Please check the build logs for more information.
See Builds for ideas on how to fix a failed build, or Metadata for how to configure docs.rs builds.
If you believe this is docs.rs' fault, open an issue.
LibAFL, the fuzzer library.
Advanced Fuzzing Library - Slot your own fuzzers together and extend their features using Rust.
LibAFL is written and maintained by
- Andrea Fioraldi andrea@aflplus.plus
- Dominik Maier dominik@aflplus.plus
- s1341 github@shmarya.net
- Dongjia Zhang toka@aflplus.plus
- Addison Crump me@addisoncrump.info
- Romain Malmain rmalmain@pm.me
Why LibAFL?
LibAFL gives you many of the benefits of an off-the-shelf fuzzer, while being completely customizable. Some highlight features currently include:
fast
: We do everything we can at compile time, keeping runtime overhead minimal. Users reach 120k execs/sec in frida-mode on a phone (using all cores).scalable
:Low Level Message Passing
,LLMP
for short, allows LibAFL to scale almost linearly over cores, and via TCP to multiple machines.adaptable
: You can replace each part of LibAFL. For example,BytesInput
is just one potential form input: feel free to add an AST-based input for structured fuzzing, and more.multi platform
: LibAFL was confirmed to work on Windows, MacOS, Linux, and Android on x86_64 and aarch64.LibAFL
can be built inno_std
mode to inject LibAFL into obscure targets like embedded devices and hypervisors.bring your own target
: We support binary-only modes, like Frida-Mode, as well as multiple compilation passes for sourced-based instrumentation. Of course it's easy to add custom instrumentation backends.
Overview
LibAFL is a collection of reusable pieces of fuzzers, written in Rust. It is fast, multi-platform, no_std compatible, and scales over cores and machines.
It offers a main crate that provide building blocks for custom fuzzers, libafl, a library containing common code that can be used for targets instrumentation, libafl_targets, and a library providing facilities to wrap compilers, libafl_cc.
LibAFL offers integrations with popular instrumentation frameworks. At the moment, the supported backends are:
- SanitizerCoverage, in libafl_targets
- Frida, in libafl_frida
- QEMU user-mode and system mode, including hooks for emulation, in libafl_qemu
- TinyInst, in libafl_tinyinst by elbiazo
Getting started
- Install the Dependecies
-
The Rust development language.
We highly recommend not to use e.g. your Linux distribition package as this is likely outdated. So rather install Rust directly, instructions can be found here. -
LLVM tools
The LLVM tools (including clang, clang++) are needed (newer than LLVM 15.0.0 up to LLVM 18.1.3) If you are using Debian/Ubuntu, again, we highly recommmend that you install the package from here
(In libafl_concolic
, we only support LLVM version newer than 18)
- Cargo-make
We use cargo-make to build the fuzzers infuzzers/
directory. You can install it with
- Clone the LibAFL repository with
- Build the library using
- Build the API documentation with
- Browse the LibAFL book (WIP!) with (requires mdbook)
&&
We collect all example fuzzers in ./fuzzers
.
Be sure to read their documentation (and source), this is the natural way to get started!
You can run each example fuzzer with
as long as the fuzzer directory has Makefile.toml
file.
The best-tested fuzzer is ./fuzzers/libfuzzer_libpng
, a multicore libfuzzer-like fuzzer using LibAFL for a libpng harness.
Resources
-
Our research paper
-
Our RC3 talk explaining the core concepts
-
Our Fuzzcon Europe talk with a (a bit but not so much outdated) step-by-step discussion on how to build some example fuzzers
-
The Fuzzing101 solutions & series of blog posts by epi
-
Blogpost on binary-only fuzzing lib libaf_qemu, Hacking TMNF - Fuzzing the game server, by RickdeJager.
Contributing
Please check out CONTRIBUTING.md for the contributing guideline.
Cite
If you use LibAFL for your academic work, please cite the following paper: