[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-aflpp":3,"mdc--d4h32p-key":35,"related-org-trail-of-bits-aflpp":5320,"related-repo-trail-of-bits-aflpp":5469},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":30,"sourceUrl":33,"mdContent":34},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"C#","c",{"name":21,"slug":22,"type":16},"Testing","testing",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:12.433192",null,541,[29],"agent-skills",{"repoUrl":24,"stars":23,"forks":27,"topics":31,"description":32},[29],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Ftesting-handbook-skills\u002Fskills\u002Faflpp","---\nname: aflpp\ntype: fuzzer\ndescription: >\n  AFL++ is a fork of AFL with better fuzzing performance and advanced features.\n  Use for multi-core fuzzing of C\u002FC++ projects.\n---\n\n# AFL++\n\nAFL++ is a fork of the original AFL fuzzer that offers better fuzzing performance and more advanced features while maintaining stability. A major benefit over libFuzzer is that AFL++ has stable support for running fuzzing campaigns on multiple cores, making it ideal for large-scale fuzzing efforts.\n\n## When to Use\n\n| Fuzzer | Best For | Complexity |\n|--------|----------|------------|\n| AFL++ | Multi-core fuzzing, diverse mutations, mature projects | Medium |\n| libFuzzer | Quick setup, single-threaded, simple harnesses | Low |\n| LibAFL | Custom fuzzers, research, advanced use cases | High |\n\n**Choose AFL++ when:**\n- You need multi-core fuzzing to maximize throughput\n- Your project can be compiled with Clang or GCC\n- You want diverse mutation strategies and mature tooling\n- libFuzzer has plateaued and you need more coverage\n- You're fuzzing production codebases that benefit from parallel execution\n\n## Quick Start\n\n```c++\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F Call your code with fuzzer-provided data\n    check_buf((char*)data, size);\n    return 0;\n}\n```\n\nCompile and run:\n```bash\n# Setup AFL++ wrapper script first (see Installation)\n.\u002Fafl++ docker afl-clang-fast++ -DNO_MAIN=1 -O2 -fsanitize=fuzzer harness.cc main.cc -o fuzz\nmkdir seeds && echo \"aaaa\" > seeds\u002Fminimal_seed\n.\u002Fafl++ docker afl-fuzz -i seeds -o out -- .\u002Ffuzz\n```\n\n## Installation\n\nAFL++ has many dependencies including LLVM, Python, and Rust. We recommend using a current Debian or Ubuntu distribution for fuzzing with AFL++.\n\n| Method | When to Use | Supported Compilers |\n|--------|-------------|---------------------|\n| Ubuntu\u002FDebian repos | Recent Ubuntu, basic features only | Ubuntu 23.10: Clang 14 & GCC 13\u003Cbr>Debian 12: Clang 14 & GCC 12 |\n| Docker (from Docker Hub) | Specific AFL++ version, Apple Silicon support | As of 4.35c: Clang 19 & GCC 11 |\n| Docker (from source) | Test unreleased features, apply patches | Configurable in Dockerfile |\n| From source | Avoid Docker, need specific patches | Adjustable via `LLVM_CONFIG` env var |\n\n### Ubuntu\u002FDebian\n\nPrior to installing afl++, check the clang version dependency of the packge with `apt-cache show afl++`, and install the matching `lld` version (e.g., `lld-17`).\n\n\n```bash\napt install afl++ lld-17\n```\n\n\n### Docker (from Docker Hub)\n\n```bash\ndocker pull aflplusplus\u002Faflplusplus:stable\n```\n\n### Docker (from source)\n\n```bash\ngit clone --depth 1 --branch stable https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\ncd AFLplusplus\ndocker build -t aflplusplus .\n```\n\n### From source\n\nRefer to the [Dockerfile](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\u002Fblob\u002Fstable\u002FDockerfile) for Ubuntu version requirements and dependencies. Set `LLVM_CONFIG` to specify Clang version (e.g., `llvm-config-18`).\n\n### Wrapper Script Setup\n\nCreate a wrapper script to run AFL++ on host or Docker:\n\n```bash\ncat \u003C\u003C'EOF' > .\u002Fafl++\n#!\u002Fbin\u002Fsh\nAFL_VERSION=\"${AFL_VERSION:-\"stable\"}\"\ncase \"$1\" in\n   host)\n        shift\n        bash -c \"$*\"\n        ;;\n    docker)\n        shift\n        \u002Fusr\u002Fbin\u002Fenv docker run -ti \\\n            --privileged \\\n            -v .\u002F:\u002Fsrc \\\n            --rm \\\n            --name afl_fuzzing \\\n            \"aflplusplus\u002Faflplusplus:$AFL_VERSION\" \\\n            bash -c \"cd \u002Fsrc && bash -c \\\"$*\\\"\"\n        ;;\n    *)\n        echo \"Usage: $0 {host|docker}\"\n        exit 1\n        ;;\nesac\nEOF\nchmod +x .\u002Fafl++\n```\n\n**Security Warning:** The `afl-system-config` and `afl-persistent-config` scripts require root privileges and disable OS security features. Do not fuzz on production systems or your development environment. Use a dedicated VM instead.\n\n### System Configuration\n\nRun after each reboot for up to 15% more executions per second:\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-system-config\n```\n\nFor maximum performance, disable kernel security mitigations (requires grub bootloader, not supported in Docker):\n\n```bash\n.\u002Fafl++ host afl-persistent-config\nupdate-grub\nreboot\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-system-config\n```\n\nVerify with `cat \u002Fproc\u002Fcmdline` - output should include `mitigations=off`.\n\n## Writing a Harness\n\n### Harness Structure\n\nAFL++ supports libFuzzer-style harnesses:\n\n```c++\n#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F 1. Validate input size if needed\n    if (size \u003C MIN_SIZE || size > MAX_SIZE) return 0;\n\n    \u002F\u002F 2. Call target function with fuzz data\n    target_function(data, size);\n\n    \u002F\u002F 3. Return 0 (non-zero reserved for future use)\n    return 0;\n}\n```\n\n### Harness Rules\n\n| Do | Don't |\n|----|-------|\n| Reset global state between runs | Rely on state from previous runs |\n| Handle edge cases gracefully | Exit on invalid input |\n| Keep harness deterministic | Use random number generators |\n| Free allocated memory | Create memory leaks |\n| Validate input sizes | Process unbounded input |\n\n> **See Also:** For detailed harness writing techniques, patterns for handling complex inputs,\n> and advanced strategies, see the **fuzz-harness-writing** technique skill.\n\n## Compilation\n\nAFL++ offers multiple compilation modes with different trade-offs.\n\n### Compilation Mode Decision Tree\n\nChoose your compilation mode:\n- **LTO mode** (`afl-clang-lto`): Best performance and instrumentation. Try this first.\n- **LLVM mode** (`afl-clang-fast`): Fall back if LTO fails to compile.\n- **GCC plugin** (`afl-gcc-fast`): For projects requiring GCC.\n\n### Basic Compilation (LLVM mode)\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-clang-fast++ -DNO_MAIN=1 -O2 -fsanitize=fuzzer harness.cc main.cc -o fuzz\n```\n\n### GCC Compilation\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-g++-fast -DNO_MAIN=1 -O2 -fsanitize=fuzzer harness.cc main.cc -o fuzz\n```\n\n**Important:** GCC version must match the version used to compile the AFL++ GCC plugin.\n\n### With Sanitizers\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> AFL_USE_ASAN=1 afl-clang-fast++ -DNO_MAIN=1 -O2 -fsanitize=fuzzer harness.cc main.cc -o fuzz\n```\n\n> **See Also:** For detailed sanitizer configuration, common issues, and advanced flags,\n> see the **address-sanitizer** and **undefined-behavior-sanitizer** technique skills.\n\n### Build Flags\n\nNote that `-g` is not necessary, it is added by default by the AFL++ compilers.\n\n| Flag | Purpose |\n|------|---------|\n| `-DNO_MAIN=1` | Skip main function when using libFuzzer harness |\n| `-O2` | Production optimization level (recommended for fuzzing) |\n| `-fsanitize=fuzzer` | Enable libFuzzer compatibility mode and adds the fuzzer runtime when linking executable |\n| `-fsanitize=fuzzer-no-link` | Instrument without linking fuzzer runtime (for static libraries and object files) |\n\n## Corpus Management\n\n### Creating Initial Corpus\n\nAFL++ requires at least one non-empty seed file:\n\n```bash\nmkdir seeds\necho \"aaaa\" > seeds\u002Fminimal_seed\n```\n\nFor real projects, gather representative inputs:\n- Download example files for the format you're fuzzing\n- Extract test cases from the project's test suite\n- Use minimal valid inputs for your file format\n\n### Corpus Minimization\n\nAfter a campaign, minimize the corpus to keep only unique coverage:\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-cmin -i out\u002Fdefault\u002Fqueue -o minimized_corpus -- .\u002Ffuzz\n```\n\n> **See Also:** For corpus creation strategies, dictionaries, and seed selection,\n> see the **fuzzing-corpus** technique skill.\n\n## Running Campaigns\n\n### Basic Run\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -i seeds -o out -- .\u002Ffuzz\n```\n\n### Setting Environment Variables\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> AFL_FAST_CAL=1 afl-fuzz -i seeds -o out -- .\u002Ffuzz\n```\n\n### Interpreting Output\n\nThe AFL++ UI shows real-time fuzzing statistics:\n\n| Output | Meaning |\n|--------|---------|\n| **execs\u002Fsec** | Execution speed - higher is better |\n| **cycles done** | Number of queue passes completed |\n| **corpus count** | Number of unique test cases in queue |\n| **saved crashes** | Number of unique crashes found |\n| **stability** | % of stable edges (should be near 100%) |\n\n### Output Directory Structure\n\n```text\nout\u002Fdefault\u002F\n├── cmdline          # How was the SUT invoked?\n├── crashes\u002F         # Inputs that crash the SUT\n│   └── id:000000,sig:06,src:000002,time:286,execs:13105,op:havoc,rep:4\n├── hangs\u002F           # Inputs that hang the SUT\n├── queue\u002F           # Test cases reproducing final fuzzer state\n│   ├── id:000000,time:0,execs:0,orig:minimal_seed\n│   └── id:000001,src:000000,time:0,execs:8,op:havoc,rep:6,+cov\n├── fuzzer_stats     # Campaign statistics\n└── plot_data        # Data for plotting\n```\n\n### Analyzing Results\n\nView live campaign statistics:\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-whatsup out\n```\n\nCreate coverage plots:\n\n```bash\napt install gnuplot\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-plot out\u002Fdefault out_graph\u002F\n```\n\n### Re-executing Test Cases\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> .\u002Ffuzz out\u002Fdefault\u002Fcrashes\u002F\u003Ctest_case>\n```\n\n### Fuzzer Options\n\n| Option | Purpose |\n|--------|---------|\n| `-G 4000` | Maximum test input length (default: 1048576 bytes) |\n| `-t 1000` | Timeout in milliseconds for each test case (default: 1000ms) |\n| `-m 1000` | Memory limit in megabytes (default: 0 = unlimited) |\n| `-x .\u002Fdict.dict` | Use dictionary file to guide mutations |\n\n## Environment Variables That Matter\n\nAFL++ has [many environment variables](https:\u002F\u002Faflplus.plus\u002Fdocs\u002Fenv_variables\u002F), but most are niche. These are the ones that matter in practice.\n\n### Always Set These\n\n```bash\n# Every campaign should use tmpfs — SSDs will thank you, and it's faster\nAFL_TMPDIR=\u002Fdev\u002Fshm\n```\n\n`AFL_TMPDIR` is a free performance win with no downsides — not setting it wears out your SSD and slows fuzzing.\n\n### Slow Targets\n\n```bash\n# Speeds up calibration ~2.5x — use when targets are slow (e.g., >10 ms\u002Fexec)\nAFL_FAST_CAL=1\n```\n\n`AFL_FAST_CAL` reduces calibration time with negligible precision loss. Recommended specifically for slow targets where calibration would otherwise take a long time.\n\n### Multi-Core Campaigns\n\n```bash\n# On the primary (-M) instance only — needed for afl-cmin, not for fuzzing itself\nAFL_FINAL_SYNC=1\n\n# On all instances — cache test cases in memory (default: 50 MB, good range: 50-250 MB)\nAFL_TESTCACHE_SIZE=100\n```\n\n`AFL_FINAL_SYNC` tells the primary instance to do a final import from all secondaries when stopping. This does not affect the fuzzing process itself — it only matters when you later run `afl-cmin` for corpus minimization, ensuring the primary's queue has the full combined corpus. `AFL_TESTCACHE_SIZE` caches test cases in memory to reduce disk I\u002FO; the default is 50 MB and values between 50-250 MB work well for most campaigns.\n\n### CI\u002FAutomated Fuzzing\n\n```bash\n# Fail fast if fuzzing isn't finding anything\nAFL_EXIT_ON_TIME=3600  # 1 hour with no new paths = stop\n\n# Or run until \"done\" (all queue entries processed)\nAFL_EXIT_WHEN_DONE=1\n\n# Headless environments\nAFL_NO_UI=1\n```\n\nUnbounded fuzzing in CI wastes resources. Set time limits or use exit conditions.\n\n### Variables to Avoid\n\n| Variable | Why Skip It |\n|----------|-------------|\n| `AFL_NO_ARITH` | Can hurt coverage on binary formats, but may be useful for text-based targets |\n| `AFL_SHUFFLE_QUEUE` | Only for exotic setups, usually harmful |\n| `AFL_DISABLE_TRIM` | Trimming is valuable, don't disable without reason |\n\n## Multi-Core Fuzzing\n\nAFL++ excels at multi-core fuzzing with two major advantages:\n1. More executions per second (scales linearly with physical cores)\n2. Asymmetrical fuzzing (e.g., one ASan job, rest without sanitizers)\n\n### Starting a Campaign\n\nStart the primary fuzzer (in background):\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -M primary -i seeds -o state -- .\u002Ffuzz 1>primary.log 2>primary.error &\n```\n\nStart secondary fuzzers (as many as you have cores):\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -S secondary01 -i seeds -o state -- .\u002Ffuzz 1>secondary01.log 2>secondary01.error &\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -S secondary02 -i seeds -o state -- .\u002Ffuzz 1>secondary02.log 2>secondary02.error &\n```\n\n### Monitoring Multi-Core Campaigns\n\nList all running jobs:\n\n```bash\njobs\n```\n\nView live statistics (updates every second):\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> watch -n1 --color afl-whatsup state\u002F\n```\n\n### Stopping All Fuzzers\n\n```bash\nkill $(jobs -p)\n```\n\n## Coverage Analysis\n\nAFL++ automatically tracks coverage through edge instrumentation. Coverage information is stored in `fuzzer_stats` and `plot_data`.\n\n### Measuring Coverage\n\nUse `afl-plot` to visualize coverage over time:\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-plot out\u002Fdefault out_graph\u002F\n```\n\n### Improving Coverage\n\n- Use dictionaries for format-aware fuzzing\n- Run longer campaigns (cycles_wo_finds indicates plateau)\n- Try different mutation strategies with multi-core fuzzing\n- Analyze coverage gaps and add targeted seed inputs\n\n> **See Also:** For detailed coverage analysis techniques, identifying coverage gaps,\n> and systematic coverage improvement, see the **coverage-analysis** technique skill.\n\n## CMPLOG\n\nCMPLOG\u002FRedQueen is the best path constraint solving mechanism available in any fuzzer.\nTo enable it, the fuzz target needs to be instrumented for it.\nBefore building the fuzzing target set the environment variable:\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> AFL_LLVM_CMPLOG=1 make\n```\n\nNo special action is needed for compiling and linking the harness.\n\nTo run a fuzzer instance with a CMPLOG instrumented fuzzing target, add `-c0` to the command like arguments:\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -c0 -S cmplog -i seeds -o state -- .\u002Ffuzz 1>secondary02.log 2>secondary02.error &\n```\n\n## Sanitizer Integration\n\nSanitizers are essential for finding memory corruption bugs that don't cause immediate crashes.\n\n### AddressSanitizer (ASan)\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> AFL_USE_ASAN=1 afl-clang-fast++ -DNO_MAIN=1 -O2 -fsanitize=fuzzer harness.cc main.cc -o fuzz\n```\n\n**Note:** Memory limit (`-m`) is not supported with ASan due to 20TB virtual memory reservation.\n\n### UndefinedBehaviorSanitizer (UBSan)\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> AFL_USE_UBSAN=1 afl-clang-fast++ -DNO_MAIN=1 -O2 -fsanitize=fuzzer,undefined harness.cc main.cc -o fuzz\n```\n\n### Common Sanitizer Issues\n\n| Issue | Solution |\n|-------|----------|\n| ASan slows fuzzing | Use only 1 ASan job in multi-core setup |\n| Stack exhaustion | Increase stack with `ASAN_OPTIONS=stack_size=...` |\n| GCC version mismatch | Ensure system GCC matches AFL++ plugin version |\n\n> **See Also:** For comprehensive sanitizer configuration and troubleshooting,\n> see the **address-sanitizer** technique skill.\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| Use LLVMFuzzerTestOneInput harnesses where possible | If a fuzzing campaign has at least 85% stability then this is the most efficient fuzzing style. If not then try standard input or file input fuzzing |\n| Use dictionaries | Helps fuzzer discover format-specific keywords and magic bytes |\n| Set realistic timeouts | Prevents false positives from system load |\n| Limit input size | Larger inputs don't necessarily explore more space |\n| Monitor stability | Low stability indicates non-deterministic behavior |\n\n### Standard Input Fuzzing\n\nAFL++ can fuzz programs reading from stdin without a libFuzzer harness:\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-clang-fast++ -O2 main_stdin.c -o fuzz_stdin\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -i seeds -o out -- .\u002Ffuzz_stdin\n```\n\nThis is slower than persistent mode but requires no harness code.\n\n### File Input Fuzzing\n\nFor programs that read files, use `@@` placeholder:\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-clang-fast++ -O2 main_file.c -o fuzz_file\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -i seeds -o out -- .\u002Ffuzz_file @@\n```\n\nFor better performance, use `fmemopen` to create file descriptors from memory.\n\n### Argument Fuzzing\n\nFuzz command-line arguments using `argv-fuzz-inl.h`:\n\n```c++\n#include \u003Cstdio.h>\n#include \u003Cstdlib.h>\n#include \u003Cstring.h>\n\n#ifdef __AFL_COMPILER\n#include \"argv-fuzz-inl.h\"\n#endif\n\nvoid check_buf(char *buf, size_t buf_len) {\n    if(buf_len > 0 && buf[0] == 'a') {\n        if(buf_len > 1 && buf[1] == 'b') {\n            if(buf_len > 2 && buf[2] == 'c') {\n                abort();\n            }\n        }\n    }\n}\n\nint main(int argc, char *argv[]) {\n#ifdef __AFL_COMPILER\n    AFL_INIT_ARGV();\n#endif\n\n    if (argc \u003C 2) {\n        fprintf(stderr, \"Usage: %s \u003Cinput_string>\\n\", argv[0]);\n        return 1;\n    }\n\n    char *input_buf = argv[1];\n    size_t len = strlen(input_buf);\n    check_buf(input_buf, len);\n    return 0;\n}\n```\n\nDownload the header:\n\n```bash\ncurl -O https:\u002F\u002Fraw.githubusercontent.com\u002FAFLplusplus\u002FAFLplusplus\u002Fstable\u002Futils\u002Fargv_fuzzing\u002Fargv-fuzz-inl.h\n```\n\nCompile and run:\n\n```bash\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-clang-fast++ -O2 main_arg.c -o fuzz_arg\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -i seeds -o out -- .\u002Ffuzz_arg\n```\n\n### Performance Tuning\n\n| Setting | Impact |\n|---------|--------|\n| CPU core count | Linear scaling with physical cores |\n| Persistent mode | 10-20x faster than fork server |\n| `-G` input size limit | Smaller = faster, but may miss bugs |\n| ASan ratio | 1 ASan job per 4-8 non-ASan jobs |\n\n## Troubleshooting\n\n| Problem | Cause | Solution |\n|---------|-------|----------|\n| Low exec\u002Fsec (\u003C1k) | Not using persistent mode | Create a LLVMFuzzerTestOneInput style harness |\n| Low stability (\u003C85%) | Non-deterministic code | Fuzz a program via stdin or file inputs, or create such a harness |\n| GCC plugin error | GCC version mismatch | Ensure system GCC matches AFL++ build and install gcc-$GCC_VERSION-plugin-dev |\n| No crashes found | Need sanitizers | Recompile with `AFL_USE_ASAN=1` |\n| Memory limit exceeded | ASan uses 20TB virtual | Remove `-m` flag when using ASan |\n| Docker performance loss | Virtualization overhead | Use bare metal or VM for production fuzzing |\n\n## Related Skills\n\n### Technique Skills\n\n| Skill | Use Case |\n|-------|----------|\n| **fuzz-harness-writing** | Detailed guidance on writing effective harnesses |\n| **address-sanitizer** | Memory error detection during fuzzing |\n| **undefined-behavior-sanitizer** | Detect undefined behavior bugs |\n| **fuzzing-corpus** | Building and managing seed corpora |\n| **fuzzing-dictionaries** | Creating dictionaries for format-aware fuzzing |\n\n### Related Fuzzers\n\n| Skill | When to Consider |\n|-------|------------------|\n| **libfuzzer** | Quick prototyping, single-threaded fuzzing is sufficient |\n| **libafl** | Need custom mutators or research-grade features |\n\n## Resources\n\n### Key External Resources\n\n**[AFL++ GitHub Repository](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus)**\nOfficial repository with comprehensive documentation, examples, and issue tracker.