Version ++4.31c (release)

• SAND mode added (docs/SAND.md) for more effecient fuzzing with sanitizers
  (thanks to @wtdcode !)
• afl-fuzz:
  • splicing phase is now DISABLED by default because research showed
    it is counterproductive. New command line parameter -u to enable
    it. Splicing is auto-enabled if two cycles without finds happen.
  • Python 3.13+ support
  • loose file and shared memory permissions on Android and iPhone
• afl-cc:
  • LLVM 20 support (again - please don't change the API all the time ...)
  • -fsanitize=fuzzer now inserts libAFLDriver.a addtionally early to help
    compiling if LLVMFuzzerTestOneOnput is in an .a archive
  • added _sanitizer_weak_hook* functions (in case that is helpful in
    weird setups)
  • fix bug with large map sizes when multiple libraries are loaded after
    the shared memory was obtained.

Version ++4.30c (release)

! afl-gcc and afl-clang funcionality is now removed !

• afl-fuzz:
  • fastresume feature added. if you abort fuzzing and resume fuzzing
    with -i - or AFL_AUTORESUME=1 and the target binary has not changed
    then a dump will be loaded and the calibration phase skipped.
    to disable this feature set AFL_NO_FASTRESUME=1
    zlib compression is used if zlib is found at compile time
  • improved seed selection algorithm
  • added AFL_CUSTOM_MUTATOR_LATE_SEND=1 to call the custom send()
    function after the target has been restarted.
  • because of bad math and undefined behaviour fixes we have to change
    the CMPLOG map. YOU NEED TO RECOMPILE CMPLOG TARGETS
  • fixed custom_post_process for calibration
  • fixes for AFL_EXIT_ON_TIME and AFL_EXIT_WHEN_DONE, changed behaviour of
    AFL_EXIT_WHEN_DONE to finish when really done :-)
• frida_mode:
  • AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just
    a function entry
  • AFL_DEBUG is now the same as AFL_FRIDA_VERBOSE
  • AFL_FRIDA_DEBUG_MAPS now works as expected
• qemu_mode:
  • new hooks supported (optional), see qemu_mode/hooking_bridge - thanks to
    @CowBoy4mH3LL
• unicorn_mode:
  • fix install and forkserver (thanks aarnav!)
  • pin unicorn version
• nyx_mode:
  • bugfixes
• custom mutators:
  • custom_send_tcp custom mutator added, thanks to @dergoegge
• afl-cc
  • fix to support pointless changes in LLVM 20
  • new runtime (!) variable: AFL_OLD_FORKSERVER to use the old vanilla
    AFL type forkserver. Useful for symcc/symqemu/nautilus/etc. with
    AFL_LLVM_INSTRUMENT=CLASSIC
  • new compile time variable: AFL_OPT_LEVEL to set a specific optimization
    level, default is 3
  • correctly explain how to get the correct map size for large targets
  • small fix for weird LLVM defines in redhat
• code formatting updated to llvm 18
• improved custom_mutators/aflpp/standalone/aflpp-standalone
• added custom_mutators/autotokens/standalone/autotokens-standalone
• AFL++ headers are now installed to $PREFIX/include/afl

Version ++4.21c (release)

• afl-fuzz
  • fixed a regression in afl-fuzz that resulted in a 5-10% performace loss
    do a switch from gettimeofday() to clock_gettime() which should be rather
    three times faster. The reason for this is unknown.
  • new queue selection algorithm based on 2 core years of queue data
    analysis. gives a noticable improvement on coverage although the results
    seem counterintuitive :-)
  • added AFL_DISABLE_REDUNDANT for huge queues
  • added AFL_NO_SYNC environment variable that does what you think it does
  • fix AFL_PERSISTENT_RECORD
  • run custom_post_process after standard trimming
  • prevent filenames in the queue that have spaces
  • minor fix for FAST schedules
  • more frequent stats update when syncing (todo: check performance impact)
  • now timing of calibration, trimming and syncing is measured seperately,
    thanks to @eqv!
  • -V timing is now accurately the fuzz time (without syncing), before
    long calibration times and syncing could result in now fuzzing being
    made when the time was already run out until then, thanks to @eqv!
  • fix -n uninstrumented mode when ending fuzzing
  • enhanced the ASAN configuration
  • make afl-fuzz use less memory with cmplog and fix a memleak
• afl-cc:
  • re-enable i386 support that was accidently disabled
  • fixes for LTO and outdated afl-gcc mode for i386
  • fix COMPCOV split compare for old LLVMs
  • disable xml/curl/g_ string transform functions because we do not check
    for null pointers ... TODO
  • ensure shared memory variables are visible in weird build setups
  • compatability to new LLVM 19 changes
• afl-cmin
  • work with input files that have a space
• afl-showmap
  • fix memory leak on shmem testcase usage (thanks to @ndrewh)
  • minor fix to collect coverage -C (thanks to @bet4it)
• Fixed a shmem mmap bug (that rarely came up on MacOS)
• libtokencap: script generate_libtoken_dict.sh added by @a-shvedov

Version ++4.20c (release)

! A new forkserver communication model is now introduced. afl-fuzz is
backward compatible to old compiled targets if they are not built
for CMPLOG/Redqueen, but new compiled targets will not work with
old afl-fuzz versions!
! Recompile all targets that are instrumented for CMPLOG/Redqueen!

