| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: afl | Distribution: openSUSE Tumbleweed |
| Version: 5.03c | Vendor: openSUSE |
| Release: 1.1 | Build date: Wed Sep 2 16:35:15 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 5530872 | Source RPM: afl-5.03c-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://github.com/AFLplusplus/AFLplusplus | |
| Summary: American fuzzy lop is a security-oriented fuzzer | |
American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage for the fuzzed code. The compact synthesized corpora produced by the tool are also useful for seeding other, more labor- or resource-intensive testing regimes down the road. Compared to other instrumented fuzzers, afl-fuzz is designed to be practical: it has modest performance overhead, uses a variety of highly effective fuzzing strategies and effort minimization tricks, requires essentially no configuration, and seamlessly handles complex, real-world use cases - say, common image parsing or file compression libraries.
AGPL-3.0-or-later AND Apache-2.0
* Wed Sep 02 2026 Marcus Meissner <meissner@suse.com>
- Version ++5.03c (release)
! Value Profile implementation for AFL++ by Khaled Yakdan (@kyakdan) that
is much more efficient and intelligent than the libfuzzer implementation.
Enable in the fuzz target with `AFL_LLVM_VALUE_PROFILE=1` and enable for
afl-fuzz with `-r <seconds>` when to activate (default off)
! macOS now uses POSIX shared memory instead of SysV, which lifts the
`kern.sysv.shmseg` / `kern.sysv.shmmax` ceilings (CmpLog alone needs a
145 MB segment, far past the 4 MB macOS default). !!! You need to
recompile your targets on macOS - a target built by an older afl-cc still
expects a SysV id in `__AFL_SHM_ID` !!!
afl-fuzz
- big change: limits before switching modes is not time based but exec based now.
- fix: shmem leakage on target timeouts and crashes - this has been the case
since vanilla AFL. Now fixed for Linux, MacOS and mmap targets.
- for more variability, a "starved" mode is implemented now. If for a longer
time no finds are found, then more seed and mutation variability is
introduced incl. splicing phase enabled. This is visible in the UI.
- env `AFL_STARVED_MINIMIZE_QUEUE`: if starve mode does not help either,
minimize the the queue like afl-cmin does and make the coverage of the
removed entries rediscoverable. Inspired by `Novelty Not Found: Adaptive
Fuzzer Restarts to Improve Input Space Coverage`
- sending `SIGUSR2` forces a sync (AFL internal sync and foreign `-F` ) as
soon as the current queue entry has been fuzzed
- the trimming stage no longer throws away what it produces: crashes,
hangs and new coverage found while shortening a queue entry are now
saved (visible as `op:trim`/`op:ptrim` in the file names)
- `-s fixed_seed` now only sets a fixed seed and does not ignore timings
anymore (required for proper benchmarking in containers without urandom)
- `-t xxx+` fix so dummy seeds do not kill a start-up. rechecks now over
time
- a queue entry that fails its calibration is never fuzzed, so the
coverage it claimed is now handed back to `virgin_bits` and can be
rediscovered by an input that does calibrate.
- the variable behavior flag of a queue entry is cleared now on slow
resumes, another afl vanilla legacy bug
- fixed SAND and FrameShift issues
- symlinked test cases and symlinked subdirectories in the `-i` input
directory are now followed
- foreign sync directories (`-F`) now import symlinked test cases too
- enhancements and fixes for cmplog and ijon
- due to a bug first introduced in v4.30c the cmplog target was used for
fuzzing if present - fixed
- an unreadable foreign sync (`-F`) directory is reported now, once per
directory, and the directories are listed at startup - a mistyped path
was silently ignored for the whole run before
- the queue driver always returns to the main loop now, even when every
entry it looks at is skipped
- a custom mutator that fails to load because it was built with an
instrumenting compiler is named as such instead of just showing the
missing `__afl_*` symbol
- afl-cc
- remove classic AFL instrumentation (colliding coverage), as `AFL_LLVM_PATH`
and `AFL_LLVM_CALLER` replace these mostly and are overall much better
- more invisible decisions can be instrumented now, all optional
- new env var `AFL_LLVM_DENSE=1` to disable PCGUARD basic block pruning
- new env var `AFL_LLVM_MINMAX=1` scores min/max/abs intrinsics, i.e.
clamps that the optimizer made branchless. Default off: it adds 10% map
entries but costs 20% throughput
- new env var `AFL_LLVM_FUSED=1` scores both halves of a fused condition,
i.e. `if (a && b)` speculated into a single `and i1`
- new env var `AFL_LLVM_VECTORS=1` instruments vector selects and vector
min/max one guard pair per lane (default off, they are rarely worth it)
- removed the obsolete afl-as assembler wrapper and its remaining references
- headers shipped in a source checkout are found in `include/` now, an
in-tree build silently preferred an older installed copy before
- fix: `CODE_COVERAGE=1` builds
- IJON: the map expansion is re-applied after a guard-init reset, so a
target whose coverage is split over several instrumented modules gets
the full map; the IJON channels also stay live under a tool that
attached a map without being a forkserver parent (`afl-showmap` on a
single input, `afl-cmin.bash`); `AFL_DUMP_MAP_SIZE` prints the
coverage/IJON breakdown to stderr
- afl-cmin:
- (all variants: C, python, bash, awk): empty (0 byte) input files are now
skipped, plus various other fixes and corner case handling
- afl-merge (symlink) - merge new files into an existing corpus (that is
not minimized)
- afl-cmin.c is now the default afl-cmin, but it needed a larger rewrite
- `-T all` (C and python variants) now counts the CPUs the process is
actually allowed to run on (like `nproc` does)
- fix: afl-cmin.c asked afl_shm_init() to chown the shared maps to gid 0,
which aborted with `fchown() failed` on POSIX shared memory. No tool
wants a chown here, so it now passes -1 like all the others do.
- afl-showmap:
- `-i` now follows symlinked test cases and symlinked subdirectories
- a child killed by a signal no longer reports a garbage exit code in
streaming mode (`-S`)
- the target's instrumentation is checked in `-I` and `-S` mode too, not
only with `-i`
- afl-showmap, afl-cmin, afl-tmin, afl-analyze:
- the IJON max-value slots and a bug-pass map are no longer counted as
coverage: they hold wide values, not hit counts, and were reported as
tuples, minimised against and bucket-classified in place
- fix: releaseshared memory when aborted
- afl-health
- more speed, more info, a few fixes
missing `__afl_*` symbol
- afl-cc
- remove classic AFL instrumentation (colliding coverage), as `AFL_LLVM_PATH`
and `AFL_LLVM_CALLER` replace these mostly and are overall much better
- more invisible decisions can be instrumented now, all optional
- new env var `AFL_LLVM_DENSE=1` to disable PCGUARD basic block pruning
- new env var `AFL_LLVM_MINMAX=1` scores min/max/abs intrinsics, i.e.
