Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?


Failed to load latest commit information.
Latest commit message
Commit time
April 26, 2016 17:54
October 20, 2017 14:48
August 18, 2017 11:35
March 31, 2016 18:41
August 18, 2017 09:33
September 19, 2017 15:28
August 18, 2017 17:01
August 18, 2017 13:34

KleeFL - Seeding Fuzzers With Symbolic Execution

HowTo ...

Prepare dependencies or simply grab the provisioned vagrant box

Vagrant box

  1. Download the file.
  2. Install vagrant (if not already installed) sudo apt-get install vagrant
  3. Add the file to vagrant vagrant box add kleefl
  4. Initialize the vagrant box (kleefl) vagrant init kleefl
  5. Bring the box up vagrant up
  6. SSH to the box vagrant ssh

Setup a project structure like this:

mkdir project_xyz
cd project_xyz
python /vagrant/tools/kleefl_init -- sets up two directories called 'klee' and 'fuzz' in your root project directory

Select your source code, e.g.:

cp -r /vagrant/example source

Build source using wllvm & afl-clang

cd source
/vagrant/tools/kleefl_build_make make

Choose & set up a target binary for evaluation

./kleefl_pick target_binary_name

Generate the test cases for AFL (KLEE symbolic execution)

The previous script will add a file called app.bc within the klee directory.
Change into the klee folder and run:

Prepare klee's findings for afl-fuzz

python /vagrant/tools/kleefl_prepare_afl

Finally: Fuzz, fuzz, fuzz!


Analyze findings

./kleefl_crash_inspector fuzz/out
(fuzz/out is the afl sync dir, report saved by default in vagrant shared dir /vagrant/crash_report/)

Analyze coverage & generate report

python kleefl_cov_inspector {make, binary fuzz/sync_dir}
zcov genhtml coverage.zcov cov_report

Further details can found in the project report or check out our beautiful USENIX poster