• AFL++ now supports up to 4 billion coverage edges, up from 6 million.
• New compile option: make PERFORMANCE=1 - this will enable special
  CPU dependent optimizations that make everything more performant - but
  the binaries will likely won't work on different platforms. Also
  enables a faster hasher if the CPU requirements are met.
• The persistent record feature (see config.h) was expanded to also
  support replay, thanks to @quarta-qti !
• afl-fuzz:
  • the new deterministic fuzzing feature is now activated by default,
    deactivate with -z. Parameters -d and -D are ignored.
  • small improvements to CMPLOG/redqueen
  • workround for a bug with MOpt -L when used with -M - in the future
    we will either remove or rewrite MOpt.
  • fix for -t xxx+ feature
  • -e extension option now saves the queue items, crashes, etc. with the
    extension too
  • fixes for trimmming, correct -V time and reading stats on resume by eqv
    thanks a lot!
• afl-cc:
  • added collision free caller instrumentation to LTO mode. activate with
    AFL_LLVM_LTO_CALLER=1. You can set a max depth to go through single
    block functions with AFL_LLVM_LTO_CALLER_DEPTH (default 0)
  • fixes for COMPCOV/LAF and most other modules
  • fix for GCC_PLUGIN cmplog that broke on std::strings
• afl-whatsup:
  • now also displays current average speed
  • small bugfixes
• Fixes for aflpp custom mutator and standalone tool
• Minor edits to afl-persistent-config
• Prevent temporary files being left behind on aborted afl-whatsup
• More CPU benchmarks added to benchmark/

Version ++4.10c (release)

• afl-fuzz:
  • default power schedule is now EXPLORE, due a fix in fast schedules
    explore is slightly better now.
  • fixed minor issues in the mutation engine, thanks to @futhewo for
    reporting!
  • better deterministic fuzzing is now available, benchmarks have shown
    to improve fuzzing. Enable with -D. Thanks to @kdsjZh for the PR!
• afl-cc:
  • large rewrite by @SonicStark which fixes a few corner cases, thanks!
  • LTO mode now requires llvm 12+
  • workaround for ASAN with gcc_plugin mode
• instrumentation:
  • LLVM 18 support, thanks to @devnexen!
  • Injection (SQL, LDAP, XSS) fuzzing feature now available, see
    instrumentation/README.injections.md how to activate/use/expand.
  • compcov/LAF-intel:
    • floating point splitting bug fix by @hexcoder
    • due a bug in LLVM 17 integer splitting is disabled there!
    • when splitting floats was selected, integers were always split as well,
      fixed to require AFL_LLVM_LAF_SPLIT_COMPARES or _ALL as it should
  • dynamic instrumentation filtering for LLVM NATIVE, thanks @mozilla!
    see utils/dynamic_covfilter/README.md
• qemu_mode:
  • plugins are now activated by default and a new module is included that
    produces drcov compatible traces for lighthouse/lightkeeper/...
    thanks to @JRomainG to submitting!
• updated Nyx checkout (fixes a bug) and some QOL
• updated the custom grammar mutator
• document afl-cmin does not work on macOS (but afl-cmin.bash does)

Version ++4.09c (release)

• afl-fuzz:
  • fixed the new mutation implementation for two bugs
  • added AFL_FINAL_SYNC which forces a final fuzzer sync (also for -F)
    before terminating.
  • added AFL_IGNORE_SEED_PROBLEMS to skip over seeds that time out instead
    of exiting with an error message
  • allow -S/-M naming up to 50 characters (from 24)
  • CMPLOG:
    • added scale support (-l S)
    • skip unhelpful insertions (u8)
  • added --version and --help command line parameters
  • fixed endless loop when reading malformed dictionaries
  • new custom mutator function: post_run - thanks to yangzao!
• afl-whatsup:
  • detect instanced that are starting up and show them as such as not dead
  • now also shows coverage reached
  • option -m shows only very relevant stats
  • option -n will not use color in the output
• instrumentation:
  • fix for a few string compare transform functions for LAF
  • we are instrumenting __cxx internal functions again. this might break
    a few targets, please report if so.
• frida_mode:
  • fixes support for large map offsets
• support for AFL_FUZZER_LOOPCOUNT for afl.rs and LLVMFuzzerTestOneInput
• afl-cmin/afl-cmin.bash: prevent unneeded file errors
• added new tool afl-addseeds that adds new seeds to a running campaign
• added benchmark/benchmark.py if you want to see how good your fuzzing
  speed is in comparison to other setups.

