Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales across cores and machines. For Windows, Android, MacOS, Linux, no_std, ...
LibAFL, the fuzzer library
Advanced Fuzzing Library - Slot your own fuzzers together and extend their features using Rust.
LibAFL is a collection of reusable pieces of fuzzers, written in Rust, it gives you many of the benefits of an off-the-shelf fuzzer, while being completely customizable. Some highlight features currently include:
fast: We do everything we can at compile time, keeping runtime overhead minimal. Users reach 120k execs/sec in frida-mode on a phone (using all cores).scalable:Low Level Message Passing,LLMPfor short, allowsLibAFLto scale almost linearly over cores, and via TCP to multiple machines.adaptable: You can replace each part ofLibAFL. For example,BytesInputis just one potential form input:
multi platform:LibAFLruns on Windows, macOS, iOS, Linux, and Android, and more.LibAFLcan be built inno_stdmode to injectLibAFLinto obscure targets like embedded devices and hypervisors.bring your own target: We support binary-only modes, like Frida-Mode, as well as multiple compilation passes for sourced-based instrumentation. Of course it's easy to add custom instrumentation backends.
Core concepts
LibAFL is fast, multi-platform, nostd compatible, and scales over cores and machines. It offers a main crate that provide building blocks for custom fuzzers, libafl, a library containing common code that can be used for targets instrumentation, libafltargets, and a library providing facilities to wrap compilers, libaflcc. It offers integrations with popular instrumentation frameworks. At the moment, the supported backends are:
SanitizerCoverage, in libafl_targetsFrida, in libafl_fridaQEMUuser-mode and system mode, including hooks for emulation, in libafl_qemuTinyInst, in libafltinyinst by elbiazo
Building and installing
Install the Dependencies
- The Rust development language
If your installed Rust version is older than the one listed in Cargo.toml, update to the latest stable toolchain:
rustup update stable- LLVM tools
- Just:
fuzzers/ directory. You can find instructions to install it in your environment in the Just Programmer's Manual.
Clone the LibAFL repository with
git clone https://github.com/AFLplusplus/LibAFLBuild the library using
cargo build --releaseBuild the API documentation with
cargo docBrowse the LibAFL book (WIP!) with (requires mdbook)
cd docs && mdbook serveGetting started
We collect all example fuzzers in ./fuzzers. Be sure to read their documentation (and source), this is the natural way to get started!
just runYou can run each example fuzzer with this following command, as long as the fuzzer directory has a Justfile file. The best-tested fuzzer is ./fuzzers/inprocess/libfuzzer_libpng, a multicore libfuzzer-like fuzzer using LibAFL for a libpng harness.
Resources
- Installation guide
- Online API documentation
- The
LibAFLbook (WIP) online or in the repo - Our research paper
- Our RC3 talk explaining the core concepts
- Our Fuzzcon Europe talk with a (a bit but not so much outdated) step-by-step discussion on how to build some example fuzzers
- The Fuzzing101 solutions & series of blog posts by epi
- Blogpost on binary-only fuzzing lib
libafqemu, Hacking TMNF - Fuzzing the game server, by RickdeJager. - A LibAFL Introductory Workshop, by Jordan Whitehead
Contributors
LibAFL is written and maintained by
Contributing
Please check out CONTRIBUTING.md for the contributing guideline.
Debugging
Your fuzzer doesn't work as expected? Try reading DEBUGGING.md to understand how to debug your problems.
Cite
If you use LibAFL for your academic work, please cite the following paper:
@inproceedings{libafl,
author = {Andrea Fioraldi and Dominik Maier and Dongjia Zhang and Davide Balzarotti},
title = {{LibAFL: A Framework to Build Modular and Reusable Fuzzers}},
booktitle = {Proceedings of the 29th ACM conference on Computer and communications security (CCS)},
series = {CCS '22},
year = {2022},
month = {November},
location = {Los Angeles, U.S.A.},
publisher = {ACM},
}License
Licensed under either of Apache License, Version 2.0 or MIT license at your option.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this crate by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.
