Skip to content
Fuzzing Android program with american fuzzy lop (AFL)
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
android-test
dictionaries
docs Update AFL to latest version 2.49b Jul 31, 2017
experimental Update AFL to latest version 2.49b Jul 31, 2017
libdislocator
libtokencap Update AFL to latest version 2.49b Jul 31, 2017
llvm_mode
qemu_mode
testcases
Android.mk More fixes. Aug 1, 2017
LICENSE
Makefile
QuickStartGuide.txt
README
README.md
afl-analyze.c
afl-as.c Put back accidentally deleted arm related functions. Aug 1, 2017
afl-as.h
afl-cmin
afl-fuzz.c Put back android-ashmem.h and make it work. Aug 1, 2017
afl-gcc.c
afl-gotcpu.c Put back android-ashmem.h and make it work. Aug 1, 2017
afl-plot
afl-showmap.c Put back android-ashmem.h and make it work. Aug 1, 2017
afl-tmin.c
afl-whatsup Update AFL to latest version 2.49b Jul 31, 2017
alloc-inl.h android-afl Sep 2, 2016
android-ashmem.h
config.h
debug.h
hash.h
test-instr.c
types.h

README.md

android-afl

Fuzzing Android program with american fuzzy lop (AFL)

android-afl: Android-enabled version of AFL

android-afl is a modified version of AFL that supports fuzzing on Android, the SHM has been replaced with ASHMEM because of Android disable SHM in the kernel. Extra codes have been added in afl-gcc.c, afl-as.c and afl-as.h to support arm arch. Android.mk has been added to support Android build system and llvm_mode. Please refer to the android-afl.patch for more details.

Requirements

  • Android source code(e.g. 6.0.1) is needed.
  • llvm-5.0 and clang-5.0 are needed to provide support for llvm_mode on Android, you can install using apt-get install llvm clang on Ubuntu.

Build

first, download and build the Android open-source project (AOSP). then, download all the android-afl source code to AOSP folder:

cd AOSP
git clone https://github.com/ele7enxxh/android-afl

to build:

. build/envsetup.sh
cd android-afl
mm

this will produce all afl binaries that you can use on host(e.g. Linux) or Android.

Usage

afl-gcc/afl-g++, afl-clang/afl-clang++ and afl-clang-fast/afl-clang-fast++ are all supported in android-afl. Please refer to android-afl-test for more details.

To fuzz

if you want fuzz on host, you should use the afl-fuzz in the $(HOST_OUT)/bin folder, otherwise you need to use the afl-fuzz in the $(target_OUT)/bin folder. To ingore bind_to_free_cpu, the AFL_NO_AFFINITY=1 should been set. Please refer to AFl README for more details.

Note

not all of the AFL tools have been tested on Android, but afl-fuzz has been working great on android-6.0.1 for me.

adb devices
adb push ../out/target/product/generic/system/bin/ /data/local/tmp

You can’t perform that action at this time.