bit more consistent and adjusted the way
1116 - Made a minor #include fix to llvm_mode. Suggested by Jonathan Metzman.
1118 - Made cosmetic updates to the docs.
1122 - Added "life pro tips" to docs/.
1124 - Moved testcases/_extras/ to dictionaries/ for visibility.
1126 - Made minor improvements to install scripts.
1128 - Added an important safety tip.
1132 - Added libtokencap, a simple feature to intercept strcmp / memcmp and
1133 generate dictionary entries that can help extend coverage.
1135 - Moved libdislocator to its own dir, added README.md.
1137 - The demo in examples/instrumented_cmp is no more.
1141 - Made a fix for libdislocator.so to compile on MacOS X.
1143 - Added support for DYLD_INSERT_LIBRARIES.
1145 - Renamed AFL_LD_PRELOAD to AFL_PRELOAD.
1149 - Made some cosmetic updates to libdislocator.so, renamed one env
1154 - Added libdislocator.so, an experimental, abusive allocator. Try
1156 afl-fuzz.
1160 - Improved the stability metric for persistent mode binaries. Problem
1163 - Made a related improvement that may bring the metric to 100% for those
1168 - Mentioned the potential conflicts between MSAN / ASAN and FORTIFY_SOURCE.
1172 - Populated the support for AFL_LD_PRELOAD to all companion tools.
1174 - Made a change to the handling of ./afl-clang-fast -v. Spotted by
1179 - Added some crash reporting notes for Solaris in docs/INSTALL, as
1182 - Fixed a minor UI mix-up with havoc strategy stats.
1186 - Revamped the handling of variable paths, replacing path count with a
1190 - Made a stability improvement to the syncing behavior with resuming
1193 - Changed the UI to include current input bitmap density along with
1196 - Added experimental support for parallelizing -M.
1200 - Made a fix to make sure that auto CPU binding happens at non-overlapping
1205 - Made several performance improvements to has_new_bits() and
1211 - Killed the error-prone and manual -Z option. On Linux, AFL will now
1215 - Made some doc updates along these lines.
1219 - Improved support for older versions of clang (hopefully without
1222 - Moved version data from Makefile to config.h. Suggested by
1227 - Added a README section on looking for non-crashing bugs.
1229 - Added license data to several boring files. Contributed by
1234 - Added FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION as a macro defined when
1235 compiling with afl-gcc and friends. Suggested by Kostya Serebryany.
1237 - Refreshed some of the non-x86 docs.
1241 - Fixed a spurious build test error with trace-pc and llvm_mode/Makefile.
1244 - Fixed a cosmetic issue with afl-whatsup. Spotted by Brandon Perry.
1248 - Fixed a minor issue in afl-tmin that can make alphabet minimization less
1253 - Fixed a minor typo in instrumented_cmp, spotted by Hanno Eissfeldt.
1255 - Added a missing size check for deterministic insertion steps.
1257 - Made an improvement to afl-gotcpu when -Z not used.
1259 - Fixed a typo in post_library_png.so.c in examples/. Spotted by Kostya
1264 - Fixed a minor core counting glitch, reported by Tyler Nighswander.
1268 - Made several documentation updates.
1270 - Added some visual indicators to promote and simplify the use of -Z.
1274 - Added explicit support for -m32 and -m64 for llvm_mode. Inspired by
1277 - Added a new benchmarking option, as requested by Kostya Serebryany.
1281 - Added CPU affinity option (-Z) on Linux. With some caution, this can
1285 - Updated afl-gotcpu to use CPU affinity where supported.
1287 - Fixed confusing CPU_TARGET error messages with QEMU build. Spotted by
1292 - Worked around LLVM persistent mode hiccups with -shared code.
1295 - Added __AFL_COMPILER as a convenient way to detect that something is
1296 built under afl-gcc / afl-clang / afl-clang-fast and enable custom
1297 optimizations in your code. Suggested by Pedro Corte-Real.
1299 - Upstreamed several minor changes developed by Franjo Ivancic to
1300 allow AFL to be built as a library. This is fairly use-specific and
1305 - Put __sanitizer_cov_module_init & co behind #ifdef to avoid problems
1310 - Removed indirect-calls coverage from -fsanitize-coverage (since it's
1315 - Added experimental -fsanitize-coverage=trace-pc support that goes with
1320 - Made several substantial improvements to better support non-standard
1323 - Switched LLVM mode to thread-local execution tracing, which may offer
1326 - Fixed a minor typo, reported by Heiko Eissfeldt.
1328 - Force-disabled symbolization for ASAN, as suggested by Christian Holler.
1330 - AFL_NOX86 renamed to AFL_NO_X86 for consistency.
1332 - Added AFL_LD_PRELOAD to allow LD_PRELOAD to be set for targets without
1333 affecting AFL itself. Suggested by Daniel Godas-Lopez.
1337 - Fixed a "lcamtuf can't count to 16" bug in the havoc stage. Reported
1342 - Made an improvement to cycle counter color coding, based on feedback
1345 - Added a mention of aflize to sister_projects.txt.
1347 - Fixed an installation issue with afl-as, as spotted by ilovezfs.
1351 - Cleaned up color handling after a minor snafu in 1.99b (affecting some
1354 - Made minor updates to the documentation.
1358 - Substantially revamped the output and the internal logic of afl-analyze.
1360 - Cleaned up some of the color handling code and added support for
1363 - Removed some stray files (oops).
1365 - Updated docs to better explain afl-analyze.
1369 - Improved to "boring string" detection in afl-analyze.
1371 - Added technical_details.txt for afl-analyze.
1375 - Added afl-analyze, a nifty tool to analyze the structure of a file
1379 - Added a mention of afl-cygwin.
1381 - Fixed a couple of typos, as reported by Jakub Wilk and others.