\n\n**[Fuzzing in Depth](https:\u002F\u002Fraw.githubusercontent.com\u002FAFLplusplus\u002FAFLplusplus\u002Frefs\u002Fheads\u002Fstable\u002Fdocs\u002Ffuzzing_in_depth.md)**\nAdvanced documentation by the AFL++ team covering instrumentation modes, optimization techniques, and advanced use cases.\n\n**[AFL++ Under The Hood](https:\u002F\u002Fblog.ritsec.club\u002Fposts\u002Fafl-under-hood\u002F)**\nTechnical deep-dive into AFL++ internals, mutation strategies, and coverage tracking mechanisms.\n\n**[AFL++: Combining Incremental Steps of Fuzzing Research](https:\u002F\u002Fwww.usenix.org\u002Fsystem\u002Ffiles\u002Fwoot20-paper-fioraldi.pdf)**\nResearch paper describing AFL++ architecture and performance improvements over original AFL.\n\n### Video Resources\n\n- [Fuzzing cURL](https:\u002F\u002Fblog.trailofbits.com\u002F2023\u002F02\u002F14\u002Fcurl-audit-fuzzing-libcurl-command-line-interface\u002F) - Trail of Bits blog post on using AFL++ argument fuzzing for cURL\n- [Sudo Vulnerability Walkthrough](https:\u002F\u002Fwww.youtube.com\u002Fplaylist?list=PLhixgUqwRTjy0gMuT4C3bmjeZjuNQyqdx) - LiveOverflow series on rediscovering CVE-2021-3156\n- [Rediscovery of libpng bug](https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=PJLWlmp8CDM) - LiveOverflow video on finding CVE-2023-4863\n",{"data":36,"body":38},{"name":4,"type":37,"description":6},"fuzzer",{"type":39,"children":40},"root",[41,50,56,63,149,158,188,194,253,258,425,431,436,548,555,584,614,619,644,649,735,740,770,776,781,1033,1059,1065,1070,1110,1115,1182,1203,1209,1215,1220,1327,1333,1420,1441,1447,1452,1458,1463,1518,1524,1586,1592,1655,1665,1671,1743,1768,1774,1787,1877,1883,1889,1894,1941,1946,1964,1970,1975,2036,2054,2060,2066,2124,2130,2197,2203,2208,2310,2316,2326,2332,2337,2377,2382,2443,2449,2509,2515,2604,2610,2624,2630,2663,2673,2679,2711,2721,2727,2790,2815,2821,2920,2925,2931,3004,3010,3015,3029,3035,3040,3134,3139,3311,3317,3322,3336,3341,3395,3401,3436,3442,3461,3467,3480,3522,3528,3551,3568,3574,3579,3623,3628,3641,3733,3739,3744,3750,3819,3837,3843,3915,3921,3988,4005,4011,4017,4104,4110,4115,4219,4224,4230,4243,4352,4365,4371,4384,4652,4657,4682,4686,4790,4796,4876,4882,5028,5034,5040,5138,5144,5197,5203,5209,5224,5239,5254,5269,5275,5314],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"afl",[47],{"type":48,"value":49},"text","AFL++",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54],{"type":48,"value":55},"AFL++ is a fork of the original AFL fuzzer that offers better fuzzing performance and more advanced features while maintaining stability. A major benefit over libFuzzer is that AFL++ has stable support for running fuzzing campaigns on multiple cores, making it ideal for large-scale fuzzing efforts.",{"type":42,"tag":57,"props":58,"children":60},"h2",{"id":59},"when-to-use",[61],{"type":48,"value":62},"When to Use",{"type":42,"tag":64,"props":65,"children":66},"table",{},[67,91],{"type":42,"tag":68,"props":69,"children":70},"thead",{},[71],{"type":42,"tag":72,"props":73,"children":74},"tr",{},[75,81,86],{"type":42,"tag":76,"props":77,"children":78},"th",{},[79],{"type":48,"value":80},"Fuzzer",{"type":42,"tag":76,"props":82,"children":83},{},[84],{"type":48,"value":85},"Best For",{"type":42,"tag":76,"props":87,"children":88},{},[89],{"type":48,"value":90},"Complexity",{"type":42,"tag":92,"props":93,"children":94},"tbody",{},[95,113,131],{"type":42,"tag":72,"props":96,"children":97},{},[98,103,108],{"type":42,"tag":99,"props":100,"children":101},"td",{},[102],{"type":48,"value":49},{"type":42,"tag":99,"props":104,"children":105},{},[106],{"type":48,"value":107},"Multi-core fuzzing, diverse mutations, mature projects",{"type":42,"tag":99,"props":109,"children":110},{},[111],{"type":48,"value":112},"Medium",{"type":42,"tag":72,"props":114,"children":115},{},[116,121,126],{"type":42,"tag":99,"props":117,"children":118},{},[119],{"type":48,"value":120},"libFuzzer",{"type":42,"tag":99,"props":122,"children":123},{},[124],{"type":48,"value":125},"Quick setup, single-threaded, simple harnesses",{"type":42,"tag":99,"props":127,"children":128},{},[129],{"type":48,"value":130},"Low",{"type":42,"tag":72,"props":132,"children":133},{},[134,139,144],{"type":42,"tag":99,"props":135,"children":136},{},[137],{"type":48,"value":138},"LibAFL",{"type":42,"tag":99,"props":140,"children":141},{},[142],{"type":48,"value":143},"Custom fuzzers, research, advanced use cases",{"type":42,"tag":99,"props":145,"children":146},{},[147],{"type":48,"value":148},"High",{"type":42,"tag":51,"props":150,"children":151},{},[152],{"type":42,"tag":153,"props":154,"children":155},"strong",{},[156],{"type":48,"value":157},"Choose AFL++ when:",{"type":42,"tag":159,"props":160,"children":161},"ul",{},[162,168,173,178,183],{"type":42,"tag":163,"props":164,"children":165},"li",{},[166],{"type":48,"value":167},"You need multi-core fuzzing to maximize throughput",{"type":42,"tag":163,"props":169,"children":170},{},[171],{"type":48,"value":172},"Your project can be compiled with Clang or GCC",{"type":42,"tag":163,"props":174,"children":175},{},[176],{"type":48,"value":177},"You want diverse mutation strategies and mature tooling",{"type":42,"tag":163,"props":179,"children":180},{},[181],{"type":48,"value":182},"libFuzzer has plateaued and you need more coverage",{"type":42,"tag":163,"props":184,"children":185},{},[186],{"type":48,"value":187},"You're fuzzing production codebases that benefit from parallel execution",{"type":42,"tag":57,"props":189,"children":191},{"id":190},"quick-start",[192],{"type":48,"value":193},"Quick Start",{"type":42,"tag":195,"props":196,"children":201},"pre",{"className":197,"code":198,"language":199,"meta":200,"style":200},"language-c++ shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F Call your code with fuzzer-provided data\n    check_buf((char*)data, size);\n    return 0;\n}\n","c++","",[202],{"type":42,"tag":203,"props":204,"children":205},"code",{"__ignoreMap":200},[206,217,226,235,244],{"type":42,"tag":207,"props":208,"children":211},"span",{"class":209,"line":210},"line",1,[212],{"type":42,"tag":207,"props":213,"children":214},{},[215],{"type":48,"value":216},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n",{"type":42,"tag":207,"props":218,"children":220},{"class":209,"line":219},2,[221],{"type":42,"tag":207,"props":222,"children":223},{},[224],{"type":48,"value":225},"    \u002F\u002F Call your code with fuzzer-provided data\n",{"type":42,"tag":207,"props":227,"children":229},{"class":209,"line":228},3,[230],{"type":42,"tag":207,"props":231,"children":232},{},[233],{"type":48,"value":234},"    check_buf((char*)data, size);\n",{"type":42,"tag":207,"props":236,"children":238},{"class":209,"line":237},4,[239],{"type":42,"tag":207,"props":240,"children":241},{},[242],{"type":48,"value":243},"    return 0;\n",{"type":42,"tag":207,"props":245,"children":247},{"class":209,"line":246},5,[248],{"type":42,"tag":207,"props":249,"children":250},{},[251],{"type":48,"value":252},"}\n",{"type":42,"tag":51,"props":254,"children":255},{},[256],{"type":48,"value":257},"Compile and run:",{"type":42,"tag":195,"props":259,"children":263},{"className":260,"code":261,"language":262,"meta":200,"style":200},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Setup AFL++ wrapper script first (see Installation)\n.\u002Fafl++ docker afl-clang-fast++ -DNO_MAIN=1 -O2 -fsanitize=fuzzer harness.cc main.cc -o fuzz\nmkdir seeds && echo \"aaaa\" > seeds\u002Fminimal_seed\n.\u002Fafl++ docker afl-fuzz -i seeds -o out -- .\u002Ffuzz\n","bash",[264],{"type":42,"tag":203,"props":265,"children":266},{"__ignoreMap":200},[267,276,331,381],{"type":42,"tag":207,"props":268,"children":269},{"class":209,"line":210},[270],{"type":42,"tag":207,"props":271,"children":273},{"style":272},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[274],{"type":48,"value":275},"# Setup AFL++ wrapper script first (see Installation)\n",{"type":42,"tag":207,"props":277,"children":278},{"class":209,"line":219},[279,285,291,296,301,306,311,316,321,326],{"type":42,"tag":207,"props":280,"children":282},{"style":281},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[283],{"type":48,"value":284},".\u002Fafl++",{"type":42,"tag":207,"props":286,"children":288},{"style":287},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[289],{"type":48,"value":290}," docker",{"type":42,"tag":207,"props":292,"children":293},{"style":287},[294],{"type":48,"value":295}," afl-clang-fast++",{"type":42,"tag":207,"props":297,"children":298},{"style":287},[299],{"type":48,"value":300}," -DNO_MAIN=1",{"type":42,"tag":207,"props":302,"children":303},{"style":287},[304],{"type":48,"value":305}," -O2",{"type":42,"tag":207,"props":307,"children":308},{"style":287},[309],{"type":48,"value":310}," -fsanitize=fuzzer",{"type":42,"tag":207,"props":312,"children":313},{"style":287},[314],{"type":48,"value":315}," harness.cc",{"type":42,"tag":207,"props":317,"children":318},{"style":287},[319],{"type":48,"value":320}," main.cc",{"type":42,"tag":207,"props":322,"children":323},{"style":287},[324],{"type":48,"value":325}," -o",{"type":42,"tag":207,"props":327,"children":328},{"style":287},[329],{"type":48,"value":330}," fuzz\n",{"type":42,"tag":207,"props":332,"children":333},{"class":209,"line":228},[334,339,344,350,356,361,366,371,376],{"type":42,"tag":207,"props":335,"children":336},{"style":281},[337],{"type":48,"value":338},"mkdir",{"type":42,"tag":207,"props":340,"children":341},{"style":287},[342],{"type":48,"value":343}," seeds",{"type":42,"tag":207,"props":345,"children":347},{"style":346},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[348],{"type":48,"value":349}," &&",{"type":42,"tag":207,"props":351,"children":353},{"style":352},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[354],{"type":48,"value":355}," echo",{"type":42,"tag":207,"props":357,"children":358},{"style":346},[359],{"type":48,"value":360}," \"",{"type":42,"tag":207,"props":362,"children":363},{"style":287},[364],{"type":48,"value":365},"aaaa",{"type":42,"tag":207,"props":367,"children":368},{"style":346},[369],{"type":48,"value":370},"\"",{"type":42,"tag":207,"props":372,"children":373},{"style":346},[374],{"type":48,"value":375}," >",{"type":42,"tag":207,"props":377,"children":378},{"style":287},[379],{"type":48,"value":380}," seeds\u002Fminimal_seed\n",{"type":42,"tag":207,"props":382,"children":383},{"class":209,"line":237},[384,388,392,397,402,406,410,415,420],{"type":42,"tag":207,"props":385,"children":386},{"style":281},[387],{"type":48,"value":284},{"type":42,"tag":207,"props":389,"children":390},{"style":287},[391],{"type":48,"value":290},{"type":42,"tag":207,"props":393,"children":394},{"style":287},[395],{"type":48,"value":396}," afl-fuzz",{"type":42,"tag":207,"props":398,"children":399},{"style":287},[400],{"type":48,"value":401}," -i",{"type":42,"tag":207,"props":403,"children":404},{"style":287},[405],{"type":48,"value":343},{"type":42,"tag":207,"props":407,"children":408},{"style":287},[409],{"type":48,"value":325},{"type":42,"tag":207,"props":411,"children":412},{"style":287},[413],{"type":48,"value":414}," out",{"type":42,"tag":207,"props":416,"children":417},{"style":287},[418],{"type":48,"value":419}," --",{"type":42,"tag":207,"props":421,"children":422},{"style":287},[423],{"type":48,"value":424}," .\u002Ffuzz\n",{"type":42,"tag":57,"props":426,"children":428},{"id":427},"installation",[429],{"type":48,"value":430},"Installation",{"type":42,"tag":51,"props":432,"children":433},{},[434],{"type":48,"value":435},"AFL++ has many dependencies including LLVM, Python, and Rust. We recommend using a current Debian or Ubuntu distribution for fuzzing with AFL++.",{"type":42,"tag":64,"props":437,"children":438},{},[439,459],{"type":42,"tag":68,"props":440,"children":441},{},[442],{"type":42,"tag":72,"props":443,"children":444},{},[445,450,454],{"type":42,"tag":76,"props":446,"children":447},{},[448],{"type":48,"value":449},"Method",{"type":42,"tag":76,"props":451,"children":452},{},[453],{"type":48,"value":62},{"type":42,"tag":76,"props":455,"children":456},{},[457],{"type":48,"value":458},"Supported Compilers",{"type":42,"tag":92,"props":460,"children":461},{},[462,486,504,522],{"type":42,"tag":72,"props":463,"children":464},{},[465,470,475],{"type":42,"tag":99,"props":466,"children":467},{},[468],{"type":48,"value":469},"Ubuntu\u002FDebian repos",{"type":42,"tag":99,"props":471,"children":472},{},[473],{"type":48,"value":474},"Recent Ubuntu, basic features only",{"type":42,"tag":99,"props":476,"children":477},{},[478,480,484],{"type":48,"value":479},"Ubuntu 23.10: Clang 14 & GCC 13",{"type":42,"tag":481,"props":482,"children":483},"br",{},[],{"type":48,"value":485},"Debian 12: Clang 14 & GCC 12",{"type":42,"tag":72,"props":487,"children":488},{},[489,494,499],{"type":42,"tag":99,"props":490,"children":491},{},[492],{"type":48,"value":493},"Docker (from Docker Hub)",{"type":42,"tag":99,"props":495,"children":496},{},[497],{"type":48,"value":498},"Specific AFL++ version, Apple Silicon support",{"type":42,"tag":99,"props":500,"children":501},{},[502],{"type":48,"value":503},"As of 4.35c: Clang 19 & GCC 11",{"type":42,"tag":72,"props":505,"children":506},{},[507,512,517],{"type":42,"tag":99,"props":508,"children":509},{},[510],{"type":48,"value":511},"Docker (from source)",{"type":42,"tag":99,"props":513,"children":514},{},[515],{"type":48,"value":516},"Test unreleased features, apply patches",{"type":42,"tag":99,"props":518,"children":519},{},[520],{"type":48,"value":521},"Configurable in Dockerfile",{"type":42,"tag":72,"props":523,"children":524},{},[525,530,535],{"type":42,"tag":99,"props":526,"children":527},{},[528],{"type":48,"value":529},"From source",{"type":42,"tag":99,"props":531,"children":532},{},[533],{"type":48,"value":534},"Avoid Docker, need specific patches",{"type":42,"tag":99,"props":536,"children":537},{},[538,540,546],{"type":48,"value":539},"Adjustable via ",{"type":42,"tag":203,"props":541,"children":543},{"className":542},[],[544],{"type":48,"value":545},"LLVM_CONFIG",{"type":48,"value":547}," env var",{"type":42,"tag":549,"props":550,"children":552},"h3",{"id":551},"ubuntudebian",[553],{"type":48,"value":554},"Ubuntu\u002FDebian",{"type":42,"tag":51,"props":556,"children":557},{},[558,560,566,568,574,576,582],{"type":48,"value":559},"Prior to installing afl++, check the clang version dependency of the packge with ",{"type":42,"tag":203,"props":561,"children":563},{"className":562},[],[564],{"type":48,"value":565},"apt-cache show afl++",{"type":48,"value":567},", and install the matching ",{"type":42,"tag":203,"props":569,"children":571},{"className":570},[],[572],{"type":48,"value":573},"lld",{"type":48,"value":575}," version (e.g., ",{"type":42,"tag":203,"props":577,"children":579},{"className":578},[],[580],{"type":48,"value":581},"lld-17",{"type":48,"value":583},").",{"type":42,"tag":195,"props":585,"children":587},{"className":260,"code":586,"language":262,"meta":200,"style":200},"apt install afl++ lld-17\n",[588],{"type":42,"tag":203,"props":589,"children":590},{"__ignoreMap":200},[591],{"type":42,"tag":207,"props":592,"children":593},{"class":209,"line":210},[594,599,604,609],{"type":42,"tag":207,"props":595,"children":596},{"style":281},[597],{"type":48,"value":598},"apt",{"type":42,"tag":207,"props":600,"children":601},{"style":287},[602],{"type":48,"value":603}," install",{"type":42,"tag":207,"props":605,"children":606},{"style":287},[607],{"type":48,"value":608}," afl++",{"type":42,"tag":207,"props":610,"children":611},{"style":287},[612],{"type":48,"value":613}," lld-17\n",{"type":42,"tag":549,"props":615,"children":617},{"id":616},"docker-from-docker-hub",[618],{"type":48,"value":493},{"type":42,"tag":195,"props":620,"children":622},{"className":260,"code":621,"language":262,"meta":200,"style":200},"docker pull aflplusplus\u002Faflplusplus:stable\n",[623],{"type":42,"tag":203,"props":624,"children":625},{"__ignoreMap":200},[626],{"type":42,"tag":207,"props":627,"children":628},{"class":209,"line":210},[629,634,639],{"type":42,"tag":207,"props":630,"children":631},{"style":281},[632],{"type":48,"value":633},"docker",{"type":42,"tag":207,"props":635,"children":636},{"style":287},[637],{"type":48,"value":638}," pull",{"type":42,"tag":207,"props":640,"children":641},{"style":287},[642],{"type":48,"value":643}," aflplusplus\u002Faflplusplus:stable\n",{"type":42,"tag":549,"props":645,"children":647},{"id":646},"docker-from-source",[648],{"type":48,"value":511},{"type":42,"tag":195,"props":650,"children":652},{"className":260,"code":651,"language":262,"meta":200,"style":200},"git clone --depth 1 --branch stable https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\ncd AFLplusplus\ndocker build -t aflplusplus .\n",[653],{"type":42,"tag":203,"props":654,"children":655},{"__ignoreMap":200},[656,695,708],{"type":42,"tag":207,"props":657,"children":658},{"class":209,"line":210},[659,664,669,674,680,685,690],{"type":42,"tag":207,"props":660,"children":661},{"style":281},[662],{"type":48,"value":663},"git",{"type":42,"tag":207,"props":665,"children":666},{"style":287},[667],{"type":48,"value":668}," clone",{"type":42,"tag":207,"props":670,"children":671},{"style":287},[672],{"type":48,"value":673}," --depth",{"type":42,"tag":207,"props":675,"children":677},{"style":676},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[678],{"type":48,"value":679}," 1",{"type":42,"tag":207,"props":681,"children":682},{"style":287},[683],{"type":48,"value":684}," --branch",{"type":42,"tag":207,"props":686,"children":687},{"style":287},[688],{"type":48,"value":689}," stable",{"type":42,"tag":207,"props":691,"children":692},{"style":287},[693],{"type":48,"value":694}," https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\n",{"type":42,"tag":207,"props":696,"children":697},{"class":209,"line":219},[698,703],{"type":42,"tag":207,"props":699,"children":700},{"style":352},[701],{"type":48,"value":702},"cd",{"type":42,"tag":207,"props":704,"children":705},{"style":287},[706],{"type":48,"value":707}," AFLplusplus\n",{"type":42,"tag":207,"props":709,"children":710},{"class":209,"line":228},[711,715,720,725,730],{"type":42,"tag":207,"props":712,"children":713},{"style":281},[714],{"type":48,"value":633},{"type":42,"tag":207,"props":716,"children":717},{"style":287},[718],{"type":48,"value":719}," build",{"type":42,"tag":207,"props":721,"children":722},{"style":287},[723],{"type":48,"value":724}," -t",{"type":42,"tag":207,"props":726,"children":727},{"style":287},[728],{"type":48,"value":729}," aflplusplus",{"type":42,"tag":207,"props":731,"children":732},{"style":287},[733],{"type":48,"value":734}," .\n",{"type":42,"tag":549,"props":736,"children":738},{"id":737},"from-source",[739],{"type":48,"value":529},{"type":42,"tag":51,"props":741,"children":742},{},[743,745,754,756,761,763,769],{"type":48,"value":744},"Refer to the ",{"type":42,"tag":746,"props":747,"children":751},"a",{"href":748,"rel":749},"https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus\u002Fblob\u002Fstable\u002FDockerfile",[750],"nofollow",[752],{"type":48,"value":753},"Dockerfile",{"type":48,"value":755}," for Ubuntu version requirements and dependencies. Set ",{"type":42,"tag":203,"props":757,"children":759},{"className":758},[],[760],{"type":48,"value":545},{"type":48,"value":762}," to specify Clang version (e.g., ",{"type":42,"tag":203,"props":764,"children":766},{"className":765},[],[767],{"type":48,"value":768},"llvm-config-18",{"type":48,"value":583},{"type":42,"tag":549,"props":771,"children":773},{"id":772},"wrapper-script-setup",[774],{"type":48,"value":775},"Wrapper Script Setup",{"type":42,"tag":51,"props":777,"children":778},{},[779],{"type":48,"value":780},"Create a wrapper script to run AFL++ on host or Docker:",{"type":42,"tag":195,"props":782,"children":784},{"className":260,"code":783,"language":262,"meta":200,"style":200},"cat \u003C\u003C'EOF' > .\u002Fafl++\n#!\u002Fbin\u002Fsh\nAFL_VERSION=\"${AFL_VERSION:-\"stable\"}\"\ncase \"$1\" in\n   host)\n        shift\n        bash -c \"$*\"\n        ;;\n    docker)\n        shift\n        \u002Fusr\u002Fbin\u002Fenv docker run -ti \\\n            --privileged \\\n            -v .\u002F:\u002Fsrc \\\n            --rm \\\n            --name afl_fuzzing \\\n            \"aflplusplus\u002Faflplusplus:$AFL_VERSION\" \\\n            bash -c \"cd \u002Fsrc && bash -c \\\"$*\\\"\"\n        ;;\n    *)\n        echo \"Usage: $0 {host|docker}\"\n        exit 1\n        ;;\nesac\nEOF\nchmod +x .