v5.02c

Version ++5.02c (release)

!!! You need to recompile persistent mode/LLVMFuzzerTestOneInput target !!!

• afl-health:
  • new tool: AFL++ campaign health tool checker, much more advanced than
    afl-whatsup, with tips, analysis and ssh support
• afl-fuzz:
  • Futex implementation missed the clean-up of the shmem
  • Futex shmem now lives in general shared memory map as by default only
    32 such regions are supported in MacOS
• afl-cc:
  • new C11 mode (AFL_LLVM_C11 at compile time): afl-cc records each
    function's local variable count and afl-fuzz uses it as an extra queue
    scheduling signal to favor more complex code paths. Noticably improvement,
    based on the paper https://mlsec.org/docs/2026-icse.pdf
  • if -fsanitize-coverage-allowlist=/-fsanitize-coverage-ignorelist= is
    passed without AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST being set, the
    supplied list is reused as AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST (with
    a warning) so the optimized PCGUARD honors it
  • instrument allow/deny lists (AFL_LLVM_ALLOWLIST/AFL_LLVM_DENYLIST and
    the GCC equivalents): function (fun:) entries are now matched verbatim
    with fnmatch() instead of having a * prepended automatically - add a
    leading * yourself for a suffix match. Function entries are matched
    against both the mangled and the demangled (LLVM) / unqualified (GCC)
    name, and an explicit fun: prefix now permits : so demangled C++/Rust
    names can be listed. File (src:) entries are unchanged and still match
    as a suffix (an implicit leading *)
  • AFL_LLVM_CRASHLIST - crash on any function that is marked not to be
    instrumented but is entered by fuzzing input
  • bugfix for __AFL_LOOP() that lingered since vanilla afl, first run
    coverage map would look different to following runs, impacting lots of
    functionality (minimizing, stability, etc.)
• afl-* script tools:
  • prefer AFL_PATH to find afl-showmap
• man pages: fixed the SYNOPSIS and OPTIONS sections for several tools

v5.01c

Version ++5.01c (release)

• MacOS persistent mode now uses futex mode now too which increases speed
  and reduces system call overhead (opt out with AFL_FAST_CHILD_SYNC) - this
  requires a MacOS from 2024 onwards.
• afl-fuzz
  • new adaptive MOpt! Much better than the outdated one we still had.
    How good it is still needs to be seen but initially it seems to be
    better than standard havoc
  • enforce halt on UBSAN errors
• afl-cc:
  • enforce halt on UBSAN errors (AFL_USE_USBAN=1)
  • better cmplog on MacOS
  • removed unsupported LLVM version code paths from afl-cc and llvm passes
  • compcov: fixes for float splittings (thanks to @ngg)
• nyx_mode:
  • fix nyx_mode issues (thanks to @morehouse)
• qemu_mode:
  • non-colliding coverage!
  • faster persistent fuzzing
  • minor bug fixes
• qemu_bridge:
  • new mode with current QEMU version, so plugins possible, new processors
  • sightly slower than qemu_mode
  • WIP!

v5.00c

Version ++5.00c (release)

! AFL++ is now an AGPL 3.0 project !
! Files where the license could be switched were moved to AGPL 3.0+, files
that were under Apache 2.0 with contributations stay on that license.
! Commercial license (donate to a good cause - no money for AFL++) is available