clamps that the optimizer made branchless. Default off: it adds 10% map
entries but costs 20% throughput
- new env var `AFL_LLVM_FUSED=1` scores both halves of a fused condition,
i.e. `if (a && b)` speculated into a single `and i1`
- new env var `AFL_LLVM_VECTORS=1` instruments vector selects and vector
min/max one guard pair per lane (default off, they are rarely worth it)
- removed the obsolete afl-as assembler wrapper and its remaining references
- headers shipped in a source checkout are found in `include/` now, an
in-tree build silently preferred an older installed copy before
- fix: `CODE_COVERAGE=1` builds
- IJON: the map expansion is re-applied after a guard-init reset, so a
target whose coverage is split over several instrumented modules gets
the full map; the IJON channels also stay live under a tool that
attached a map without being a forkserver parent (`afl-showmap` on a
single input, `afl-cmin.bash`); `AFL_DUMP_MAP_SIZE` prints the
coverage/IJON breakdown to stderr
- afl-cmin:
- (all variants: C, python, bash, awk): empty (0 byte) input files are now
skipped, plus various other fixes and corner case handling
- afl-merge (symlink) - merge new files into an existing corpus (that is
not minimized)
- afl-cmin.c is now the default afl-cmin, but it needed a larger rewrite
- `-T all` (C and python variants) now counts the CPUs the process is
actually allowed to run on (like `nproc` does)
- fix: afl-cmin.c asked afl_shm_init() to chown the shared maps to gid 0,
which aborted with `fchown() failed` on POSIX shared memory. No tool
wants a chown here, so it now passes -1 like all the others do.
- afl-showmap:
- `-i` now follows symlinked test cases and symlinked subdirectories
- a child killed by a signal no longer reports a garbage exit code in
streaming mode (`-S`)
- the target's instrumentation is checked in `-I` and `-S` mode too, not
only with `-i`
- afl-showmap, afl-cmin, afl-tmin, afl-analyze:
- the IJON max-value slots and a bug-pass map are no longer counted as
coverage: they hold wide values, not hit counts, and were reported as
tuples, minimised against and bucket-classified in place
- fix: releaseshared memory when aborted
- afl-health
- more speed, more info, a few fixes
- custom_mutators:
- removed outdated and pointless radamsa
- frida_mode:
- fix arm64 inline coverage ADRP fixups when instrumentation suppression is
disabled
* Mon Jun 29 2026 Marcus Meissner <meissner@suse.com>
- Version ++5.02c (release)
!!! You need to recompile persistent mode/LLVMFuzzerTestOneInput target !!!
- afl-health:
- new tool: AFL++ campaign health tool checker, much more advanced than
afl-whatsup, with tips, analysis and ssh support
- afl-fuzz:
- Futex implementation missed the clean-up of the shmem
- Futex shmem now lives in general shared memory map as by default only
32 such regions are supported in MacOS
- afl-cc:
- new C11 mode (`AFL_LLVM_C11` at compile time): afl-cc records each
function's local variable count and afl-fuzz uses it as an extra queue
scheduling signal to favor more complex code paths. Noticably improvement,
based on the paper https://mlsec.org/docs/2026-icse.pdf
- if `-fsanitize-coverage-allowlist=`/`-fsanitize-coverage-ignorelist=` is
passed without `AFL_LLVM_ALLOWLIST`/`AFL_LLVM_DENYLIST` being set, the
supplied list is reused as `AFL_LLVM_ALLOWLIST`/`AFL_LLVM_DENYLIST` (with
a warning) so the optimized PCGUARD honors it
- instrument allow/deny lists (`AFL_LLVM_ALLOWLIST`/`AFL_LLVM_DENYLIST` and
the GCC equivalents): function (`fun:`) entries are now matched verbatim
with `fnmatch()` instead of having a `*` prepended automatically - add a
leading `*` yourself for a suffix match. Function entries are matched
against both the mangled and the demangled (LLVM) / unqualified (GCC)
name, and an explicit `fun:` prefix now permits `:` so demangled C++/Rust
names can be listed. File (`src:`) entries are unchanged and still match
as a suffix (an implicit leading `*`)
- AFL_LLVM_CRASHLIST - crash on any function that is marked not to be
instrumented but is entered by fuzzing input
- bugfix for __AFL_LOOP() that lingered since vanilla afl, first run
coverage map would look different to following runs, impacting lots of
functionality (minimizing, stability, etc.)
- afl-* script tools:
- prefer AFL_PATH to find afl-showmap
- man pages: fixed the SYNOPSIS and OPTIONS sections for several tools
- Version ++5.01c (release)
- MacOS persistent mode now uses futex mode now too which increases speed
and reduces system call overhead (opt out with AFL_FAST_CHILD_SYNC) - this
requires a MacOS from 2024 onwards.
- afl-fuzz
- new adaptive MOpt! Much better than the outdated one we still had.
How good it is still needs to be seen but initially it seems to be
better than standard havoc
- enforce halt on UBSAN errors
- afl-cc:
- enforce halt on UBSAN errors (AFL_USE_USBAN=1)
- better cmplog on MacOS
- removed unsupported LLVM version code paths from afl-cc and llvm passes
- compcov: fixes for float splittings (thanks to @ngg)
- nyx_mode:
- fix nyx_mode issues (thanks to @morehouse)
- qemu_mode:
- non-colliding coverage!
- faster persistent fuzzing
- minor bug fixes
- qemu_bridge:
- new mode with current QEMU version, so plugins possible, new processors
- sightly slower than qemu_mode
- WIP!
* Tue Jun 09 2026 Marcus Meissner <meissner@suse.com>
- updated to 5.00c
! AFL++ is now an AGPL 3.0 project !
! Files where the license could be switched were moved to AGPL 3.0+, files
that were under Apache 2.0 with contributations stay on that license.
! Commercial license (donate to a good cause - no money for AFL++) is available
- Switched https://github.com/AFLplusplus/cov-analysis for outdated afl-cov
- MacOS most current version support for afl-fuzz, afl-cc (incl. LTO) and
frida mode!
- Refreshed FreeBSD support by jsaunders-rr, thanks!
- Linux persistent mode uses futex now which increases speed and reduces
system call overhead (opt out with AFL_FAST_CHILD_SYNC), thanks to
@martinus for most of the implementation!
- afl-fuzz:
- `-I tool` call now receives the new crash as a command line parameter
- changed to a better map classifier
- frameshift is disabled now if AFL_CUSTOM_MUTATOR_ONLY is set
- python module fixes
- minor speed, leak and zombie enhancements
- stability info was lost on fast resume - fixed
- somewhere we removed .state/variable/... now it is back :-)
- afl-cc:
- Add LLVM 23 support
- LTO and PCGUARD: new `AFL_LLVM_PATH` (also `AFL_LLVM_LTO_PATH` /
`AFL_LLVM_PATH_MODE`) Ball-Larus per-function path coverage on top
of edge coverage. Three levels: `=1` relaxed (collapse all
guard-only BBs), `=2` restricted (collapse only 2-successor
guard-only BBs), `=3` strict Ball-Larus. LTO additionally composes
with `AFL_LLVM_LTO_CALLER`. See
instrumentation/README.llvm.md and instrumentation/README.lto.md.
- Fixes in the PCGUARD and LTO instrumentation that could lead to sanitizer
triggers in target binaries
- new instrumentation: `afl-llvm-bug-pass.so` provides five runtime
oracles (SCALAR, BUDGET, SIZEFILL, ALLOCSIZE, SLACK) plus a slice-
filter sub-mode for SCALAR, covering arithmetic-bound and logical-
OOB bugs that ASan misses (CVE-2023-4863 / libwebp-Huffman class).
Note: ALLOCSIZE/DERIVE are disabled automatically under
AFL_USE_ASAN to avoid double-instrumentation; see
docs/env_variables.md.
* `AFL_LLVM_BUG_SCALAR=1` - max-value-per-arithmetic-site coverage,
plus per-loop iteration count
* `AFL_LLVM_BUG_SCALAR_SLICE=1` - restrict SCALAR instrumentation to
arithmetic that flows into a memory-
size sink (allocator size, GEP index,
memcpy/memset length). Implies SCALAR.
* `AFL_LLVM_BUG_BUDGET=1` - check `ptr += func()` write-extent
contract
* `AFL_LLVM_BUG_SIZEFILL=1` - check NULL-means-size-only idioms
* `AFL_LLVM_BUG_ALLOCSIZE=1` - track every malloc/calloc/realloc and
feed three signals (headroom IJON-min,
proximity-bucket coverage edge, soft-OOB
tripwire) per in-loop store
* `AFL_LLVM_BUG_SLACK=1` - per-icmp |op0-op1| feedback, mapped
MIN-style onto the bug map (inverse-
bucket) for tight-comparison signal
* `AFL_LLVM_BUG_ALLOCSIZE_FUNCS=Name1,Name2,...` - extend tracking
to user-listed custom allocators
* `AFL_LLVM_BUG_ALLOCSIZE_FREE_FUNCS=Name1,Name2,...` - matching
custom-free functions for the above
* `AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1` - log tracked allocation sizes
into CmpLog RTN slots for `-l Z`
* `AFL_LLVM_BUG=1` - enable all bug-pass modes
Per-site bug-map slots are kept in a private MAP_SIZE_BUG region and
tracked max-rule (compatible with the IJON model)
- cmplog scheduling extensions (companion to bug-pass):
* `-l M` (afl-fuzz) - predicate-tightness scheduling. Treat any
new per-site minimum slack on an inequality CmpLog cmp as a
coverage event and mark the queue entry favoured. Catches the
libwebp-1.3.1 / CVE-2023-4863 input pattern (validation
predicates simultaneously at their tight edges).
* `AFL_LLVM_BUG_ALLOCSIZE_DERIVE=1` or `AFL_LLVM_BUG=1`
(compile-time) and
`-l Z` (afl-fuzz) - size-derive logging. On every freed tracked
allocation, write `(computed_size, max_observed_offset)` into a
CmpLog RTN slot keyed by alloc-site. The existing CmpLog
dictionary mining harvests `computed_size` as a magic constant
and feeds the producing input bytes back into havoc.
- afl-cmin*:
- nyx_mode is now working for all minimizer variants
- afl-showmap:
- no more .afl-showmap-temp-* files lying around
- IJON dist was changed to original IJON implementation: initial matching
bytes, max length is 1024
- lib* tools:
- MacOS support is back, thanks to @Jay-1409 !
* Thu Apr 23 2026 Max Lin <mlin@suse.com>
- Fix suse_version check since SLE 16 SP1 will use a value of 1610
* Fri Mar 13 2026 Marcus Meissner <meissner@suse.com>
- updated to 4.40c
- afl-fuzz:
- FrameShift integrated and enabled by default, disable with
AFL_FRAMESHIFT_DISABLE and configure effort via
AFL_FRAMESHIFT_MAX_OVERHEAD. In extensive fuzzbench analysis at worst
(on average) it does nothing, at best it improves time to new coverage
and total coverage unlocked. https://arxiv.org/pdf/2507.05421
Thanks to @hgarrereyn for the PR!
- Fixed several potential crashes when using IJON
- added `AFL_FORCE_FASTRESUME` which will ignore the saved hash of the
target - but note it will only work if the coverage map size did not
change
- prevent further executed instrumented programs by the fuzz target to
manipulate the coverage
- afl-cc:
- LLVM 22 support (they are again switching around include files ...)
- g_/curl_/xml_ string support for COMPCOV, thanks to @Prajwal-kp-18
- optimized hidden CFG instrumentation (don't instrument vector selects)
- plugin optimization and fixes by @nbars, @kyakdan and @koltiradw
- marked GCC plugins as unmaintained. We need someone who know gimple and
is willing to fix the plugin issues, workarounds for gcc bugs and
overall improve the plugin.
- env `AFL_LLVM_DENY_EXEC` will abort any common exec calls
- afl-cmin:
- new implementation in C by @kcwu - it is currenlty not built though
because of maturity issues, e.g. does not work with Nyx
- afl-cmin.py was changing behaviour to hash the original filenames,
this was reverted.
- afl-cmin and afl-cmin.py honor `AFL_SHA1_FILENAMES` now
- afl-showmap:
- -f support added by Prajwal-kp-18 - thanks!
- faster stream mode by @nbars
- qemu_mode:
- fix when AFL_EXITPOINT is not set, which could prevent detecting crashes
- afl-plot:
- multiple AFL++ out directories now supported, thanks to @Jay-1409 !
* Mon Dec 29 2025 Marcus Meissner <meissner@suse.com>
- updated to 4.35c
- GUIFuzz++ merged: Unleashing Grey-box Fuzzing on Desktop Graphical User
Interfacing Applications
https://futures.cs.utah.edu/papers/25ASE.pdf
- afl-fuzz:
- fix syncing issues with crashes and custom mutators by @AndyH-1
- another attempt to kill every client, thanks to @leonasdev
- afl-cc:
- Huge refactor for default pcguard instrumentation, several minor and
medium bug fixes, complete hidden decision coverage
- LTO: also added complete hidden decision coverage
- Various small fixes by @nbars, thanks!
- IJON fix to search for the necessary include
- Allow compiling the gcc plugin with clang++, thanks to @exoosh
- Fix for unusual bit sizes in cmplog-instructions-pass by @forzafedor
- qemu_mode:
- IJON support, thanks to @nj00001! see qemu_mode/README.md
- leaner, less warnings, thanks to @McSinyx!
- afl-tmin
- fix custom trimmings, thanks to @renatahodovan!
- custom mutators:
- Gramatron: fixes + cjson switch by @CarvedCoder, fix by @jubnzv
* Mon Nov 10 2025 Marcus Meissner <meissner@suse.com>
- disable LTO, causes gcc ICE on s390x due to mix between clang and gcc lto. (bsc#1252006)
* Tue Oct 07 2025 Marcus Meissner <meissner@suse.com>
- updated to 4.34c
- IJON integration by @vi3tL0u1s - thanks a lot!!
- see docs/IJON.md on how to use it
- unicorn_mode:
- UnicornAFL v3!! thanks to @wtdcode!