\u002Fafl++\n",[785],{"type":42,"tag":203,"props":786,"children":787},{"__ignoreMap":200},[788,815,823,831,839,847,856,865,874,883,891,900,909,918,927,936,945,954,962,971,980,989,997,1006,1015],{"type":42,"tag":207,"props":789,"children":790},{"class":209,"line":210},[791,796,801,806,810],{"type":42,"tag":207,"props":792,"children":793},{"style":281},[794],{"type":48,"value":795},"cat",{"type":42,"tag":207,"props":797,"children":798},{"style":346},[799],{"type":48,"value":800}," \u003C\u003C",{"type":42,"tag":207,"props":802,"children":803},{"style":346},[804],{"type":48,"value":805},"'EOF'",{"type":42,"tag":207,"props":807,"children":808},{"style":346},[809],{"type":48,"value":375},{"type":42,"tag":207,"props":811,"children":812},{"style":287},[813],{"type":48,"value":814}," .\u002Fafl++\n",{"type":42,"tag":207,"props":816,"children":817},{"class":209,"line":219},[818],{"type":42,"tag":207,"props":819,"children":820},{"style":287},[821],{"type":48,"value":822},"#!\u002Fbin\u002Fsh\n",{"type":42,"tag":207,"props":824,"children":825},{"class":209,"line":228},[826],{"type":42,"tag":207,"props":827,"children":828},{"style":287},[829],{"type":48,"value":830},"AFL_VERSION=\"${AFL_VERSION:-\"stable\"}\"\n",{"type":42,"tag":207,"props":832,"children":833},{"class":209,"line":237},[834],{"type":42,"tag":207,"props":835,"children":836},{"style":287},[837],{"type":48,"value":838},"case \"$1\" in\n",{"type":42,"tag":207,"props":840,"children":841},{"class":209,"line":246},[842],{"type":42,"tag":207,"props":843,"children":844},{"style":287},[845],{"type":48,"value":846},"   host)\n",{"type":42,"tag":207,"props":848,"children":850},{"class":209,"line":849},6,[851],{"type":42,"tag":207,"props":852,"children":853},{"style":287},[854],{"type":48,"value":855},"        shift\n",{"type":42,"tag":207,"props":857,"children":859},{"class":209,"line":858},7,[860],{"type":42,"tag":207,"props":861,"children":862},{"style":287},[863],{"type":48,"value":864},"        bash -c \"$*\"\n",{"type":42,"tag":207,"props":866,"children":868},{"class":209,"line":867},8,[869],{"type":42,"tag":207,"props":870,"children":871},{"style":287},[872],{"type":48,"value":873},"        ;;\n",{"type":42,"tag":207,"props":875,"children":877},{"class":209,"line":876},9,[878],{"type":42,"tag":207,"props":879,"children":880},{"style":287},[881],{"type":48,"value":882},"    docker)\n",{"type":42,"tag":207,"props":884,"children":886},{"class":209,"line":885},10,[887],{"type":42,"tag":207,"props":888,"children":889},{"style":287},[890],{"type":48,"value":855},{"type":42,"tag":207,"props":892,"children":894},{"class":209,"line":893},11,[895],{"type":42,"tag":207,"props":896,"children":897},{"style":287},[898],{"type":48,"value":899},"        \u002Fusr\u002Fbin\u002Fenv docker run -ti \\\n",{"type":42,"tag":207,"props":901,"children":903},{"class":209,"line":902},12,[904],{"type":42,"tag":207,"props":905,"children":906},{"style":287},[907],{"type":48,"value":908},"            --privileged \\\n",{"type":42,"tag":207,"props":910,"children":912},{"class":209,"line":911},13,[913],{"type":42,"tag":207,"props":914,"children":915},{"style":287},[916],{"type":48,"value":917},"            -v .\u002F:\u002Fsrc \\\n",{"type":42,"tag":207,"props":919,"children":921},{"class":209,"line":920},14,[922],{"type":42,"tag":207,"props":923,"children":924},{"style":287},[925],{"type":48,"value":926},"            --rm \\\n",{"type":42,"tag":207,"props":928,"children":930},{"class":209,"line":929},15,[931],{"type":42,"tag":207,"props":932,"children":933},{"style":287},[934],{"type":48,"value":935},"            --name afl_fuzzing \\\n",{"type":42,"tag":207,"props":937,"children":939},{"class":209,"line":938},16,[940],{"type":42,"tag":207,"props":941,"children":942},{"style":287},[943],{"type":48,"value":944},"            \"aflplusplus\u002Faflplusplus:$AFL_VERSION\" \\\n",{"type":42,"tag":207,"props":946,"children":948},{"class":209,"line":947},17,[949],{"type":42,"tag":207,"props":950,"children":951},{"style":287},[952],{"type":48,"value":953},"            bash -c \"cd \u002Fsrc && bash -c \\\"$*\\\"\"\n",{"type":42,"tag":207,"props":955,"children":957},{"class":209,"line":956},18,[958],{"type":42,"tag":207,"props":959,"children":960},{"style":287},[961],{"type":48,"value":873},{"type":42,"tag":207,"props":963,"children":965},{"class":209,"line":964},19,[966],{"type":42,"tag":207,"props":967,"children":968},{"style":287},[969],{"type":48,"value":970},"    *)\n",{"type":42,"tag":207,"props":972,"children":974},{"class":209,"line":973},20,[975],{"type":42,"tag":207,"props":976,"children":977},{"style":287},[978],{"type":48,"value":979},"        echo \"Usage: $0 {host|docker}\"\n",{"type":42,"tag":207,"props":981,"children":983},{"class":209,"line":982},21,[984],{"type":42,"tag":207,"props":985,"children":986},{"style":287},[987],{"type":48,"value":988},"        exit 1\n",{"type":42,"tag":207,"props":990,"children":992},{"class":209,"line":991},22,[993],{"type":42,"tag":207,"props":994,"children":995},{"style":287},[996],{"type":48,"value":873},{"type":42,"tag":207,"props":998,"children":1000},{"class":209,"line":999},23,[1001],{"type":42,"tag":207,"props":1002,"children":1003},{"style":287},[1004],{"type":48,"value":1005},"esac\n",{"type":42,"tag":207,"props":1007,"children":1009},{"class":209,"line":1008},24,[1010],{"type":42,"tag":207,"props":1011,"children":1012},{"style":346},[1013],{"type":48,"value":1014},"EOF\n",{"type":42,"tag":207,"props":1016,"children":1018},{"class":209,"line":1017},25,[1019,1024,1029],{"type":42,"tag":207,"props":1020,"children":1021},{"style":281},[1022],{"type":48,"value":1023},"chmod",{"type":42,"tag":207,"props":1025,"children":1026},{"style":287},[1027],{"type":48,"value":1028}," +x",{"type":42,"tag":207,"props":1030,"children":1031},{"style":287},[1032],{"type":48,"value":814},{"type":42,"tag":51,"props":1034,"children":1035},{},[1036,1041,1043,1049,1051,1057],{"type":42,"tag":153,"props":1037,"children":1038},{},[1039],{"type":48,"value":1040},"Security Warning:",{"type":48,"value":1042}," The ",{"type":42,"tag":203,"props":1044,"children":1046},{"className":1045},[],[1047],{"type":48,"value":1048},"afl-system-config",{"type":48,"value":1050}," and ",{"type":42,"tag":203,"props":1052,"children":1054},{"className":1053},[],[1055],{"type":48,"value":1056},"afl-persistent-config",{"type":48,"value":1058}," scripts require root privileges and disable OS security features. Do not fuzz on production systems or your development environment. Use a dedicated VM instead.",{"type":42,"tag":549,"props":1060,"children":1062},{"id":1061},"system-configuration",[1063],{"type":48,"value":1064},"System Configuration",{"type":42,"tag":51,"props":1066,"children":1067},{},[1068],{"type":48,"value":1069},"Run after each reboot for up to 15% more executions per second:",{"type":42,"tag":195,"props":1071,"children":1073},{"className":260,"code":1072,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-system-config\n",[1074],{"type":42,"tag":203,"props":1075,"children":1076},{"__ignoreMap":200},[1077],{"type":42,"tag":207,"props":1078,"children":1079},{"class":209,"line":210},[1080,1084,1089,1094,1100,1105],{"type":42,"tag":207,"props":1081,"children":1082},{"style":281},[1083],{"type":48,"value":284},{"type":42,"tag":207,"props":1085,"children":1086},{"style":346},[1087],{"type":48,"value":1088}," \u003C",{"type":42,"tag":207,"props":1090,"children":1091},{"style":287},[1092],{"type":48,"value":1093},"host\u002Fdocke",{"type":42,"tag":207,"props":1095,"children":1097},{"style":1096},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1098],{"type":48,"value":1099},"r",{"type":42,"tag":207,"props":1101,"children":1102},{"style":346},[1103],{"type":48,"value":1104},">",{"type":42,"tag":207,"props":1106,"children":1107},{"style":287},[1108],{"type":48,"value":1109}," afl-system-config\n",{"type":42,"tag":51,"props":1111,"children":1112},{},[1113],{"type":48,"value":1114},"For maximum performance, disable kernel security mitigations (requires grub bootloader, not supported in Docker):",{"type":42,"tag":195,"props":1116,"children":1118},{"className":260,"code":1117,"language":262,"meta":200,"style":200},".\u002Fafl++ host afl-persistent-config\nupdate-grub\nreboot\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-system-config\n",[1119],{"type":42,"tag":203,"props":1120,"children":1121},{"__ignoreMap":200},[1122,1139,1147,1155],{"type":42,"tag":207,"props":1123,"children":1124},{"class":209,"line":210},[1125,1129,1134],{"type":42,"tag":207,"props":1126,"children":1127},{"style":281},[1128],{"type":48,"value":284},{"type":42,"tag":207,"props":1130,"children":1131},{"style":287},[1132],{"type":48,"value":1133}," host",{"type":42,"tag":207,"props":1135,"children":1136},{"style":287},[1137],{"type":48,"value":1138}," afl-persistent-config\n",{"type":42,"tag":207,"props":1140,"children":1141},{"class":209,"line":219},[1142],{"type":42,"tag":207,"props":1143,"children":1144},{"style":281},[1145],{"type":48,"value":1146},"update-grub\n",{"type":42,"tag":207,"props":1148,"children":1149},{"class":209,"line":228},[1150],{"type":42,"tag":207,"props":1151,"children":1152},{"style":281},[1153],{"type":48,"value":1154},"reboot\n",{"type":42,"tag":207,"props":1156,"children":1157},{"class":209,"line":237},[1158,1162,1166,1170,1174,1178],{"type":42,"tag":207,"props":1159,"children":1160},{"style":281},[1161],{"type":48,"value":284},{"type":42,"tag":207,"props":1163,"children":1164},{"style":346},[1165],{"type":48,"value":1088},{"type":42,"tag":207,"props":1167,"children":1168},{"style":287},[1169],{"type":48,"value":1093},{"type":42,"tag":207,"props":1171,"children":1172},{"style":1096},[1173],{"type":48,"value":1099},{"type":42,"tag":207,"props":1175,"children":1176},{"style":346},[1177],{"type":48,"value":1104},{"type":42,"tag":207,"props":1179,"children":1180},{"style":287},[1181],{"type":48,"value":1109},{"type":42,"tag":51,"props":1183,"children":1184},{},[1185,1187,1193,1195,1201],{"type":48,"value":1186},"Verify with ",{"type":42,"tag":203,"props":1188,"children":1190},{"className":1189},[],[1191],{"type":48,"value":1192},"cat \u002Fproc\u002Fcmdline",{"type":48,"value":1194}," - output should include ",{"type":42,"tag":203,"props":1196,"children":1198},{"className":1197},[],[1199],{"type":48,"value":1200},"mitigations=off",{"type":48,"value":1202},".",{"type":42,"tag":57,"props":1204,"children":1206},{"id":1205},"writing-a-harness",[1207],{"type":48,"value":1208},"Writing a Harness",{"type":42,"tag":549,"props":1210,"children":1212},{"id":1211},"harness-structure",[1213],{"type":48,"value":1214},"Harness Structure",{"type":42,"tag":51,"props":1216,"children":1217},{},[1218],{"type":48,"value":1219},"AFL++ supports libFuzzer-style harnesses:",{"type":42,"tag":195,"props":1221,"children":1223},{"className":197,"code":1222,"language":199,"meta":200,"style":200},"#include \u003Cstdint.h>\n#include \u003Cstddef.h>\n\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F 1. Validate input size if needed\n    if (size \u003C MIN_SIZE || size > MAX_SIZE) return 0;\n\n    \u002F\u002F 2. Call target function with fuzz data\n    target_function(data, size);\n\n    \u002F\u002F 3. Return 0 (non-zero reserved for future use)\n    return 0;\n}\n",[1224],{"type":42,"tag":203,"props":1225,"children":1226},{"__ignoreMap":200},[1227,1235,1243,1252,1259,1267,1275,1282,1290,1298,1305,1313,1320],{"type":42,"tag":207,"props":1228,"children":1229},{"class":209,"line":210},[1230],{"type":42,"tag":207,"props":1231,"children":1232},{},[1233],{"type":48,"value":1234},"#include \u003Cstdint.h>\n",{"type":42,"tag":207,"props":1236,"children":1237},{"class":209,"line":219},[1238],{"type":42,"tag":207,"props":1239,"children":1240},{},[1241],{"type":48,"value":1242},"#include \u003Cstddef.h>\n",{"type":42,"tag":207,"props":1244,"children":1245},{"class":209,"line":228},[1246],{"type":42,"tag":207,"props":1247,"children":1249},{"emptyLinePlaceholder":1248},true,[1250],{"type":48,"value":1251},"\n",{"type":42,"tag":207,"props":1253,"children":1254},{"class":209,"line":237},[1255],{"type":42,"tag":207,"props":1256,"children":1257},{},[1258],{"type":48,"value":216},{"type":42,"tag":207,"props":1260,"children":1261},{"class":209,"line":246},[1262],{"type":42,"tag":207,"props":1263,"children":1264},{},[1265],{"type":48,"value":1266},"    \u002F\u002F 1. Validate input size if needed\n",{"type":42,"tag":207,"props":1268,"children":1269},{"class":209,"line":849},[1270],{"type":42,"tag":207,"props":1271,"children":1272},{},[1273],{"type":48,"value":1274},"    if (size \u003C MIN_SIZE || size > MAX_SIZE) return 0;\n",{"type":42,"tag":207,"props":1276,"children":1277},{"class":209,"line":858},[1278],{"type":42,"tag":207,"props":1279,"children":1280},{"emptyLinePlaceholder":1248},[1281],{"type":48,"value":1251},{"type":42,"tag":207,"props":1283,"children":1284},{"class":209,"line":867},[1285],{"type":42,"tag":207,"props":1286,"children":1287},{},[1288],{"type":48,"value":1289},"    \u002F\u002F 2. Call target function with fuzz data\n",{"type":42,"tag":207,"props":1291,"children":1292},{"class":209,"line":876},[1293],{"type":42,"tag":207,"props":1294,"children":1295},{},[1296],{"type":48,"value":1297},"    target_function(data, size);\n",{"type":42,"tag":207,"props":1299,"children":1300},{"class":209,"line":885},[1301],{"type":42,"tag":207,"props":1302,"children":1303},{"emptyLinePlaceholder":1248},[1304],{"type":48,"value":1251},{"type":42,"tag":207,"props":1306,"children":1307},{"class":209,"line":893},[1308],{"type":42,"tag":207,"props":1309,"children":1310},{},[1311],{"type":48,"value":1312},"    \u002F\u002F 3. Return 0 (non-zero reserved for future use)\n",{"type":42,"tag":207,"props":1314,"children":1315},{"class":209,"line":902},[1316],{"type":42,"tag":207,"props":1317,"children":1318},{},[1319],{"type":48,"value":243},{"type":42,"tag":207,"props":1321,"children":1322},{"class":209,"line":911},[1323],{"type":42,"tag":207,"props":1324,"children":1325},{},[1326],{"type":48,"value":252},{"type":42,"tag":549,"props":1328,"children":1330},{"id":1329},"harness-rules",[1331],{"type":48,"value":1332},"Harness Rules",{"type":42,"tag":64,"props":1334,"children":1335},{},[1336,1352],{"type":42,"tag":68,"props":1337,"children":1338},{},[1339],{"type":42,"tag":72,"props":1340,"children":1341},{},[1342,1347],{"type":42,"tag":76,"props":1343,"children":1344},{},[1345],{"type":48,"value":1346},"Do",{"type":42,"tag":76,"props":1348,"children":1349},{},[1350],{"type":48,"value":1351},"Don't",{"type":42,"tag":92,"props":1353,"children":1354},{},[1355,1368,1381,1394,1407],{"type":42,"tag":72,"props":1356,"children":1357},{},[1358,1363],{"type":42,"tag":99,"props":1359,"children":1360},{},[1361],{"type":48,"value":1362},"Reset global state between runs",{"type":42,"tag":99,"props":1364,"children":1365},{},[1366],{"type":48,"value":1367},"Rely on state from previous runs",{"type":42,"tag":72,"props":1369,"children":1370},{},[1371,1376],{"type":42,"tag":99,"props":1372,"children":1373},{},[1374],{"type":48,"value":1375},"Handle edge cases gracefully",{"type":42,"tag":99,"props":1377,"children":1378},{},[1379],{"type":48,"value":1380},"Exit on invalid input",{"type":42,"tag":72,"props":1382,"children":1383},{},[1384,1389],{"type":42,"tag":99,"props":1385,"children":1386},{},[1387],{"type":48,"value":1388},"Keep harness deterministic",{"type":42,"tag":99,"props":1390,"children":1391},{},[1392],{"type":48,"value":1393},"Use random number generators",{"type":42,"tag":72,"props":1395,"children":1396},{},[1397,1402],{"type":42,"tag":99,"props":1398,"children":1399},{},[1400],{"type":48,"value":1401},"Free allocated memory",{"type":42,"tag":99,"props":1403,"children":1404},{},[1405],{"type":48,"value":1406},"Create memory leaks",{"type":42,"tag":72,"props":1408,"children":1409},{},[1410,1415],{"type":42,"tag":99,"props":1411,"children":1412},{},[1413],{"type":48,"value":1414},"Validate input sizes",{"type":42,"tag":99,"props":1416,"children":1417},{},[1418],{"type":48,"value":1419},"Process unbounded input",{"type":42,"tag":1421,"props":1422,"children":1423},"blockquote",{},[1424],{"type":42,"tag":51,"props":1425,"children":1426},{},[1427,1432,1434,1439],{"type":42,"tag":153,"props":1428,"children":1429},{},[1430],{"type":48,"value":1431},"See Also:",{"type":48,"value":1433}," For detailed harness writing techniques, patterns for handling complex inputs,\nand advanced strategies, see the ",{"type":42,"tag":153,"props":1435,"children":1436},{},[1437],{"type":48,"value":1438},"fuzz-harness-writing",{"type":48,"value":1440}," technique skill.",{"type":42,"tag":57,"props":1442,"children":1444},{"id":1443},"compilation",[1445],{"type":48,"value":1446},"Compilation",{"type":42,"tag":51,"props":1448,"children":1449},{},[1450],{"type":48,"value":1451},"AFL++ offers multiple compilation modes with different trade-offs.",{"type":42,"tag":549,"props":1453,"children":1455},{"id":1454},"compilation-mode-decision-tree",[1456],{"type":48,"value":1457},"Compilation Mode Decision Tree",{"type":42,"tag":51,"props":1459,"children":1460},{},[1461],{"type":48,"value":1462},"Choose your compilation mode:",{"type":42,"tag":159,"props":1464,"children":1465},{},[1466,1484,1501],{"type":42,"tag":163,"props":1467,"children":1468},{},[1469,1474,1476,1482],{"type":42,"tag":153,"props":1470,"children":1471},{},[1472],{"type":48,"value":1473},"LTO mode",{"type":48,"value":1475}," (",{"type":42,"tag":203,"props":1477,"children":1479},{"className":1478},[],[1480],{"type":48,"value":1481},"afl-clang-lto",{"type":48,"value":1483},"): Best performance and instrumentation. Try this first.",{"type":42,"tag":163,"props":1485,"children":1486},{},[1487,1492,1493,1499],{"type":42,"tag":153,"props":1488,"children":1489},{},[1490],{"type":48,"value":1491},"LLVM mode",{"type":48,"value":1475},{"type":42,"tag":203,"props":1494,"children":1496},{"className":1495},[],[1497],{"type":48,"value":1498},"afl-clang-fast",{"type":48,"value":1500},"): Fall back if LTO fails to compile.",{"type":42,"tag":163,"props":1502,"children":1503},{},[1504,1509,1510,1516],{"type":42,"tag":153,"props":1505,"children":1506},{},[1507],{"type":48,"value":1508},"GCC plugin",{"type":48,"value":1475},{"type":42,"tag":203,"props":1511,"children":1513},{"className":1512},[],[1514],{"type":48,"value":1515},"afl-gcc-fast",{"type":48,"value":1517},"): For projects requiring GCC.",{"type":42,"tag":549,"props":1519,"children":1521},{"id":1520},"basic-compilation-llvm-mode",[1522],{"type":48,"value":1523},"Basic Compilation (LLVM mode)",{"type":42,"tag":195,"props":1525,"children":1527},{"className":260,"code":1526,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-clang-fast++ -DNO_MAIN=1 -O2 -fsanitize=fuzzer harness.cc main.cc -o fuzz\n",[1528],{"type":42,"tag":203,"props":1529,"children":1530},{"__ignoreMap":200},[1531],{"type":42,"tag":207,"props":1532,"children":1533},{"class":209,"line":210},[1534,1538,1542,1546,1550,1554,1558,1562,1566,1570,1574,1578,1582],{"type":42,"tag":207,"props":1535,"children":1536},{"style":281},[1537],{"type":48,"value":284},{"type":42,"tag":207,"props":1539,"children":1540},{"style":346},[1541],{"type":48,"value":1088},{"type":42,"tag":207,"props":1543,"children":1544},{"style":287},[1545],{"type":48,"value":1093},{"type":42,"tag":207,"props":1547,"children":1548},{"style":1096},[1549],{"type":48,"value":1099},{"type":42,"tag":207,"props":1551,"children":1552},{"style":346},[1553],{"type":48,"value":1104},{"type":42,"tag":207,"props":1555,"children":1556},{"style":287},[1557],{"type":48,"value":295},{"type":42,"tag":207,"props":1559,"children":1560},{"style":287},[1561],{"type":48,"value":300},{"type":42,"tag":207,"props":1563,"children":1564},{"style":287},[1565],{"type":48,"value":305},{"type":42,"tag":207,"props":1567,"children":1568},{"style":287},[1569],{"type":48,"value":310},{"type":42,"tag":207,"props":1571,"children":1572},{"style":287},[1573],{"type":48,"value":315},{"type":42,"tag":207,"props":1575,"children":1576},{"style":287},[1577],{"type":48,"value":320},{"type":42,"tag":207,"props":1579,"children":1580},{"style":287},[1581],{"type":48,"value":325},{"type":42,"tag":207,"props":1583,"children":1584},{"style":287},[1585],{"type":48,"value":330},{"type":42,"tag":549,"props":1587,"children":1589},{"id":1588},"gcc-compilation",[1590],{"type":48,"value":1591},"GCC Compilation",{"type":42,"tag":195,"props":1593,"children":1595},{"className":260,"code":1594,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-g++-fast -DNO_MAIN=1 -O2 -fsanitize=fuzzer harness.cc main.cc -o