1385 - Added -fpic to CFLAGS for the clang plugin, as suggested by Hanno Boeck.
1387 - Made another clang change (IRBuilder) suggested by Jeff Trull.
1389 - Fixed several typos, spotted by Jakub Wilk.
1391 - Added support for AFL_SHUFFLE_QUEUE, based on discussions with
1396 - Fixed a harmless bug when handling -B. Spotted by Jacek Wielemborek.
1398 - Made the exit message a bit more accurate when AFL_EXIT_WHEN_DONE is set.
1400 - Added some error-checking for old-style forkserver syntax. Suggested by
1403 - Switched from exit() to _exit() in injected code to avoid snafus with
1406 - Made a change to avoid spuriously setting __AFL_SHM_ID when
1407 AFL_DUMB_FORKSRV is set in conjunction with -n. Spotted by Jakub Wilk.
1411 - Changed allocator alignment to improve support for non-x86 systems (now
1414 - Fixed a minor typo in afl-cmin. Spotted by Jonathan Neuschafer.
1416 - Fixed an obscure bug that would affect people trying to use afl-gcc
1421 - Hopefully fixed a problem with MacOS X and persistent mode, spotted by
1426 - Made yet another C++ fix (namespaces). Reported by Daniel Lockyer.
1430 - Made another fix to make 1.90b actually work properly with C++ (d'oh).
1435 - Fixed a minor typo spotted by Kai Zhao; and made several other minor updates
1438 - Updated the project URL for python-afl. Requested by Jakub Wilk.
1440 - Fixed a potential problem with deferred mode signatures getting optimized
1441 out by the linker (with --gc-sections).
1445 - Revamped the support for persistent and deferred forkserver modes.
1449 - Added a bit more info about afl-showmap. Suggested by Jacek Wielemborek.
1453 - Made AFL_EXIT_WHEN_DONE work in non-tty mode. Issue spotted by
1458 - Added QuickStartGuide.txt, a one-page quick start doc.
1460 - Fixed several typos spotted by Dominique Pelle.
1462 - Revamped several parts of README.
1466 - Added support for AFL_SKIP_CRASHES, which is a very hackish solution to
1469 - Removed the hard-fail terminal size check, replaced with a dynamic
1472 - Fixed a minor typo in show_stats. Spotted by Dingbao Xie.
1476 - Fixed a garbled sentence in notes on parallel fuzzing. Thanks to Jakub Wilk.
1478 - Fixed a minor glitch in afl-cmin. Spotted by Jonathan Foote.
1482 - Made SIMPLE_FILES behave as expected when naming backup directories for
1485 - Added the total number of favored paths to fuzzer_stats. Requested by
1488 - Made afl-tmin, afl-fuzz, and afl-cmin reject negative values passed to
1489 -t and -m, since they generally won't work as expected.
1491 - Made a fix for no lahf / sahf support on older versions of FreeBSD.
1496 - Fixed a problem with xargs -d on non-Linux systems in afl-cmin. Spotted by
1499 - Fixed an implicit declaration in LLVM mode on MacOS X. Reported by
1504 - Fixed a harmless but annoying race condition in persistent mode - signal
1507 - Updated the documentation to explain persistent mode a bit better.
1509 - Tweaked AFL_PERSISTENT to force AFL_NO_VAR_CHECK.
1513 - Added persistent mode for in-process fuzzing. See llvm_mode/README.llvm.
1516 - Changed the in-place resume code to preserve crashes/README.txt. Suggested
1519 - Included a potential fix for LLVM mode issues on MacOS X, based on the
1524 - Made afl-cmin tolerant of whitespaces in filenames. Suggested by
1527 - Added support for AFL_EXIT_WHEN_DONE, as suggested by Michael Rash.
1531 - Added support for dictionary levels, see testcases/README.testcases.
1533 - Reworked the SQL dictionary to use levels.
1535 - Added a note about Preeny.
1539 - Added a dictionary for PDF, contributed by Ben Nagy.
1541 - Added several references to afl-cov, a new tool by Michael Rash.
1543 - Fixed a problem with crash reporter detection on MacOS X, as reported by
1548 - Extended the -x option to support single-file dictionaries.
1550 - Replaced factory-packaged dictionaries with file-based variants.
1552 - Removed newlines from HTML keywords in testcases/_extras/html/.
1556 - Very significantly reduced the number of duplicate execs during
1558 identical path yields. This should improve early-stage efficiency by
1559 around 5-10%.
1561 - Reduced the likelihood of duplicate non-deterministic execs by
1563 that this doesn't seem to have significant impact on coverage with
1566 - Added a note about integrating afl-fuzz with third-party tools.
1570 - Improved argv_fuzzing to allow it to emit empty args. Spotted by Jakub
1573 - afl-clang-fast now defines __AFL_HAVE_MANUAL_INIT. Suggested by Jakub Wilk.
1575 - Fixed a libtool-related bug with afl-clang-fast that would make some
1578 - Removed flock() on Solaris. This means no locking on this platform,
1581 - Fixed a typo. Reported by Jakub Wilk.
1585 - Added an example argv[] fuzzing wrapper in examples/argv_fuzzing.
1588 - Clarified llvm_mode prerequisites for FreeBSD.
1590 - Improved afl-tmin to use /tmp if cwd is not writeable.
1592 - Removed redundant includes for sys/fcntl.h, which caused warnings with
1595 - Added a corpus of basic HTML tags that parsers are likely to pay attention
1598 - Added EP_EnabledOnOptLevel0 to llvm_mode, so that the instrumentation is
1601 - Switched qemu_mode to use the newly-released QEMU 2.3.0, which contains
1606 - Fixed a pretty stupid bug in effector maps that could sometimes cause
1613 - Fixed a glitch in non-x86 install, spotted by Tobias Ospelt.