- qemu_mode:
- fix compilation for a few platforms
- afl-fuzz
- larger improvements to CMPLOG, thanks to @am009
- scroll down before clearing the screen to not loose content
- minor bug fixes
- afl-showmap
- fix -C parameter breakage introduced in v4.33c
- afl-cc:
- enabled LLVM 22
- new env: AFL_COMPILER_LAUNCHER to allow ccache usage (thanks to @nbars)
- fix a offset calculation bug in AFL++ PCGUARD
- make AFL_DUMP_MAP_SIZE work for CLASSIC modes
- fix a crash when running with LLVM 20 when compiling PCGUARD with LTO
- fix deprecation warnings for LLVM 20+
- fix 128 bit support for cmplog-switches pass
- fix 32 bit cmplog support
- skip blocks for instrumentation that are already instrumented
- Building:
- new NO_UNICORN and NO_QEMU and NO_FRIDA build options
- build fixes for FreeBSD
- custom_mutators:
- added AIXCC Team Atlanta's zero-mq plugin to add testcases from remote
* Wed Jul 30 2025 Max Lin <mlin@suse.com>
- Fix Leap 16.0 build
* no dummy gcc-devel in SLFO
* Wed Jul 09 2025 John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
- Add loongarch64 to the list of 32-bit architectures
* Tue Jul 08 2025 John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
- Add loongarch64 to the list of 64-bit architectures
* Mon Jun 30 2025 Marcus Meissner <meissner@suse.com>
- updated to 4.33c
- afl-fuzz:
- Use `AFL_PRELOAD_DISCRIMINATE_FORKSERVER_PARENT` if you use AFL_PRELOAD
to disable fork, see docs (thanks to @alexandredoyen29)
- Fix for FAST power schedules (introduced in 4.32c) (thanks to @kcwu)
- Colors for NO_UI output (thanks to @smoelius)
- Fix potential sync issues when resuming sessions and when instances in a
campaign are restarted and skip entries that were synced from itself
(thanks to @kcwu for raising the issues and providing support!)
- Fix for when fast resuming failed
- more 64 bit archicture support by @maribu
- afl-cc:
- Added instrumenting hidden edges (approx 5% edges were not instrumented,
LLVM sancov overall misses 8% of edges compared to our implementation)
Note that is is currently only implemented for our PCGUARD plugin, not
LTO, CLASSIC, etc.!
- Fix to make AFL_SAN_NO_INST work with gcc_plugin
- MacOS aflpp driver compilation fix (-fsanitize=fuzzer implementation)
- Make AFL_DUMP_MAP_SIZE work even if the target has sanitizer issues
- qemuafl:
- Better MIPS persistent mode support
- `AFL_EXITPOINT` support added
- `AFL_QEMU_BLOCK_COV` block coverage support added
- afl-cmin:
- New afl-cmin.py which is much faster, will be executed by default via
afl-cmin if it executes successfully (thanks to @kcwu!)
- Nyx mode now fully works for minimizing (with afl-cmin.py which is
called by afl-cmin if python is available) - before the map size was
fixed and so large targets lost coverage.
- New desocketing library: utils/libaflppdesock
- Likely works when all other desocketing options fail
- nyx_mode:
- Properly determine map size
* Fri May 16 2025 Marcus Meissner <meissner@suse.com>
- require exact gcc it was built with to avoid gcc version mismatches
(bsc#1243255)
* Mon Apr 28 2025 Marcus Meissner <meissner@suse.com>
- updated to 4.32c
- Fixed a bug where after a fast restart of a full fuzzed corpus afl-fuzz
terminates with "need at least one valid input seed that does not crash"
Small improvements to afl-*-config
- afl-fuzz:
- memory leak fixes by @kcwu - thanks!
- many more nits and small memory saves thanks to @kcwu
- remove deprecated files from queue/.state
- fix bitmap update function if no current trace is present
- fix for afl_custom_queue_get
- various small nits
- afl-cc:
- fix pass support for LLVM 20 (passes were run too early)
- dropped plugin support for LLVM 13
- fix AFL_OLD_FORKSERVER
- various minor fixes
- frida_mode:
- fixes for new MacOS + M4 hardware
- 0001-fix-32-bit-compile.patch: upstream
* Tue Feb 11 2025 Marcus Meissner <meissner@suse.com>
- updated to 4.31c
- SAND mode added (docs/SAND.md) for more effecient fuzzing with sanitizers
(thanks to @wtdcode !)
- afl-fuzz:
- splicing phase is now DISABLED by default because research showed
it is counterproductive. New command line parameter `-u` to enable
it. Splicing is auto-enabled if two cycles without finds happen.
- Python 3.13+ support
- loose file and shared memory permissions on Android and iPhone
- afl-cc:
- LLVM 20 support (again - please don't change the API all the time ...)
- -fsanitize=fuzzer now inserts libAFLDriver.a addtionally early to help
compiling if LLVMFuzzerTestOneOnput is in an .a archive
- added __sanitizer_weak_hook_* functions (in case that is helpful in
weird setups)
- fix bug with large map sizes when multiple libraries are loaded after
the shared memory was obtained.
- 0001-fix-32-bit-compile.patch: fix 32bit builds
* Tue Jan 21 2025 Wolfgang Frisch <wolfgang.frisch@suse.com>
- Bump BuildRequires to llvm >= 17
- This fixes afl-clang-fast and afl-clang-lto on Tumbleweed (boo#1236169)
* Tue Dec 03 2024 Marcus Meissner <meissner@suse.com>
- updated to 4.30c
- afl-gcc and afl-clang funcionality is now removed
- afl-fuzz:
- fastresume feature added. if you abort fuzzing and resume fuzzing
with `-i -` or `AFL_AUTORESUME=1` and the target binary has not changed
then a dump will be loaded and the calibration phase skipped.
to disable this feature set `AFL_NO_FASTRESUME=1`
zlib compression is used if zlib is found at compile time
- improved seed selection algorithm
- added `AFL_CUSTOM_MUTATOR_LATE_SEND=1` to call the custom send()
function after the target has been restarted.
- because of bad math and undefined behaviour fixes we have to change
the CMPLOG map. **YOU NEED TO RECOMPILE CMPLOG TARGETS**
- fixed custom_post_process for calibration
- fixes for AFL_EXIT_ON_TIME and AFL_EXIT_WHEN_DONE, changed behaviour of
AFL_EXIT_WHEN_DONE to finish when really done :-)
- frida_mode:
- AFL_FRIDA_PERSISTENT_ADDR can now be be any reachable address not just
a function entry
- AFL_DEBUG is now the same as AFL_FRIDA_VERBOSE
- AFL_FRIDA_DEBUG_MAPS now works as expected
- qemu_mode:
- new hooks supported (optional), see qemu_mode/hooking_bridge - thanks to
@CowBoy4mH3LL
- unicorn_mode:
- fix install and forkserver (thanks aarnav!)
