https://github.com/vanhauser-thc/afl-pin

run AFL with pintool
https://github.com/vanhauser-thc/afl-pin

afl afl-fuzz afl-fuzzer binary-instrument fuzzer fuzzing pin pintool thc

Last synced: 8 days ago
JSON representation

run AFL with pintool

• Host: GitHub
• URL: https://github.com/vanhauser-thc/afl-pin
• Owner: vanhauser-thc
• License: agpl-3.0
• Created: 2018-03-23T23:55:59.000Z (over 6 years ago)
• Default Branch: master
• Last Pushed: 2020-02-24T13:14:22.000Z (over 4 years ago)
• Last Synced: 2024-10-14T12:15:41.335Z (22 days ago)
• Topics: afl, afl-fuzz, afl-fuzzer, binary-instrument, fuzzer, fuzzing, pin, pintool, thc
• Language: C++
• Size: 27.3 KB
• Stars: 66
• Watchers: 5
• Forks: 11
• Open Issues: 2
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
Intro

=====

This is the fastest pintool afl-fuzzer out there currently.

And it runs with pintool 3.6 up to 3.11, so 4.x x64 kernels are fine.

But ... pintool is super slow.

So this is basically only if you have no other option.

I am currently developing an alternative with DynamoRIO and is 10x faster -

but still, afl qemu mode is 10-50x faster than that ...

Installation

============

1. download, compile and install afl => https://github.com/vanhauser-thc/AFLplusplus

Optional: 2. download, compile and install dyninst => https://github.com/dyninst/dyninst

Optional: 3. download, compile and install afl-dyninst  => https://github.com/vanhauser-thc/afl-dyninst

4. download and unpack pin => https://software.intel.com/en-us/articles/pintool-downloads (download version 3.6 to 3.11)

5. export PIN_ROOT=/path/to/pin directory

6. make a symlink to the afl folder in the afl-pin directory named "afl" , e.g. "ln -s ../AFLplusplus afl"

7. make

8. make install

Options

=======

-libs               also instrument the dynamic libraries

-exitpoint target   exit the program when this address/function is reached. speeeed!

-forkserver         install a forkserver. You must set PIN_APP_LD_PRELOAD - or use afl-fuzz-pin.sh

-entrypoint target  function or address where you want to install the forkserver

-alternative        a little bit faster but less quality

How to run

==========

Optional: 1. afl-dyninst.sh -i program -o program_instrumented -D

It is a good idea to add -e and -E with well selected function addresses to

make the fuzzing faster

2. afl-fuzz-pin.sh [normal afl-fuzz options]

If you did not do step 1, add the option -forkserver (-forkserver is faster

than afl-dyninst). You can increase speed more by selecting a good

"-entrypoint function_name" or "-entrypoing 0x123456" location.

That's it! If you fuzzing does not run, afl-fuzz might need more memory, set

AFL_MEM to a high value, e.g. 700 for 700MB

Using -forkserver requires

PIN_APP_LD_PRELOAD=/usr/local/lib/pintool/forkserver.so

but afl-fuzz-pin.sh takes care of this.

When to use it

==============

When you have no source code, normal afl-dyninst is crashing the binary,

qemu mode -Q is not an option and dynamorio is not working either.

Pin is even 90% slower than my dynamorio implementation ...

Limitations

===========

Pin is super slow ... it is the tool of last resort on x86/x64.

Who and where

=============

Marc "van Hauser" Heuse  || 

https://github.com/vanhauser-thc/afl-pin