DOCSEARCHbyAlgolia
Submit Docs

LibAFL Documentation

repository·main·Indexed 25 days ago

https://github.com/aflplusplus/libafl

A library for building fuzzers, featuring the pylibafl Python bindings (v0.16.0) and a collection of low-level utility crates known as libafl_bolts. Included tools provide cross-platform shared memory (ShMem), high-performance random number generation (fast_rands), CPU core affinity management (core_affinity2), unique build ID generation (build_id2), and OS-specific signal and exception handling (exceptional). It also includes libafl_build for detecting LLVM tools and versions.

Tokens
59K
Snippets
143
Records
377
Agent score
82%

What's inside LibAFL

  1. Overview of Fuzzbench Harness (text) features

    main

    The Fuzzbench Harness (text) is an example fuzzer optimized for Fuzzbench environments.

    Key characteristics:

    • Single-threaded optimization: Uses SimpleRestartingEventManager instead of LlmpRestartEventManager because Fuzzbench is single-threaded.
    • Auto-detection: Automatically detects if passed-in tokens and initial inputs are text or binary data.
    • Grimoire Integration: Automatically enables Grimoire if text data is detected.
    • Compatibility: Uses the libfuzzer compatibility layer and SanitizerCoverage for feedback.

  2. Overview of LibAFL Compatibility & Integration

    main

    These crates help integrate LibAFL with existing tools and compilers:

    • libafl_cc: A library to wrap compilers and link LibAFL.
    • libafl_libfuzzer: A libFuzzer shim that utilizes LibAFL with common defaults.
    • libafl_libfuzzer_runtime: A runtime library for the libFuzzer compatibility layer.

  4. Overview of LibAFL crates

    main

    LibAFL is modular. Depending on your needs, you may only need a subset of the following crates:

    • libafl: The core crate containing all components needed to build a fuzzer.
    • libafl_bolts: A low-level utility crate providing features like core_affinity, SerdeAnyMap, minibsod, LLMP (lock-free IPC), Rand (fast RNGs), ShMem, and Tuples.
    • libafl_sugar: A high-level abstraction crate designed for ease of use and minimal code, at the expense of some flexibility.
    • libafl_derive: A proc-macro crate providing the derive(SerdeAny) macro for defining Metadata structs.
    • libafl_targets: Provides instrumentation and interaction with targets. Supported feature flags include pcguard_edges, pcguard_hitcounts, libfuzzer (compatibility layer), and value_profile.
    • libafl_cc: Utilities for wrapping compilers (currently Clang only) to create source-level fuzzers.
    • libafl_frida: Bridges LibAFL with Frida for instrumentation on Linux, macOS, Windows, and Android.
    • libafl_qemu: Bridges LibAFL with QEMU user-mode for cross-platform ELF binary fuzzing on Linux.
    • libafl_nyx: Adds KVM-based snapshot fuzzing capabilities via the Nyx framework.

  5. Overview of LibAFL

    main
    LibAFL is a Rust-based library designed as a collection of reusable components for building custom fuzzers. Unlike monolithic fuzzers, LibAFL allows developers to assemble tailored fuzzing solutions by combining specific instrumentation backends, mutators, and targets. It is designed to be highly extensible, avoiding the need to reinvent complex fuzzing features when creating new tools.

  6. Overview of `libafl_targets` runtime components

    main

    libafl_targets is a Rust crate that provides the essential runtime components injected into a target program during compilation for fuzzing with LibAFL.

    This code runs inside the fuzzed program and is responsible for communicating with the LibAFL fuzzer to provide:

    • Code coverage information
    • Comparison data
    • Other feedback mechanisms

  7. Overview of LibAFL Core Crates

    main

    The core LibAFL ecosystem allows you to build and extend fuzzers using Rust. Use these crates as the foundation for your fuzzing infrastructure:

    • libafl: The main crate used to slot fuzzers together and extend their features.
    • libafl_bolts: Provides low-level building blocks (bolts) for creating fuzzers.
    • libafl_sugar: Provides 'sugar builders' to simplify the creation of common fuzzers.
    • libafl_targets: Contains common code for target instrumentation to be used with LibAFL.

  8. Overview of LibAFL Backends & Instrumentation

    main

    LibAFL supports various backends and instrumentation methods to facilitate fuzzing across different environments and architectures:

    • libafl_frida: Frida backend library.
    • libafl_intelpt: Intel Processor Trace wrapper.
    • libafl_nyx: Nyx backend (available on Linux only).
    • libafl_qemu: QEMU user backend library.
    • libafl_tinyinst: TinyInst backend.
    • libafl_unicorn: Unicorn backend library.

  9. Overview of libafl_qemu_asan variants

    main

    The libafl_qemu_asan library provides Address Sanitizer (ASan) support for guests running in QEMU. It is designed with a modular architecture allowing you to choose between different implementation variants based on your environment:

    • libafl_qemu_asan_host: A drop-in replacement for the original libqasan. It interacts with QEMU via a bespoke syscall interface to handle memory tracking and shadow mapping.
    • libafl_qemu_asan_guest: Performs shadow memory management and memory tracking entirely within the guest. This variant is generally more performant than the host-based approach.
    • libafl_qemu_asan_nolibc: A variant with no dependencies on libc or other libraries. Use this for bare-metal targets or targets that use a statically linked libc.

  10. Overview of LibAFL Utility & Infrastructure Crates

    main

    LibAFL provides several utility crates for low-level system tasks, memory management, and performance:

    • libafl_asan: Address sanitizer library.
    • libafl_core: Minimal set of core functions shared across almost all LibAFL crates.
    • libafl_derive: Proc-macro crate for LibAFL.
    • core_affinity2: Cross-platform crate to bind to CPU cores.
    • fast_rands: Fast, non-cryptographic RNG implementations.
    • shmem_providers: Platform-independent shared memory providers (Windows, Linux, Android, iOS, etc.).
    • exceptional: Exception and signal handling.
    • build_id2: Build ID library.
    • ll_mp: Low-level message passing.
    • minibsod: Dumps register states on crash.
    • no_std_time: Time measurements for no_std environments.
    • ownedref: References that become owned types upon deserialization.
    • serde_anymap: SerDe serializable map that retrieves values by type.
    • tuple_list_ex: Extensions for the tuple_list crate.

  11. Overview of qemu_tmin testcase minimizer

    main
    The qemu_tmin fuzzer is a QEMU-based testcase minimizer. It iterates through each entry in an input corpus and attempts to minimize the input while ensuring the coverage map remains unchanged. The resulting output is a new corpus where inputs are either smaller than or equal to the original size. Duplicate inputs are deduplicated before minimization.

  12. Overview of LibAFL Core

    main
    LibAFL Core is the primary library containing the core fuzzing components and their implementations. A significant portion of the library is designed to be no_std compatible, depending only on rust core and alloc, allowing it to run in environments without a standard library.