• Switched https://github.com/AFLplusplus/cov-analysis for outdated afl-cov
• MacOS most current version support for afl-fuzz, afl-cc (incl. LTO) and
  frida mode!
• Refreshed FreeBSD support by jsaunders-rr, thanks!
• Linux persistent mode uses futex now which increases speed and reduces
  system call overhead (opt out with AFL_FAST_CHILD_SYNC), thanks to
  @martinus for most of the implementation!
• afl-fuzz:
  • -I tool call now receives the new crash as a command line parameter
  • changed to a better map classifier
  • frameshift is disabled now if AFL_CUSTOM_MUTATOR_ONLY is set
  • python module fixes
  • minor speed, leak and zombie enhancements
  • stability info was lost on fast resume - fixed
  • somewhere we removed .state/variable/... now it is back :-)
• afl-cc:
  • Add LLVM 23 support
  • LTO and PCGUARD: new AFL_LLVM_PATH (also AFL_LLVM_LTO_PATH /
    AFL_LLVM_PATH_MODE) Ball-Larus per-function path coverage on top
    of edge coverage. Three levels: =1 relaxed (collapse all
    guard-only BBs), =2 restricted (collapse only 2-successor
    guard-only BBs), =3 strict Ball-Larus. LTO additionally composes
    with AFL_LLVM_LTO_CALLER. See
    instrumentation/README.llvm.md and instrumentation/README.lto.md.
  • Fixes in the PCGUARD and LTO instrumentation that could lead to sanitizer
    triggers in target binaries
  • new instrumentation: afl-llvm-bug-pass.so provides five runtime
    oracles (SCALAR, BUDGET, SIZEFILL, ALLOCSIZE, SLACK) plus a slice-
    filter sub-mode for SCALAR, covering arithmetic-bound and logical-
    OOB bugs that ASan misses (CVE-2023-4863 / libwebp-Huffman class).
    Note: ALLOCSIZE/DERIVE are disabled automatically under
    AFL_USE_ASAN to avoid double-instrumentation; see
    docs/env_variables.md.
    • AFL_LLVM_BUG_SCALAR=1 - max-value-per-arithmetic-site coverage,
      plus per-loop iteration count
    • AFL_LLVM_BUG_SCALAR_SLICE=1 - restrict SCALAR instrumentation to
      arithmetic that flows into a memory-
      size sink (allocator size, GEP index,
      memcpy/memset length). Implies SCALAR.
    • AFL_LLVM_BUG_BUDGET=1 - check ptr += func() write-extent
      contract
    • AFL_LLVM_BUG_SIZEFILL=1 - check NULL-means-size-only idioms
    • AFL_LLVM_BUG_ALLOCSIZE=1 - track every malloc/calloc/realloc and
      feed three signals (headroom IJON-min,
      proximity-bucket coverage edge, soft-OOB
      tripwire) per in-loop store
    • AFL_LLVM_BUG_SLACK=1 - per-icmp |op0-op1| feedback, mapped
      MIN-style onto the bug map (inverse-
      bucket) for tight-comparison signal
    • AFL_LLVM_BUG_ALLOCSIZE_FUNCS=Name1,Name2,... - extend tracking
      to user-listed custom allocators
    • AFL_LLVM_BUG_ALLOCSIZE_FREE_FUNCS=Name1,Name2,... - matching
      custom-free functions for the above
    • AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1 - log tracked allocation sizes
      into CmpLog RTN slots for -l Z
    • AFL_LLVM_BUG=1 - enable all bug-pass modes
      Per-site bug-map slots are kept in a private MAP_SIZE_BUG region and
      tracked max-rule (compatible with the IJON model)
  • cmplog scheduling extensions (companion to bug-pass):
    • -l M (afl-fuzz) - predicate-tightness scheduling. Treat any
      new per-site minimum slack on an inequality CmpLog cmp as a
      coverage event and mark the queue entry favoured. Catches the
      libwebp-1.3.1 / CVE-2023-4863 input pattern (validation
      predicates simultaneously at their tight edges).
    • AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1 or AFL_LLVM_BUG=1
      (compile-time) and
      -l Z (afl-fuzz) - size-derive logging. On every freed tracked
      allocation, write (computed_size, max_observed_offset) into a
      CmpLog RTN slot keyed by alloc-site. The existing CmpLog
      dictionary mining harvests computed_size as a magic constant
      and feeds the producing input bytes back into havoc.
• afl-cmin*:
  • nyx_mode is now working for all minimizer variants
• afl-showmap:
  • no more .afl-showmap-temp-* files lying around
• IJON dist was changed to original IJON implementation: initial matching
  bytes, max length is 1024
• lib* tools:
  • MacOS support is back, thanks to @Jay-1409 !

v4.40c

Version ++4.40c (release)

• afl-fuzz:
  • FrameShift integrated and enabled by default, disable with
    AFL_FRAMESHIFT_DISABLE and configure effort via
    AFL_FRAMESHIFT_MAX_OVERHEAD. In extensive fuzzbench analysis at worst
    (on average) it does nothing, at best it improves time to new coverage
    and total coverage unlocked. https://arxiv.org/pdf/2507.05421
    Thanks to @hgarrereyn for the PR!
  • Fixed several potential crashes when using IJON
  • added AFL_FORCE_FASTRESUME which will ignore the saved hash of the
    target - but note it will only work if the coverage map size did not
    change
  • prevent further executed instrumented programs by the fuzz target to
    manipulate the coverage
• afl-cc:
  • LLVM 22 support (they are again switching around include files ...)
  • g_/curl_/xml_ string support for COMPCOV, thanks to @Prajwal-kp-18
  • optimized hidden CFG instrumentation (don't instrument vector selects)
  • plugin optimization and fixes by @nbars, @kyakdan and @koltiradw
  • marked GCC plugins as unmaintained. We need someone who know gimple and
    is willing to fix the plugin issues, workarounds for gcc bugs and
    overall improve the plugin.
  • env AFL_LLVM_DENY_EXEC will abort any common exec calls
• afl-cmin:
  • new implementation in C by @kcwu - it is currenlty not built though
    because of maturity issues, e.g. does not work with Nyx
  • afl-cmin.py was changing behaviour to hash the original filenames,
    this was reverted.
  • afl-cmin and afl-cmin.py honor AFL_SHA1_FILENAMES now
• afl-showmap:
  • -f support added by Prajwal-kp-18 - thanks!
  • faster stream mode by @nbars
• qemu_mode:
  • fix when AFL_EXITPOINT is not set, which could prevent detecting crashes
• afl-plot:
  • multiple AFL++ out directories now supported, thanks to @Jay-1409 !