fuzz\n",[1596],{"type":42,"tag":203,"props":1597,"children":1598},{"__ignoreMap":200},[1599],{"type":42,"tag":207,"props":1600,"children":1601},{"class":209,"line":210},[1602,1606,1610,1614,1618,1622,1627,1631,1635,1639,1643,1647,1651],{"type":42,"tag":207,"props":1603,"children":1604},{"style":281},[1605],{"type":48,"value":284},{"type":42,"tag":207,"props":1607,"children":1608},{"style":346},[1609],{"type":48,"value":1088},{"type":42,"tag":207,"props":1611,"children":1612},{"style":287},[1613],{"type":48,"value":1093},{"type":42,"tag":207,"props":1615,"children":1616},{"style":1096},[1617],{"type":48,"value":1099},{"type":42,"tag":207,"props":1619,"children":1620},{"style":346},[1621],{"type":48,"value":1104},{"type":42,"tag":207,"props":1623,"children":1624},{"style":287},[1625],{"type":48,"value":1626}," afl-g++-fast",{"type":42,"tag":207,"props":1628,"children":1629},{"style":287},[1630],{"type":48,"value":300},{"type":42,"tag":207,"props":1632,"children":1633},{"style":287},[1634],{"type":48,"value":305},{"type":42,"tag":207,"props":1636,"children":1637},{"style":287},[1638],{"type":48,"value":310},{"type":42,"tag":207,"props":1640,"children":1641},{"style":287},[1642],{"type":48,"value":315},{"type":42,"tag":207,"props":1644,"children":1645},{"style":287},[1646],{"type":48,"value":320},{"type":42,"tag":207,"props":1648,"children":1649},{"style":287},[1650],{"type":48,"value":325},{"type":42,"tag":207,"props":1652,"children":1653},{"style":287},[1654],{"type":48,"value":330},{"type":42,"tag":51,"props":1656,"children":1657},{},[1658,1663],{"type":42,"tag":153,"props":1659,"children":1660},{},[1661],{"type":48,"value":1662},"Important:",{"type":48,"value":1664}," GCC version must match the version used to compile the AFL++ GCC plugin.",{"type":42,"tag":549,"props":1666,"children":1668},{"id":1667},"with-sanitizers",[1669],{"type":48,"value":1670},"With Sanitizers",{"type":42,"tag":195,"props":1672,"children":1674},{"className":260,"code":1673,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> AFL_USE_ASAN=1 afl-clang-fast++ -DNO_MAIN=1 -O2 -fsanitize=fuzzer harness.cc main.cc -o fuzz\n",[1675],{"type":42,"tag":203,"props":1676,"children":1677},{"__ignoreMap":200},[1678],{"type":42,"tag":207,"props":1679,"children":1680},{"class":209,"line":210},[1681,1685,1689,1693,1697,1701,1706,1711,1715,1719,1723,1727,1731,1735,1739],{"type":42,"tag":207,"props":1682,"children":1683},{"style":281},[1684],{"type":48,"value":284},{"type":42,"tag":207,"props":1686,"children":1687},{"style":346},[1688],{"type":48,"value":1088},{"type":42,"tag":207,"props":1690,"children":1691},{"style":287},[1692],{"type":48,"value":1093},{"type":42,"tag":207,"props":1694,"children":1695},{"style":1096},[1696],{"type":48,"value":1099},{"type":42,"tag":207,"props":1698,"children":1699},{"style":346},[1700],{"type":48,"value":1104},{"type":42,"tag":207,"props":1702,"children":1703},{"style":287},[1704],{"type":48,"value":1705}," AFL_USE_ASAN=",{"type":42,"tag":207,"props":1707,"children":1708},{"style":676},[1709],{"type":48,"value":1710},"1",{"type":42,"tag":207,"props":1712,"children":1713},{"style":287},[1714],{"type":48,"value":295},{"type":42,"tag":207,"props":1716,"children":1717},{"style":287},[1718],{"type":48,"value":300},{"type":42,"tag":207,"props":1720,"children":1721},{"style":287},[1722],{"type":48,"value":305},{"type":42,"tag":207,"props":1724,"children":1725},{"style":287},[1726],{"type":48,"value":310},{"type":42,"tag":207,"props":1728,"children":1729},{"style":287},[1730],{"type":48,"value":315},{"type":42,"tag":207,"props":1732,"children":1733},{"style":287},[1734],{"type":48,"value":320},{"type":42,"tag":207,"props":1736,"children":1737},{"style":287},[1738],{"type":48,"value":325},{"type":42,"tag":207,"props":1740,"children":1741},{"style":287},[1742],{"type":48,"value":330},{"type":42,"tag":1421,"props":1744,"children":1745},{},[1746],{"type":42,"tag":51,"props":1747,"children":1748},{},[1749,1753,1755,1760,1761,1766],{"type":42,"tag":153,"props":1750,"children":1751},{},[1752],{"type":48,"value":1431},{"type":48,"value":1754}," For detailed sanitizer configuration, common issues, and advanced flags,\nsee the ",{"type":42,"tag":153,"props":1756,"children":1757},{},[1758],{"type":48,"value":1759},"address-sanitizer",{"type":48,"value":1050},{"type":42,"tag":153,"props":1762,"children":1763},{},[1764],{"type":48,"value":1765},"undefined-behavior-sanitizer",{"type":48,"value":1767}," technique skills.",{"type":42,"tag":549,"props":1769,"children":1771},{"id":1770},"build-flags",[1772],{"type":48,"value":1773},"Build Flags",{"type":42,"tag":51,"props":1775,"children":1776},{},[1777,1779,1785],{"type":48,"value":1778},"Note that ",{"type":42,"tag":203,"props":1780,"children":1782},{"className":1781},[],[1783],{"type":48,"value":1784},"-g",{"type":48,"value":1786}," is not necessary, it is added by default by the AFL++ compilers.",{"type":42,"tag":64,"props":1788,"children":1789},{},[1790,1806],{"type":42,"tag":68,"props":1791,"children":1792},{},[1793],{"type":42,"tag":72,"props":1794,"children":1795},{},[1796,1801],{"type":42,"tag":76,"props":1797,"children":1798},{},[1799],{"type":48,"value":1800},"Flag",{"type":42,"tag":76,"props":1802,"children":1803},{},[1804],{"type":48,"value":1805},"Purpose",{"type":42,"tag":92,"props":1807,"children":1808},{},[1809,1826,1843,1860],{"type":42,"tag":72,"props":1810,"children":1811},{},[1812,1821],{"type":42,"tag":99,"props":1813,"children":1814},{},[1815],{"type":42,"tag":203,"props":1816,"children":1818},{"className":1817},[],[1819],{"type":48,"value":1820},"-DNO_MAIN=1",{"type":42,"tag":99,"props":1822,"children":1823},{},[1824],{"type":48,"value":1825},"Skip main function when using libFuzzer harness",{"type":42,"tag":72,"props":1827,"children":1828},{},[1829,1838],{"type":42,"tag":99,"props":1830,"children":1831},{},[1832],{"type":42,"tag":203,"props":1833,"children":1835},{"className":1834},[],[1836],{"type":48,"value":1837},"-O2",{"type":42,"tag":99,"props":1839,"children":1840},{},[1841],{"type":48,"value":1842},"Production optimization level (recommended for fuzzing)",{"type":42,"tag":72,"props":1844,"children":1845},{},[1846,1855],{"type":42,"tag":99,"props":1847,"children":1848},{},[1849],{"type":42,"tag":203,"props":1850,"children":1852},{"className":1851},[],[1853],{"type":48,"value":1854},"-fsanitize=fuzzer",{"type":42,"tag":99,"props":1856,"children":1857},{},[1858],{"type":48,"value":1859},"Enable libFuzzer compatibility mode and adds the fuzzer runtime when linking executable",{"type":42,"tag":72,"props":1861,"children":1862},{},[1863,1872],{"type":42,"tag":99,"props":1864,"children":1865},{},[1866],{"type":42,"tag":203,"props":1867,"children":1869},{"className":1868},[],[1870],{"type":48,"value":1871},"-fsanitize=fuzzer-no-link",{"type":42,"tag":99,"props":1873,"children":1874},{},[1875],{"type":48,"value":1876},"Instrument without linking fuzzer runtime (for static libraries and object files)",{"type":42,"tag":57,"props":1878,"children":1880},{"id":1879},"corpus-management",[1881],{"type":48,"value":1882},"Corpus Management",{"type":42,"tag":549,"props":1884,"children":1886},{"id":1885},"creating-initial-corpus",[1887],{"type":48,"value":1888},"Creating Initial Corpus",{"type":42,"tag":51,"props":1890,"children":1891},{},[1892],{"type":48,"value":1893},"AFL++ requires at least one non-empty seed file:",{"type":42,"tag":195,"props":1895,"children":1897},{"className":260,"code":1896,"language":262,"meta":200,"style":200},"mkdir seeds\necho \"aaaa\" > seeds\u002Fminimal_seed\n",[1898],{"type":42,"tag":203,"props":1899,"children":1900},{"__ignoreMap":200},[1901,1913],{"type":42,"tag":207,"props":1902,"children":1903},{"class":209,"line":210},[1904,1908],{"type":42,"tag":207,"props":1905,"children":1906},{"style":281},[1907],{"type":48,"value":338},{"type":42,"tag":207,"props":1909,"children":1910},{"style":287},[1911],{"type":48,"value":1912}," seeds\n",{"type":42,"tag":207,"props":1914,"children":1915},{"class":209,"line":219},[1916,1921,1925,1929,1933,1937],{"type":42,"tag":207,"props":1917,"children":1918},{"style":352},[1919],{"type":48,"value":1920},"echo",{"type":42,"tag":207,"props":1922,"children":1923},{"style":346},[1924],{"type":48,"value":360},{"type":42,"tag":207,"props":1926,"children":1927},{"style":287},[1928],{"type":48,"value":365},{"type":42,"tag":207,"props":1930,"children":1931},{"style":346},[1932],{"type":48,"value":370},{"type":42,"tag":207,"props":1934,"children":1935},{"style":346},[1936],{"type":48,"value":375},{"type":42,"tag":207,"props":1938,"children":1939},{"style":287},[1940],{"type":48,"value":380},{"type":42,"tag":51,"props":1942,"children":1943},{},[1944],{"type":48,"value":1945},"For real projects, gather representative inputs:",{"type":42,"tag":159,"props":1947,"children":1948},{},[1949,1954,1959],{"type":42,"tag":163,"props":1950,"children":1951},{},[1952],{"type":48,"value":1953},"Download example files for the format you're fuzzing",{"type":42,"tag":163,"props":1955,"children":1956},{},[1957],{"type":48,"value":1958},"Extract test cases from the project's test suite",{"type":42,"tag":163,"props":1960,"children":1961},{},[1962],{"type":48,"value":1963},"Use minimal valid inputs for your file format",{"type":42,"tag":549,"props":1965,"children":1967},{"id":1966},"corpus-minimization",[1968],{"type":48,"value":1969},"Corpus Minimization",{"type":42,"tag":51,"props":1971,"children":1972},{},[1973],{"type":48,"value":1974},"After a campaign, minimize the corpus to keep only unique coverage:",{"type":42,"tag":195,"props":1976,"children":1978},{"className":260,"code":1977,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-cmin -i out\u002Fdefault\u002Fqueue -o minimized_corpus -- .\u002Ffuzz\n",[1979],{"type":42,"tag":203,"props":1980,"children":1981},{"__ignoreMap":200},[1982],{"type":42,"tag":207,"props":1983,"children":1984},{"class":209,"line":210},[1985,1989,1993,1997,2001,2005,2010,2014,2019,2023,2028,2032],{"type":42,"tag":207,"props":1986,"children":1987},{"style":281},[1988],{"type":48,"value":284},{"type":42,"tag":207,"props":1990,"children":1991},{"style":346},[1992],{"type":48,"value":1088},{"type":42,"tag":207,"props":1994,"children":1995},{"style":287},[1996],{"type":48,"value":1093},{"type":42,"tag":207,"props":1998,"children":1999},{"style":1096},[2000],{"type":48,"value":1099},{"type":42,"tag":207,"props":2002,"children":2003},{"style":346},[2004],{"type":48,"value":1104},{"type":42,"tag":207,"props":2006,"children":2007},{"style":287},[2008],{"type":48,"value":2009}," afl-cmin",{"type":42,"tag":207,"props":2011,"children":2012},{"style":287},[2013],{"type":48,"value":401},{"type":42,"tag":207,"props":2015,"children":2016},{"style":287},[2017],{"type":48,"value":2018}," out\u002Fdefault\u002Fqueue",{"type":42,"tag":207,"props":2020,"children":2021},{"style":287},[2022],{"type":48,"value":325},{"type":42,"tag":207,"props":2024,"children":2025},{"style":287},[2026],{"type":48,"value":2027}," minimized_corpus",{"type":42,"tag":207,"props":2029,"children":2030},{"style":287},[2031],{"type":48,"value":419},{"type":42,"tag":207,"props":2033,"children":2034},{"style":287},[2035],{"type":48,"value":424},{"type":42,"tag":1421,"props":2037,"children":2038},{},[2039],{"type":42,"tag":51,"props":2040,"children":2041},{},[2042,2046,2048,2053],{"type":42,"tag":153,"props":2043,"children":2044},{},[2045],{"type":48,"value":1431},{"type":48,"value":2047}," For corpus creation strategies, dictionaries, and seed selection,\nsee the ",{"type":42,"tag":153,"props":2049,"children":2050},{},[2051],{"type":48,"value":2052},"fuzzing-corpus",{"type":48,"value":1440},{"type":42,"tag":57,"props":2055,"children":2057},{"id":2056},"running-campaigns",[2058],{"type":48,"value":2059},"Running Campaigns",{"type":42,"tag":549,"props":2061,"children":2063},{"id":2062},"basic-run",[2064],{"type":48,"value":2065},"Basic Run",{"type":42,"tag":195,"props":2067,"children":2069},{"className":260,"code":2068,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -i seeds -o out -- .\u002Ffuzz\n",[2070],{"type":42,"tag":203,"props":2071,"children":2072},{"__ignoreMap":200},[2073],{"type":42,"tag":207,"props":2074,"children":2075},{"class":209,"line":210},[2076,2080,2084,2088,2092,2096,2100,2104,2108,2112,2116,2120],{"type":42,"tag":207,"props":2077,"children":2078},{"style":281},[2079],{"type":48,"value":284},{"type":42,"tag":207,"props":2081,"children":2082},{"style":346},[2083],{"type":48,"value":1088},{"type":42,"tag":207,"props":2085,"children":2086},{"style":287},[2087],{"type":48,"value":1093},{"type":42,"tag":207,"props":2089,"children":2090},{"style":1096},[2091],{"type":48,"value":1099},{"type":42,"tag":207,"props":2093,"children":2094},{"style":346},[2095],{"type":48,"value":1104},{"type":42,"tag":207,"props":2097,"children":2098},{"style":287},[2099],{"type":48,"value":396},{"type":42,"tag":207,"props":2101,"children":2102},{"style":287},[2103],{"type":48,"value":401},{"type":42,"tag":207,"props":2105,"children":2106},{"style":287},[2107],{"type":48,"value":343},{"type":42,"tag":207,"props":2109,"children":2110},{"style":287},[2111],{"type":48,"value":325},{"type":42,"tag":207,"props":2113,"children":2114},{"style":287},[2115],{"type":48,"value":414},{"type":42,"tag":207,"props":2117,"children":2118},{"style":287},[2119],{"type":48,"value":419},{"type":42,"tag":207,"props":2121,"children":2122},{"style":287},[2123],{"type":48,"value":424},{"type":42,"tag":549,"props":2125,"children":2127},{"id":2126},"setting-environment-variables",[2128],{"type":48,"value":2129},"Setting Environment Variables",{"type":42,"tag":195,"props":2131,"children":2133},{"className":260,"code":2132,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> AFL_FAST_CAL=1 afl-fuzz -i seeds -o out -- .\u002Ffuzz\n",[2134],{"type":42,"tag":203,"props":2135,"children":2136},{"__ignoreMap":200},[2137],{"type":42,"tag":207,"props":2138,"children":2139},{"class":209,"line":210},[2140,2144,2148,2152,2156,2160,2165,2169,2173,2177,2181,2185,2189,2193],{"type":42,"tag":207,"props":2141,"children":2142},{"style":281},[2143],{"type":48,"value":284},{"type":42,"tag":207,"props":2145,"children":2146},{"style":346},[2147],{"type":48,"value":1088},{"type":42,"tag":207,"props":2149,"children":2150},{"style":287},[2151],{"type":48,"value":1093},{"type":42,"tag":207,"props":2153,"children":2154},{"style":1096},[2155],{"type":48,"value":1099},{"type":42,"tag":207,"props":2157,"children":2158},{"style":346},[2159],{"type":48,"value":1104},{"type":42,"tag":207,"props":2161,"children":2162},{"style":287},[2163],{"type":48,"value":2164}," AFL_FAST_CAL=",{"type":42,"tag":207,"props":2166,"children":2167},{"style":676},[2168],{"type":48,"value":1710},{"type":42,"tag":207,"props":2170,"children":2171},{"style":287},[2172],{"type":48,"value":396},{"type":42,"tag":207,"props":2174,"children":2175},{"style":287},[2176],{"type":48,"value":401},{"type":42,"tag":207,"props":2178,"children":2179},{"style":287},[2180],{"type":48,"value":343},{"type":42,"tag":207,"props":2182,"children":2183},{"style":287},[2184],{"type":48,"value":325},{"type":42,"tag":207,"props":2186,"children":2187},{"style":287},[2188],{"type":48,"value":414},{"type":42,"tag":207,"props":2190,"children":2191},{"style":287},[2192],{"type":48,"value":419},{"type":42,"tag":207,"props":2194,"children":2195},{"style":287},[2196],{"type":48,"value":424},{"type":42,"tag":549,"props":2198,"children":2200},{"id":2199},"interpreting-output",[2201],{"type":48,"value":2202},"Interpreting Output",{"type":42,"tag":51,"props":2204,"children":2205},{},[2206],{"type":48,"value":2207},"The AFL++ UI shows real-time fuzzing statistics:",{"type":42,"tag":64,"props":2209,"children":2210},{},[2211,2227],{"type":42,"tag":68,"props":2212,"children":2213},{},[2214],{"type":42,"tag":72,"props":2215,"children":2216},{},[2217,2222],{"type":42,"tag":76,"props":2218,"children":2219},{},[2220],{"type":48,"value":2221},"Output",{"type":42,"tag":76,"props":2223,"children":2224},{},[2225],{"type":48,"value":2226},"Meaning",{"type":42,"tag":92,"props":2228,"children":2229},{},[2230,2246,2262,2278,2294],{"type":42,"tag":72,"props":2231,"children":2232},{},[2233,2241],{"type":42,"tag":99,"props":2234,"children":2235},{},[2236],{"type":42,"tag":153,"props":2237,"children":2238},{},[2239],{"type":48,"value":2240},"execs\u002Fsec",{"type":42,"tag":99,"props":2242,"children":2243},{},[2244],{"type":48,"value":2245},"Execution speed - higher is better",{"type":42,"tag":72,"props":2247,"children":2248},{},[2249,2257],{"type":42,"tag":99,"props":2250,"children":2251},{},[2252],{"type":42,"tag":153,"props":2253,"children":2254},{},[2255],{"type":48,"value":2256},"cycles done",{"type":42,"tag":99,"props":2258,"children":2259},{},[2260],{"type":48,"value":2261},"Number of queue passes completed",{"type":42,"tag":72,"props":2263,"children":2264},{},[2265,2273],{"type":42,"tag":99,"props":2266,"children":2267},{},[2268],{"type":42,"tag":153,"props":2269,"children":2270},{},[2271],{"type":48,"value":2272},"corpus count",{"type":42,"tag":99,"props":2274,"children":2275},{},[2276],{"type":48,"value":2277},"Number of unique test cases in queue",{"type":42,"tag":72,"props":2279,"children":2280},{},[2281,2289],{"type":42,"tag":99,"props":2282,"children":2283},{},[2284],{"type":42,"tag":153,"props":2285,"children":2286},{},[2287],{"type":48,"value":2288},"saved crashes",{"type":42,"tag":99,"props":2290,"children":2291},{},[2292],{"type":48,"value":2293},"Number of unique crashes found",{"type":42,"tag":72,"props":2295,"children":2296},{},[2297,2305],{"type":42,"tag":99,"props":2298,"children":2299},{},[2300],{"type":42,"tag":153,"props":2301,"children":2302},{},[2303],{"type":48,"value":2304},"stability",{"type":42,"tag":99,"props":2306,"children":2307},{},[2308],{"type":48,"value":2309},"% of stable edges (should be near 100%)",{"type":42,"tag":549,"props":2311,"children":2313},{"id":2312},"output-directory-structure",[2314],{"type":48,"value":2315},"Output Directory Structure",{"type":42,"tag":195,"props":2317,"children":2321},{"className":2318,"code":2320,"language":48,"meta":200},[2319],"language-text","out\u002Fdefault\u002F\n├── cmdline          # How was the SUT invoked?\n├── crashes\u002F         # Inputs that crash the SUT\n│   └── id:000000,sig:06,src:000002,time:286,execs:13105,op:havoc,rep:4\n├── hangs\u002F           # Inputs that hang the SUT\n├── queue\u002F           # Test cases reproducing final fuzzer state\n│   ├── id:000000,time:0,execs:0,orig:minimal_seed\n│   └── id:000001,src:000000,time:0,execs:8,op:havoc,rep:6,+cov\n├── fuzzer_stats     # Campaign statistics\n└── plot_data        # Data for plotting\n",[2322],{"type":42,"tag":203,"props":2323,"children":2324},{"__ignoreMap":200},[2325],{"type":48,"value":2320},{"type":42,"tag":549,"props":2327,"children":2329},{"id":2328},"analyzing-results",[2330],{"type":48,"value":2331},"Analyzing Results",{"type":42,"tag":51,"props":2333,"children":2334},{},[2335],{"type":48,"value":2336},"View live campaign statistics:",{"type":42,"tag":195,"props":2338,"children":2340},{"className":260,"code":2339,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-whatsup out\n",[2341],{"type":42,"tag":203,"props":2342,"children":2343},{"__ignoreMap":200},[2344],{"type":42,"tag":207,"props":2345,"children":2346},{"class":209,"line":210},[2347,2351,2355,2359,2363,2367,2372],{"type":42,"tag":207,"props":2348,"children":2349},{"style":281},[2350],{"type":48,"value":284},{"type":42,"tag":207,"props":2352,"children":2353},{"style":346},[2354],{"type":48,"value":1088},{"type":42,"tag":207,"props":2356,"children":2357},{"style":287},[2358],{"type":48,"value":1093},{"type":42,"tag":207,"props":2360,"children":2361},{"style":1096},[2362],{"type":48,"value":1099},{"type":42,"tag":207,"props":2364,"children":2365},{"style":346},[2366],{"type":48,"value":1104},{"type":42,"tag":207,"props":2368,"children":2369},{"style":287},[2370],{"type":48,"value":2371}," afl-whatsup",{"type":42,"tag":207,"props":2373,"children":2374},{"style":287},[2375],{"type":48,"value":2376}," out\n",{"type":42,"tag":51,"props":2378,"children":2379},{},[2380],{"type":48,"value":2381},"Create coverage plots:",{"type":42,"tag":195,"props":2383,"children":2385},{"className":260,"code":2384,"language":262,"meta":200,"style":200},"apt install gnuplot\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-plot out\u002Fdefault out_graph\u002F\n",[2386],{"type":42,"tag":203,"props":2387,"children":2388},{"__ignoreMap":200},[2389,2405],{"type":42,"tag":207,"props":2390,"children":2391},{"class":209,"line":210},[2392,2396,2400],{"type":42,"tag":207,"props":2393,"children":2394},{"style":281},[2395],{"type":48,"value":598},{"type":42,"tag":207,"props":2397,"children":2398},{"style":287},[2399],{"type":48,"value":603},{"type":42,"tag":207,"props":2401,"children":2402},{"style":287},[2403],{"type":48,"value":2404}," gnuplot\n",{"type":42,"tag":207,"props":2406,"children":2407},{"class":209,"line":219},[2408,2412,2416,2420,2424,2428,2433,2438],{"type":42,"tag":207,"props":2409,"children":2410},{"style":281},[2411],{"type":48,"value":284},{"type":42,"tag":207,"props":2413,"children":2414},{"style":346},[2415],{"type":48,"value":1088},{"type":42,"tag":207,"props":2417,"children":2418},{"style":287},[2419],{"type":48,"value":1093},{"type":42,"tag":207,"props":2421,"children":2422},{"style":1096},[2423],{"type":48,"value":1099},{"type":42,"tag":207,"props":2425,"children":2426},{"style":346},[2427],{"type":48,"value":1104},{"type":42,"tag":207,"props":2429,"children":2430},{"style":287},[2431],{"type":48,"value":2432}," afl-plot",{"type":42,"tag":207,"props":2434,"children":2435},{"style":287},[2436],{"type":48,"value":2437}," out\u002Fdefault",{"type":42,"tag":207,"props":2439,"children":2440},{"style":287},[2441],{"type":48,"value":2442}," out_graph\u002F\n",{"type":42,"tag":549,"props":2444,"children":2446},{"id":2445},"re-executing-test-cases",[2447],{"type":48,"value":2448},"Re-executing Test Cases",{"type":42,"tag":195,"props":2450,"children":2452},{"className":260,"code":2451,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> .