{"id":13843147,"url":"https://github.com/IntelLabs/kAFL","last_synced_at":"2025-07-11T18:30:32.878Z","repository":{"id":37259707,"uuid":"265391486","full_name":"IntelLabs/kAFL","owner":"IntelLabs","description":"A fuzzer for full VM kernel/driver targets","archived":false,"fork":false,"pushed_at":"2025-06-06T13:23:14.000Z","size":10474,"stargazers_count":715,"open_issues_count":45,"forks_count":95,"subscribers_count":26,"default_branch":"master","last_synced_at":"2025-06-06T14:27:46.722Z","etag":null,"topics":["firmware","fuzzing","grimoire","intel","kernel","kvm","qemu","redqueen","research","security","validation"],"latest_commit_sha":null,"homepage":"https://intellabs.github.io/kAFL/","language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/IntelLabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"Security.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-05-19T23:20:24.000Z","updated_at":"2025-06-06T13:23:16.000Z","dependencies_parsed_at":"2022-07-08T19:49:29.376Z","dependency_job_id":"b6e20431-af5b-4d31-b671-321ab9fb7b17","html_url":"https://github.com/IntelLabs/kAFL","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/IntelLabs/kAFL","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IntelLabs%2FkAFL","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IntelLabs%2FkAFL/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IntelLabs%2FkAFL/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IntelLabs%2FkAFL/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/IntelLabs","download_url":"https://codeload.github.com/IntelLabs/kAFL/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IntelLabs%2FkAFL/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264869918,"owners_count":23676130,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["firmware","fuzzing","grimoire","intel","kernel","kvm","qemu","redqueen","research","security","validation"],"created_at":"2024-08-04T17:01:56.197Z","updated_at":"2025-07-11T18:30:32.854Z","avatar_url":"https://github.com/IntelLabs.png","language":"Makefile","readme":"\u003ch1 align=\"center\"\u003e\n  \u003cbr\u003ekAFL\u003c/br\u003e\n\u003c/h1\u003e\n\n\u003ch3 align=\"center\"\u003e\nHW-assisted Feedback Fuzzer for x86 VMs\n\u003c/h3\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://github.com/IntelLabs/kAFL/actions/workflows/CI.yml\"\u003e\n    \u003cimg src=\"https://github.com/IntelLabs/kAFL/actions/workflows/CI.yml/badge.svg\" alt=\"CI\"\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://github.com/IntelLabs/kAFL/releases\"\u003e\n    \u003cimg alt=\"GitHub release (latest by date)\" src=\"https://img.shields.io/github/v/release/IntelLabs/kAFL\"\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://hub.docker.com/r/intellabs/kafl\"\u003e\n    \u003cimg alt=\"Docker Image Version (latest by date)\" src=\"https://img.shields.io/docker/v/intellabs/kafl?label=Docker%20Image\"\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://hub.docker.com/r/intellabs/kafl\"\u003e\n    \u003cimg alt=\"Docker Pulls\" src=\"https://img.shields.io/docker/pulls/intellabs/kafl\"\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://github.com/IntelLabs/kAFL/blob/master/LICENSE.md\"\u003e\n    \u003cimg alt=\"GitHub\" src=\"https://img.shields.io/github/license/IntelLabs/kafl\"\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://IntelLabs.github.io/kAFL/\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/Online-Documentation-green?style=for-the-badge\u0026logo=gitbook\" alt=\"online_docs\"/\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\nkAFL/[Nyx](https://nyx-fuzz.com) is a fast guided fuzzer for the x86 VM. It is great for anything that\nexecutes as QEMU/KVM guest, in particular x86 firmware, kernels and full-blown\noperating systems.\n\n**Note: All components are provided for research and validation purposes only.\nUse at your own Risk**\n\n## Targets\n\nkAFL is the main fuzzer driving the [**Linux Security Hardening for Confidential Compute**](https://github.com/intel/ccc-linux-guest-hardening) effort, identifing vulnerabilities in a complex setup and improving the security of the Linux kernel for all CC solutions.