1615 - Added a minor safeguard to llvm_mode Makefile following a report from
1620 - Fixed a bug with installed copies of AFL trying to use QEMU mode. Spotted
1623 - Added last find / crash / hang times to fuzzer_stats, suggested by
1626 - Fixed a typo, thanks to Jakub Wilk.
1630 - Modified resumption code to reuse the original timeout value when resuming
1631 a session if -t is not given. This prevents timeout creep in continuous
1634 - Added improved error messages for failed handshake when AFL_DEFER_FORKSRV
1637 - Made a slight improvement to llvm_mode/Makefile based on feedback from
1640 - Refreshed several bits of documentation.
1642 - Added a more prominent note about the MacOS X trade-offs to Makefile.
1646 - Added support for deferred initialization in LLVM mode. Suggested by
1651 - Fixed a minor PRNG glitch that would make the first seconds of a fuzzing
1654 - Made tmp[] static in the LLVM runtime to keep Valgrind happy (this had
1657 - Clarified the footnote in README.
1661 - Made one more correction to llvm_mode Makefile, spotted by Jakub Wilk.
1665 - Added CC / CXX support to llvm_mode Makefile. Requested by Charlie Eriksen.
1667 - Fixed 'make clean' with gmake. Suggested by Oliver Schneider.
1669 - Fixed 'make -j n clean all'. Suggested by Oliver Schneider.
1671 - Removed build date and time from banners to give people deterministic
1676 - Fixed a snafu with some leftover code in afl-clang-fast.
1678 - Corrected even moar typos.
1682 - Further simplified afl-clang-fast runtime by reverting .init_array to
1684 non-ELF platforms.
1686 - Fixed a problem with afl-clang-fast and -shared libraries. Simplified
1690 - Removed unnecessary instrumentation density adjustment for the LLVM mode.
1695 - Updated cgroups_asan/ with a new version from Sam, made a couple changes
1698 - Fixed typos, thanks to Jakub Wilk.
1702 - Improved the handling of -x in afl-clang-fast,
1704 - Improved the handling of low AFL_INST_RATIO settings for QEMU and
1707 - Fixed the llvm-config bug for good (thanks to Tobias Ospelt).
1711 - Fixed an obscure bug compiling OpenSSL with afl-clang-fast. Patch by
1714 - Fixed a 'make install' bug on non-x86 systems, thanks to Tobias Ospelt.
1716 - Fixed a problem with half-broken llvm-config on Odroid, thanks to
1718 fixed - TBD).
1722 - Allowed examples/llvm_instrumentation/ to graduate to llvm_mode/.
1724 - Removed examples/arm_support/, since it's completely broken and likely
1727 - Added ASAN cgroups script to examples/asan_cgroups/, updated existing
1730 - Refactored afl-tmin to reduce the number of execs in common use cases.
1733 - Added a note about CLAs at the bottom of README.
1735 - Renamed testcases_readme.txt to README.testcases for some semblance of
1738 - Made assorted updates to docs.
1740 - Added MEM_BARRIER() to afl-showmap and afl-tmin, just to be safe.
1744 - Imported Laszlo Szekeres' experimental LLVM instrumentation into
1748 - Fixed another typo, thanks to Jakub Wilk.
1752 - Added a workaround for abort() behavior in -lpthread programs in QEMU mode.
1755 - Made several documentation updates, including links to the static
1760 - Fixed a problem with exception handling on some versions of MacOS X.
1763 - Tweaked afl-gcc to use BIN_PATH instead of a fixed string in help
1768 - Renamed related_work.txt to historical_notes.txt.
1770 - Made minor edits to the ASAN doc.
1772 - Added docs/sister_projects.txt with a list of inspired or closely
1777 - Fixed a glitch with afl-showmap opening /dev/null with O_RDONLY when
1782 - Added another postprocessor example for PNG.
1784 - Made a cosmetic fix to realloc() handling in examples/post_library/,
1787 - Improved -ldl handling. Suggested by Jakub Wilk.
1791 - Fixed an -l ordering issue that is apparently still a problem on Ubuntu.
1796 - Added support for file format postprocessors. Requested by Ben Nagy. This
1802 - Made it possible to properly override LD_BIND_NOW after one very unusual
1805 - Cleaned up typos, thanks to Jakub Wilk.
1807 - Fixed a bug in AFL_DUMB_FORKSRV.
1811 - Fixed a flock() bug that would prevent dir reuse errors from kicking
1814 - Renamed references to ppvm (the project is now called recidivm).
1816 - Made improvements to file descriptor handling to avoid leaving some fds
1819 - Fixed a typo or two.
1823 - Added code to save original command line in fuzzer_stats and
1829 - Fixed a bug with QEMU fork server crashes when translation is attempted
1836 - Fixed a bug with afl-cmin in -Q mode complaining about binary being not
1839 - Fixed another bug with argv handling for afl-fuzz in -Q mode. Reported
1842 - Improved the use of colors when showing crash counts in -C mode.
1846 - Improved instrumentation performance on 32-bit systems by getting rid of
1847 xor-swap (oddly enough, xor-swap is still faster on 64-bit) and tweaking
1850 - Made path depth numbers more accurate with imported test cases.
1854 - Added support for SIMPLE_FILES in config.h for folks who don't like
1858 - Replaced zero-sized files with symlinks in the variable behavior state
1861 - Changed the period of limited-range block ops from 5 to 10 minutes based
1865 without discovering new paths. Should have no effect on well-seeded jobs.
1867 - Made several minor updates to docs.
1871 - Corrected two bungled attempts to get the -C mode work properly
1872 with afl-cmin (accounting for the short-lived releases tagged 1.42 and
1873 1.43b) - sorry.
1875 - Removed AFL_ALLOW_CRASHES in favor of the -C mode in said tool.
1877 - Said goodbye to Hello Kitty, as requested by Padraig Brady.