\u002Ffuzz out\u002Fdefault\u002Fcrashes\u002F\u003Ctest_case>\n",[2453],{"type":42,"tag":203,"props":2454,"children":2455},{"__ignoreMap":200},[2456],{"type":42,"tag":207,"props":2457,"children":2458},{"class":209,"line":210},[2459,2463,2467,2471,2475,2479,2484,2489,2494,2499,2504],{"type":42,"tag":207,"props":2460,"children":2461},{"style":281},[2462],{"type":48,"value":284},{"type":42,"tag":207,"props":2464,"children":2465},{"style":346},[2466],{"type":48,"value":1088},{"type":42,"tag":207,"props":2468,"children":2469},{"style":287},[2470],{"type":48,"value":1093},{"type":42,"tag":207,"props":2472,"children":2473},{"style":1096},[2474],{"type":48,"value":1099},{"type":42,"tag":207,"props":2476,"children":2477},{"style":346},[2478],{"type":48,"value":1104},{"type":42,"tag":207,"props":2480,"children":2481},{"style":287},[2482],{"type":48,"value":2483}," .\u002Ffuzz",{"type":42,"tag":207,"props":2485,"children":2486},{"style":287},[2487],{"type":48,"value":2488}," out\u002Fdefault\u002Fcrashes\u002F",{"type":42,"tag":207,"props":2490,"children":2491},{"style":346},[2492],{"type":48,"value":2493},"\u003C",{"type":42,"tag":207,"props":2495,"children":2496},{"style":287},[2497],{"type":48,"value":2498},"test_cas",{"type":42,"tag":207,"props":2500,"children":2501},{"style":1096},[2502],{"type":48,"value":2503},"e",{"type":42,"tag":207,"props":2505,"children":2506},{"style":346},[2507],{"type":48,"value":2508},">\n",{"type":42,"tag":549,"props":2510,"children":2512},{"id":2511},"fuzzer-options",[2513],{"type":48,"value":2514},"Fuzzer Options",{"type":42,"tag":64,"props":2516,"children":2517},{},[2518,2533],{"type":42,"tag":68,"props":2519,"children":2520},{},[2521],{"type":42,"tag":72,"props":2522,"children":2523},{},[2524,2529],{"type":42,"tag":76,"props":2525,"children":2526},{},[2527],{"type":48,"value":2528},"Option",{"type":42,"tag":76,"props":2530,"children":2531},{},[2532],{"type":48,"value":1805},{"type":42,"tag":92,"props":2534,"children":2535},{},[2536,2553,2570,2587],{"type":42,"tag":72,"props":2537,"children":2538},{},[2539,2548],{"type":42,"tag":99,"props":2540,"children":2541},{},[2542],{"type":42,"tag":203,"props":2543,"children":2545},{"className":2544},[],[2546],{"type":48,"value":2547},"-G 4000",{"type":42,"tag":99,"props":2549,"children":2550},{},[2551],{"type":48,"value":2552},"Maximum test input length (default: 1048576 bytes)",{"type":42,"tag":72,"props":2554,"children":2555},{},[2556,2565],{"type":42,"tag":99,"props":2557,"children":2558},{},[2559],{"type":42,"tag":203,"props":2560,"children":2562},{"className":2561},[],[2563],{"type":48,"value":2564},"-t 1000",{"type":42,"tag":99,"props":2566,"children":2567},{},[2568],{"type":48,"value":2569},"Timeout in milliseconds for each test case (default: 1000ms)",{"type":42,"tag":72,"props":2571,"children":2572},{},[2573,2582],{"type":42,"tag":99,"props":2574,"children":2575},{},[2576],{"type":42,"tag":203,"props":2577,"children":2579},{"className":2578},[],[2580],{"type":48,"value":2581},"-m 1000",{"type":42,"tag":99,"props":2583,"children":2584},{},[2585],{"type":48,"value":2586},"Memory limit in megabytes (default: 0 = unlimited)",{"type":42,"tag":72,"props":2588,"children":2589},{},[2590,2599],{"type":42,"tag":99,"props":2591,"children":2592},{},[2593],{"type":42,"tag":203,"props":2594,"children":2596},{"className":2595},[],[2597],{"type":48,"value":2598},"-x .\u002Fdict.dict",{"type":42,"tag":99,"props":2600,"children":2601},{},[2602],{"type":48,"value":2603},"Use dictionary file to guide mutations",{"type":42,"tag":57,"props":2605,"children":2607},{"id":2606},"environment-variables-that-matter",[2608],{"type":48,"value":2609},"Environment Variables That Matter",{"type":42,"tag":51,"props":2611,"children":2612},{},[2613,2615,2622],{"type":48,"value":2614},"AFL++ has ",{"type":42,"tag":746,"props":2616,"children":2619},{"href":2617,"rel":2618},"https:\u002F\u002Faflplus.plus\u002Fdocs\u002Fenv_variables\u002F",[750],[2620],{"type":48,"value":2621},"many environment variables",{"type":48,"value":2623},", but most are niche. These are the ones that matter in practice.",{"type":42,"tag":549,"props":2625,"children":2627},{"id":2626},"always-set-these",[2628],{"type":48,"value":2629},"Always Set These",{"type":42,"tag":195,"props":2631,"children":2633},{"className":260,"code":2632,"language":262,"meta":200,"style":200},"# Every campaign should use tmpfs — SSDs will thank you, and it's faster\nAFL_TMPDIR=\u002Fdev\u002Fshm\n",[2634],{"type":42,"tag":203,"props":2635,"children":2636},{"__ignoreMap":200},[2637,2645],{"type":42,"tag":207,"props":2638,"children":2639},{"class":209,"line":210},[2640],{"type":42,"tag":207,"props":2641,"children":2642},{"style":272},[2643],{"type":48,"value":2644},"# Every campaign should use tmpfs — SSDs will thank you, and it's faster\n",{"type":42,"tag":207,"props":2646,"children":2647},{"class":209,"line":219},[2648,2653,2658],{"type":42,"tag":207,"props":2649,"children":2650},{"style":1096},[2651],{"type":48,"value":2652},"AFL_TMPDIR",{"type":42,"tag":207,"props":2654,"children":2655},{"style":346},[2656],{"type":48,"value":2657},"=",{"type":42,"tag":207,"props":2659,"children":2660},{"style":287},[2661],{"type":48,"value":2662},"\u002Fdev\u002Fshm\n",{"type":42,"tag":51,"props":2664,"children":2665},{},[2666,2671],{"type":42,"tag":203,"props":2667,"children":2669},{"className":2668},[],[2670],{"type":48,"value":2652},{"type":48,"value":2672}," is a free performance win with no downsides — not setting it wears out your SSD and slows fuzzing.",{"type":42,"tag":549,"props":2674,"children":2676},{"id":2675},"slow-targets",[2677],{"type":48,"value":2678},"Slow Targets",{"type":42,"tag":195,"props":2680,"children":2682},{"className":260,"code":2681,"language":262,"meta":200,"style":200},"# Speeds up calibration ~2.5x — use when targets are slow (e.g., >10 ms\u002Fexec)\nAFL_FAST_CAL=1\n",[2683],{"type":42,"tag":203,"props":2684,"children":2685},{"__ignoreMap":200},[2686,2694],{"type":42,"tag":207,"props":2687,"children":2688},{"class":209,"line":210},[2689],{"type":42,"tag":207,"props":2690,"children":2691},{"style":272},[2692],{"type":48,"value":2693},"# Speeds up calibration ~2.5x — use when targets are slow (e.g., >10 ms\u002Fexec)\n",{"type":42,"tag":207,"props":2695,"children":2696},{"class":209,"line":219},[2697,2702,2706],{"type":42,"tag":207,"props":2698,"children":2699},{"style":1096},[2700],{"type":48,"value":2701},"AFL_FAST_CAL",{"type":42,"tag":207,"props":2703,"children":2704},{"style":346},[2705],{"type":48,"value":2657},{"type":42,"tag":207,"props":2707,"children":2708},{"style":287},[2709],{"type":48,"value":2710},"1\n",{"type":42,"tag":51,"props":2712,"children":2713},{},[2714,2719],{"type":42,"tag":203,"props":2715,"children":2717},{"className":2716},[],[2718],{"type":48,"value":2701},{"type":48,"value":2720}," reduces calibration time with negligible precision loss. Recommended specifically for slow targets where calibration would otherwise take a long time.",{"type":42,"tag":549,"props":2722,"children":2724},{"id":2723},"multi-core-campaigns",[2725],{"type":48,"value":2726},"Multi-Core Campaigns",{"type":42,"tag":195,"props":2728,"children":2730},{"className":260,"code":2729,"language":262,"meta":200,"style":200},"# On the primary (-M) instance only — needed for afl-cmin, not for fuzzing itself\nAFL_FINAL_SYNC=1\n\n# On all instances — cache test cases in memory (default: 50 MB, good range: 50-250 MB)\nAFL_TESTCACHE_SIZE=100\n",[2731],{"type":42,"tag":203,"props":2732,"children":2733},{"__ignoreMap":200},[2734,2742,2758,2765,2773],{"type":42,"tag":207,"props":2735,"children":2736},{"class":209,"line":210},[2737],{"type":42,"tag":207,"props":2738,"children":2739},{"style":272},[2740],{"type":48,"value":2741},"# On the primary (-M) instance only — needed for afl-cmin, not for fuzzing itself\n",{"type":42,"tag":207,"props":2743,"children":2744},{"class":209,"line":219},[2745,2750,2754],{"type":42,"tag":207,"props":2746,"children":2747},{"style":1096},[2748],{"type":48,"value":2749},"AFL_FINAL_SYNC",{"type":42,"tag":207,"props":2751,"children":2752},{"style":346},[2753],{"type":48,"value":2657},{"type":42,"tag":207,"props":2755,"children":2756},{"style":287},[2757],{"type":48,"value":2710},{"type":42,"tag":207,"props":2759,"children":2760},{"class":209,"line":228},[2761],{"type":42,"tag":207,"props":2762,"children":2763},{"emptyLinePlaceholder":1248},[2764],{"type":48,"value":1251},{"type":42,"tag":207,"props":2766,"children":2767},{"class":209,"line":237},[2768],{"type":42,"tag":207,"props":2769,"children":2770},{"style":272},[2771],{"type":48,"value":2772},"# On all instances — cache test cases in memory (default: 50 MB, good range: 50-250 MB)\n",{"type":42,"tag":207,"props":2774,"children":2775},{"class":209,"line":246},[2776,2781,2785],{"type":42,"tag":207,"props":2777,"children":2778},{"style":1096},[2779],{"type":48,"value":2780},"AFL_TESTCACHE_SIZE",{"type":42,"tag":207,"props":2782,"children":2783},{"style":346},[2784],{"type":48,"value":2657},{"type":42,"tag":207,"props":2786,"children":2787},{"style":287},[2788],{"type":48,"value":2789},"100\n",{"type":42,"tag":51,"props":2791,"children":2792},{},[2793,2798,2800,2806,2808,2813],{"type":42,"tag":203,"props":2794,"children":2796},{"className":2795},[],[2797],{"type":48,"value":2749},{"type":48,"value":2799}," tells the primary instance to do a final import from all secondaries when stopping. This does not affect the fuzzing process itself — it only matters when you later run ",{"type":42,"tag":203,"props":2801,"children":2803},{"className":2802},[],[2804],{"type":48,"value":2805},"afl-cmin",{"type":48,"value":2807}," for corpus minimization, ensuring the primary's queue has the full combined corpus. ",{"type":42,"tag":203,"props":2809,"children":2811},{"className":2810},[],[2812],{"type":48,"value":2780},{"type":48,"value":2814}," caches test cases in memory to reduce disk I\u002FO; the default is 50 MB and values between 50-250 MB work well for most campaigns.",{"type":42,"tag":549,"props":2816,"children":2818},{"id":2817},"ciautomated-fuzzing",[2819],{"type":48,"value":2820},"CI\u002FAutomated Fuzzing",{"type":42,"tag":195,"props":2822,"children":2824},{"className":260,"code":2823,"language":262,"meta":200,"style":200},"# Fail fast if fuzzing isn't finding anything\nAFL_EXIT_ON_TIME=3600  # 1 hour with no new paths = stop\n\n# Or run until \"done\" (all queue entries processed)\nAFL_EXIT_WHEN_DONE=1\n\n# Headless environments\nAFL_NO_UI=1\n",[2825],{"type":42,"tag":203,"props":2826,"children":2827},{"__ignoreMap":200},[2828,2836,2858,2865,2873,2889,2896,2904],{"type":42,"tag":207,"props":2829,"children":2830},{"class":209,"line":210},[2831],{"type":42,"tag":207,"props":2832,"children":2833},{"style":272},[2834],{"type":48,"value":2835},"# Fail fast if fuzzing isn't finding anything\n",{"type":42,"tag":207,"props":2837,"children":2838},{"class":209,"line":219},[2839,2844,2848,2853],{"type":42,"tag":207,"props":2840,"children":2841},{"style":1096},[2842],{"type":48,"value":2843},"AFL_EXIT_ON_TIME",{"type":42,"tag":207,"props":2845,"children":2846},{"style":346},[2847],{"type":48,"value":2657},{"type":42,"tag":207,"props":2849,"children":2850},{"style":287},[2851],{"type":48,"value":2852},"3600",{"type":42,"tag":207,"props":2854,"children":2855},{"style":272},[2856],{"type":48,"value":2857},"  # 1 hour with no new paths = stop\n",{"type":42,"tag":207,"props":2859,"children":2860},{"class":209,"line":228},[2861],{"type":42,"tag":207,"props":2862,"children":2863},{"emptyLinePlaceholder":1248},[2864],{"type":48,"value":1251},{"type":42,"tag":207,"props":2866,"children":2867},{"class":209,"line":237},[2868],{"type":42,"tag":207,"props":2869,"children":2870},{"style":272},[2871],{"type":48,"value":2872},"# Or run until \"done\" (all queue entries processed)\n",{"type":42,"tag":207,"props":2874,"children":2875},{"class":209,"line":246},[2876,2881,2885],{"type":42,"tag":207,"props":2877,"children":2878},{"style":1096},[2879],{"type":48,"value":2880},"AFL_EXIT_WHEN_DONE",{"type":42,"tag":207,"props":2882,"children":2883},{"style":346},[2884],{"type":48,"value":2657},{"type":42,"tag":207,"props":2886,"children":2887},{"style":287},[2888],{"type":48,"value":2710},{"type":42,"tag":207,"props":2890,"children":2891},{"class":209,"line":849},[2892],{"type":42,"tag":207,"props":2893,"children":2894},{"emptyLinePlaceholder":1248},[2895],{"type":48,"value":1251},{"type":42,"tag":207,"props":2897,"children":2898},{"class":209,"line":858},[2899],{"type":42,"tag":207,"props":2900,"children":2901},{"style":272},[2902],{"type":48,"value":2903},"# Headless environments\n",{"type":42,"tag":207,"props":2905,"children":2906},{"class":209,"line":867},[2907,2912,2916],{"type":42,"tag":207,"props":2908,"children":2909},{"style":1096},[2910],{"type":48,"value":2911},"AFL_NO_UI",{"type":42,"tag":207,"props":2913,"children":2914},{"style":346},[2915],{"type":48,"value":2657},{"type":42,"tag":207,"props":2917,"children":2918},{"style":287},[2919],{"type":48,"value":2710},{"type":42,"tag":51,"props":2921,"children":2922},{},[2923],{"type":48,"value":2924},"Unbounded fuzzing in CI wastes resources. Set time limits or use exit conditions.",{"type":42,"tag":549,"props":2926,"children":2928},{"id":2927},"variables-to-avoid",[2929],{"type":48,"value":2930},"Variables to Avoid",{"type":42,"tag":64,"props":2932,"children":2933},{},[2934,2950],{"type":42,"tag":68,"props":2935,"children":2936},{},[2937],{"type":42,"tag":72,"props":2938,"children":2939},{},[2940,2945],{"type":42,"tag":76,"props":2941,"children":2942},{},[2943],{"type":48,"value":2944},"Variable",{"type":42,"tag":76,"props":2946,"children":2947},{},[2948],{"type":48,"value":2949},"Why Skip It",{"type":42,"tag":92,"props":2951,"children":2952},{},[2953,2970,2987],{"type":42,"tag":72,"props":2954,"children":2955},{},[2956,2965],{"type":42,"tag":99,"props":2957,"children":2958},{},[2959],{"type":42,"tag":203,"props":2960,"children":2962},{"className":2961},[],[2963],{"type":48,"value":2964},"AFL_NO_ARITH",{"type":42,"tag":99,"props":2966,"children":2967},{},[2968],{"type":48,"value":2969},"Can hurt coverage on binary formats, but may be useful for text-based targets",{"type":42,"tag":72,"props":2971,"children":2972},{},[2973,2982],{"type":42,"tag":99,"props":2974,"children":2975},{},[2976],{"type":42,"tag":203,"props":2977,"children":2979},{"className":2978},[],[2980],{"type":48,"value":2981},"AFL_SHUFFLE_QUEUE",{"type":42,"tag":99,"props":2983,"children":2984},{},[2985],{"type":48,"value":2986},"Only for exotic setups, usually harmful",{"type":42,"tag":72,"props":2988,"children":2989},{},[2990,2999],{"type":42,"tag":99,"props":2991,"children":2992},{},[2993],{"type":42,"tag":203,"props":2994,"children":2996},{"className":2995},[],[2997],{"type":48,"value":2998},"AFL_DISABLE_TRIM",{"type":42,"tag":99,"props":3000,"children":3001},{},[3002],{"type":48,"value":3003},"Trimming is valuable, don't disable without reason",{"type":42,"tag":57,"props":3005,"children":3007},{"id":3006},"multi-core-fuzzing",[3008],{"type":48,"value":3009},"Multi-Core Fuzzing",{"type":42,"tag":51,"props":3011,"children":3012},{},[3013],{"type":48,"value":3014},"AFL++ excels at multi-core fuzzing with two major advantages:",{"type":42,"tag":3016,"props":3017,"children":3018},"ol",{},[3019,3024],{"type":42,"tag":163,"props":3020,"children":3021},{},[3022],{"type":48,"value":3023},"More executions per second (scales linearly with physical cores)",{"type":42,"tag":163,"props":3025,"children":3026},{},[3027],{"type":48,"value":3028},"Asymmetrical fuzzing (e.g., one ASan job, rest without sanitizers)",{"type":42,"tag":549,"props":3030,"children":3032},{"id":3031},"starting-a-campaign",[3033],{"type":48,"value":3034},"Starting a Campaign",{"type":42,"tag":51,"props":3036,"children":3037},{},[3038],{"type":48,"value":3039},"Start the primary fuzzer (in background):",{"type":42,"tag":195,"props":3041,"children":3043},{"className":260,"code":3042,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -M primary -i seeds -o state -- .\u002Ffuzz 1>primary.log 2>primary.error &\n",[3044],{"type":42,"tag":203,"props":3045,"children":3046},{"__ignoreMap":200},[3047],{"type":42,"tag":207,"props":3048,"children":3049},{"class":209,"line":210},[3050,3054,3058,3062,3066,3070,3074,3079,3084,3088,3092,3096,3101,3105,3109,3114,3119,3124,3129],{"type":42,"tag":207,"props":3051,"children":3052},{"style":281},[3053],{"type":48,"value":284},{"type":42,"tag":207,"props":3055,"children":3056},{"style":346},[3057],{"type":48,"value":1088},{"type":42,"tag":207,"props":3059,"children":3060},{"style":287},[3061],{"type":48,"value":1093},{"type":42,"tag":207,"props":3063,"children":3064},{"style":1096},[3065],{"type":48,"value":1099},{"type":42,"tag":207,"props":3067,"children":3068},{"style":346},[3069],{"type":48,"value":1104},{"type":42,"tag":207,"props":3071,"children":3072},{"style":287},[3073],{"type":48,"value":396},{"type":42,"tag":207,"props":3075,"children":3076},{"style":287},[3077],{"type":48,"value":3078}," -M",{"type":42,"tag":207,"props":3080,"children":3081},{"style":287},[3082],{"type":48,"value":3083}," primary",{"type":42,"tag":207,"props":3085,"children":3086},{"style":287},[3087],{"type":48,"value":401},{"type":42,"tag":207,"props":3089,"children":3090},{"style":287},[3091],{"type":48,"value":343},{"type":42,"tag":207,"props":3093,"children":3094},{"style":287},[3095],{"type":48,"value":325},{"type":42,"tag":207,"props":3097,"children":3098},{"style":287},[3099],{"type":48,"value":3100}," state",{"type":42,"tag":207,"props":3102,"children":3103},{"style":287},[3104],{"type":48,"value":419},{"type":42,"tag":207,"props":3106,"children":3107},{"style":287},[3108],{"type":48,"value":2483},{"type":42,"tag":207,"props":3110,"children":3111},{"style":346},[3112],{"type":48,"value":3113}," 1>",{"type":42,"tag":207,"props":3115,"children":3116},{"style":287},[3117],{"type":48,"value":3118},"primary.log",{"type":42,"tag":207,"props":3120,"children":3121},{"style":346},[3122],{"type":48,"value":3123}," 2>",{"type":42,"tag":207,"props":3125,"children":3126},{"style":287},[3127],{"type":48,"value":3128},"primary.error",{"type":42,"tag":207,"props":3130,"children":3131},{"style":346},[3132],{"type":48,"value":3133}," &\n",{"type":42,"tag":51,"props":3135,"children":3136},{},[3137],{"type":48,"value":3138},"Start secondary fuzzers (as many as you have cores):",{"type":42,"tag":195,"props":3140,"children":3142},{"className":260,"code":3141,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -S secondary01 -i seeds -o state -- .\u002Ffuzz 1>secondary01.log 2>secondary01.error &\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -S secondary02 -i seeds -o state -- .