#libafl — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #libafl, aggregated by home.social.
-
Oh look, new version of #LibAFL !!
With 0.16.0 we moved all reusable and non-fuzzer-related parts into their own crates.
Crates for pinning cores, rngs, getting BSODs for processes, and just in general helpful rust things.
Have fun using them for other projects <3
A lot of actual #fuzzer improvements, too, read more at:
https://github.com/AFLplusplus/LibAFL/releases/tag/0.16.0 -
LibAFL 0.15.4 has just been released 🎉
Of the 30 Contributers for this release, almost half are new faces <3
-
Want to learn how to build your own #libafl components, but never had the right project? Try working through the interactive exercises that I released today: https://github.com/addisoncrump/parking-game-fuzzer
You'll work through building your own LibAFL components with templates, allowing you to understand them progressively through the context of trying to solve "Tokyo Parking" (AKA Thinkfun's "Rush Hour") puzzles with fuzzing.
#fuzzing #aflplusplus #puzzles #rust #rustlang -
Guess who just released #LibAFL 0.15.3?
That's right, you all did! (thank you☺️)Highlights:
- better forkserver
- scriptable Lua mutations
- SIMD performance in stable rust
- CmpLog and RISC-V for LibAFL_Unicorn
- TMin for LibAFL_QEMU
- Updated Sugar for easy fuzzing
-
You can now replace libfuzzer with #LibAFL on Windows, thanks to @novafacing
-
🚨 LibAFL 0.15.2 🚨
- Rust 2024 edition
- LibAFL_Unicorn
- Use LibAFL rand types for other crates
- Allow logging to StatsD
- LibAFL_QEMU updates like binary-only ASan in Rust 🦀🦀🦀, inputs via StdIn, better snapshots
And so much more:
-
This is so cool: The LibAFL_QEMU ASan implementation was ported to rust
https://github.com/AFLplusplus/LibAFL/pull/3023 -
We've just released #LibAFL 0.15.0 - A big step toward 1.0 stable!
Featuring
- Mutators for Numeric Types
- Bloomfilter-based deduplication for to-be-executed inputs
- Nyx hypercall API support for LibAFL QEMU and new utilities for binary-only fuzzing
- ...https://github.com/AFLplusplus/LibAFL/releases/tag/0.15.0
-
C Harness to #LibAFL
https://github.com/v-p-b/libfuzzer_kfx/blob/main/C2LIBAFL.md
I nice part of making an archive of my Twitter posts is that I realize I wrote stuff like this o.O #fuzzing -
Slides for my @ekoparty talk "Advanced Fuzzing
With #LibAFL" -
Late last year we released #LibAFL 0.11.2
Highlights:- Unicode-preserving mutators, better mutations for text!
- GSoC project: Nicer TUI
- Scalability introspector
- Improved libafl_frida
- Extended libafl_qemu - added CmpLog and more!
Full changelog:
https://github.com/AFLplusplus/LibAFL/releases/tag/0.11.2 -
The recording of our #37c3 talk "Fuzz Everything, Everywhere, All at Once - Advanced QEMU-based fuzzing" can be found here
https://media.ccc.de/v/37c3-12102-fuzz_everything_everywhere_all_at_once
-
We released #LibAFL 0.11 (and 0.11.1 with a doc fix).
Highlights:
- libafl_libfuzzer: a full #LibFuzzer replacement
- libafl_bolts: low-level building blocks for #rust
- libafl_qemu: hooks and fuzzing in #QEMU 8, #Hexagon support, ..
- Updated #FRIDA
- ...
https://github.com/AFLplusplus/LibAFL/releases/tag/0.11.0
Have fun #fuzzing
-
With lots of community help, we're proud to release #LibAFL 0.10!