1881 - Added AFL_ALLOW_CRASHES=1 to afl-cmin. Allows crashing inputs in the
1884 - Made the afl-cmin output dir default to 0700, not 0755, to be consistent
1885 with afl-fuzz; documented the rationale for 0755 in afl-plot.
1887 - Lowered the output dir reuse time limit to 25 minutes as a dice-roll
1888 compromise after a discussion on afl-users@.
1890 - Made afl-showmap accept -o /dev/null without borking out.
1892 - Added support for crash / hang info in exit codes of afl-showmap.
1894 - Tweaked block operation scaling to also factor in ballpark run time
1897 - Fixed typos and made improvements to several docs.
1901 - Switched to smaller block op sizes during the first passes over the
1904 - Added memory barrier for run_target(), just in case compilers get
1907 - Updated a bunch of docs.
1911 - Added the ability to skip inputs by sending SIGUSR1 to the fuzzer.
1913 - Reworked several portions of the documentation.
1915 - Changed the code to reset splicing perf scores between runs to keep
1918 - Reduced the minimum value of -t to 5 for afl-fuzz (~200 exec/sec)
1921 - Switched to more aggressive default timeouts (rounded up to 25 ms
1922 versus 50 ms - ~40 execs/sec) and made several other cosmetic changes
1927 - Fixed a bug in the QEMU build script, spotted by William Robinet.
1929 - Improved the reporting of skipped bitflips to keep the UI counters a bit
1932 - Cleaned up related_work.txt and added some non-goals.
1934 - Fixed typos, thanks to Jakub Wilk.
1938 - Added effector maps, which detect regions that do not seem to respond
1941 improvements with quite a few types of text-based formats, reducing the
1944 - Cleaned up mem limit handling in afl-cmin.
1946 - Switched from uname -i to uname -m to work around Gentoo-specific
1949 - Switched from PID checking to flock() to detect running sessions.
1952 - Added SKIP_COUNTS and changed the behavior of COVERAGE_ONLY in config.h.
1955 - Made improvements to UI refresh rates and exec/sec stats to make them
1958 - Made assorted improvements to the documentation and to the QEMU build
1961 - Switched from perror() to strerror() in error macros, thanks to Jakub
1964 - Moved afl-cmin back to bash, wasn't thinking straight. It has to stay
1969 - Switched afl-cmin over to /bin/sh. Thanks to Jonathan Gray.
1971 - Fixed an off-by-one bug in queue limit check when resuming sessions
1974 - Fixed the QEMU script to tolerate i686 if returned by uname -i. Based on
1977 - Added multiple references to Jakub's ppvm tool.
1979 - Made several minor improvements to the Makefile.
1981 - Believe it or not, fixed some typos. Thanks to Jakub Wilk.
1985 - Cleaned up regular expressions in some of the scripts to avoid errors
1990 - Performed a substantial documentation and program output cleanup to
1995 - Added support for AFL_INST_RATIO and AFL_INST_LIBS in the QEMU mode.
1997 - Fixed a stack allocation crash in QEMU mode (bug in QEMU, fixed with
2000 - Added code to test the QEMU instrumentation once the afl-qemu-trace
2003 - Modified afl-tmin and afl-showmap to search $PATH for binaries and to
2006 - Added a check for instrumented binaries when passing -Q to afl-fuzz.
2010 - Fixed 'make install' following the QEMU changes. Spotted by Hanno Boeck.
2012 - Fixed EXTRA_PAR handling in afl-cmin.
2016 - Hallelujah! Thanks to Andrew Griffiths, we now support very fast, black-box
2017 instrumentation of binary-only code. See qemu_mode/README.qemu.
2020 directory and then run afl-fuzz with -Q.
2024 - Added -s (summary) option to afl-whatsup. Suggested by Jodie Cunningham.
2026 - Added a sanity check in afl-tmin to detect minimization to zero len or
2029 - Fixed alphabet size counter in afl-tmin.
2031 - Slightly improved the handling of -B in afl-fuzz.
2033 - Fixed process crash messages with -m none.
2037 - Improved the naming of test cases when orig: is already present in the file
2040 - Made substantial improvements to technical_details.txt.
2044 - Made a minor tweak to the instrumentation to preserve the directionality
2045 of tuples (i.e., A -> B != B -> A) and to maintain the identity of tight
2046 loops (A -> A). You need to recompile targeted binaries to leverage this.
2048 - Cleaned up some of the afl-whatsup stats.
2050 - Added several sanity checks to afl-cmin.
2054 - Made afl-tmin recursive. Thanks to Hanno Boeck for the tip.
2056 - Added docs/technical_details.txt.
2058 - Changed afl-showmap search strategy in afl-cmap to just look into the
2059 same place that afl-cmin is executed from. Thanks to Jakub Wilk.
2061 - Removed current_todo.txt and cleaned up the remaining docs.
2065 - Added total execs/sec stat for afl-whatsup.
2067 - afl-cmin now auto-selects between cp or ln. Based on feedback from
2070 - Fixed a typo. Thanks to Jakub Wilk.
2072 - Made afl-gotcpu a bit more accurate by using getrusage instead of
2075 - Fixed a memory limit issue during the build process on NetBSD-current.
2080 - Introduced afl-whatsup, a simple tool for querying the status of
2081 local synced instances of afl-fuzz.
2083 - Added -x compiler to clang options on Darwin. Suggested by Filipe
2086 - Improved exit codes for afl-gotcpu.
2088 - Improved the checks for -m and -t values in afl-cmin. Bug report
2093 - Introduced afl-getcpu, an experimental tool to empirically measure
2098 - Reverted one change to afl-cmin that actually made it slower.
2102 - Reworked afl-showmap.c to support normal options, including -o, -q,
2103 -e. Also added support for timeouts and memory limits.