- pin unicorn version
- nyx_mode:
- bugfixes
- custom mutators:
- custom_send_tcp custom mutator added, thanks to @dergoegge
- afl-cc
- fix to support pointless changes in LLVM 20
- new runtime (!) variable: `AFL_OLD_FORKSERVER` to use the old vanilla
AFL type forkserver. Useful for symcc/symqemu/nautilus/etc. with
AFL_LLVM_INSTRUMENT=CLASSIC
- new compile time variable: `AFL_OPT_LEVEL` to set a specific optimization
level, default is `3`
- correctly explain how to get the correct map size for large targets
- small fix for weird LLVM defines in redhat
- code formatting updated to llvm 18
- improved custom_mutators/aflpp/standalone/aflpp-standalone
- added custom_mutators/autotokens/standalone/autotokens-standalone
- AFL++ headers are now installed to $PREFIX/include/afl
* Mon Jun 10 2024 Marcus Meissner <meissner@suse.com>
- updated to 4.21c
* afl-fuzz
- fixed a regression in afl-fuzz that resulted in a 5-10% performace loss
do a switch from gettimeofday() to clock_gettime() which should be rather
three times faster. The reason for this is unknown.
- new queue selection algorithm based on 2 core years of queue data
analysis. gives a noticable improvement on coverage although the results
seem counterintuitive :-)
- added AFL_DISABLE_REDUNDANT for huge queues
- added `AFL_NO_SYNC` environment variable that does what you think it does
- fix AFL_PERSISTENT_RECORD
- run custom_post_process after standard trimming
- prevent filenames in the queue that have spaces
- minor fix for FAST schedules
- more frequent stats update when syncing (todo: check performance impact)
- now timing of calibration, trimming and syncing is measured seperately,
thanks to @eqv!
- -V timing is now accurately the fuzz time (without syncing), before
long calibration times and syncing could result in now fuzzing being
made when the time was already run out until then, thanks to @eqv!
- fix -n uninstrumented mode when ending fuzzing
- enhanced the ASAN configuration
- make afl-fuzz use less memory with cmplog and fix a memleak
* afl-cc:
- re-enable i386 support that was accidently disabled
- fixes for LTO and outdated afl-gcc mode for i386
- fix COMPCOV split compare for old LLVMs
- disable xml/curl/g_ string transform functions because we do not check
for null pointers ... TODO
- ensure shared memory variables are visible in weird build setups
- compatability to new LLVM 19 changes
* afl-cmin
- work with input files that have a space
* afl-showmap
- fix memory leak on shmem testcase usage (thanks to @ndrewh)
- minor fix to collect coverage -C (thanks to @bet4it)
* Fixed a shmem mmap bug (that rarely came up on MacOS)
* libtokencap: script generate_libtoken_dict.sh added by @a-shvedov
* Mon Apr 15 2024 Marcus Meissner <meissner@suse.com>
- updated to 4.20c
+ A new forkserver communication model is now introduced. afl-fuzz is
backward compatible to old compiled targets if they are not built
for CMPLOG/Redqueen, but new compiled targets will not work with
old afl-fuzz versions!
+ Recompile all targets that are instrumented for CMPLOG/Redqueen!
- AFL++ now supports up to 4 billion coverage edges, up from 6 million.
- New compile option: `make PERFORMANCE=1` - this will enable special
CPU dependent optimizations that make everything more performant - but
the binaries will likely won't work on different platforms. Also
enables a faster hasher if the CPU requirements are met.
- The persistent record feature (see config.h) was expanded to also
support replay, thanks to @quarta-qti !
- afl-fuzz:
- the new deterministic fuzzing feature is now activated by default,
deactivate with -z. Parameters -d and -D are ignored.
- small improvements to CMPLOG/redqueen
- workround for a bug with MOpt -L when used with -M - in the future
we will either remove or rewrite MOpt.
- fix for `-t xxx+` feature
- -e extension option now saves the queue items, crashes, etc. with the
extension too
- fixes for trimmming, correct -V time and reading stats on resume by eqv
thanks a lot!
- afl-cc:
- added collision free caller instrumentation to LTO mode. activate with
`AFL_LLVM_LTO_CALLER=1`. You can set a max depth to go through single
block functions with `AFL_LLVM_LTO_CALLER_DEPTH` (default 0)
- fixes for COMPCOV/LAF and most other modules
- fix for GCC_PLUGIN cmplog that broke on std::strings
- afl-whatsup:
- now also displays current average speed
- small bugfixes
- Fixes for aflpp custom mutator and standalone tool
- Minor edits to afl-persistent-config
- Prevent temporary files being left behind on aborted afl-whatsup
- More CPU benchmarks added to benchmark/
* Mon Feb 05 2024 Marcus Meissner <meissner@suse.com>
- updated to 4.10c
- afl-fuzz:
- default power schedule is now EXPLORE, due a fix in fast schedules
explore is slightly better now.
- fixed minor issues in the mutation engine, thanks to @futhewo for
reporting!
- better deterministic fuzzing is now available, benchmarks have shown
to improve fuzzing. Enable with -D. Thanks to @kdsjZh for the PR!
- afl-cc:
- large rewrite by @SonicStark which fixes a few corner cases, thanks!
- LTO mode now requires llvm 12+
- workaround for ASAN with gcc_plugin mode
- instrumentation:
- LLVM 18 support, thanks to @devnexen!
- Injection (SQL, LDAP, XSS) fuzzing feature now available, see
`instrumentation/README.injections.md` how to activate/use/expand.
- compcov/LAF-intel:
- floating point splitting bug fix by @hexcoder
- due a bug in LLVM 17 integer splitting is disabled there!
- when splitting floats was selected, integers were always split as well,
fixed to require AFL_LLVM_LAF_SPLIT_COMPARES or _ALL as it should
- dynamic instrumentation filtering for LLVM NATIVE, thanks @Mozilla!
see utils/dynamic_covfilter/README.md
- qemu_mode:
- plugins are now activated by default and a new module is included that
produces drcov compatible traces for lighthouse/lightkeeper/...
thanks to @JRomainG to submitting!
- updated Nyx checkout (fixes a bug) and some QOL
- updated the custom grammar mutator
- document afl-cmin does not work on macOS (but afl-cmin.bash does)
* Sun Dec 17 2023 Marcus Meissner <meissner@suse.com>
- updated to 4.09c
- afl-fuzz:
- fixed the new mutation implementation for two bugs
- added `AFL_FINAL_SYNC` which forces a final fuzzer sync (also for `-F`)
before terminating.
- added AFL_IGNORE_SEED_PROBLEMS to skip over seeds that time out instead
of exiting with an error message
- allow -S/-M naming up to 50 characters (from 24)
- CMPLOG:
- added scale support (-l S)
- skip unhelpful insertions (u8)
- added --version and --help command line parameters
- fixed endless loop when reading malformed dictionaries
- new custom mutator function: post_run - thanks to yangzao!
- afl-whatsup:
- detect instanced that are starting up and show them as such as not dead
- now also shows coverage reached
- option -m shows only very relevant stats
- option -n will not use color in the output
- instrumentation:
- fix for a few string compare transform functions for LAF
- we are instrumenting __cxx internal functions again. this might break
a few targets, please report if so.