v4.35c

Version ++4.35a (release)

• GUIFuzz++ merged: Unleashing Grey-box Fuzzing on Desktop Graphical User
  Interfacing Applications
  https://futures.cs.utah.edu/papers/25ASE.pdf
• afl-fuzz:
  • fix syncing issues with crashes and custom mutators by @AndyH-1
  • another attempt to kill every client, thanks to @leonasdev
• afl-cc:
  • Huge refactor for default pcguard instrumentation, several minor and
    medium bug fixes, complete hidden decision coverage
  • LTO: also added complete hidden decision coverage
  • Various small fixes by @nbars, thanks!
  • IJON fix to search for the necessary include
  • Allow compiling the gcc plugin with clang++, thanks to @exoosh
  • Fix for unusual bit sizes in cmplog-instructions-pass by @forzafedor
• qemu_mode:
  • IJON support, thanks to @nj00001! see qemu_mode/README.md
  • leaner, less warnings, thanks to @McSinyx!
• afl-tmin
  • fix custom trimmings, thanks to @renatahodovan!
• custom mutators:
  • Gramatron: fixes + cjson switch by @CarvedCoder, fix by @jubnzv

v4.34c

Version ++4.34c (release)

• IJON integration by @vi3tL0u1s - thanks a lot!!
  • see docs/IJON.md on how to use it
• unicorn_mode:
  • UnicornAFL v3!! thanks to @wtdcode!
• qemu_mode:
  • fix compilation for a few platforms
• afl-fuzz
  • larger improvements to CMPLOG, thanks to @am009
  • scroll down before clearing the screen to not loose content
  • minor bug fixes
• afl-showmap
  • fix -C parameter breakage introduced in v4.33c
• afl-cc:
  • enabled LLVM 22
  • new env: AFL_COMPILER_LAUNCHER to allow ccache usage (thanks to @nbars)
  • fix a offset calculation bug in AFL++ PCGUARD
  • make AFL_DUMP_MAP_SIZE work for CLASSIC modes
  • fix a crash when running with LLVM 20 when compiling PCGUARD with LTO
  • fix deprecation warnings for LLVM 20+
  • fix 128 bit support for cmplog-switches pass
  • fix 32 bit cmplog support
  • skip blocks for instrumentation that are already instrumented
• Building:
  • new NO_UNICORN and NO_QEMU and NO_FRIDA build options
  • build fixes for FreeBSD
• custom_mutators:
  • added AIXCC Team Atlanta's zero-mq plugin to add testcases from remote

v4.33c

Version ++4.33c (release)

• afl-fuzz:
  • Use AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT if you use AFL_PRELOAD
    to disable fork, see docs (thanks to @alexandredoyen29)
  • Fix for FAST power schedules (introduced in 4.32c) (thanks to @kcwu)
  • Colors for NO_UI output (thanks to @smoelius)
  • Fix potential sync issues when resuming sessions and when instances in a
    campaign are restarted and skip entries that were synced from itself
    (thanks to @kcwu for raising the issues and providing support!)
  • Fix for when fast resuming failed
  • more 64 bit archicture support by @maribu
• afl-cc:
  • Added instrumenting hidden edges (approx 5% edges were not instrumented,
    LLVM sancov overall misses 8% of edges compared to our implementation)
    Note that is is currently only implemented for our PCGUARD plugin, not
    LTO, CLASSIC, etc.!
  • Fix to make AFL_SAN_NO_INST work with gcc_plugin
  • MacOS aflpp driver compilation fix (-fsanitize=fuzzer implementation)
  • Make AFL_DUMP_MAP_SIZE work even if the target has sanitizer issues
• qemuafl:
  • Better MIPS persistent mode support
  • AFL_EXITPOINT support added
  • AFL_QEMU_BLOCK_COV block coverage support added
• afl-cmin:
  • New afl-cmin.py which is much faster, will be executed by default via
    afl-cmin if it executes successfully (thanks to @kcwu!)
  • Nyx mode now fully works for minimizing (with afl-cmin.py which is
    called by afl-cmin if python is available) - before the map size was
    fixed and so large targets lost coverage.
• New desocketing library: utils/libaflppdesock
  • Likely works when all other desocketing options fail
• nyx_mode:
  • Properly determine map size

v4.32c

Version ++4.32c (release)