2105 - Made changes to afl-cmin and other scripts to accommodate the new
2108 - Officially retired AFL_EDGES_ONLY.
2110 - Fixed another typo in afl-tmin, courtesy of Jakub Wilk.
2114 - Graduated minimize_corpus.sh to afl-cmin. It is now a first-class
2117 - Made significant improvements to afl-cmin to make it faster, more
2120 - Refactored some of afl-tmin code to make it a bit more readable.
2122 - Made assorted changes to the doc to document afl-cmin and other stuff.
2126 - Added AFL_DUMB_FORKSRV, as requested by Jakub Wilk. This works only
2127 in -n mode and allows afl-fuzz to run with "dummy" fork servers that
2130 - Renamed AFL_SKIP_CHECKS to AFL_SKIP_BIN_CHECK to make it at least
2133 - Switched to using clang as the default assembler on MacOS X to work
2137 - Fixed a typo (via Jakub Wilk).
2141 - Improved exec failure detection in afl-fuzz and afl-showmap.
2143 - Improved Ctrl-C handling in afl-showmap.
2145 - Added afl-tmin, a handy instrumentation-enabled minimizer.
2149 - Fixed a serious but short-lived bug in the resumption behavior introduced
2152 - Added -t nn+ mode for soft-skipping timing-out paths.
2156 - Fixed a compiler warning introduced in 1.16b for newer versions of GCC.
2159 - Improved the consistency of saving fuzzer_stats, bitmap info, and
2160 auto-dictionaries when aborting fuzzing sessions.
2162 - Made several noticeable performance improvements to deterministic arith
2167 - Added a bit of code to make resumption pick up from the last known
2171 - Switched to tighter timeout control for slow programs (3x rather than
2176 - Added support for AFL_NO_VAR_CHECK to speed up resumption and inhibit
2179 - Made the trimmer run even for variable paths, since there is no special
2183 - Made the UI a bit more descriptive by adding "n/a" instead of "0" in a
2188 - Added a (partial) dictionary for JavaScript.
2190 - Added AFL_NO_CPU_RED, as suggested by Jakub Wilk.
2192 - Tweaked the havoc scaling logic added in 1.12b.
2196 - Improved the performance of minimize_corpus.sh by switching to a
2197 sort-based approach.
2199 - Made several minor revisions to the docs.
2203 - Made an improvement to dictionary generation to avoid runs of identical
2206 - Added havoc cycle scaling to help with slow binaries in -d mode. Based on
2209 - Added AFL_SYNC_FIRST for afl-fuzz. This is useful for those who obsess
2212 - Switched to more robust box drawing codes, suggested by Jakub Wilk.
2214 - Created faster 64-bit variants of several critical-path bitmap functions
2217 - Fixed moar typos, as reported by Jakub Wilk.
2221 - Added a bit more info about dictionary strategies to the status screen.
2225 - Revised the dictionary behavior to use insertion and overwrite in
2226 deterministic steps, rather than just the latter. This improves coverage
2229 - Added a mention of "*" in status_screen.txt, as suggested by Jakub Wilk.
2233 - Corrected a cosmetic problem with 'extras' stage count not always being
2236 - Fixed a typo reported by Jakub Wilk and made some minor documentation
2241 - Fixed a div-by-zero bug in the newly-added code when using a dictionary.
2245 - Added code that automatically finds and extracts syntax tokens from the
2248 - Fixed a problem with ld dead-code removal option on MacOS X, reported
2251 - Corrected minor typos spotted by Jakub Wilk.
2253 - Added a couple of more exotic archive format samples.
2257 - Switched to slightly more accurate (if still not very helpful) reporting
2262 - Revamped some of the allocator and debug code, adding comments and
2265 - Tweaked the odds of fuzzing non-favored test cases to make sure that
2266 baseline coverage of all inputs is reached sooner.
2270 - Added a dictionary for WebP.
2272 - Made some additional performance improvements to minimize_corpus.sh,
2277 - Made substantial performance improvements to minimize_corpus.sh with
2281 - Tweaked afl-showmap to support the format used by the new script.
2285 - Added code to skip README.txt in the input directory to make the crash
2288 - Added a dictionary for SQLite.
2292 - Reverted the ./ search path in minimize_corpus.sh because people did
2295 - Added very explicit warnings not to run various shell scripts that
2297 multi-user systems).
2299 - Added a check for /tmp binaries and -f locations in afl-fuzz.
2303 - Added dictionaries for XML and GIF.
2307 - Slightly improved the performance of minimize_corpus.sh, especially on
2310 - Made a couple of improvements to calibration timeouts for resumed scans.
2314 - Fixed minimize_corpus.sh to work with dash, as suggested by Jakub Wilk.
2316 - Modified minimize_corpus.sh to try locate afl-showmap in $PATH and ./.
2319 - Added support for afl-as --version, as required by one funky build
2324 - Added a dictionary for TIFF.
2326 - Fixed another cosmetic snafu with stage exec counts for -x.
2328 - Switched afl-plot to /bin/sh, since it seems bashism-free. Also tried
2335 - Fixed cosmetic issues around the naming of -x strategy files.
2337 - Added a dictionary for JPEG.
2339 - Fixed a very rare glitch when running instrumenting 64-bit code that makes
2344 - Added support for extra dictionaries, provided testcases/_extras/png/
2347 - Fixed a minor bug in number formatting routines used by the UI.
2349 - Added several additional PNG test cases that are relatively unlikely
2352 - Fixed afl-plot syntax for gnuplot 5.x. Reported by David Necas.
2356 - Cleaned up the OSX ReportCrash code. Thanks to Tobias Ospelt for help.
2358 - Added some extra tips for AFL_NO_FORKSERVER on OSX.
2360 - Refreshed the INSTALL file.
2364 - Added in-place resume (-i-) to address a common user complaint.