- frida_mode:
- fixes support for large map offsets
- support for AFL_FUZZER_LOOPCOUNT for afl.rs and LLVMFuzzerTestOneInput
- afl-cmin/afl-cmin.bash: prevent unneeded file errors
- added new tool afl-addseeds that adds new seeds to a running campaign
- added benchmark/benchmark.py if you want to see how good your fuzzing
speed is in comparison to other setups.
* Fri Aug 11 2023 Marcus Meissner <meissner@suse.com>
- updated to 4.08c
- afl-fuzz:
- new mutation engine: mutations that favor discovery more paths are
prefered until no new finds for 10 minutes then switching to mutations
that favor triggering crashes. Modes and switch time can be configured
with `-P`. Also input mode for the target can be defined with `-a` to
be `text` or `binary` (defaults to `generic`)
- new custom mutator that has the new afl++ engine (so it can easily
incorporated into new custom mutators), and also comes with a standalone
command line tool! See custom_mutators/aflpp/standalone/
- display the state of the fuzzing run in the UI :-)
- fix timeout setting if '+' is used or a session is restarted
- -l X option to enable base64 transformation solving
- allow to disable CMPLOG with '-c -' (e.g. afl.rs enforces '-c 0' on
every instance which is counterproductive).
- afl-cmin/afl-cmin.bash:
- fixed a bug inherited from vanilla AFL where a coverage of
map[123] = 11 would be the same as map[1123] = 1
- warn on crashing inputs
- adjust threads if less inputs than threads specified
- afl-cc:
- fixed an off-by-one instrumentation of iselect, hurting coverage a bit.
Thanks to @amykweon for spotting and fixing!
- @toka fixed a bug in laf-intel signed integer comparison splitting,
thanks a lot!!
- more LLVM compatability
- frida_mode:
- support for long form instrumentation on x86_x64 and arm64
- renamed utils/get_symbol_addr.sh to utils/frida_get_symbol_addr.sh
- qemu_mode:
- added qemu_mode/utils/qemu_get_symbol_addr.sh
* Mon Jun 12 2023 Marcus Meissner <meissner@suse.com>
- updated to 4.07c
- afl-fuzz:
- reverse reading the seeds only on restarts (increases performance)
- new env `AFL_POST_PROCESS_KEEP_ORIGINAL` to keep the orignal
data before post process on finds (for atnwalk custom mutator)
- new env `AFL_IGNORE_PROBLEMS_COVERAGE` to ignore coverage from
loaded libs after forkserver initialization (required by Mozilla)
- afl-cc:
- added @responsefile support
- new env `AFL_LLVM_LTO_SKIPINIT` to support the AFL++ based WASM
(https://github.com/fgsect/WAFL) project
- error and print help if afl-clan-lto is used with lto=thin
- rewrote our PCGUARD pass to be compatible with LLVM 15+ shenanigans,
requires LLVM 13+ now instead of 10.0.1+
- fallback to native LLVM PCGUARD if our PCGUARD is unavailable
- fixed a crash in GCC CMPLOG
- afl-showmap:
- added custom mutator post_process and send support
- add `-I filelist` option, an alternative to `-i in_dir`
- afl-cmin + afl-cmin.bash:
- `-T threads` parallel task support, can be a huge speedup!
- qemu_mode:
- Persistent mode + QASAN support for ppc32 targets by @worksbutnottested
- a new grammar custom mutator atnwalk was submitted by @voidptr127 !
- two new custom mutators are now available:
- TritonDSE in custom_mutators/aflpp_tritondse
- SymQEMU in custom_mutators/symqemu
- removed ppc64le condition (failed parsing), we have no 32bit ppc64le
* Mon Apr 17 2023 Marcus Meissner <meissner@suse.com>
- updated to 4.06c
- afl-fuzz:
- ensure temporary file descriptor is closed when not used
- added `AFL_NO_WARN_INSTABILITY`
- added time_wo_finds to fuzzer_stats
- fixed a crash in pizza (1st april easter egg) mode. Sorry for
everyone who was affected!
- allow pizza mode to be disabled when AFL_PIZZA_MODE is set to -1
- option `-p mmopt` now also selects new queue items more often
- fix bug in post_process custom mutator implementation
- print name of custom mutator in UI
- slight changes that improve fuzzer performance
- afl-cc:
- add CFI sanitizer variant to gcc targets
- llvm 16 + 17 support (thanks to @devnexen!)
- support llvm 15 native pcguard changes
- support for LLVMFuzzerTestOneInput -1 return
- LTO autoken and llvm_mode: added AFL_LLVM_DICT2FILE_NO_MAIN support
- qemu_mode:
- fix _RANGES envs to allow hyphens in the filenames
- basic riscv support
- frida_mode:
- added `AFL_FRIDA_STATS_INTERVAL`
- fix issue on MacOS
- unicorn_mode:
- updated and minor issues fixed
- nyx_mode support for all tools
- better sanitizer default options support for all tools
- new custom module: autotoken, a grammar free fuzzer for text inputs
- fixed custom mutator C examples
- more minor fixes and cross-platform support
* Wed Apr 12 2023 Dominique Leuenberger <dimstar@opensuse.org>
- Pin to llvm15 for the time being: code fails to build with
llvm16.
* Thu Jan 05 2023 Marcus Meissner <meissner@suse.com>
- updated to 4.05c
- afl-fuzz:
- added afl_custom_fuzz_send custom mutator feature. Now your can
send fuzz data to the target as you need, e.g. via IPC.
- cmplog mode now has a -l R option for random colorization, thanks
to guyf2010 for the PR!