\u002Ffuzz 1>secondary02.log 2>secondary02.error &\n",[3143],{"type":42,"tag":203,"props":3144,"children":3145},{"__ignoreMap":200},[3146,3229],{"type":42,"tag":207,"props":3147,"children":3148},{"class":209,"line":210},[3149,3153,3157,3161,3165,3169,3173,3178,3183,3187,3191,3195,3199,3203,3207,3211,3216,3220,3225],{"type":42,"tag":207,"props":3150,"children":3151},{"style":281},[3152],{"type":48,"value":284},{"type":42,"tag":207,"props":3154,"children":3155},{"style":346},[3156],{"type":48,"value":1088},{"type":42,"tag":207,"props":3158,"children":3159},{"style":287},[3160],{"type":48,"value":1093},{"type":42,"tag":207,"props":3162,"children":3163},{"style":1096},[3164],{"type":48,"value":1099},{"type":42,"tag":207,"props":3166,"children":3167},{"style":346},[3168],{"type":48,"value":1104},{"type":42,"tag":207,"props":3170,"children":3171},{"style":287},[3172],{"type":48,"value":396},{"type":42,"tag":207,"props":3174,"children":3175},{"style":287},[3176],{"type":48,"value":3177}," -S",{"type":42,"tag":207,"props":3179,"children":3180},{"style":287},[3181],{"type":48,"value":3182}," secondary01",{"type":42,"tag":207,"props":3184,"children":3185},{"style":287},[3186],{"type":48,"value":401},{"type":42,"tag":207,"props":3188,"children":3189},{"style":287},[3190],{"type":48,"value":343},{"type":42,"tag":207,"props":3192,"children":3193},{"style":287},[3194],{"type":48,"value":325},{"type":42,"tag":207,"props":3196,"children":3197},{"style":287},[3198],{"type":48,"value":3100},{"type":42,"tag":207,"props":3200,"children":3201},{"style":287},[3202],{"type":48,"value":419},{"type":42,"tag":207,"props":3204,"children":3205},{"style":287},[3206],{"type":48,"value":2483},{"type":42,"tag":207,"props":3208,"children":3209},{"style":346},[3210],{"type":48,"value":3113},{"type":42,"tag":207,"props":3212,"children":3213},{"style":287},[3214],{"type":48,"value":3215},"secondary01.log",{"type":42,"tag":207,"props":3217,"children":3218},{"style":346},[3219],{"type":48,"value":3123},{"type":42,"tag":207,"props":3221,"children":3222},{"style":287},[3223],{"type":48,"value":3224},"secondary01.error",{"type":42,"tag":207,"props":3226,"children":3227},{"style":346},[3228],{"type":48,"value":3133},{"type":42,"tag":207,"props":3230,"children":3231},{"class":209,"line":219},[3232,3236,3240,3244,3248,3252,3256,3260,3265,3269,3273,3277,3281,3285,3289,3293,3298,3302,3307],{"type":42,"tag":207,"props":3233,"children":3234},{"style":281},[3235],{"type":48,"value":284},{"type":42,"tag":207,"props":3237,"children":3238},{"style":346},[3239],{"type":48,"value":1088},{"type":42,"tag":207,"props":3241,"children":3242},{"style":287},[3243],{"type":48,"value":1093},{"type":42,"tag":207,"props":3245,"children":3246},{"style":1096},[3247],{"type":48,"value":1099},{"type":42,"tag":207,"props":3249,"children":3250},{"style":346},[3251],{"type":48,"value":1104},{"type":42,"tag":207,"props":3253,"children":3254},{"style":287},[3255],{"type":48,"value":396},{"type":42,"tag":207,"props":3257,"children":3258},{"style":287},[3259],{"type":48,"value":3177},{"type":42,"tag":207,"props":3261,"children":3262},{"style":287},[3263],{"type":48,"value":3264}," secondary02",{"type":42,"tag":207,"props":3266,"children":3267},{"style":287},[3268],{"type":48,"value":401},{"type":42,"tag":207,"props":3270,"children":3271},{"style":287},[3272],{"type":48,"value":343},{"type":42,"tag":207,"props":3274,"children":3275},{"style":287},[3276],{"type":48,"value":325},{"type":42,"tag":207,"props":3278,"children":3279},{"style":287},[3280],{"type":48,"value":3100},{"type":42,"tag":207,"props":3282,"children":3283},{"style":287},[3284],{"type":48,"value":419},{"type":42,"tag":207,"props":3286,"children":3287},{"style":287},[3288],{"type":48,"value":2483},{"type":42,"tag":207,"props":3290,"children":3291},{"style":346},[3292],{"type":48,"value":3113},{"type":42,"tag":207,"props":3294,"children":3295},{"style":287},[3296],{"type":48,"value":3297},"secondary02.log",{"type":42,"tag":207,"props":3299,"children":3300},{"style":346},[3301],{"type":48,"value":3123},{"type":42,"tag":207,"props":3303,"children":3304},{"style":287},[3305],{"type":48,"value":3306},"secondary02.error",{"type":42,"tag":207,"props":3308,"children":3309},{"style":346},[3310],{"type":48,"value":3133},{"type":42,"tag":549,"props":3312,"children":3314},{"id":3313},"monitoring-multi-core-campaigns",[3315],{"type":48,"value":3316},"Monitoring Multi-Core Campaigns",{"type":42,"tag":51,"props":3318,"children":3319},{},[3320],{"type":48,"value":3321},"List all running jobs:",{"type":42,"tag":195,"props":3323,"children":3325},{"className":260,"code":3324,"language":262,"meta":200,"style":200},"jobs\n",[3326],{"type":42,"tag":203,"props":3327,"children":3328},{"__ignoreMap":200},[3329],{"type":42,"tag":207,"props":3330,"children":3331},{"class":209,"line":210},[3332],{"type":42,"tag":207,"props":3333,"children":3334},{"style":352},[3335],{"type":48,"value":3324},{"type":42,"tag":51,"props":3337,"children":3338},{},[3339],{"type":48,"value":3340},"View live statistics (updates every second):",{"type":42,"tag":195,"props":3342,"children":3344},{"className":260,"code":3343,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> watch -n1 --color afl-whatsup state\u002F\n",[3345],{"type":42,"tag":203,"props":3346,"children":3347},{"__ignoreMap":200},[3348],{"type":42,"tag":207,"props":3349,"children":3350},{"class":209,"line":210},[3351,3355,3359,3363,3367,3371,3376,3381,3386,3390],{"type":42,"tag":207,"props":3352,"children":3353},{"style":281},[3354],{"type":48,"value":284},{"type":42,"tag":207,"props":3356,"children":3357},{"style":346},[3358],{"type":48,"value":1088},{"type":42,"tag":207,"props":3360,"children":3361},{"style":287},[3362],{"type":48,"value":1093},{"type":42,"tag":207,"props":3364,"children":3365},{"style":1096},[3366],{"type":48,"value":1099},{"type":42,"tag":207,"props":3368,"children":3369},{"style":346},[3370],{"type":48,"value":1104},{"type":42,"tag":207,"props":3372,"children":3373},{"style":287},[3374],{"type":48,"value":3375}," watch",{"type":42,"tag":207,"props":3377,"children":3378},{"style":287},[3379],{"type":48,"value":3380}," -n1",{"type":42,"tag":207,"props":3382,"children":3383},{"style":287},[3384],{"type":48,"value":3385}," --color",{"type":42,"tag":207,"props":3387,"children":3388},{"style":287},[3389],{"type":48,"value":2371},{"type":42,"tag":207,"props":3391,"children":3392},{"style":287},[3393],{"type":48,"value":3394}," state\u002F\n",{"type":42,"tag":549,"props":3396,"children":3398},{"id":3397},"stopping-all-fuzzers",[3399],{"type":48,"value":3400},"Stopping All Fuzzers",{"type":42,"tag":195,"props":3402,"children":3404},{"className":260,"code":3403,"language":262,"meta":200,"style":200},"kill $(jobs -p)\n",[3405],{"type":42,"tag":203,"props":3406,"children":3407},{"__ignoreMap":200},[3408],{"type":42,"tag":207,"props":3409,"children":3410},{"class":209,"line":210},[3411,3416,3421,3426,3431],{"type":42,"tag":207,"props":3412,"children":3413},{"style":352},[3414],{"type":48,"value":3415},"kill",{"type":42,"tag":207,"props":3417,"children":3418},{"style":346},[3419],{"type":48,"value":3420}," $(",{"type":42,"tag":207,"props":3422,"children":3423},{"style":352},[3424],{"type":48,"value":3425},"jobs",{"type":42,"tag":207,"props":3427,"children":3428},{"style":287},[3429],{"type":48,"value":3430}," -p",{"type":42,"tag":207,"props":3432,"children":3433},{"style":346},[3434],{"type":48,"value":3435},")\n",{"type":42,"tag":57,"props":3437,"children":3439},{"id":3438},"coverage-analysis",[3440],{"type":48,"value":3441},"Coverage Analysis",{"type":42,"tag":51,"props":3443,"children":3444},{},[3445,3447,3453,3454,3460],{"type":48,"value":3446},"AFL++ automatically tracks coverage through edge instrumentation. Coverage information is stored in ",{"type":42,"tag":203,"props":3448,"children":3450},{"className":3449},[],[3451],{"type":48,"value":3452},"fuzzer_stats",{"type":48,"value":1050},{"type":42,"tag":203,"props":3455,"children":3457},{"className":3456},[],[3458],{"type":48,"value":3459},"plot_data",{"type":48,"value":1202},{"type":42,"tag":549,"props":3462,"children":3464},{"id":3463},"measuring-coverage",[3465],{"type":48,"value":3466},"Measuring Coverage",{"type":42,"tag":51,"props":3468,"children":3469},{},[3470,3472,3478],{"type":48,"value":3471},"Use ",{"type":42,"tag":203,"props":3473,"children":3475},{"className":3474},[],[3476],{"type":48,"value":3477},"afl-plot",{"type":48,"value":3479}," to visualize coverage over time:",{"type":42,"tag":195,"props":3481,"children":3483},{"className":260,"code":3482,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-plot out\u002Fdefault out_graph\u002F\n",[3484],{"type":42,"tag":203,"props":3485,"children":3486},{"__ignoreMap":200},[3487],{"type":42,"tag":207,"props":3488,"children":3489},{"class":209,"line":210},[3490,3494,3498,3502,3506,3510,3514,3518],{"type":42,"tag":207,"props":3491,"children":3492},{"style":281},[3493],{"type":48,"value":284},{"type":42,"tag":207,"props":3495,"children":3496},{"style":346},[3497],{"type":48,"value":1088},{"type":42,"tag":207,"props":3499,"children":3500},{"style":287},[3501],{"type":48,"value":1093},{"type":42,"tag":207,"props":3503,"children":3504},{"style":1096},[3505],{"type":48,"value":1099},{"type":42,"tag":207,"props":3507,"children":3508},{"style":346},[3509],{"type":48,"value":1104},{"type":42,"tag":207,"props":3511,"children":3512},{"style":287},[3513],{"type":48,"value":2432},{"type":42,"tag":207,"props":3515,"children":3516},{"style":287},[3517],{"type":48,"value":2437},{"type":42,"tag":207,"props":3519,"children":3520},{"style":287},[3521],{"type":48,"value":2442},{"type":42,"tag":549,"props":3523,"children":3525},{"id":3524},"improving-coverage",[3526],{"type":48,"value":3527},"Improving Coverage",{"type":42,"tag":159,"props":3529,"children":3530},{},[3531,3536,3541,3546],{"type":42,"tag":163,"props":3532,"children":3533},{},[3534],{"type":48,"value":3535},"Use dictionaries for format-aware fuzzing",{"type":42,"tag":163,"props":3537,"children":3538},{},[3539],{"type":48,"value":3540},"Run longer campaigns (cycles_wo_finds indicates plateau)",{"type":42,"tag":163,"props":3542,"children":3543},{},[3544],{"type":48,"value":3545},"Try different mutation strategies with multi-core fuzzing",{"type":42,"tag":163,"props":3547,"children":3548},{},[3549],{"type":48,"value":3550},"Analyze coverage gaps and add targeted seed inputs",{"type":42,"tag":1421,"props":3552,"children":3553},{},[3554],{"type":42,"tag":51,"props":3555,"children":3556},{},[3557,3561,3563,3567],{"type":42,"tag":153,"props":3558,"children":3559},{},[3560],{"type":48,"value":1431},{"type":48,"value":3562}," For detailed coverage analysis techniques, identifying coverage gaps,\nand systematic coverage improvement, see the ",{"type":42,"tag":153,"props":3564,"children":3565},{},[3566],{"type":48,"value":3438},{"type":48,"value":1440},{"type":42,"tag":57,"props":3569,"children":3571},{"id":3570},"cmplog",[3572],{"type":48,"value":3573},"CMPLOG",{"type":42,"tag":51,"props":3575,"children":3576},{},[3577],{"type":48,"value":3578},"CMPLOG\u002FRedQueen is the best path constraint solving mechanism available in any fuzzer.\nTo enable it, the fuzz target needs to be instrumented for it.\nBefore building the fuzzing target set the environment variable:",{"type":42,"tag":195,"props":3580,"children":3582},{"className":260,"code":3581,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> AFL_LLVM_CMPLOG=1 make\n",[3583],{"type":42,"tag":203,"props":3584,"children":3585},{"__ignoreMap":200},[3586],{"type":42,"tag":207,"props":3587,"children":3588},{"class":209,"line":210},[3589,3593,3597,3601,3605,3609,3614,3618],{"type":42,"tag":207,"props":3590,"children":3591},{"style":281},[3592],{"type":48,"value":284},{"type":42,"tag":207,"props":3594,"children":3595},{"style":346},[3596],{"type":48,"value":1088},{"type":42,"tag":207,"props":3598,"children":3599},{"style":287},[3600],{"type":48,"value":1093},{"type":42,"tag":207,"props":3602,"children":3603},{"style":1096},[3604],{"type":48,"value":1099},{"type":42,"tag":207,"props":3606,"children":3607},{"style":346},[3608],{"type":48,"value":1104},{"type":42,"tag":207,"props":3610,"children":3611},{"style":287},[3612],{"type":48,"value":3613}," AFL_LLVM_CMPLOG=",{"type":42,"tag":207,"props":3615,"children":3616},{"style":676},[3617],{"type":48,"value":1710},{"type":42,"tag":207,"props":3619,"children":3620},{"style":287},[3621],{"type":48,"value":3622}," make\n",{"type":42,"tag":51,"props":3624,"children":3625},{},[3626],{"type":48,"value":3627},"No special action is needed for compiling and linking the harness.",{"type":42,"tag":51,"props":3629,"children":3630},{},[3631,3633,3639],{"type":48,"value":3632},"To run a fuzzer instance with a CMPLOG instrumented fuzzing target, add ",{"type":42,"tag":203,"props":3634,"children":3636},{"className":3635},[],[3637],{"type":48,"value":3638},"-c0",{"type":48,"value":3640}," to the command like arguments:",{"type":42,"tag":195,"props":3642,"children":3644},{"className":260,"code":3643,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -c0 -S cmplog -i seeds -o state -- .\u002Ffuzz 1>secondary02.log 2>secondary02.error &\n",[3645],{"type":42,"tag":203,"props":3646,"children":3647},{"__ignoreMap":200},[3648],{"type":42,"tag":207,"props":3649,"children":3650},{"class":209,"line":210},[3651,3655,3659,3663,3667,3671,3675,3680,3684,3689,3693,3697,3701,3705,3709,3713,3717,3721,3725,3729],{"type":42,"tag":207,"props":3652,"children":3653},{"style":281},[3654],{"type":48,"value":284},{"type":42,"tag":207,"props":3656,"children":3657},{"style":346},[3658],{"type":48,"value":1088},{"type":42,"tag":207,"props":3660,"children":3661},{"style":287},[3662],{"type":48,"value":1093},{"type":42,"tag":207,"props":3664,"children":3665},{"style":1096},[3666],{"type":48,"value":1099},{"type":42,"tag":207,"props":3668,"children":3669},{"style":346},[3670],{"type":48,"value":1104},{"type":42,"tag":207,"props":3672,"children":3673},{"style":287},[3674],{"type":48,"value":396},{"type":42,"tag":207,"props":3676,"children":3677},{"style":287},[3678],{"type":48,"value":3679}," -c0",{"type":42,"tag":207,"props":3681,"children":3682},{"style":287},[3683],{"type":48,"value":3177},{"type":42,"tag":207,"props":3685,"children":3686},{"style":287},[3687],{"type":48,"value":3688}," cmplog",{"type":42,"tag":207,"props":3690,"children":3691},{"style":287},[3692],{"type":48,"value":401},{"type":42,"tag":207,"props":3694,"children":3695},{"style":287},[3696],{"type":48,"value":343},{"type":42,"tag":207,"props":3698,"children":3699},{"style":287},[3700],{"type":48,"value":325},{"type":42,"tag":207,"props":3702,"children":3703},{"style":287},[3704],{"type":48,"value":3100},{"type":42,"tag":207,"props":3706,"children":3707},{"style":287},[3708],{"type":48,"value":419},{"type":42,"tag":207,"props":3710,"children":3711},{"style":287},[3712],{"type":48,"value":2483},{"type":42,"tag":207,"props":3714,"children":3715},{"style":346},[3716],{"type":48,"value":3113},{"type":42,"tag":207,"props":3718,"children":3719},{"style":287},[3720],{"type":48,"value":3297},{"type":42,"tag":207,"props":3722,"children":3723},{"style":346},[3724],{"type":48,"value":3123},{"type":42,"tag":207,"props":3726,"children":3727},{"style":287},[3728],{"type":48,"value":3306},{"type":42,"tag":207,"props":3730,"children":3731},{"style":346},[3732],{"type":48,"value":3133},{"type":42,"tag":57,"props":3734,"children":3736},{"id":3735},"sanitizer-integration",[3737],{"type":48,"value":3738},"Sanitizer Integration",{"type":42,"tag":51,"props":3740,"children":3741},{},[3742],{"type":48,"value":3743},"Sanitizers are essential for finding memory corruption bugs that don't cause immediate crashes.",{"type":42,"tag":549,"props":3745,"children":3747},{"id":3746},"addresssanitizer-asan",[3748],{"type":48,"value":3749},"AddressSanitizer (ASan)",{"type":42,"tag":195,"props":3751,"children":3752},{"className":260,"code":1673,"language":262,"meta":200,"style":200},[3753],{"type":42,"tag":203,"props":3754,"children":3755},{"__ignoreMap":200},[3756],{"type":42,"tag":207,"props":3757,"children":3758},{"class":209,"line":210},[3759,3763,3767,3771,3775,3779,3783,3787,3791,3795,3799,3803,3807,3811,3815],{"type":42,"tag":207,"props":3760,"children":3761},{"style":281},[3762],{"type":48,"value":284},{"type":42,"tag":207,"props":3764,"children":3765},{"style":346},[3766],{"type":48,"value":1088},{"type":42,"tag":207,"props":3768,"children":3769},{"style":287},[3770],{"type":48,"value":1093},{"type":42,"tag":207,"props":3772,"children":3773},{"style":1096},[3774],{"type":48,"value":1099},{"type":42,"tag":207,"props":3776,"children":3777},{"style":346},[3778],{"type":48,"value":1104},{"type":42,"tag":207,"props":3780,"children":3781},{"style":287},[3782],{"type":48,"value":1705},{"type":42,"tag":207,"props":3784,"children":3785},{"style":676},[3786],{"type":48,"value":1710},{"type":42,"tag":207,"props":3788,"children":3789},{"style":287},[3790],{"type":48,"value":295},{"type":42,"tag":207,"props":3792,"children":3793},{"style":287},[3794],{"type":48,"value":300},{"type":42,"tag":207,"props":3796,"children":3797},{"style":287},[3798],{"type":48,"value":305},{"type":42,"tag":207,"props":3800,"children":3801},{"style":287},[3802],{"type":48,"value":310},{"type":42,"tag":207,"props":3804,"children":3805},{"style":287},[3806],{"type":48,"value":315},{"type":42,"tag":207,"props":3808,"children":3809},{"style":287},[3810],{"type":48,"value":320},{"type":42,"tag":207,"props":3812,"children":3813},{"style":287},[3814],{"type":48,"value":325},{"type":42,"tag":207,"props":3816,"children":3817},{"style":287},[3818],{"type":48,"value":330},{"type":42,"tag":51,"props":3820,"children":3821},{},[3822,3827,3829,3835],{"type":42,"tag":153,"props":3823,"children":3824},{},[3825],{"type":48,"value":3826},"Note:",{"type":48,"value":3828}," Memory limit (",{"type":42,"tag":203,"props":3830,"children":3832},{"className":3831},[],[3833],{"type":48,"value":3834},"-m",{"type":48,"value":3836},") is not supported with ASan due to 20TB virtual memory reservation.",{"type":42,"tag":549,"props":3838,"children":3840},{"id":3839},"undefinedbehaviorsanitizer-ubsan",[3841],{"type":48,"value":3842},"UndefinedBehaviorSanitizer (UBSan)",{"type":42,"tag":195,"props":3844,"children":3846},{"className":260,"code":3845,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> AFL_USE_UBSAN=1 afl-clang-fast++ -DNO_MAIN=1 -O2 -fsanitize=fuzzer,undefined harness.cc main.cc -o fuzz\n",[3847],{"type":42,"tag":203,"props":3848,"children":3849},{"__ignoreMap":200},[3850],{"type":42,"tag":207,"props":3851,"children":3852},{"class":209,"line":210},[3853,3857,3861,3865,3869,3873,3878,3882,3886,3890,3894,3899,3903,3907,3911],{"type":42,"tag":207,"props":3854,"children":3855},{"style":281},[3856],{"type":48,"value":284},{"type":42,"tag":207,"props":3858,"children":3859},{"style":346},[3860],{"type":48,"value":1088},{"type":42,"tag":207,"props":3862,"children":3863},{"style":287},[3864],{"type":48,"value":1093},{"type":42,"tag":207,"props":3866,"children":3867},{"style":1096},[3868],{"type":48,"value":1099},{"type":42,"tag":207,"props":3870,"children":3871},{"style":346},[3872],{"type":48,"value":1104},{"type":42,"tag":207,"props":3874,"children":3875},{"style":287},[3876],{"type":48,"value":3877}," AFL_USE_UBSAN=",{"type":42,"tag":207,"props":3879,"children":3880},{"style":676},[3881],{"type":48,"value":1710},{"type":42,"tag":207,"props":3883,"children":3884},{"style":287},[3885],{"type":48,"value":295},{"type":42,"tag":207,"props":3887,"children":3888},{"style":287},[3889],{"type":48,"value":300},{"type":42,"tag":207,"props":3891,"children":3892},{"style":287},[3893],{"type":48,"value":305},{"type":42,"tag":207,"props":3895,"children":3896},{"style":287},[3897],{"type":48,"value":3898}," -fsanitize=fuzzer,undefined",{"type":42,"tag":207,"props":3900,"children":3901},{"style":287},[3902],{"type":48,"value":315},{"type":42,"tag":207,"props":3904,"children":3905},{"style":287},[3906],{"type":48,"value":320},{"type":42,"tag":207,"props":3908,"children":3909},{"style":287},[3910],{"type":48,"value":325},{"type":42,"tag":207,"props":3912,"children":3913},{"style":287},[3914],{"type":48,"value":330},{"type":42,"tag":549,"props":3916,"children":3918},{"id":3917},"common-sanitizer-issues",[3919],{"type":48,"value":3920},"Common Sanitizer Issues",{"type":42,"tag":64,"props":3922,"children":3923},{},[3924,3940],{"type":42,"tag":68,"props":3925,"children":3926},{},[3927],{"type":42,"tag":72,"props":3928,"children":3929},{},[3930,3935],{"type":42,"tag":76,"props":3931,"children":3932},{},[3933],{"type":48,"value":3934},"Issue",{"type":42,"tag":76,"props":3936,"children":3937},{},[3938],{"type":48,"value":3939},"Solution",{"type":42,"tag":92,"props":3941,"children":3942},{},[3943,3956,3975],{"type":42,"tag":72,"props":3944,"children":3945},{},[3946,3951],{"type":42,"tag":99,"props":3947,"children":3948},{},[3949],{"type":48,"value":3950},"ASan slows fuzzing",{"type":42,"tag":99,"props":3952,"children":3953},{},[3954],{"type":48,"value":3955},"Use