2366 - Added an awful workaround for ReportCrash on MacOS X. Problem
2371 - Fixed the link() workaround, as reported by Jakub Wilk.
2375 - Added support for reading test cases from another filesystem.
2378 - Added pointers to the mailing list.
2380 - Added a sample PDF document.
2384 - Refactored minimize_corpus.sh to make it a bit more user-friendly and to
2388 - Slightly improved the performance of splicing code.
2392 - Moved to an algorithm where paths are marked as preferred primarily based
2393 on size and speed, rather than bitmap coverage. This should offer
2396 - Refactored path calibration code; calibration now takes place as soon as a
2400 - Changed the way of marking variable paths to avoid .state metadata
2403 - Made sure that calibration routines always create a new test case to avoid
2406 - Added bitmap saturation to fuzzer stats and plot data.
2408 - Added a testcase for JPEG XR.
2410 - Added a tty check for the colors warning in Makefile, to keep distro build
2415 - Renamed afl-plot.sh to afl-plot, as requested by Padraig Brady.
2417 - Improved the compatibility of afl-plot with older versions of gnuplot.
2419 - Added banner information to fuzzer_stats, populated it to afl-plot.
2423 - Added support for plotting, with design and implementation based on a
2426 - Added afl-plot.sh, which allows you to, well, generate a nice plot using
2429 - Refactored the code slightly to make more frequent updates to fuzzer_stats
2432 - Added an fflush(stdout) call for non-tty operation, as requested by
2435 - Added some detail to fuzzer_stats for parity with plot_file.
2439 - Added support for MSAN, via AFL_USE_MSAN, same gotchas as for ASAN.
2443 - Added AFL_NO_FORKSRV, allowing the forkserver to be bypassed. Suggested
2446 - Simplified afl-showmap.c to make use of the no-forkserver mode.
2448 - Made minor improvements to crash_triage.sh, as suggested by Jakub Wilk.
2452 - Fixed the CPU counting code - no sysctlbyname() on OpenBSD, d'oh. Bug
2455 - Made a slight correction to error messages - the advice on testing
2460 - Added support for the CPU widget on some non-Linux platforms (I hope).
2463 - Cleaned up the changelog (very meta).
2467 - Added examples/clang_asm_normalize/ and related notes in
2468 env_variables.txt and afl-as.c. Thanks to Ryan Govostes for the idea.
2470 - Added advice on hardware utilization in README.
2474 - Made additional fixes for Xcode support, juggling -Q and -q flags. Thanks to
2477 - Added a check for __asm__ blocks and switches to .intel_syntax in assembly.
2482 - A workaround for Xcode 6 as -Q flag glitch. Spotted by Ryan Govostes.
2484 - Improved Solaris build instructions, as suggested by Martin Carpenter.
2486 - Fix for a slightly busted path scoring conditional. Minor practical impact.
2490 - Added a check for $PATH-induced loops. Problem noticed by Kartik Agaram.
2492 - Added AFL_KEEP_ASSEMBLY for easier troubleshooting.
2494 - Added an override for AFL_USE_ASAN if set at AFL compile time. Requested by
2499 - Made minor adjustments to path skipping logic.
2501 - Made several documentation updates to reflect the path selection changes
2506 - Added a CPU governor check. Bug report from Joe Zbiciak.
2508 - Favored paths are now selected strictly based on new edges, not hit
2509 counts. This speeds up the first pass by a factor of 3-6x without
2510 significantly impacting ultimate coverage (tested with libgif, libpng,
2514 some of the in-memory bitmaps much smaller.
2516 - Made multiple significant performance improvements to bitmap checking
2519 - Owing largely to these optimizations, bumped the size of the bitmap to
2525 - Added AFL_SKIP_CHECKS to bypass binary checks when really warranted.
2528 - Fixed a couple of typos.
2530 - Added a warning for runs that are aborted early on.
2534 - Incorporated another signal handling fix for Solaris. Suggestion
2539 - Implemented a slightly more "elegant" kludge for the %llu glitch (see
2542 - Relaxed CPU load warnings to stay in sync with reality.
2546 - Switched to more responsive exec speed averages and better UI speed
2549 - Fixed a bug with interrupted reads on Solaris. Issue spotted by Martin
2554 - Fixed a stray memcpy() instead of memmove() on overlapping buffers.
2559 - Bumped map size up to 32k. You may want to recompile instrumented
2562 - Made huge performance improvements for bit-counting functions.
2564 - Default optimizations now include -funroll-loops. This should have
2568 - Made a fix for stack alignment crash on MacOS X 10.10; looks like the
2569 rhetorical question in the comments in afl-as.h has been answered.
2574 - Added a fix for the nonsensical MacOS ELF check. Spotted by Mudge Zatko.
2576 - Made some improvements to ASAN checks.
2580 - Added explicit detection of ASANified binaries.
2582 - Fixed compilation issues on Solaris. Reported by Martin Carpenter.
2586 - Improved the detection of non-instrumented binaries.
2588 - Made the crash counter in -C mode accurate.
2590 - Fixed an obscure install bug that made afl-as non-functional with the tool
2593 - Fixed for a cosmetic SIGFPE when Ctrl-C is pressed while the fork server
2598 - Added crash exploration mode! Woot!
2602 - Fixed several more typos, the project is now cartified 100% typo-free.
2605 - Made a change to write fuzzer_stats early on.
2607 - Fixed a glitch when (not!) running on MacOS X as root. Spotted by Tobias
2610 - Made it possible to override -O3 in Makefile. Suggested by Jakub Wilk.
2614 - Fixed a very obscure issue with build systems that use gcc as an assembler
2615 for hand-written .s files; this would confuse afl-as. Affected nss, reported
2618 - Fixed a bug when cleaning up synchronized fuzzer output dirs. Issue reported
2623 - Cleaned up shell printf escape codes in Makefile. Reported by Jakub Wilk.
