Changelog for afl-4.21c-1.1.x86_64.rpm :

* Mon Jun 10 2024 Marcus Meissner - updated to 4.21c
* afl-fuzz - fixed a regression in afl-fuzz that resulted in a 5-10% performace loss do a switch from gettimeofday() to clock_gettime() which should be rather three times faster. The reason for this is unknown. - new queue selection algorithm based on 2 core years of queue data analysis. gives a noticable improvement on coverage although the results seem counterintuitive :-) - added AFL_DISABLE_REDUNDANT for huge queues - added `AFL_NO_SYNC` environment variable that does what you think it does - fix AFL_PERSISTENT_RECORD - run custom_post_process after standard trimming - prevent filenames in the queue that have spaces - minor fix for FAST schedules - more frequent stats update when syncing (todo: check performance impact) - now timing of calibration, trimming and syncing is measured seperately, thanks to AATTeqv! - -V timing is now accurately the fuzz time (without syncing), before long calibration times and syncing could result in now fuzzing being made when the time was already run out until then, thanks to AATTeqv! - fix -n uninstrumented mode when ending fuzzing - enhanced the ASAN configuration - make afl-fuzz use less memory with cmplog and fix a memleak
* afl-cc: - re-enable i386 support that was accidently disabled - fixes for LTO and outdated afl-gcc mode for i386 - fix COMPCOV split compare for old LLVMs - disable xml/curl/g_ string transform functions because we do not check for null pointers ... TODO - ensure shared memory variables are visible in weird build setups - compatability to new LLVM 19 changes
* afl-cmin - work with input files that have a space
* afl-showmap - fix memory leak on shmem testcase usage (thanks to AATTndrewh) - minor fix to collect coverage -C (thanks to AATTbet4it)
* Fixed a shmem mmap bug (that rarely came up on MacOS)
* libtokencap: script generate_libtoken_dict.sh added by AATTa-shvedov
* Mon Apr 15 2024 Marcus Meissner - updated to 4.20c + A new forkserver communication model is now introduced. afl-fuzz is backward compatible to old compiled targets if they are not built for CMPLOG/Redqueen, but new compiled targets will not work with old afl-fuzz versions! + Recompile all targets that are instrumented for CMPLOG/Redqueen! - AFL++ now supports up to 4 billion coverage edges, up from 6 million. - New compile option: `make PERFORMANCE=1` - this will enable special CPU dependent optimizations that make everything more performant - but the binaries will likely won\'t work on different platforms. Also enables a faster hasher if the CPU requirements are met. - The persistent record feature (see config.h) was expanded to also support replay, thanks to AATTquarta-qti ! - afl-fuzz: - the new deterministic fuzzing feature is now activated by default, deactivate with -z. Parameters -d and -D are ignored. - small improvements to CMPLOG/redqueen - workround for a bug with MOpt -L when used with -M - in the future we will either remove or rewrite MOpt. - fix for `-t xxx+` feature - -e extension option now saves the queue items, crashes, etc. with the extension too - fixes for trimmming, correct -V time and reading stats on resume by eqv thanks a lot! - afl-cc: - added collision free caller instrumentation to LTO mode. activate with `AFL_LLVM_LTO_CALLER=1`. You can set a max depth to go through single block functions with `AFL_LLVM_LTO_CALLER_DEPTH` (default 0) - fixes for COMPCOV/LAF and most other modules - fix for GCC_PLUGIN cmplog that broke on std::strings - afl-whatsup: - now also displays current average speed - small bugfixes - Fixes for aflpp custom mutator and standalone tool - Minor edits to afl-persistent-config - Prevent temporary files being left behind on aborted afl-whatsup - More CPU benchmarks added to benchmark/
* Mon Feb 05 2024 Marcus Meissner - updated to 4.10c - afl-fuzz: - default power schedule is now EXPLORE, due a fix in fast schedules explore is slightly better now. - fixed minor issues in the mutation engine, thanks to AATTfuthewo for reporting! - better deterministic fuzzing is now available, benchmarks have shown to improve fuzzing. Enable with -D. Thanks to AATTkdsjZh for the PR! - afl-cc: - large rewrite by AATTSonicStark which fixes a few corner cases, thanks! - LTO mode now requires llvm 12+ - workaround for ASAN with gcc_plugin mode - instrumentation: - LLVM 18 support, thanks to AATTdevnexen! - Injection (SQL, LDAP, XSS) fuzzing feature now available, see `instrumentation/README.injections.md` how to