only 1 ASan job in multi-core setup",{"type":42,"tag":72,"props":3957,"children":3958},{},[3959,3964],{"type":42,"tag":99,"props":3960,"children":3961},{},[3962],{"type":48,"value":3963},"Stack exhaustion",{"type":42,"tag":99,"props":3965,"children":3966},{},[3967,3969],{"type":48,"value":3968},"Increase stack with ",{"type":42,"tag":203,"props":3970,"children":3972},{"className":3971},[],[3973],{"type":48,"value":3974},"ASAN_OPTIONS=stack_size=...",{"type":42,"tag":72,"props":3976,"children":3977},{},[3978,3983],{"type":42,"tag":99,"props":3979,"children":3980},{},[3981],{"type":48,"value":3982},"GCC version mismatch",{"type":42,"tag":99,"props":3984,"children":3985},{},[3986],{"type":48,"value":3987},"Ensure system GCC matches AFL++ plugin version",{"type":42,"tag":1421,"props":3989,"children":3990},{},[3991],{"type":42,"tag":51,"props":3992,"children":3993},{},[3994,3998,4000,4004],{"type":42,"tag":153,"props":3995,"children":3996},{},[3997],{"type":48,"value":1431},{"type":48,"value":3999}," For comprehensive sanitizer configuration and troubleshooting,\nsee the ",{"type":42,"tag":153,"props":4001,"children":4002},{},[4003],{"type":48,"value":1759},{"type":48,"value":1440},{"type":42,"tag":57,"props":4006,"children":4008},{"id":4007},"advanced-usage",[4009],{"type":48,"value":4010},"Advanced Usage",{"type":42,"tag":549,"props":4012,"children":4014},{"id":4013},"tips-and-tricks",[4015],{"type":48,"value":4016},"Tips and Tricks",{"type":42,"tag":64,"props":4018,"children":4019},{},[4020,4036],{"type":42,"tag":68,"props":4021,"children":4022},{},[4023],{"type":42,"tag":72,"props":4024,"children":4025},{},[4026,4031],{"type":42,"tag":76,"props":4027,"children":4028},{},[4029],{"type":48,"value":4030},"Tip",{"type":42,"tag":76,"props":4032,"children":4033},{},[4034],{"type":48,"value":4035},"Why It Helps",{"type":42,"tag":92,"props":4037,"children":4038},{},[4039,4052,4065,4078,4091],{"type":42,"tag":72,"props":4040,"children":4041},{},[4042,4047],{"type":42,"tag":99,"props":4043,"children":4044},{},[4045],{"type":48,"value":4046},"Use LLVMFuzzerTestOneInput harnesses where possible",{"type":42,"tag":99,"props":4048,"children":4049},{},[4050],{"type":48,"value":4051},"If a fuzzing campaign has at least 85% stability then this is the most efficient fuzzing style. If not then try standard input or file input fuzzing",{"type":42,"tag":72,"props":4053,"children":4054},{},[4055,4060],{"type":42,"tag":99,"props":4056,"children":4057},{},[4058],{"type":48,"value":4059},"Use dictionaries",{"type":42,"tag":99,"props":4061,"children":4062},{},[4063],{"type":48,"value":4064},"Helps fuzzer discover format-specific keywords and magic bytes",{"type":42,"tag":72,"props":4066,"children":4067},{},[4068,4073],{"type":42,"tag":99,"props":4069,"children":4070},{},[4071],{"type":48,"value":4072},"Set realistic timeouts",{"type":42,"tag":99,"props":4074,"children":4075},{},[4076],{"type":48,"value":4077},"Prevents false positives from system load",{"type":42,"tag":72,"props":4079,"children":4080},{},[4081,4086],{"type":42,"tag":99,"props":4082,"children":4083},{},[4084],{"type":48,"value":4085},"Limit input size",{"type":42,"tag":99,"props":4087,"children":4088},{},[4089],{"type":48,"value":4090},"Larger inputs don't necessarily explore more space",{"type":42,"tag":72,"props":4092,"children":4093},{},[4094,4099],{"type":42,"tag":99,"props":4095,"children":4096},{},[4097],{"type":48,"value":4098},"Monitor stability",{"type":42,"tag":99,"props":4100,"children":4101},{},[4102],{"type":48,"value":4103},"Low stability indicates non-deterministic behavior",{"type":42,"tag":549,"props":4105,"children":4107},{"id":4106},"standard-input-fuzzing",[4108],{"type":48,"value":4109},"Standard Input Fuzzing",{"type":42,"tag":51,"props":4111,"children":4112},{},[4113],{"type":48,"value":4114},"AFL++ can fuzz programs reading from stdin without a libFuzzer harness:",{"type":42,"tag":195,"props":4116,"children":4118},{"className":260,"code":4117,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-clang-fast++ -O2 main_stdin.c -o fuzz_stdin\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -i seeds -o out -- .\u002Ffuzz_stdin\n",[4119],{"type":42,"tag":203,"props":4120,"children":4121},{"__ignoreMap":200},[4122,4167],{"type":42,"tag":207,"props":4123,"children":4124},{"class":209,"line":210},[4125,4129,4133,4137,4141,4145,4149,4153,4158,4162],{"type":42,"tag":207,"props":4126,"children":4127},{"style":281},[4128],{"type":48,"value":284},{"type":42,"tag":207,"props":4130,"children":4131},{"style":346},[4132],{"type":48,"value":1088},{"type":42,"tag":207,"props":4134,"children":4135},{"style":287},[4136],{"type":48,"value":1093},{"type":42,"tag":207,"props":4138,"children":4139},{"style":1096},[4140],{"type":48,"value":1099},{"type":42,"tag":207,"props":4142,"children":4143},{"style":346},[4144],{"type":48,"value":1104},{"type":42,"tag":207,"props":4146,"children":4147},{"style":287},[4148],{"type":48,"value":295},{"type":42,"tag":207,"props":4150,"children":4151},{"style":287},[4152],{"type":48,"value":305},{"type":42,"tag":207,"props":4154,"children":4155},{"style":287},[4156],{"type":48,"value":4157}," main_stdin.c",{"type":42,"tag":207,"props":4159,"children":4160},{"style":287},[4161],{"type":48,"value":325},{"type":42,"tag":207,"props":4163,"children":4164},{"style":287},[4165],{"type":48,"value":4166}," fuzz_stdin\n",{"type":42,"tag":207,"props":4168,"children":4169},{"class":209,"line":219},[4170,4174,4178,4182,4186,4190,4194,4198,4202,4206,4210,4214],{"type":42,"tag":207,"props":4171,"children":4172},{"style":281},[4173],{"type":48,"value":284},{"type":42,"tag":207,"props":4175,"children":4176},{"style":346},[4177],{"type":48,"value":1088},{"type":42,"tag":207,"props":4179,"children":4180},{"style":287},[4181],{"type":48,"value":1093},{"type":42,"tag":207,"props":4183,"children":4184},{"style":1096},[4185],{"type":48,"value":1099},{"type":42,"tag":207,"props":4187,"children":4188},{"style":346},[4189],{"type":48,"value":1104},{"type":42,"tag":207,"props":4191,"children":4192},{"style":287},[4193],{"type":48,"value":396},{"type":42,"tag":207,"props":4195,"children":4196},{"style":287},[4197],{"type":48,"value":401},{"type":42,"tag":207,"props":4199,"children":4200},{"style":287},[4201],{"type":48,"value":343},{"type":42,"tag":207,"props":4203,"children":4204},{"style":287},[4205],{"type":48,"value":325},{"type":42,"tag":207,"props":4207,"children":4208},{"style":287},[4209],{"type":48,"value":414},{"type":42,"tag":207,"props":4211,"children":4212},{"style":287},[4213],{"type":48,"value":419},{"type":42,"tag":207,"props":4215,"children":4216},{"style":287},[4217],{"type":48,"value":4218}," .\u002Ffuzz_stdin\n",{"type":42,"tag":51,"props":4220,"children":4221},{},[4222],{"type":48,"value":4223},"This is slower than persistent mode but requires no harness code.",{"type":42,"tag":549,"props":4225,"children":4227},{"id":4226},"file-input-fuzzing",[4228],{"type":48,"value":4229},"File Input Fuzzing",{"type":42,"tag":51,"props":4231,"children":4232},{},[4233,4235,4241],{"type":48,"value":4234},"For programs that read files, use ",{"type":42,"tag":203,"props":4236,"children":4238},{"className":4237},[],[4239],{"type":48,"value":4240},"@@",{"type":48,"value":4242}," placeholder:",{"type":42,"tag":195,"props":4244,"children":4246},{"className":260,"code":4245,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-clang-fast++ -O2 main_file.c -o fuzz_file\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -i seeds -o out -- .\u002Ffuzz_file @@\n",[4247],{"type":42,"tag":203,"props":4248,"children":4249},{"__ignoreMap":200},[4250,4295],{"type":42,"tag":207,"props":4251,"children":4252},{"class":209,"line":210},[4253,4257,4261,4265,4269,4273,4277,4281,4286,4290],{"type":42,"tag":207,"props":4254,"children":4255},{"style":281},[4256],{"type":48,"value":284},{"type":42,"tag":207,"props":4258,"children":4259},{"style":346},[4260],{"type":48,"value":1088},{"type":42,"tag":207,"props":4262,"children":4263},{"style":287},[4264],{"type":48,"value":1093},{"type":42,"tag":207,"props":4266,"children":4267},{"style":1096},[4268],{"type":48,"value":1099},{"type":42,"tag":207,"props":4270,"children":4271},{"style":346},[4272],{"type":48,"value":1104},{"type":42,"tag":207,"props":4274,"children":4275},{"style":287},[4276],{"type":48,"value":295},{"type":42,"tag":207,"props":4278,"children":4279},{"style":287},[4280],{"type":48,"value":305},{"type":42,"tag":207,"props":4282,"children":4283},{"style":287},[4284],{"type":48,"value":4285}," main_file.c",{"type":42,"tag":207,"props":4287,"children":4288},{"style":287},[4289],{"type":48,"value":325},{"type":42,"tag":207,"props":4291,"children":4292},{"style":287},[4293],{"type":48,"value":4294}," fuzz_file\n",{"type":42,"tag":207,"props":4296,"children":4297},{"class":209,"line":219},[4298,4302,4306,4310,4314,4318,4322,4326,4330,4334,4338,4342,4347],{"type":42,"tag":207,"props":4299,"children":4300},{"style":281},[4301],{"type":48,"value":284},{"type":42,"tag":207,"props":4303,"children":4304},{"style":346},[4305],{"type":48,"value":1088},{"type":42,"tag":207,"props":4307,"children":4308},{"style":287},[4309],{"type":48,"value":1093},{"type":42,"tag":207,"props":4311,"children":4312},{"style":1096},[4313],{"type":48,"value":1099},{"type":42,"tag":207,"props":4315,"children":4316},{"style":346},[4317],{"type":48,"value":1104},{"type":42,"tag":207,"props":4319,"children":4320},{"style":287},[4321],{"type":48,"value":396},{"type":42,"tag":207,"props":4323,"children":4324},{"style":287},[4325],{"type":48,"value":401},{"type":42,"tag":207,"props":4327,"children":4328},{"style":287},[4329],{"type":48,"value":343},{"type":42,"tag":207,"props":4331,"children":4332},{"style":287},[4333],{"type":48,"value":325},{"type":42,"tag":207,"props":4335,"children":4336},{"style":287},[4337],{"type":48,"value":414},{"type":42,"tag":207,"props":4339,"children":4340},{"style":287},[4341],{"type":48,"value":419},{"type":42,"tag":207,"props":4343,"children":4344},{"style":287},[4345],{"type":48,"value":4346}," .\u002Ffuzz_file",{"type":42,"tag":207,"props":4348,"children":4349},{"style":287},[4350],{"type":48,"value":4351}," @@\n",{"type":42,"tag":51,"props":4353,"children":4354},{},[4355,4357,4363],{"type":48,"value":4356},"For better performance, use ",{"type":42,"tag":203,"props":4358,"children":4360},{"className":4359},[],[4361],{"type":48,"value":4362},"fmemopen",{"type":48,"value":4364}," to create file descriptors from memory.",{"type":42,"tag":549,"props":4366,"children":4368},{"id":4367},"argument-fuzzing",[4369],{"type":48,"value":4370},"Argument Fuzzing",{"type":42,"tag":51,"props":4372,"children":4373},{},[4374,4376,4382],{"type":48,"value":4375},"Fuzz command-line arguments using ",{"type":42,"tag":203,"props":4377,"children":4379},{"className":4378},[],[4380],{"type":48,"value":4381},"argv-fuzz-inl.h",{"type":48,"value":4383},":",{"type":42,"tag":195,"props":4385,"children":4387},{"className":197,"code":4386,"language":199,"meta":200,"style":200},"#include \u003Cstdio.h>\n#include \u003Cstdlib.h>\n#include \u003Cstring.h>\n\n#ifdef __AFL_COMPILER\n#include \"argv-fuzz-inl.h\"\n#endif\n\nvoid check_buf(char *buf, size_t buf_len) {\n    if(buf_len > 0 && buf[0] == 'a') {\n        if(buf_len > 1 && buf[1] == 'b') {\n            if(buf_len > 2 && buf[2] == 'c') {\n                abort();\n            }\n        }\n    }\n}\n\nint main(int argc, char *argv[]) {\n#ifdef __AFL_COMPILER\n    AFL_INIT_ARGV();\n#endif\n\n    if (argc \u003C 2) {\n        fprintf(stderr, \"Usage: %s \u003Cinput_string>\\n\", argv[0]);\n        return 1;\n    }\n\n    char *input_buf = argv[1];\n    size_t len = strlen(input_buf);\n    check_buf(input_buf, len);\n    return 0;\n}\n",[4388],{"type":42,"tag":203,"props":4389,"children":4390},{"__ignoreMap":200},[4391,4399,4407,4415,4422,4430,4438,4446,4453,4461,4469,4477,4485,4493,4501,4509,4517,4524,4531,4539,4546,4554,4561,4568,4576,4584,4593,4601,4609,4618,4627,4636,4644],{"type":42,"tag":207,"props":4392,"children":4393},{"class":209,"line":210},[4394],{"type":42,"tag":207,"props":4395,"children":4396},{},[4397],{"type":48,"value":4398},"#include \u003Cstdio.h>\n",{"type":42,"tag":207,"props":4400,"children":4401},{"class":209,"line":219},[4402],{"type":42,"tag":207,"props":4403,"children":4404},{},[4405],{"type":48,"value":4406},"#include \u003Cstdlib.h>\n",{"type":42,"tag":207,"props":4408,"children":4409},{"class":209,"line":228},[4410],{"type":42,"tag":207,"props":4411,"children":4412},{},[4413],{"type":48,"value":4414},"#include \u003Cstring.h>\n",{"type":42,"tag":207,"props":4416,"children":4417},{"class":209,"line":237},[4418],{"type":42,"tag":207,"props":4419,"children":4420},{"emptyLinePlaceholder":1248},[4421],{"type":48,"value":1251},{"type":42,"tag":207,"props":4423,"children":4424},{"class":209,"line":246},[4425],{"type":42,"tag":207,"props":4426,"children":4427},{},[4428],{"type":48,"value":4429},"#ifdef __AFL_COMPILER\n",{"type":42,"tag":207,"props":4431,"children":4432},{"class":209,"line":849},[4433],{"type":42,"tag":207,"props":4434,"children":4435},{},[4436],{"type":48,"value":4437},"#include \"argv-fuzz-inl.h\"\n",{"type":42,"tag":207,"props":4439,"children":4440},{"class":209,"line":858},[4441],{"type":42,"tag":207,"props":4442,"children":4443},{},[4444],{"type":48,"value":4445},"#endif\n",{"type":42,"tag":207,"props":4447,"children":4448},{"class":209,"line":867},[4449],{"type":42,"tag":207,"props":4450,"children":4451},{"emptyLinePlaceholder":1248},[4452],{"type":48,"value":1251},{"type":42,"tag":207,"props":4454,"children":4455},{"class":209,"line":876},[4456],{"type":42,"tag":207,"props":4457,"children":4458},{},[4459],{"type":48,"value":4460},"void check_buf(char *buf, size_t buf_len) {\n",{"type":42,"tag":207,"props":4462,"children":4463},{"class":209,"line":885},[4464],{"type":42,"tag":207,"props":4465,"children":4466},{},[4467],{"type":48,"value":4468},"    if(buf_len > 0 && buf[0] == 'a') {\n",{"type":42,"tag":207,"props":4470,"children":4471},{"class":209,"line":893},[4472],{"type":42,"tag":207,"props":4473,"children":4474},{},[4475],{"type":48,"value":4476},"        if(buf_len > 1 && buf[1] == 'b') {\n",{"type":42,"tag":207,"props":4478,"children":4479},{"class":209,"line":902},[4480],{"type":42,"tag":207,"props":4481,"children":4482},{},[4483],{"type":48,"value":4484},"            if(buf_len > 2 && buf[2] == 'c') {\n",{"type":42,"tag":207,"props":4486,"children":4487},{"class":209,"line":911},[4488],{"type":42,"tag":207,"props":4489,"children":4490},{},[4491],{"type":48,"value":4492},"                abort();\n",{"type":42,"tag":207,"props":4494,"children":4495},{"class":209,"line":920},[4496],{"type":42,"tag":207,"props":4497,"children":4498},{},[4499],{"type":48,"value":4500},"            }\n",{"type":42,"tag":207,"props":4502,"children":4503},{"class":209,"line":929},[4504],{"type":42,"tag":207,"props":4505,"children":4506},{},[4507],{"type":48,"value":4508},"        }\n",{"type":42,"tag":207,"props":4510,"children":4511},{"class":209,"line":938},[4512],{"type":42,"tag":207,"props":4513,"children":4514},{},[4515],{"type":48,"value":4516},"    }\n",{"type":42,"tag":207,"props":4518,"children":4519},{"class":209,"line":947},[4520],{"type":42,"tag":207,"props":4521,"children":4522},{},[4523],{"type":48,"value":252},{"type":42,"tag":207,"props":4525,"children":4526},{"class":209,"line":956},[4527],{"type":42,"tag":207,"props":4528,"children":4529},{"emptyLinePlaceholder":1248},[4530],{"type":48,"value":1251},{"type":42,"tag":207,"props":4532,"children":4533},{"class":209,"line":964},[4534],{"type":42,"tag":207,"props":4535,"children":4536},{},[4537],{"type":48,"value":4538},"int main(int argc, char *argv[]) {\n",{"type":42,"tag":207,"props":4540,"children":4541},{"class":209,"line":973},[4542],{"type":42,"tag":207,"props":4543,"children":4544},{},[4545],{"type":48,"value":4429},{"type":42,"tag":207,"props":4547,"children":4548},{"class":209,"line":982},[4549],{"type":42,"tag":207,"props":4550,"children":4551},{},[4552],{"type":48,"value":4553},"    AFL_INIT_ARGV();\n",{"type":42,"tag":207,"props":4555,"children":4556},{"class":209,"line":991},[4557],{"type":42,"tag":207,"props":4558,"children":4559},{},[4560],{"type":48,"value":4445},{"type":42,"tag":207,"props":4562,"children":4563},{"class":209,"line":999},[4564],{"type":42,"tag":207,"props":4565,"children":4566},{"emptyLinePlaceholder":1248},[4567],{"type":48,"value":1251},{"type":42,"tag":207,"props":4569,"children":4570},{"class":209,"line":1008},[4571],{"type":42,"tag":207,"props":4572,"children":4573},{},[4574],{"type":48,"value":4575},"    if (argc \u003C 2) {\n",{"type":42,"tag":207,"props":4577,"children":4578},{"class":209,"line":1017},[4579],{"type":42,"tag":207,"props":4580,"children":4581},{},[4582],{"type":48,"value":4583},"        fprintf(stderr, \"Usage: %s \u003Cinput_string>\\n\", argv[0]);\n",{"type":42,"tag":207,"props":4585,"children":4587},{"class":209,"line":4586},26,[4588],{"type":42,"tag":207,"props":4589,"children":4590},{},[4591],{"type":48,"value":4592},"        return 1;\n",{"type":42,"tag":207,"props":4594,"children":4596},{"class":209,"line":4595},27,[4597],{"type":42,"tag":207,"props":4598,"children":4599},{},[4600],{"type":48,"value":4516},{"type":42,"tag":207,"props":4602,"children":4604},{"class":209,"line":4603},28,[4605],{"type":42,"tag":207,"props":4606,"children":4607},{"emptyLinePlaceholder":1248},[4608],{"type":48,"value":1251},{"type":42,"tag":207,"props":4610,"children":4612},{"class":209,"line":4611},29,[4613],{"type":42,"tag":207,"props":4614,"children":4615},{},[4616],{"type":48,"value":4617},"    char *input_buf = argv[1];\n",{"type":42,"tag":207,"props":4619,"children":4621},{"class":209,"line":4620},30,[4622],{"type":42,"tag":207,"props":4623,"children":4624},{},[4625],{"type":48,"value":4626},"    size_t len = strlen(input_buf);\n",{"type":42,"tag":207,"props":4628,"children":4630},{"class":209,"line":4629},31,[4631],{"type":42,"tag":207,"props":4632,"children":4633},{},[4634],{"type":48,"value":4635},"    check_buf(input_buf, len);\n",{"type":42,"tag":207,"props":4637,"children":4639},{"class":209,"line":4638},32,[4640],{"type":42,"tag":207,"props":4641,"children":4642},{},[4643],{"type":48,"value":243},{"type":42,"tag":207,"props":4645,"children":4647},{"class":209,"line":4646},33,[4648],{"type":42,"tag":207,"props":4649,"children":4650},{},[4651],{"type":48,"value":252},{"type":42,"tag":51,"props":4653,"children":4654},{},[4655],{"type":48,"value":4656},"Download the header:",{"type":42,"tag":195,"props":4658,"children":4660},{"className":260,"code":4659,"language":262,"meta":200,"style":200},"curl -O https:\u002F\u002Fraw.githubusercontent.com\u002FAFLplusplus\u002FAFLplusplus\u002Fstable\u002Futils\u002Fargv_fuzzing\u002Fargv-fuzz-inl.h\n",[4661],{"type":42,"tag":203,"props":4662,"children":4663},{"__ignoreMap":200},[4664],{"type":42,"tag":207,"props":4665,"children":4666},{"class":209,"line":210},[4667,4672,4677],{"type":42,"tag":207,"props":4668,"children":4669},{"style":281},[4670],{"type":48,"value":4671},"curl",{"type":42,"tag":207,"props":4673,"children":4674},{"style":287},[4675],{"type":48,"value":4676}," -O",{"type":42,"tag":207,"props":4678,"children":4679},{"style":287},[4680],{"type":48,"value":4681}," https:\u002F\u002Fraw.githubusercontent.com\u002FAFLplusplus\u002FAFLplusplus\u002Fstable\u002Futils\u002Fargv_fuzzing\u002Fargv-fuzz-inl.h\n",{"type":42,"tag":51,"props":4683,"children":4684},{},[4685],{"type":48,"value":257},{"type":42,"tag":195,"props":4687,"children":4689},{"className":260,"code":4688,"language":262,"meta":200,"style":200},".\u002Fafl++ \u003Chost\u002Fdocker> afl-clang-fast++ -O2 main_arg.c -o fuzz_arg\n.\u002Fafl++ \u003Chost\u002Fdocker> afl-fuzz -i seeds -o out -- .