➟ AFL++'s Redqueen
➟ CASR integration for crash analysis
➟ Low-overhead timeout handling
➟ EcoFuzz
➟ Full AFL++ forkserver support
➟ WASM fuzzing example
and much more. Get your copy at https://github.com/AFLplusplus/LibAFL/releases/tag/0.10.0 -
In case you missed it, this is a very cool series about fuzzing and LibAFL by @epi
Fuzzing Xpdf: https://epi052.gitlab.io/notes-to-self/blog/2021-11-01-fuzzing-101-with-libafl/
Speed Improvements: https://epi052.gitlab.io/notes-to-self/blog/2021-11-07-fuzzing-101-with-libafl-part-1.5/
Fuzzing libexif: https://epi052.gitlab.io/notes-to-self/blog/2021-11-07-fuzzing-101-with-libafl-part-2/
Fuzzing tcpdump: https://epi052.gitlab.io/notes-to-self/blog/2021-11-20-fuzzing-101-with-libafl-part-3/
Fuzzing LibTIFF: https://epi052.gitlab.io/notes-to-self/blog/2021-11-26-fuzzing-101-with-libafl-part-4/
Fuzzing LibXML2: https://epi052.gitlab.io/notes-to-self/blog/2022-01-17-fuzzing-101-with-libafl-part-5/
-
LibAFL 0.9.0 is out with a new logo🔥
Highlights:
→ QEMU user-mode and system-mode snapshot fuzzing
→ Stable CorpusId when removing/updating entries in Corpus
→ Tinyinst binary-only instrumentation
→ Full support to AFL++ binaries with forkserver
... -
Just found out #LibAFL launcher can print output of child processes if you set the
LIBAFL_DEBUG_OUTPUT=1env variable.I knew this some time in the past, but forgot..
-
Cool series about fuzzing and LibAFL (credits @epi)
1: https://epi052.gitlab.io/notes-to-self/blog/2021-11-01-fuzzing-101-with-libafl/
1.5: https://epi052.gitlab.io/notes-to-self/blog/2021-11-07-fuzzing-101-with-libafl-part-1.5/
2: https://epi052.gitlab.io/notes-to-self/blog/2021-11-07-fuzzing-101-with-libafl-part-2/
3: https://epi052.gitlab.io/notes-to-self/blog/2021-11-20-fuzzing-101-with-libafl-part-3/
4: https://epi052.gitlab.io/notes-to-self/blog/2021-11-26-fuzzing-101-with-libafl-part-4/
5: https://epi052.gitlab.io/notes-to-self/blog/2022-01-17-fuzzing-101-with-libafl-part-5/ -
WRT #libfuzzer deprecation: the official alternative uses out-of-process fuzzing, which means the fuzzer doesn't run in the same process as the target.
This is what the original #AFL fuzzer does, as well.
It turns out that this doesn't scale well, thanks to IPC overhead and context switches for _every single _ testcase (of which you can reach millions per second of).*
We spent years creating good in-process fuzzing with #LibAFL, trying to match the success of libfuzzer, and it's sad to see the OG in-process fuzzer get depreciated in favour of an (IMHO) technically inferior alternative.
This may be a good engineering choice if you don't care about CPU cost and have an almost infinite amount of CPUs to spare.
The amount of companies worldwide that has a virtually infinite amount of CPU cores to spare for #fuzzing is low.
There are multiple ways to bring fuzzing to the masses, but this is not the one I would pick.
*the one reason where out-of-process fuzzing is favorable is for crashing targets. Instead of slowly restoring your state, you can simply respawn the target. However, most fuzzing campaigns are over when crashes are found.
-
The deprecation of #libfuzzer is a great time to recompile your fuzzing testcases with AFL++'s afl-cc (supports the same testcases!)
and switch your future fuzzer developments to #LibAFL -
For binary-only emulation in #LibAFL qemu, you can now dump DrCov traces to see in #idapro (lighthouse), #binaryninja (bncov), or #ghidra (dragondance) which paths the executions took.
This helps you understand where your fuzzer gets stuck, develop the harness further, and reach greater depth in the binary, eventually.
Binary-only modes of #AFLplusplus ( #qemu / #frida ) and libafl_frida also support DrCov output, already.
#fuzzing #fuzzingTips
https://github.com/AFLplusplus/LibAFL/pull/878 -
Finally you can do proper Javascript engine #fuzzing with the latest #LibAFL again.
https://github.com/andreafioraldi/libafl_quickjs_fuzzing/pull/1 -
Andrea presented our #LibAFL paper today at #acm_ccs 🎉
https://www.eurecom.fr/en/publication/6973 -
Prometheus Integration for #LibAFL fuzzer just landed, cool contribution
@aflplusplus #fuzzing
https://github.com/AFLplusplus/LibAFL/pull/875