activate/use/expand. - compcov/LAF-intel: - floating point splitting bug fix by AATThexcoder - due a bug in LLVM 17 integer splitting is disabled there! - when splitting floats was selected, integers were always split as well, fixed to require AFL_LLVM_LAF_SPLIT_COMPARES or _ALL as it should - dynamic instrumentation filtering for LLVM NATIVE, thanks AATTMozilla! see utils/dynamic_covfilter/README.md - qemu_mode: - plugins are now activated by default and a new module is included that produces drcov compatible traces for lighthouse/lightkeeper/... thanks to AATTJRomainG to submitting! - updated Nyx checkout (fixes a bug) and some QOL - updated the custom grammar mutator - document afl-cmin does not work on macOS (but afl-cmin.bash does)
* Sun Dec 17 2023 Marcus Meissner - updated to 4.09c - afl-fuzz: - fixed the new mutation implementation for two bugs - added `AFL_FINAL_SYNC` which forces a final fuzzer sync (also for `-F`) before terminating. - added AFL_IGNORE_SEED_PROBLEMS to skip over seeds that time out instead of exiting with an error message - allow -S/-M naming up to 50 characters (from 24) - CMPLOG: - added scale support (-l S) - skip unhelpful insertions (u8) - added --version and --help command line parameters - fixed endless loop when reading malformed dictionaries - new custom mutator function: post_run - thanks to yangzao! - afl-whatsup: - detect instanced that are starting up and show them as such as not dead - now also shows coverage reached - option -m shows only very relevant stats - option -n will not use color in the output - instrumentation: - fix for a few string compare transform functions for LAF - we are instrumenting __cxx internal functions again. this might break a few targets, please report if so. - frida_mode: - fixes support for large map offsets - support for AFL_FUZZER_LOOPCOUNT for afl.rs and LLVMFuzzerTestOneInput - afl-cmin/afl-cmin.bash: prevent unneeded file errors - added new tool afl-addseeds that adds new seeds to a running campaign - added benchmark/benchmark.py if you want to see how good your fuzzing speed is in comparison to other setups.
* Fri Aug 11 2023 Marcus Meissner - updated to 4.08c - afl-fuzz: - new mutation engine: mutations that favor discovery more paths are prefered until no new finds for 10 minutes then switching to mutations that favor triggering crashes. Modes and switch time can be configured with `-P`. Also input mode for the target can be defined with `-a` to be `text` or `binary` (defaults to `generic`) - new custom mutator that has the new afl++ engine (so it can easily incorporated into new custom mutators), and also comes with a standalone command line tool! See custom_mutators/aflpp/standalone/ - display the state of the fuzzing run in the UI :-) - fix timeout setting if \'+\' is used or a session is restarted - -l X option to enable base64 transformation solving - allow to disable CMPLOG with \'-c -\' (e.g. afl.rs enforces \'-c 0\' on every instance which is counterproductive). - afl-cmin/afl-cmin.bash: - fixed a bug inherited from vanilla AFL where a coverage of map[123] = 11 would be the same as map[1123] = 1 - warn on crashing inputs - adjust threads if less inputs than threads specified - afl-cc: - fixed an off-by-one instrumentation of iselect, hurting coverage a bit. Thanks to AATTamykweon for spotting and fixing! - AATTtoka fixed a bug in laf-intel signed integer comparison splitting, thanks a lot!! - more LLVM compatability - frida_mode: - support for long form instrumentation on x86_x64 and arm64 - renamed utils/get_symbol_addr.sh to utils/frida_get_symbol_addr.sh - qemu_mode: - added qemu_mode/utils/qemu_get_symbol_addr.sh
* Mon Jun 12 2023 Marcus Meissner - updated to 4.07c - afl-fuzz: - reverse reading the seeds only on restarts (increases performance) - new env `AFL_POST_PROCESS_KEEP_ORIGINAL` to keep the orignal data before post process on finds (for atnwalk custom mutator) - new env `AFL_IGNORE_PROBLEMS_COVERAGE` to ignore coverage from loaded libs after forkserver initialization (required by Mozilla) - afl-cc: - added AATTresponsefile support - new env `AFL_LLVM_LTO_SKIPINIT` to support the AFL++ based WASM (https://github.com/fgsect/WAFL) project - error and print help if afl-clan-lto is used with lto=thin - rewrote our PCGUARD pass to be compatible with LLVM 15+ shenanigans, requires LLVM 13+ now instead of 10.0.1+ - fallback to native LLVM PCGUARD if our PCGUARD is unavailable - fixed a crash in GCC CMPLOG - afl-showmap: - added custom mutator post_process and send support - add `-I filelist` option, an alternative to `-i in_dir` - afl-cmin + afl-cmin.bash: - `-T threads` parallel task support, can be a huge speedup! - qemu_mode: - Persistent mode + QASAN support for ppc32 targets by AATTworksbutnottested - a new grammar custom mutator atnwalk was submitted by AATTvoidptr127 ! - two new custom mutators are now available: - TritonDSE in custom_mutators/aflpp_tritondse - SymQEMU in custom_mutators/symqemu- removed ppc64le condition (failed parsing), we have no 32bit ppc64le
