Home

Awesome

Intro

This is the fastest pintool afl-fuzzer out there currently. And it runs with pintool 3.6 up to 3.11, so 4.x x64 kernels are fine. But ... pintool is super slow. So this is basically only if you have no other option. I am currently developing an alternative with DynamoRIO and is 10x faster - but still, afl qemu mode is 10-50x faster than that ...

Installation

  1. download, compile and install afl => https://github.com/vanhauser-thc/AFLplusplus Optional: 2. download, compile and install dyninst => https://github.com/dyninst/dyninst Optional: 3. download, compile and install afl-dyninst => https://github.com/vanhauser-thc/afl-dyninst
  2. download and unpack pin => https://software.intel.com/en-us/articles/pintool-downloads (download version 3.6 to 3.11)
  3. export PIN_ROOT=/path/to/pin directory
  4. make a symlink to the afl folder in the afl-pin directory named "afl" , e.g. "ln -s ../AFLplusplus afl"
  5. make
  6. make install

Options

-libs also instrument the dynamic libraries -exitpoint target exit the program when this address/function is reached. speeeed! -forkserver install a forkserver. You must set PIN_APP_LD_PRELOAD - or use afl-fuzz-pin.sh -entrypoint target function or address where you want to install the forkserver -alternative a little bit faster but less quality

How to run

Optional: 1. afl-dyninst.sh -i program -o program_instrumented -D It is a good idea to add -e and -E with well selected function addresses to make the fuzzing faster

  1. afl-fuzz-pin.sh [normal afl-fuzz options] If you did not do step 1, add the option -forkserver (-forkserver is faster than afl-dyninst). You can increase speed more by selecting a good "-entrypoint function_name" or "-entrypoing 0x123456" location. That's it! If you fuzzing does not run, afl-fuzz might need more memory, set AFL_MEM to a high value, e.g. 700 for 700MB Using -forkserver requires PIN_APP_LD_PRELOAD=/usr/local/lib/pintool/forkserver.so but afl-fuzz-pin.sh takes care of this.

When to use it

When you have no source code, normal afl-dyninst is crashing the binary, qemu mode -Q is not an option and dynamorio is not working either. Pin is even 90% slower than my dynamorio implementation ...

Limitations

Pin is super slow ... it is the tool of last resort on x86/x64.

Who and where

Marc "van Hauser" Heuse mh@mh-sec.de || vh@thc.org https://github.com/vanhauser-thc/afl-pin