\u002Ffuzz_arg\n",[4690],{"type":42,"tag":203,"props":4691,"children":4692},{"__ignoreMap":200},[4693,4738],{"type":42,"tag":207,"props":4694,"children":4695},{"class":209,"line":210},[4696,4700,4704,4708,4712,4716,4720,4724,4729,4733],{"type":42,"tag":207,"props":4697,"children":4698},{"style":281},[4699],{"type":48,"value":284},{"type":42,"tag":207,"props":4701,"children":4702},{"style":346},[4703],{"type":48,"value":1088},{"type":42,"tag":207,"props":4705,"children":4706},{"style":287},[4707],{"type":48,"value":1093},{"type":42,"tag":207,"props":4709,"children":4710},{"style":1096},[4711],{"type":48,"value":1099},{"type":42,"tag":207,"props":4713,"children":4714},{"style":346},[4715],{"type":48,"value":1104},{"type":42,"tag":207,"props":4717,"children":4718},{"style":287},[4719],{"type":48,"value":295},{"type":42,"tag":207,"props":4721,"children":4722},{"style":287},[4723],{"type":48,"value":305},{"type":42,"tag":207,"props":4725,"children":4726},{"style":287},[4727],{"type":48,"value":4728}," main_arg.c",{"type":42,"tag":207,"props":4730,"children":4731},{"style":287},[4732],{"type":48,"value":325},{"type":42,"tag":207,"props":4734,"children":4735},{"style":287},[4736],{"type":48,"value":4737}," fuzz_arg\n",{"type":42,"tag":207,"props":4739,"children":4740},{"class":209,"line":219},[4741,4745,4749,4753,4757,4761,4765,4769,4773,4777,4781,4785],{"type":42,"tag":207,"props":4742,"children":4743},{"style":281},[4744],{"type":48,"value":284},{"type":42,"tag":207,"props":4746,"children":4747},{"style":346},[4748],{"type":48,"value":1088},{"type":42,"tag":207,"props":4750,"children":4751},{"style":287},[4752],{"type":48,"value":1093},{"type":42,"tag":207,"props":4754,"children":4755},{"style":1096},[4756],{"type":48,"value":1099},{"type":42,"tag":207,"props":4758,"children":4759},{"style":346},[4760],{"type":48,"value":1104},{"type":42,"tag":207,"props":4762,"children":4763},{"style":287},[4764],{"type":48,"value":396},{"type":42,"tag":207,"props":4766,"children":4767},{"style":287},[4768],{"type":48,"value":401},{"type":42,"tag":207,"props":4770,"children":4771},{"style":287},[4772],{"type":48,"value":343},{"type":42,"tag":207,"props":4774,"children":4775},{"style":287},[4776],{"type":48,"value":325},{"type":42,"tag":207,"props":4778,"children":4779},{"style":287},[4780],{"type":48,"value":414},{"type":42,"tag":207,"props":4782,"children":4783},{"style":287},[4784],{"type":48,"value":419},{"type":42,"tag":207,"props":4786,"children":4787},{"style":287},[4788],{"type":48,"value":4789}," .\u002Ffuzz_arg\n",{"type":42,"tag":549,"props":4791,"children":4793},{"id":4792},"performance-tuning",[4794],{"type":48,"value":4795},"Performance Tuning",{"type":42,"tag":64,"props":4797,"children":4798},{},[4799,4815],{"type":42,"tag":68,"props":4800,"children":4801},{},[4802],{"type":42,"tag":72,"props":4803,"children":4804},{},[4805,4810],{"type":42,"tag":76,"props":4806,"children":4807},{},[4808],{"type":48,"value":4809},"Setting",{"type":42,"tag":76,"props":4811,"children":4812},{},[4813],{"type":48,"value":4814},"Impact",{"type":42,"tag":92,"props":4816,"children":4817},{},[4818,4831,4844,4863],{"type":42,"tag":72,"props":4819,"children":4820},{},[4821,4826],{"type":42,"tag":99,"props":4822,"children":4823},{},[4824],{"type":48,"value":4825},"CPU core count",{"type":42,"tag":99,"props":4827,"children":4828},{},[4829],{"type":48,"value":4830},"Linear scaling with physical cores",{"type":42,"tag":72,"props":4832,"children":4833},{},[4834,4839],{"type":42,"tag":99,"props":4835,"children":4836},{},[4837],{"type":48,"value":4838},"Persistent mode",{"type":42,"tag":99,"props":4840,"children":4841},{},[4842],{"type":48,"value":4843},"10-20x faster than fork server",{"type":42,"tag":72,"props":4845,"children":4846},{},[4847,4858],{"type":42,"tag":99,"props":4848,"children":4849},{},[4850,4856],{"type":42,"tag":203,"props":4851,"children":4853},{"className":4852},[],[4854],{"type":48,"value":4855},"-G",{"type":48,"value":4857}," input size limit",{"type":42,"tag":99,"props":4859,"children":4860},{},[4861],{"type":48,"value":4862},"Smaller = faster, but may miss bugs",{"type":42,"tag":72,"props":4864,"children":4865},{},[4866,4871],{"type":42,"tag":99,"props":4867,"children":4868},{},[4869],{"type":48,"value":4870},"ASan ratio",{"type":42,"tag":99,"props":4872,"children":4873},{},[4874],{"type":48,"value":4875},"1 ASan job per 4-8 non-ASan jobs",{"type":42,"tag":57,"props":4877,"children":4879},{"id":4878},"troubleshooting",[4880],{"type":48,"value":4881},"Troubleshooting",{"type":42,"tag":64,"props":4883,"children":4884},{},[4885,4905],{"type":42,"tag":68,"props":4886,"children":4887},{},[4888],{"type":42,"tag":72,"props":4889,"children":4890},{},[4891,4896,4901],{"type":42,"tag":76,"props":4892,"children":4893},{},[4894],{"type":48,"value":4895},"Problem",{"type":42,"tag":76,"props":4897,"children":4898},{},[4899],{"type":48,"value":4900},"Cause",{"type":42,"tag":76,"props":4902,"children":4903},{},[4904],{"type":48,"value":3939},{"type":42,"tag":92,"props":4906,"children":4907},{},[4908,4926,4944,4961,4985,5010],{"type":42,"tag":72,"props":4909,"children":4910},{},[4911,4916,4921],{"type":42,"tag":99,"props":4912,"children":4913},{},[4914],{"type":48,"value":4915},"Low exec\u002Fsec (\u003C1k)",{"type":42,"tag":99,"props":4917,"children":4918},{},[4919],{"type":48,"value":4920},"Not using persistent mode",{"type":42,"tag":99,"props":4922,"children":4923},{},[4924],{"type":48,"value":4925},"Create a LLVMFuzzerTestOneInput style harness",{"type":42,"tag":72,"props":4927,"children":4928},{},[4929,4934,4939],{"type":42,"tag":99,"props":4930,"children":4931},{},[4932],{"type":48,"value":4933},"Low stability (\u003C85%)",{"type":42,"tag":99,"props":4935,"children":4936},{},[4937],{"type":48,"value":4938},"Non-deterministic code",{"type":42,"tag":99,"props":4940,"children":4941},{},[4942],{"type":48,"value":4943},"Fuzz a program via stdin or file inputs, or create such a harness",{"type":42,"tag":72,"props":4945,"children":4946},{},[4947,4952,4956],{"type":42,"tag":99,"props":4948,"children":4949},{},[4950],{"type":48,"value":4951},"GCC plugin error",{"type":42,"tag":99,"props":4953,"children":4954},{},[4955],{"type":48,"value":3982},{"type":42,"tag":99,"props":4957,"children":4958},{},[4959],{"type":48,"value":4960},"Ensure system GCC matches AFL++ build and install gcc-$GCC_VERSION-plugin-dev",{"type":42,"tag":72,"props":4962,"children":4963},{},[4964,4969,4974],{"type":42,"tag":99,"props":4965,"children":4966},{},[4967],{"type":48,"value":4968},"No crashes found",{"type":42,"tag":99,"props":4970,"children":4971},{},[4972],{"type":48,"value":4973},"Need sanitizers",{"type":42,"tag":99,"props":4975,"children":4976},{},[4977,4979],{"type":48,"value":4978},"Recompile with ",{"type":42,"tag":203,"props":4980,"children":4982},{"className":4981},[],[4983],{"type":48,"value":4984},"AFL_USE_ASAN=1",{"type":42,"tag":72,"props":4986,"children":4987},{},[4988,4993,4998],{"type":42,"tag":99,"props":4989,"children":4990},{},[4991],{"type":48,"value":4992},"Memory limit exceeded",{"type":42,"tag":99,"props":4994,"children":4995},{},[4996],{"type":48,"value":4997},"ASan uses 20TB virtual",{"type":42,"tag":99,"props":4999,"children":5000},{},[5001,5003,5008],{"type":48,"value":5002},"Remove ",{"type":42,"tag":203,"props":5004,"children":5006},{"className":5005},[],[5007],{"type":48,"value":3834},{"type":48,"value":5009}," flag when using ASan",{"type":42,"tag":72,"props":5011,"children":5012},{},[5013,5018,5023],{"type":42,"tag":99,"props":5014,"children":5015},{},[5016],{"type":48,"value":5017},"Docker performance loss",{"type":42,"tag":99,"props":5019,"children":5020},{},[5021],{"type":48,"value":5022},"Virtualization overhead",{"type":42,"tag":99,"props":5024,"children":5025},{},[5026],{"type":48,"value":5027},"Use bare metal or VM for production fuzzing",{"type":42,"tag":57,"props":5029,"children":5031},{"id":5030},"related-skills",[5032],{"type":48,"value":5033},"Related Skills",{"type":42,"tag":549,"props":5035,"children":5037},{"id":5036},"technique-skills",[5038],{"type":48,"value":5039},"Technique Skills",{"type":42,"tag":64,"props":5041,"children":5042},{},[5043,5059],{"type":42,"tag":68,"props":5044,"children":5045},{},[5046],{"type":42,"tag":72,"props":5047,"children":5048},{},[5049,5054],{"type":42,"tag":76,"props":5050,"children":5051},{},[5052],{"type":48,"value":5053},"Skill",{"type":42,"tag":76,"props":5055,"children":5056},{},[5057],{"type":48,"value":5058},"Use Case",{"type":42,"tag":92,"props":5060,"children":5061},{},[5062,5077,5092,5107,5122],{"type":42,"tag":72,"props":5063,"children":5064},{},[5065,5072],{"type":42,"tag":99,"props":5066,"children":5067},{},[5068],{"type":42,"tag":153,"props":5069,"children":5070},{},[5071],{"type":48,"value":1438},{"type":42,"tag":99,"props":5073,"children":5074},{},[5075],{"type":48,"value":5076},"Detailed guidance on writing effective harnesses",{"type":42,"tag":72,"props":5078,"children":5079},{},[5080,5087],{"type":42,"tag":99,"props":5081,"children":5082},{},[5083],{"type":42,"tag":153,"props":5084,"children":5085},{},[5086],{"type":48,"value":1759},{"type":42,"tag":99,"props":5088,"children":5089},{},[5090],{"type":48,"value":5091},"Memory error detection during fuzzing",{"type":42,"tag":72,"props":5093,"children":5094},{},[5095,5102],{"type":42,"tag":99,"props":5096,"children":5097},{},[5098],{"type":42,"tag":153,"props":5099,"children":5100},{},[5101],{"type":48,"value":1765},{"type":42,"tag":99,"props":5103,"children":5104},{},[5105],{"type":48,"value":5106},"Detect undefined behavior bugs",{"type":42,"tag":72,"props":5108,"children":5109},{},[5110,5117],{"type":42,"tag":99,"props":5111,"children":5112},{},[5113],{"type":42,"tag":153,"props":5114,"children":5115},{},[5116],{"type":48,"value":2052},{"type":42,"tag":99,"props":5118,"children":5119},{},[5120],{"type":48,"value":5121},"Building and managing seed corpora",{"type":42,"tag":72,"props":5123,"children":5124},{},[5125,5133],{"type":42,"tag":99,"props":5126,"children":5127},{},[5128],{"type":42,"tag":153,"props":5129,"children":5130},{},[5131],{"type":48,"value":5132},"fuzzing-dictionaries",{"type":42,"tag":99,"props":5134,"children":5135},{},[5136],{"type":48,"value":5137},"Creating dictionaries for format-aware fuzzing",{"type":42,"tag":549,"props":5139,"children":5141},{"id":5140},"related-fuzzers",[5142],{"type":48,"value":5143},"Related Fuzzers",{"type":42,"tag":64,"props":5145,"children":5146},{},[5147,5162],{"type":42,"tag":68,"props":5148,"children":5149},{},[5150],{"type":42,"tag":72,"props":5151,"children":5152},{},[5153,5157],{"type":42,"tag":76,"props":5154,"children":5155},{},[5156],{"type":48,"value":5053},{"type":42,"tag":76,"props":5158,"children":5159},{},[5160],{"type":48,"value":5161},"When to Consider",{"type":42,"tag":92,"props":5163,"children":5164},{},[5165,5181],{"type":42,"tag":72,"props":5166,"children":5167},{},[5168,5176],{"type":42,"tag":99,"props":5169,"children":5170},{},[5171],{"type":42,"tag":153,"props":5172,"children":5173},{},[5174],{"type":48,"value":5175},"libfuzzer",{"type":42,"tag":99,"props":5177,"children":5178},{},[5179],{"type":48,"value":5180},"Quick prototyping, single-threaded fuzzing is sufficient",{"type":42,"tag":72,"props":5182,"children":5183},{},[5184,5192],{"type":42,"tag":99,"props":5185,"children":5186},{},[5187],{"type":42,"tag":153,"props":5188,"children":5189},{},[5190],{"type":48,"value":5191},"libafl",{"type":42,"tag":99,"props":5193,"children":5194},{},[5195],{"type":48,"value":5196},"Need custom mutators or research-grade features",{"type":42,"tag":57,"props":5198,"children":5200},{"id":5199},"resources",[5201],{"type":48,"value":5202},"Resources",{"type":42,"tag":549,"props":5204,"children":5206},{"id":5205},"key-external-resources",[5207],{"type":48,"value":5208},"Key External Resources",{"type":42,"tag":51,"props":5210,"children":5211},{},[5212,5222],{"type":42,"tag":153,"props":5213,"children":5214},{},[5215],{"type":42,"tag":746,"props":5216,"children":5219},{"href":5217,"rel":5218},"https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus",[750],[5220],{"type":48,"value":5221},"AFL++ GitHub Repository",{"type":48,"value":5223},"\nOfficial repository with comprehensive documentation, examples, and issue tracker.",{"type":42,"tag":51,"props":5225,"children":5226},{},[5227,5237],{"type":42,"tag":153,"props":5228,"children":5229},{},[5230],{"type":42,"tag":746,"props":5231,"children":5234},{"href":5232,"rel":5233},"https:\u002F\u002Fraw.githubusercontent.com\u002FAFLplusplus\u002FAFLplusplus\u002Frefs\u002Fheads\u002Fstable\u002Fdocs\u002Ffuzzing_in_depth.md",[750],[5235],{"type":48,"value":5236},"Fuzzing in Depth",{"type":48,"value":5238},"\nAdvanced documentation by the AFL++ team covering instrumentation modes, optimization techniques, and advanced use cases.",{"type":42,"tag":51,"props":5240,"children":5241},{},[5242,5252],{"type":42,"tag":153,"props":5243,"children":5244},{},[5245],{"type":42,"tag":746,"props":5246,"children":5249},{"href":5247,"rel":5248},"https:\u002F\u002Fblog.ritsec.club\u002Fposts\u002Fafl-under-hood\u002F",[750],[5250],{"type":48,"value":5251},"AFL++ Under The Hood",{"type":48,"value":5253},"\nTechnical deep-dive into AFL++ internals, mutation strategies, and coverage tracking mechanisms.",{"type":42,"tag":51,"props":5255,"children":5256},{},[5257,5267],{"type":42,"tag":153,"props":5258,"children":5259},{},[5260],{"type":42,"tag":746,"props":5261,"children":5264},{"href":5262,"rel":5263},"https:\u002F\u002Fwww.usenix.org\u002Fsystem\u002Ffiles\u002Fwoot20-paper-fioraldi.pdf",[750],[5265],{"type":48,"value":5266},"AFL++: Combining Incremental Steps of Fuzzing Research",{"type":48,"value":5268},"\nResearch paper describing AFL++ architecture and performance improvements over original AFL.",{"type":42,"tag":549,"props":5270,"children":5272},{"id":5271},"video-resources",[5273],{"type":48,"value":5274},"Video Resources",{"type":42,"tag":159,"props":5276,"children":5277},{},[5278,5290,5302],{"type":42,"tag":163,"props":5279,"children":5280},{},[5281,5288],{"type":42,"tag":746,"props":5282,"children":5285},{"href":5283,"rel":5284},"https:\u002F\u002Fblog.trailofbits.com\u002F2023\u002F02\u002F14\u002Fcurl-audit-fuzzing-libcurl-command-line-interface\u002F",[750],[5286],{"type":48,"value":5287},"Fuzzing cURL",{"type":48,"value":5289}," - Trail of Bits blog post on using AFL++ argument fuzzing for cURL",{"type":42,"tag":163,"props":5291,"children":5292},{},[5293,5300],{"type":42,"tag":746,"props":5294,"children":5297},{"href":5295,"rel":5296},"https:\u002F\u002Fwww.youtube.com\u002Fplaylist?list=PLhixgUqwRTjy0gMuT4C3bmjeZjuNQyqdx",[750],[5298],{"type":48,"value":5299},"Sudo Vulnerability Walkthrough",{"type":48,"value":5301}," - LiveOverflow series on rediscovering CVE-2021-3156",{"type":42,"tag":163,"props":5303,"children":5304},{},[5305,5312],{"type":42,"tag":746,"props":5306,"children":5309},{"href":5307,"rel":5308},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=PJLWlmp8CDM",[750],[5310],{"type":48,"value":5311},"Rediscovery of libpng bug",{"type":48,"value":5313}," - LiveOverflow video on finding CVE-2023-4863",{"type":42,"tag":5315,"props":5316,"children":5317},"style",{},[5318],{"type":48,"value":5319},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":5321,"total":5468},[5322,5334,5340,5360,5375,5388,5400,5410,5423,5434,5446,5457],{"slug":1759,"name":1759,"fn":5323,"description":5324,"org":5325,"tags":5326,"stars":23,"repoUrl":24,"updatedAt":5333},"detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5327,5328,5331,5332],{"name":18,"slug":19,"type":16},{"name":5329,"slug":5330,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.925095",{"slug":4,"name":4,"fn":5,"description":6,"org":5335,"tags":5336,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5337,5338,5339],{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":5341,"name":5341,"fn":5342,"description":5343,"org":5344,"tags":5345,"stars":23,"repoUrl":24,"updatedAt":5359},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5346,5349,5352,5355,5358],{"name":5347,"slug":5348,"type":16},"Agents","agents",{"name":5350,"slug":5351,"type":16},"CI\u002FCD","ci-cd",{"name":5353,"slug":5354,"type":16},"Code Analysis","code-analysis",{"name":5356,"slug":5357,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":5361,"name":5361,"fn":5362,"description":5363,"org":5364,"tags":5365,"stars":23,"repoUrl":24,"updatedAt":5374},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5366,5369,5370,5371],{"name":5367,"slug":5368,"type":16},"Audit","audit",{"name":5353,"slug":5354,"type":16},{"name":14,"slug":15,"type":16},{"name":5372,"slug":5373,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":5376,"name":5376,"fn":5377,"description":5378,"org":5379,"tags":5380,"stars":23,"repoUrl":24,"updatedAt":5387},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5381,5384],{"name":5382,"slug":5383,"type":16},"Engineering","engineering",{"name":5385,"slug":5386,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":5389,"name":5389,"fn":5390,"description":5391,"org":5392,"tags":5393,"stars":23,"repoUrl":24,"updatedAt":5399},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5394,5397,5398],{"name":5395,"slug":5396,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-17T06:05:14.575191",{"slug":5401,"name":5401,"fn":5402,"description":5403,"org":5404,"tags":5405,"stars":23,"repoUrl":24,"updatedAt":5409},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5406,5407,5408],{"name":5367,"slug":5368,"type":16},{"name":5353,"slug":5354,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":5411,"name":5411,"fn":5412,"description":5413,"org":5414,"tags":5415,"stars":23,"repoUrl":24,"updatedAt":5422},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5416,5419,5420,5421],{"name":5417,"slug":5418,"type":16},"Architecture","architecture",{"name":5367,"slug":5368,"type":16},{"name":5353,"slug":5354,"type":16},{"name":5382,"slug":5383,"type":16},"2026-07-18T05:47:40.122449",{"slug":5424,"name":5424,"fn":5425,"description":5426,"org":5427,"tags":5428,"stars":23,"repoUrl":24,"updatedAt":5433},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5429,5430,5431,5432],{"name":5367,"slug":5368,"type":16},{"name":5353,"slug":5354,"type":16},{"name":5382,"slug":5383,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":5435,"name":5435,"fn":5436,"description":5437,"org":5438,"tags":5439,"stars":23,"repoUrl":24,"updatedAt":5445},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5440,5441,5444],{"name":5367,"slug":5368,"type":16},{"name":5442,"slug":5443,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":5447,"name":5447,"fn":5448,"description":5449,"org":5450,"tags":5451,"stars":23,"repoUrl":24,"updatedAt":5456},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5452,5453,5454,5455],{"name":5367,"slug":5368,"type":16},{"name":18,"slug":19,"type":16},{"name":5353,"slug":5354,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":5458,"name":5458,"fn":5459,"description":5460,"org":5461,"tags":5462,"stars":23,"repoUrl":24,"updatedAt":5467},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5463,5464,5465,5466],{"name":5367,"slug":5368,"type":16},{"name":5353,"slug":5354,"type":16},{"name":14,"slug":15,"type":16},{"name":5372,"slug":5373,"type":16},"2026-07-18T05:47:42.84568",111,{"items":5470,"total":5516},[5471,5478,5484,5492,5499,5504,5510],{"slug":1759,"name":1759,"fn":5323,"description":5324,"org":5472,"tags":5473,"stars":23,"repoUrl":24,"updatedAt":5333},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5474,5475,5476,5477],{"name":18,"slug":19,"type":16},{"name":5329,"slug":5330,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":4,"name":4,"fn":5,"description":6,"org":5479,"tags":5480,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5481,5482,5483],{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":5341,"name":5341,"fn":5342,"description":5343,"org":5485,"tags":5486,"stars":23,"repoUrl":24,"updatedAt":5359},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5487,5488,5489,5490,5491],{"name":5347,"slug":5348,"type":16},{"name":5350,"slug":5351,"type":16},{"name":5353,"slug":5354,"type":16},{"name":5356,"slug":5357,"type":16},{"name":14,"slug":15,"type":16},{"slug":5361,"name":5361,"fn":5362,"description":5363,"org":5493,"tags":5494,"stars":23,"repoUrl":24,"updatedAt":5374},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5495,5496,5497,5498],{"name":5367,"slug":5368,"type":16},{"name":5353,"slug":5354,"type":16},{"name":14,"slug":15,"type":16},{"name":5372,"slug":5373,"type":16},{"slug":5376,"name":5376,"fn":5377,"description":5378,"org":5500,"tags":5501,"stars":23,"repoUrl":24,"updatedAt":5387},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5502,5503],{"name":5382,"slug":5383,"type":16},{"name":5385,"slug":5386,"type":16},{"slug":5389,"name":5389,"fn":5390,"description":5391,"org":5505,"tags":5506,"stars":23,"repoUrl":24,"updatedAt":5399},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5507,5508,5509],{"name":5395,"slug":5396,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":5401,"name":5401,"fn":5402,"description":5403,"org":5511,"tags":5512,"stars":23,"repoUrl":24,"updatedAt":5409},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5513,5514,5515],{"name":5367,"slug":5368,"type":16},{"name":5353,"slug":5354,"type":16},{"name":14,"slug":15,"type":16},77]