performing-fuzzing-with-aflplusplus

Compile the target with afl-cc or afl-clang-fast to add instrumentation, prepare a seed corpus of valid inputs, then run afl-fuzz with -i for the input directory and -o for the output directory. Monitor progress with afl-whatsup and the fuzzer_stats file.

Use afl-cmin to remove redundant seeds from the corpus while preserving coverage, and afl-tmin to shrink individual crash test cases to their minimal reproducing form. Both tools take -i input, -o output, and the target binary after a double dash.

Yes, AFL++ supports binary-only fuzzing through QEMU mode (-Q flag) and Unicorn mode (-U flag), which instrument the target at runtime instead of compile time. Compile-time instrumentation is preferred when source is available because it runs faster.

Yes, compile the target with -fsanitize=address during instrumentation to detect memory errors that do not crash outright. When using ASan, set the afl-fuzz memory limit to none with -m none because ASan allocates large amounts of virtual memory.

Crashes are stored in the crashes subdirectory of the output folder, with filenames encoding the signal number. Use casr-afl for automated severity analysis, afl-tmin to minimize inputs, or gdb --batch -ex run to reproduce crashes under a debugger.

Coverage-guided fuzzing requires an initial seed corpus of valid inputs and works best on Linux with proper core_pattern configuration. It may struggle with highly structured input formats unless you supply a dictionary or use CMPLOG instrumentation for comparison solving.