2625 - Added more color to fuzzer_stats, provided short documentation of the file
2626 format, and made several other stats-related improvements.
2630 - Enabled GCC support on MacOS X.
2634 - Provided a new, simplified way to pass data in files (@@). See README.
2636 - Made additional fixes for 64-bit MacOS X, working around a crashing bug in
2639 - Added a minor workaround for a bug in 64-bit FreeBSD (clang -m32 -g doesn't
2640 work on that platform, but clang -m32 does, so we no longer insert -g).
2642 - Added a build-time warning for inverse video terminals and better
2647 - Made minor improvements to the allocator, as suggested by Tobias Ospelt.
2649 - Added example instrumented memcmp() in examples/instrumented_cmp.
2651 - Added a speculative fix for MacOS X (clang detection, again).
2653 - Fixed typos in parallel_fuzzing.txt. Problems spotted by Thomas Jarosch.
2657 - Fixed a minor issue with clang detection on systems with a clang cc
2658 wrapper, so that afl-gcc doesn't confuse it with GCC.
2660 - Made cosmetic improvements to docs and to the CPU load indicator.
2662 - Fixed a glitch with crash removal (README.txt left behind, d'oh).
2666 - Fixed problems with jump tables generated by exotic versions of GCC. This
2667 solves an outstanding problem on OpenBSD when using afl-gcc + PIE (not
2668 present with afl-clang).
2670 - Fixed permissions on one of the sample archives.
2672 - Added a lahf / sahf workaround for OpenBSD (their assembler doesn't know
2675 - Added docs/INSTALL.
2679 - Modified 'make install' to also install test cases.
2681 - Provided better pointers to installed README in afl-fuzz.
2683 - More work on RLIMIT_AS for OpenBSD.
2687 - Added a core count check on Linux.
2689 - Refined the code for the lack-of-RLIMIT_AS case on OpenBSD.
2691 - Added a rudimentary CPU utilization meter to help with optimal loading.
2695 - Made fixes to support FreeBSD and OpenBSD: use_64bit is now inferred if not
2696 explicitly specified when calling afl-as, and RLIMIT_AS is behind an #ifdef.
2699 - Modified 'make install' to also install docs (in /usr/local/share/doc/afl).
2701 - Fixed a typo in status_screen.txt.
2703 - Made a couple of Makefile improvements as proposed by Jakub Wilk.
2707 - Added probabilistic instrumentation density reduction in ASAN mode. This
2708 compensates for ASAN-specific branches in a crude but workable way.
2710 - Updated notes_for_asan.txt.
2714 - Implemented smarter out_dir behavior, automatically deleting directories
2718 - Added more detail in fuzzer_stats (start time, run time, fuzzer PID).
2720 - Implemented support for configurable install prefixes in Makefile
2723 - Made it possible to resume by doing -i <out_dir>, without having to specify
2724 -i <out_dir>/queue/.
2728 - Added a fix for -Wformat warning messages (oops, I thought this had been in
2733 - Redesigned the crash & hang duplicate detection code to better deal with
2736 The old approach could be compared to hashing stack traces to de-dupe
2741 The middle ground currently used in afl-fuzz can be compared to looking
2749 - Added a fix for harmless but absurd trim ratios shown if the first exec in
2754 - Added a quick summary of the contents in examples/.
2756 - Made a fix to the process of writing fuzzer_stats.
2758 - Slightly reorganized the .state/ directory, now recording redundant paths,
2760 - sorry about that.
2767 - Changed the search order for afl-as to avoid the problem with older copies
2768 installed system-wide; this also means that I can remove the Makefile check
2771 - Made it possible to set instrumentation ratio of 0%.
2773 - Introduced some typos, fixed others.
2775 - Fixed the test_prev target in Makefile, as reported by Ozzy Johnson.
2779 - Improved the 'make install' logic, as suggested by Padraig Brady.
2781 - Revamped various bits of the documentation, especially around perf_tips.txt;
2784 - Added AFL_INST_RATIO to afl-as. The only case where this comes handy is
2786 ffmpeg ./configure also ignores CC and --cc, probably unintentionally).
2788 - Added documentation for all environmental variables (env_variables.txt).
2790 - Implemented a visual warning for excessive or insufficient bitmap density.
2792 - Changed afl-gcc to add -O3 by default; use AFL_DONT_OPTIMIZE if you don't
2795 - Made a regression fix to afl-as to ignore .LBB labels in gcc mode.
2799 - Fixed more typos, as found by Jakub Wilk.
2801 - Added support for clang!
2803 - Changed AFL_HARDEN to *not* include ASAN by default. Use AFL_USE_ASAN if
2806 - Switched from configure auto-detection to isatty() to keep afl-as and
2807 afl-gcc quiet.
2809 - Improved installation process to properly create symlinks, rather than
2814 - Improved afl-fuzz to force-set ASAN_OPTIONS=abort_on_error=1. Otherwise,
2817 - Improved Makefile mkdir logic, as suggested by Hanno Boeck.
2819 - Improved the 64-bit instrumentation to properly save r8-r11 registers in
2822 .o file has 5+ parameters. No impact on code running under afl-fuzz or
2823 afl-showmap. Issue spotted by Padraig Brady.
2827 - Fixed another Makefile bug for parallel builds of afl. Problem identified
2830 - Added support for suffixes for -m.
2832 - Updated the documentation and added notes_for_asan.txt. Based on feedback
2835 - Moved the project to https://lcamtuf.coredump.cx/afl/.
2839 - Cleaned up Makefile dependencies for parallel builds. Requested by
2842 - Added support for DESTDIR in Makefile. Once again suggested by
2843 Richard W. M. Jones :-)
2845 - Removed all the USE_64BIT stuff; we now just auto-detect compilation mode.