Version ++4.08c (release)

• afl-fuzz:

  • new mutation engine: mutations that favor discovery more paths are
    prefered until no new finds for 10 minutes then switching to mutations
    that favor triggering crashes. Modes and switch time can be configured
    with -P. Also input mode for the target can be defined with -a to
    be text or binary (defaults to generic)
  • new custom mutator that has the new afl++ engine (so it can easily
    incorporated into new custom mutators), and also comes with a standalone
    command line tool! See custom_mutators/aflpp/standalone/
  • display the state of the fuzzing run in the UI :-)
  • fix timeout setting if '+' is used or a session is restarted
  • -l X option to enable base64 transformation solving
  • allow to disable CMPLOG with '-c -' (e.g. afl.rs enforces '-c 0' on
    every instance which is counterproductive).

• afl-cmin/afl-cmin.bash:

  • fixed a bug inherited from vanilla AFL where a coverage of
    map[123] = 11 would be the same as map[1123] = 1
  • warn on crashing inputs
  • adjust threads if less inputs than threads specified

• afl-cc:

  • fixed an off-by-one instrumentation of iselect, hurting coverage a bit.
    Thanks to @amykweon for spotting and fixing!
  • @toka fixed a bug in laf-intel signed integer comparison splitting,
    thanks a lot!!
  • more LLVM compatability

• frida_mode:

  • support for long form instrumentation on x86_x64 and arm64
  • renamed utils/get_symbol_addr.sh to utils/frida_get_symbol_addr.sh

• qemu_mode:

  • added qemu_mode/utils/qemu_get_symbol_addr.sh

Version ++4.07c (release)

• afl-fuzz:
  • reverse reading the seeds only on restarts (increases performance)
  • new env AFL_POST_PROCESS_KEEP_ORIGINAL to keep the orignal
    data before post process on finds (for atnwalk custom mutator)
  • new env AFL_IGNORE_PROBLEMS_COVERAGE to ignore coverage from
    loaded libs after forkserver initialization (required by Mozilla)
• afl-cc:
  • added @responsefile support
  • new env AFL_LLVM_LTO_SKIPINIT to support the AFL++ based WASM
    (https://github.com/fgsect/WAFL) project
  • error and print help if afl-clan-lto is used with lto=thin
  • rewrote our PCGUARD pass to be compatible with LLVM 15+ shenanigans,
    requires LLVM 13+ now instead of 10.0.1+
  • fallback to native LLVM PCGUARD if our PCGUARD is unavailable
  • fixed a crash in GCC CMPLOG
• afl-showmap:
  • added custom mutator post_process and send support
  • add -I filelist option, an alternative to -i in_dir
• afl-cmin + afl-cmin.bash:
  • -T threads parallel task support, can be a huge speedup!
• qemu_mode:
  • Persistent mode + QASAN support for ppc32 targets by @WorksButNotTested
• a new grammar custom mutator atnwalk was submitted by @voidptr127 !
• two new custom mutators are now available:
  • TritonDSE in custom_mutators/aflpp_tritondse
  • SymQEMU in custom_mutators/symqemu

Version ++4.06c (release)

• afl-fuzz:
  • ensure temporary file descriptor is closed when not used
  • added AFL_NO_WARN_INSTABILITY
  • added time_wo_finds to fuzzer_stats
  • fixed a crash in pizza (1st april easter egg) mode. Sorry for
    everyone who was affected!
  • allow pizza mode to be disabled when AFL_PIZZA_MODE is set to -1
  • option -p mmopt now also selects new queue items more often
  • fix bug in post_process custom mutator implementation
  • print name of custom mutator in UI
  • slight changes that improve fuzzer performance
• afl-cc:
  • add CFI sanitizer variant to gcc targets
  • llvm 16 + 17 support (thanks to @devnexen!)
  • support llvm 15 native pcguard changes
  • support for LLVMFuzzerTestOneInput -1 return
  • LTO autoken and llvm_mode: added AFL_LLVM_DICT2FILE_NO_MAIN support
• qemu_mode:
  • fix _RANGES envs to allow hyphens in the filenames
  • basic riscv support
• frida_mode:
  • added AFL_FRIDA_STATS_INTERVAL
  • fix issue on MacOS
• unicorn_mode:
  • updated and minor issues fixed
• nyx_mode support for all tools
• better sanitizer default options support for all tools
• new custom module: autotoken, a grammar free fuzzer for text inputs
• fixed custom mutator C examples
• more minor fixes and cross-platform support

Version ++4.05c (release)

• MacOS: libdislocator, libtokencap etc. do not work with modern
  MacOS anymore, but could be patched to work, see this issue if you
  want to make the effort and send a PR:
  #1594
• afl-fuzz:
  • added afl_custom_fuzz_send custom mutator feature. Now your can
    send fuzz data to the target as you need, e.g. via IPC.
  • cmplog mode now has a -l R option for random colorization, thanks
    to guyf2010 for the PR!
  • queue statistics are written every 30 minutes to
    out/NAME/queue_data if compiled with INTROSPECTION
  • new env: AFL_FORK_SERVER_KILL_SIGNAL
• afl-showmap/afl-cmin
  • -t none now translates to -t 120000 (120 seconds)
• unicorn_mode updated
• updated rust custom mutator dependencies and LibAFL custom mutator
• several minor bugfixes