• Fixed a bug where after a fast restart of a full fuzzed corpus afl-fuzz
  terminates with "need at least one valid input seed that does not crash"
• Small improvements to afl-*-config
• afl-fuzz:
  • memory leak fixes by @kcwu - thanks!
  • many more nits and small memory saves thanks to @kcwu
  • remove deprecated files from queue/.state
  • fix bitmap update function if no current trace is present
  • fix for afl_custom_queue_get
  • various small nits
• afl-cc:
  • fix pass support for LLVM 20 (passes were run too early)
  • dropped plugin support for LLVM 13
  • fix AFL_OLD_FORKSERVER
  • various minor fixes
• frida_mode:
  • fixes for new MacOS + M4 hardware

v4.31c

Version ++4.31c (release)

• SAND mode added (docs/SAND.md) for more effecient fuzzing with sanitizers
  (thanks to @wtdcode !)
• afl-fuzz:
  • splicing phase is now DISABLED by default because research showed
    it is counterproductive. New command line parameter -u to enable
    it. Splicing is auto-enabled if two cycles without finds happen.
  • Python 3.13+ support
  • loose file and shared memory permissions on Android and iPhone
• afl-cc:
  • LLVM 20 support (again - please don't change the API all the time ...)
  • -fsanitize=fuzzer now inserts libAFLDriver.a addtionally early to help
    compiling if LLVMFuzzerTestOneOnput is in an .a archive
  • added _sanitizer_weak_hook* functions (in case that is helpful in
    weird setups)
  • fix bug with large map sizes when multiple libraries are loaded after
    the shared memory was obtained.

v4.30c

Version ++4.30c (release)

! afl-gcc and afl-clang funcionality is now removed !

• afl-fuzz:
  • fastresume feature added. if you abort fuzzing and resume fuzzing
    with -i - or AFL_AUTORESUME=1 and the target binary has not changed
    then a dump will be loaded and the calibration phase skipped.
    to disable this feature set AFL_NO_FASTRESUME=1
    zlib compression is used if zlib is found at compile time
  • improved seed selection algorithm
  • added AFL_CUSTOM_MUTATOR_LATE_SEND=1 to call the custom send()
    function after the target has been restarted.
  • because of bad math and undefined behaviour fixes we have to change
    the CMPLOG map. YOU NEED TO RECOMPILE CMPLOG TARGETS
  • fixed custom_post_process for calibration
  • fixes for AFL_EXIT_ON_TIME and AFL_EXIT_WHEN_DONE, changed behaviour of
    AFL_EXIT_WHEN_DONE to finish when really done :-)
• frida_mode:
  • AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just
    a function entry
  • AFL_DEBUG is now the same as AFL_FRIDA_VERBOSE
  • AFL_FRIDA_DEBUG_MAPS now works as expected
• qemu_mode:
  • new hooks supported (optional), see qemu_mode/hooking_bridge - thanks to
    @CowBoy4mH3LL
• unicorn_mode:
  • fix install and forkserver (thanks aarnav!)
  • pin unicorn version
• nyx_mode:
  • bugfixes
• custom mutators:
  • custom_send_tcp custom mutator added, thanks to @dergoegge
• afl-cc
  • fix to support pointless changes in LLVM 20
  • new runtime (!) variable: AFL_OLD_FORKSERVER to use the old vanilla
    AFL type forkserver. Useful for symcc/symqemu/nautilus/etc. with
    AFL_LLVM_INSTRUMENT=CLASSIC
  • new compile time variable: AFL_OPT_LEVEL to set a specific optimization
    level, default is 3
  • correctly explain how to get the correct map size for large targets
  • small fix for weird LLVM defines in redhat
• code formatting updated to llvm 18
• improved custom_mutators/aflpp/standalone/aflpp-standalone
• added custom_mutators/autotokens/standalone/autotokens-standalone
• AFL++ headers are now installed to $PREFIX/include/afl