- queue statistics are written every 30 minutes to
out/NAME/queue_data if compiled with INTROSPECTION
- new env: AFL_FORK_SERVER_KILL_SIGNAL
- afl-showmap/afl-cmin
- `-t none` now translates to `-t 120000` (120 seconds)
- unicorn_mode updated
- updated rust custom mutator dependencies and LibAFL custom mutator
- several minor bugfixes
/usr/bin/afl-addseeds /usr/bin/afl-analyze /usr/bin/afl-c++ /usr/bin/afl-cc /usr/bin/afl-clang /usr/bin/afl-clang++ /usr/bin/afl-clang-fast /usr/bin/afl-clang-fast++ /usr/bin/afl-clang-lto /usr/bin/afl-clang-lto++ /usr/bin/afl-cmin /usr/bin/afl-cmin.awk /usr/bin/afl-cmin.bash /usr/bin/afl-cmin.py /usr/bin/afl-fuzz /usr/bin/afl-g++ /usr/bin/afl-g++-fast /usr/bin/afl-gcc /usr/bin/afl-gcc-fast /usr/bin/afl-gotcpu /usr/bin/afl-health /usr/bin/afl-ld-lto /usr/bin/afl-lto /usr/bin/afl-lto++ /usr/bin/afl-merge /usr/bin/afl-persistent-config /usr/bin/afl-plot /usr/bin/afl-showmap /usr/bin/afl-system-config /usr/bin/afl-tmin /usr/bin/afl-whatsup /usr/libexec/afl /usr/libexec/afl/SanitizerCoverageLTO.so /usr/libexec/afl/SanitizerCoveragePCGUARD.so /usr/libexec/afl/afl-c11-pass.so /usr/libexec/afl/afl-compiler-rt-32.o /usr/libexec/afl/afl-compiler-rt-64.o /usr/libexec/afl/afl-compiler-rt.o /usr/libexec/afl/afl-gcc-cmplog-pass.so /usr/libexec/afl/afl-gcc-cmptrs-pass.so /usr/libexec/afl/afl-gcc-pass.so /usr/libexec/afl/afl-llvm-bug-pass.so /usr/libexec/afl/afl-llvm-dict2file.so /usr/libexec/afl/afl-llvm-ijon-pass.so /usr/libexec/afl/afl-llvm-lto-instrumentlist.so /usr/libexec/afl/afl-llvm-rt-lto-32.o /usr/libexec/afl/afl-llvm-rt-lto-64.o /usr/libexec/afl/afl-llvm-rt-lto.o /usr/libexec/afl/cmplog-instructions-pass.so /usr/libexec/afl/cmplog-routines-pass.so /usr/libexec/afl/cmplog-switches-pass.so /usr/libexec/afl/compare-transform-pass.so /usr/libexec/afl/dynamic_list.txt /usr/libexec/afl/injection-pass.so /usr/libexec/afl/libAFLDriver.a /usr/libexec/afl/libAFLQemuDriver.a /usr/libexec/afl/split-compares-pass.so /usr/libexec/afl/split-switches-pass.so /usr/share/afl /usr/share/afl/dictionaries /usr/share/afl/dictionaries/README.md /usr/share/afl/dictionaries/aff.dict /usr/share/afl/dictionaries/ass.dict /usr/share/afl/dictionaries/atom.dict /usr/share/afl/dictionaries/av1_dc.dict /usr/share/afl/dictionaries/bash.dict /usr/share/afl/dictionaries/bdf.dict /usr/share/afl/dictionaries/bmp.dict /usr/share/afl/dictionaries/bz2.dict /usr/share/afl/dictionaries/creole.dict /usr/share/afl/dictionaries/css.dict /usr/share/afl/dictionaries/csv.dict /usr/share/afl/dictionaries/dds.dict /usr/share/afl/dictionaries/djvu.dict /usr/share/afl/dictionaries/docommand.dict /usr/share/afl/dictionaries/exif.dict /usr/share/afl/dictionaries/fbs.dict /usr/share/afl/dictionaries/ftp.dict /usr/share/afl/dictionaries/gif.dict /usr/share/afl/dictionaries/graphviz.dict /usr/share/afl/dictionaries/heif.dict /usr/share/afl/dictionaries/hoextdown.dict /usr/share/afl/dictionaries/html_tags.dict /usr/share/afl/dictionaries/http.dict /usr/share/afl/dictionaries/icc.dict /usr/share/afl/dictionaries/iccprofile.dict /usr/share/afl/dictionaries/icns.dict /usr/share/afl/dictionaries/initfile.dict /usr/share/afl/dictionaries/jbig2.dict /usr/share/afl/dictionaries/jpeg.dict /usr/share/afl/dictionaries/jpeg2000.dict /usr/share/afl/dictionaries/js.dict /usr/share/afl/dictionaries/json.dict /usr/share/afl/dictionaries/jsonnet.dict /usr/share/afl/dictionaries/jsonschema.dict /usr/share/afl/dictionaries/markdown.dict /usr/share/afl/dictionaries/math.dict /usr/share/afl/dictionaries/mathml.dict /usr/share/afl/dictionaries/mp4.dict /usr/share/afl/dictionaries/mysqld.dict /usr/share/afl/dictionaries/ogg.dict /usr/share/afl/dictionaries/openexr.dict /usr/share/afl/dictionaries/otf.dict /usr/share/afl/dictionaries/pbm.dict /usr/share/afl/dictionaries/pcap.dict /usr/share/afl/dictionaries/pdf.dict /usr/share/afl/dictionaries/perl.dict /usr/share/afl/dictionaries/png.dict /usr/share/afl/dictionaries/proj4.dict /usr/share/afl/dictionaries/protobuf.dict /usr/share/afl/dictionaries/ps.dict /usr/share/afl/dictionaries/psd.dict /usr/share/afl/dictionaries/regexp.dict /usr/share/afl/dictionaries/riff.dict /usr/share/afl/dictionaries/rss.dict /usr/share/afl/dictionaries/rst.dict /usr/share/afl/dictionaries/rtf.dict /usr/share/afl/dictionaries/ruby.dict /usr/share/afl/dictionaries/sas.dict /usr/share/afl/dictionaries/spss.dict /usr/share/afl/dictionaries/sql.dict /usr/share/afl/dictionaries/stata.dict /usr/share/afl/dictionaries/stl.dict /usr/share/afl/dictionaries/svg.dict /usr/share/afl/dictionaries/tex.dict /usr/share/afl/dictionaries/theme-load-fuzz.dict /usr/share/afl/dictionaries/tiff.dict /usr/share/afl/dictionaries/tokener_parse_ex.dict /usr/share/afl/dictionaries/toml.dict /usr/share/afl/dictionaries/type42.dict /usr/share/afl/dictionaries/url.dict /usr/share/afl/dictionaries/utf8.dict /usr/share/afl/dictionaries/vcf.dict /usr/share/afl/dictionaries/vhd.dict /usr/share/afl/dictionaries/vpx_dec.dict /usr/share/afl/dictionaries/wav.dict /usr/share/afl/dictionaries/webm.dict /usr/share/afl/dictionaries/webp.dict /usr/share/afl/dictionaries/wkt.dict /usr/share/afl/dictionaries/x86.dict /usr/share/afl/dictionaries/xml.dict /usr/share/afl/dictionaries/xml_UTF_16.dict /usr/share/afl/dictionaries/xml_UTF_16BE.dict /usr/share/afl/dictionaries/xml_UTF_16LE.dict /usr/share/afl/dictionaries/xpath.dict /usr/share/afl/dictionaries/xslt.dict /usr/share/afl/dictionaries/yaml.dict /usr/share/afl/dictionaries/yara.dict /usr/share/afl/dictionaries/zip.dict /usr/share/afl/injections.dic /usr/share/afl/testcases /usr/share/afl/testcases/README.md /usr/share/afl/testcases/archives /usr/share/afl/testcases/archives/common /usr/share/afl/testcases/archives/common/ar /usr/share/afl/testcases/archives/common/ar/small_archive.a /usr/share/afl/testcases/archives/common/bzip2 /usr/share/afl/testcases/archives/common/bzip2/small_archive.bz2 /usr/share/afl/testcases/archives/common/cab /usr/share/afl/testcases/archives/common/cab/small_archive.cab /usr/share/afl/testcases/archives/common/compress /usr/share/afl/testcases/archives/common/compress/small_archive.Z /usr/share/afl/testcases/archives/common/cpio /usr/share/afl/testcases/archives/common/cpio/small_archive.cpio /usr/share/afl/testcases/archives/common/gzip /usr/share/afl/testcases/archives/common/gzip/small_archive.gz /usr/share/afl/testcases/archives/common/lzo /usr/share/afl/testcases/archives/common/lzo/small_archive.lzo /usr/share/afl/testcases/archives/common/rar /usr/share/afl/testcases/archives/common/rar/small_archive.rar /usr/share/afl/testcases/archives/common/tar /usr/share/afl/testcases/archives/common/tar/small_archive.tar /usr/share/afl/testcases/archives/common/xz /usr/share/afl/testcases/archives/common/xz/small_archive.xz /usr/share/afl/testcases/archives/common/zip /usr/share/afl/testcases/archives/common/zip/small_archive.zip /usr/share/afl/testcases/archives/exotic /usr/share/afl/testcases/archives/exotic/arj /usr/share/afl/testcases/archives/exotic/arj/small_archive.arj /usr/share/afl/testcases/archives/exotic/lha /usr/share/afl/testcases/archives/exotic/lha/small_archive.lha /usr/share/afl/testcases/archives/exotic/lrzip /usr/share/afl/testcases/archives/exotic/lrzip/small_archive.lrz /usr/share/afl/testcases/archives/exotic/lzip /usr/share/afl/testcases/archives/exotic/lzip/small_archive.lz /usr/share/afl/testcases/archives/exotic/lzma /usr/share/afl/testcases/archives/exotic/lzma/small_archive.lzma /usr/share/afl/testcases/archives/exotic/rzip /usr/share/afl/testcases/archives/exotic/rzip/small_archive.rz /usr/share/afl/testcases/archives/exotic/zoo /usr/share/afl/testcases/archives/exotic/zoo/small_archive.zoo /usr/share/afl/testcases/images /usr/share/afl/testcases/images/bmp /usr/share/afl/testcases/images/bmp/not_kitty.bmp /usr/share/afl/testcases/images/gif /usr/share/afl/testcases/images/gif/not_kitty.gif /usr/share/afl/testcases/images/ico /usr/share/afl/testcases/images/ico/not_kitty.ico /usr/share/afl/testcases/images/jp2 /usr/share/afl/testcases/images/jp2/not_kitty.jp2 /usr/share/afl/testcases/images/jpeg /usr/share/afl/testcases/images/jpeg/not_kitty.jpg /usr/share/afl/testcases/images/jxr /usr/share/afl/testcases/images/jxr/not_kitty.jxr /usr/share/afl/testcases/images/png /usr/share/afl/testcases/images/png/not_kitty.png /usr/share/afl/testcases/images/png/not_kitty_alpha.png /usr/share/afl/testcases/images/png/not_kitty_gamma.png /usr/share/afl/testcases/images/png/not_kitty_icc.png /usr/share/afl/testcases/images/tiff /usr/share/afl/testcases/images/tiff/not_kitty.tiff /usr/share/afl/testcases/images/webp /usr/share/afl/testcases/images/webp/not_kitty.webp /usr/share/afl/testcases/multimedia /usr/share/afl/testcases/multimedia/h264 /usr/share/afl/testcases/multimedia/h264/small_movie.mp4 /usr/share/afl/testcases/others /usr/share/afl/testcases/others/elf /usr/share/afl/testcases/others/elf/small_exec.elf /usr/share/afl/testcases/others/js /usr/share/afl/testcases/others/js/small_script.js /usr/share/afl/testcases/others/pcap /usr/share/afl/testcases/others/pcap/small_capture.pcap /usr/share/afl/testcases/others/pdf /usr/share/afl/testcases/others/pdf/small.pdf /usr/share/afl/testcases/others/rtf /usr/share/afl/testcases/others/rtf/small_document.rtf /usr/share/afl/testcases/others/sql /usr/share/afl/testcases/others/sql/simple_queries.sql /usr/share/afl/testcases/others/text /usr/share/afl/testcases/others/text/hello_world.txt /usr/share/afl/testcases/others/xml /usr/share/afl/testcases/others/xml/small_document.xml /usr/share/doc/packages/afl /usr/share/doc/packages/afl/Changelog.md /usr/share/doc/packages/afl/FAQ.md /usr/share/doc/packages/afl/FrameShift.md /usr/share/doc/packages/afl/IJON.md /usr/share/doc/packages/afl/INSTALL.md /usr/share/doc/packages/afl/README.cmplog.md /usr/share/doc/packages/afl/README.gcc_plugin.md /usr/share/doc/packages/afl/README.injections.md /usr/share/doc/packages/afl/README.instrument_list.md /usr/share/doc/packages/afl/README.laf-intel.md /usr/share/doc/packages/afl/README.llvm.md /usr/share/doc/packages/afl/README.lto.md /usr/share/doc/packages/afl/README.md /usr/share/doc/packages/afl/README.persistent_mode.md /usr/share/doc/packages/afl/SAND.md /usr/share/doc/packages/afl/afl-fuzz_approach.md /usr/share/doc/packages/afl/best_practices.md /usr/share/doc/packages/afl/custom_mutators.md /usr/share/doc/packages/afl/env_variables.md /usr/share/doc/packages/afl/features.md /usr/share/doc/packages/afl/fuzzing_binary-only_targets.md /usr/share/doc/packages/afl/fuzzing_in_depth.md /usr/share/doc/packages/afl/important_changes.md /usr/share/doc/packages/afl/rpc_statsd.md /usr/share/doc/packages/afl/third_party_tools.md /usr/share/doc/packages/afl/tutorials.md /usr/share/doc/packages/afl/value_profiling.md /usr/share/licenses/afl /usr/share/licenses/afl/COPYING /usr/share/licenses/afl/LICENSE /usr/share/man/man8/afl-addseeds.8.gz /usr/share/man/man8/afl-analyze.8.gz /usr/share/man/man8/afl-c++.8.gz /usr/share/man/man8/afl-cc.8.gz /usr/share/man/man8/afl-clang-fast++.8.gz /usr/share/man/man8/afl-clang-fast.8.gz /usr/share/man/man8/afl-clang-lto++.8.gz /usr/share/man/man8/afl-clang-lto.8.gz /usr/share/man/man8/afl-cmin.8.gz /usr/share/man/man8/afl-cmin.awk.8.gz /usr/share/man/man8/afl-cmin.bash.8.gz /usr/share/man/man8/afl-cmin.py.8.gz /usr/share/man/man8/afl-fuzz.8.gz /usr/share/man/man8/afl-g++-fast.8.gz /usr/share/man/man8/afl-gcc-fast.8.gz /usr/share/man/man8/afl-gotcpu.8.gz /usr/share/man/man8/afl-health.8.gz /usr/share/man/man8/afl-lto++.8.gz /usr/share/man/man8/afl-lto.8.gz /usr/share/man/man8/afl-merge.8.gz /usr/share/man/man8/afl-persistent-config.8.gz /usr/share/man/man8/afl-plot.8.gz /usr/share/man/man8/afl-showmap.8.gz /usr/share/man/man8/afl-system-config.8.gz /usr/share/man/man8/afl-tmin.8.gz /usr/share/man/man8/afl-whatsup.8.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Sep 6 22:37:26 2026