{"id":16837035,"url":"https://github.com/vanhauser-thc/afl-pin","last_synced_at":"2025-03-22T04:30:57.814Z","repository":{"id":48132411,"uuid":"126550048","full_name":"vanhauser-thc/afl-pin","owner":"vanhauser-thc","description":"run AFL with pintool","archived":false,"fork":false,"pushed_at":"2020-02-24T13:14:22.000Z","size":28,"stargazers_count":65,"open_issues_count":2,"forks_count":11,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-03-18T08:11:20.435Z","etag":null,"topics":["afl","afl-fuzz","afl-fuzzer","binary-instrument","fuzzer","fuzzing","pin","pintool","thc"],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vanhauser-thc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-03-23T23:55:59.000Z","updated_at":"2024-10-26T01:09:05.000Z","dependencies_parsed_at":"2022-08-12T19:20:43.671Z","dependency_job_id":null,"html_url":"https://github.com/vanhauser-thc/afl-pin","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vanhauser-thc%2Fafl-pin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vanhauser-thc%2Fafl-pin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vanhauser-thc%2Fafl-pin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vanhauser-thc%2Fafl-pin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vanhauser-thc","download_url":"https://codeload.github.com/vanhauser-thc/afl-pin/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244907420,"owners_count":20529850,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["afl","afl-fuzz","afl-fuzzer","binary-instrument","fuzzer","fuzzing","pin","pintool","thc"],"created_at":"2024-10-13T12:15:52.286Z","updated_at":"2025-03-22T04:30:57.323Z","avatar_url":"https://github.com/vanhauser-thc.png","language":"C++","funding_links":[],"categories":["Uncategorized"],"sub_categories":["Uncategorized"],"readme":"Intro\n=====\nThis is the fastest pintool afl-fuzzer out there currently.\nAnd it runs with pintool 3.6 up to 3.11, so 4.x x64 kernels are fine.\nBut ... pintool is super slow.\nSo this is basically only if you have no other option.\nI am currently developing an alternative with DynamoRIO and is 10x faster -\nbut still, afl qemu mode is 10-50x faster than that ...\n\n\nInstallation\n============\n1. download, compile and install afl =\u003e https://github.com/vanhauser-thc/AFLplusplus\nOptional: 2. download, compile and install dyninst =\u003e https://github.com/dyninst/dyninst\nOptional: 3. download, compile and install afl-dyninst  =\u003e https://github.com/vanhauser-thc/afl-dyninst\n4. download and unpack pin =\u003e https://software.intel.com/en-us/articles/pintool-downloads (download version 3.6 to 3.11)\n5. export PIN_ROOT=/path/to/pin directory\n6. make a symlink to the afl folder in the afl-pin directory named \"afl\" , e.g. \"ln -s ../AFLplusplus afl\"\n7. make\n8. make install\n\n\nOptions\n=======\n-libs               also instrument the dynamic libraries\n-exitpoint target   exit the program when this address/function is reached. speeeed!\n-forkserver         install a forkserver. You must set PIN_APP_LD_PRELOAD - or use afl-fuzz-pin.sh\n-entrypoint target  function or address where you want to install the forkserver\n-alternative        a little bit faster but less quality\n\n\nHow to run\n==========\nOptional: 1. afl-dyninst.sh -i program -o program_instrumented -D\nIt is a good idea to add -e and -E with well selected function addresses to\nmake the fuzzing faster\n\n2. afl-fuzz-pin.sh [normal afl-fuzz options]\nIf you did not do step 1, add the option -forkserver (-forkserver is faster\nthan afl-dyninst). You can increase speed more by selecting a good\n\"-entrypoint function_name\" or \"-entrypoing 0x123456\" location.\nThat's it! If you fuzzing does not run, afl-fuzz might need more memory, set\nAFL_MEM to a high value, e.g. 700 for 700MB\nUsing -forkserver requires\nPIN_APP_LD_PRELOAD=/usr/local/lib/pintool/forkserver.so\nbut afl-fuzz-pin.sh takes care of this.\n\n\nWhen to use it\n==============\nWhen you have no source code, normal afl-dyninst is crashing the binary,\nqemu mode -Q is not an option and dynamorio is not working either.\nPin is even 90% slower than my dynamorio implementation ...\n\n\nLimitations\n===========\nPin is super slow ... it is the tool of last resort on x86/x64.\n\n\nWho and where\n=============\nMarc \"van Hauser\" Heuse \u003cmh@mh-sec.de\u003e || \u003cvh@thc.org\u003e\nhttps://github.com/vanhauser-thc/afl-pin\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvanhauser-thc%2Fafl-pin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvanhauser-thc%2Fafl-pin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvanhauser-thc%2Fafl-pin/lists"}