2848 - Fixed rare problems with programs that use snippets of assembly and
2854 - Implemented a test case trimmer. Results in 20-30% size reduction for many
2858 - Added better warnings for various problems with input directories.
2860 - Added a Makefile warning for older copies, based on counterintuitive
2863 - Added fuzzer_stats file for status monitoring. Suggested by @dronesec.
2865 - Fixed moar typos, thanks to Alexander Cherepanov.
2867 - Implemented better warnings for ASAN memory requirements, based on calls
2870 - Switched to saner behavior with non-tty stdout (less output generated,
2875 - Added support for AFL_CC and AFL_CXX, based on a patch from Ben Laurie.
2877 - Replaced afl-fuzz -S -D with -M for simplicity.
2879 - Added a check for .section .text; lack of this prevented main() from
2882 - Reorganized the testcases/ directory.
2884 - Added an extra check to confirm that the build is operational.
2886 - Made more consistent use of color reset codes, as suggested by Oliver
2891 - Fixed a bug with 64-bit gcc -shared relocs.
2893 - Removed echo -e from Makefile for compatibility with dash. Suggested
2896 - Added status_screen.txt.
2898 - Added examples/canvas_harness.
2900 - Made a minor change to the Makefile GCC check. Suggested by Hanno Boeck.
2904 - Fixed a bug with red zone handling for 64-bit (oops!). Problem reported by
2907 - Implemented horribly experimental ARM support in examples/arm_support.
2909 - Made several improvements to error messages.
2911 - Added AFL_QUIET to silence afl-gcc and afl-as when using wonky build
2914 - Improved check for 64-bit compilation, plus several sanity checks
2919 - Fixed a fork served bug for processes that call execve().
2921 - Made minor compatibility fixes to Makefile, afl-gcc; suggested by Jakub
2924 - Fixed triage_crashes.sh to work with the new layout of output directories.
2927 - Made multiple performance-related improvements to the injected
2930 - Added visual indication of the number of imported paths.
2932 - Fixed afl-showmap to make it work well with new instrumentation.
2934 - Added much better error messages for crashes when importing test cases
2939 - Added support for parallelized fuzzing. Inspired by earlier patch
2942 - Added an example in examples/distributed_fuzzing/.
2946 - Redesigned status screen, now 90% more spiffy.
2948 - Added more verbose and user-friendly messages for some common problems.
2950 - Modified the resumption code to reconstruct path depth.
2952 - Changed the code to inhibit core dumps and improve the ability to detect
2955 - Added a check for redirection of core dumps to programs.
2957 - Made a minor improvement to the handling of variable paths.
2959 - Made additional performance tweaks to afl-fuzz, chiefly around mem limits.
2961 - Added performance_tips.txt.
2965 - Fixed an fd leak and +cov tracking bug resulting from changes in 0.37b.
2967 - Implemented auto-scaling for screen update speed.
2969 - Added a visual indication when running in non-instrumented mode.
2973 - Added fuzz state tracking for more seamless resumption of aborted
2976 - Removed the -D option, as it's no longer necessary.
2978 - Refactored calibration code and improved startup reporting.
2980 - Implemented dynamically scaled timeouts, so that you don't need to
2981 play with -t except in some very rare cases.
2983 - Added visual notification for slow binaries.
2985 - Improved instrumentation to explicitly cover the other leg of every
2986 branch.
2990 - Implemented fork server support to avoid the overhead of execve(). A
2991 nearly-verbatim design from Jann Horn; still pending part 2 that would
2994 - Added a check for shell scripts used as fuzz targets.
2996 - Added a check for fuzz jobs that don't seem to be finding anything.
2998 - Fixed the way IGNORE_FINDS works (was a bit broken after adding splicing
3003 - Properly integrated 64-bit instrumentation into afl-as.
3007 - Added a new exec count classifier (the working theory is that it gets
3008 meaningful coverage with fewer test cases spewed out).
3012 - Switched to new, somewhat experimental instrumentation that tries to
3016 - Made several other cosmetic fixes and typo corrections, thanks to
3021 - Another take at fixing the C++ exception thing. Reported by Jakub Wilk.
3025 - Made another fix to afl-as to address a potential problem with newer
3030 - Added more detail about the underlying operations in file names.
3034 - Made some general improvements to chunk operations.
3038 - Fixed C++ exception handling in newer versions of GCC. Problem diagnosed
3041 - Fixed the handling of the overflow flag. Once again, thanks to
3046 - Added prioritization of new paths over the already-fuzzed ones.
3048 - Included spliced test case ID in the output file name.
3050 - Fixed a rare, cosmetic null ptr deref after Ctrl-C.
3052 - Refactored the code to make copies of test cases in the output directory.
3054 - Switched to better output file names, keeping track of stage and splicing
3059 - Revamped storage of testcases, -u option removed,
3061 - Added a built-in effort minimizer to get rid of potentially redundant
3064 - Provided a testcase count minimization script in examples/,
3066 - Made miscellaneous improvements to directory and file handling.
3068 - Fixed a bug in timeout detection.
3072 - Improved count-based instrumentation.
3074 - Improved the hang deduplication logic.
3076 - Added -cov prefixes for test cases.
3078 - Switched from readdir() to scandir() + alphasort() to preserve ordering of
3081 - Added a splicing strategy.
3083 - Made various minor UI improvements and several other bugfixes.
3087 - Added program name to the status screen, plus the -T parameter to go with
3092 - Improved the detection of variable behaviors.
3094 - Added path depth tracking,
3096 - Improved the UI a bit,
3098 - Switched to simplified (XOR-based) tuple instrumentation.
3102 - Refactored the handling of long bitflips and some swaps.
3104 - Fixed the handling of gcc -pipe, thanks to anonymous reporter.
3106 ### Version 0.21b (2013-11-12):
3108 - Initial public release.
3110 - Added support for use of multiple custom mutators which can be specified using