\n\nAmong other successful targets for kAFL/Nyx :\n\n- [**Intel SGX enclaves**](https://www.usenix.org/conference/usenixsecurity22/presentation/cloosters)\n- [**Intel TDX TDVF firmware**](https://github.com/hemx0147/TDVFuzz)\n- [**Mozilla Firefox IPCs**](https://dl.acm.org/doi/10.1145/3492321.3519591)\n- [**Linux network applications** ](https://dl.acm.org/doi/10.1145/3492321.3519591)\n- [**Windows drivers**](https://github.com/IntelLabs/kAFL/issues/53)\n- [**Hypervisors**](https://www.usenix.org/conference/usenixsecurity21/presentation/schumilo)\n- Play [**Super Mario** at 10-30x speedups](https://dl.acm.org/doi/10.1145/3492321.3519591) !\n\nAdditionally, kAFL has been used internally at Intel for x86 firmware and drivers validation as well as SMM handlers fuzzing.\n\n## Features\n\n- kAFL/Nyx uses [_Intel VT_](https://www.intel.com/content/www/us/en/virtualization/virtualization-technology/intel-virtualization-technology.html), [_Intel PML_](https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/page-modification-logging-vmm-white-paper.pdf) and _Intel PT_ to achieve efficient execution, snapshot reset and coverage feedback for greybox or whitebox fuzzing scenarios. It allows to run many x86 FW and OS kernels with any desired toolchain and minimal code \nmodifications.\n\n- kAFL uses a custom [kAFL-Fuzzer](https://github.com/IntelLabs/kafl.fuzzer)\n  written in Python. The kAFL-Fuzzer follows an AFL-like design and is optimized\n  for working with many Qemu instances in parallel, supporting flexible VM\n  configuration, logging and debug options.\n\n- kAFL integrates the [_Radamsa_](https://gitlab.com/akihe/radamsa) fuzzer as well as [_Redqueen_](https://github.com/RUB-SysSec/redqueen) and [_Grimoire_](https://github.com/RUB-SysSec/grimoire) extensions. Redqueen uses VM introspection to extract runtime inputs to conditional instructions, overcoming typical magic byte and other input checks. Grimoire attempts to identify keywords and syntax from fuzz inputs in order to generate more clever large-scale mutations.\n\nFor details on **Redqueen**, **Grimoire**, [_IJON_](https://github.com/RUB-SysSec/ijon), **Nyx**, please visit [nyx-fuzz.com](https://nyx-fuzz.com).\n\n\n## Requirements\n\n- **Intel Skylake or later:** The setup requires a Gen-6 or newer Intel CPU (for\n  Intel PT) and adequate system memory (~2GB RAM per CPU)\n\n- **Patched Host Kernel:** A modified Linux host kernel will be installed as part\n  of the setup. Running kAFL inside a VM may work starting IceLake or later CPU.\n\n- **Recent Debian/Ubuntu:** The installation and tutorials are\n  tested for recent Ubuntu LTS (\u003e=20.04) and Debian (\u003e=bullseye).\n\n\n## Getting Started\n\nOnce you have python3-venv and make installed, you can install kAFL using `make deploy`:\n\n```shell\nsudo apt install python3-venv make git\ngit clone https://github.com/IntelLabs/kAFL.git\ncd kAFl\nmake deploy\n```\n\nInstallation make take some time and require a reboot to update your kernel.\n\nCheck the detailed [installation guide](https://intellabs.github.io/kAFL/tutorials/installation.html) in case\nof trouble, or the [deployment guide](https://intellabs.github.io/kAFL/reference/deployment.html) for detailed\ninformation and customizing the kAFL setup for your project.\n\n## Fuzzing your first target\n\nAs a first fuzzing example, we recommend [Fuzzing the Linux Kernel](https://intellabs.github.io/kAFL/tutorials/linux/fuzzing_linux_kernel.html).\n\nOther targets are available such as:\n\n- [Windows driver/userspace](https://intellabs.github.io/kAFL/tutorials/windows/index.html)\n- [Linux userspace](https://github.com/IntelLabs/kafl.targets/tree/master/linux-user)\n- [UEFI OVMF](https://github.com/IntelLabs/kafl.targets/tree/master/uefi_ovmf_64)\n\nA improved documentation is under work for these targets.\n\n## Maintainers\n\n- [@Wenzel - Mathieu Tarral](https://github.com/Wenzel) ([Intel](https://github.com/IntelLabs))\n- [@il-steffen - Steffen Schulz](https://github.com/il-steffen) ([IntelLabs](https://github.com/IntelLabs))\n\n## License\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n","funding_links":[],"categories":["Python","Python (1887)","Makefile"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FIntelLabs%2FkAFL","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FIntelLabs%2FkAFL","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FIntelLabs%2FkAFL/lists"}