* Mon Apr 17 2023 Marcus Meissner - updated to 4.06c - afl-fuzz: - ensure temporary file descriptor is closed when not used - added `AFL_NO_WARN_INSTABILITY` - added time_wo_finds to fuzzer_stats - fixed a crash in pizza (1st april easter egg) mode. Sorry for everyone who was affected! - allow pizza mode to be disabled when AFL_PIZZA_MODE is set to -1 - option `-p mmopt` now also selects new queue items more often - fix bug in post_process custom mutator implementation - print name of custom mutator in UI - slight changes that improve fuzzer performance - afl-cc: - add CFI sanitizer variant to gcc targets - llvm 16 + 17 support (thanks to AATTdevnexen!) - support llvm 15 native pcguard changes - support for LLVMFuzzerTestOneInput -1 return - LTO autoken and llvm_mode: added AFL_LLVM_DICT2FILE_NO_MAIN support - qemu_mode: - fix _RANGES envs to allow hyphens in the filenames - basic riscv support - frida_mode: - added `AFL_FRIDA_STATS_INTERVAL` - fix issue on MacOS - unicorn_mode: - updated and minor issues fixed - nyx_mode support for all tools - better sanitizer default options support for all tools - new custom module: autotoken, a grammar free fuzzer for text inputs - fixed custom mutator C examples - more minor fixes and cross-platform support
* Wed Apr 12 2023 Dominique Leuenberger - Pin to llvm15 for the time being: code fails to build with llvm16.
* Thu Jan 05 2023 Marcus Meissner - updated to 4.05c - afl-fuzz: - added afl_custom_fuzz_send custom mutator feature. Now your can send fuzz data to the target as you need, e.g. via IPC. - cmplog mode now has a -l R option for random colorization, thanks to guyf2010 for the PR! - queue statistics are written every 30 minutes to out/NAME/queue_data if compiled with INTROSPECTION - new env: AFL_FORK_SERVER_KILL_SIGNAL - afl-showmap/afl-cmin - `-t none` now translates to `-t 120000` (120 seconds) - unicorn_mode updated - updated rust custom mutator dependencies and LibAFL custom mutator - several minor bugfixes
* Sat Oct 22 2022 Andreas Schwab - Update file list for riscv64
* Fri Oct 21 2022 Marcus Meissner - updated to 4.04c - fix gramatron and grammar_mutator build scripts - enhancements to the afl-persistent-config and afl-system-config - scripts - afl-fuzz: - force writing all stats on exit - afl-cc: - make gcc_mode (afl-gcc-fast) work with gcc down to version 3.6 - qemu_mode: - fixed 10x speed degredation in v4.03c - added qemu_mode/fastexit helper library - unicorn_mode: - Enabled tricore arch (by AATTjma-qb) - Updated Capstone version in Rust bindings - llvm-mode: - AFL runtime will always pass inputs via shared memory, when possible, ignoring the command line.
* Tue Sep 20 2022 Marcus Meissner - updated to 4.03c - Building now gives a build summary what succeeded and what not - afl-fuzz: - added AFL_NO_STARTUP_CALIBRATION to start fuzzing at once instead of calibrating all initial seeds first. Good for large queues and long execution times, especially in CIs. - default calibration cycles set to 7 from 8, and only add 5 cycles to variables queue items instead of 12. - afl-cc: - fixed off-by-one bug in our pcguard implemenation, thanks for AATTtokatoka for reporting - fix for llvm 15 and reenabling LTO, thanks to nikic for the PR! - better handling of -fsanitize=..,...,.. lists - support added for LLVMFuzzerRunDriver() - fix gcc_mode cmplog - obtain the map size of a target with setting AFL_DUMP_MAP_SIZE=1 note that this will exit the target before main() - qemu_mode: - added AFL_QEMU_TRACK_UNSTABLE to log the addresses of unstable edges (together with AFL_DEBUG=1 afl-fuzz). thanks to worksbutnottested! - afl-analyze broke at some point, fix by CodeLogicError, thank you! - afl-cmin/afl-cmin.bash now have an -A option to allow also crashing and timeout inputs - unicorn_mode: - updated upstream unicorn version - fixed builds for aarch64 - build now uses all available cores
* Sat Aug 20 2022 Marcus Meissner - updated to 4.02c - afl-cc: - important fix for the default pcguard mode when LLVM IR vector selects are produced, thanks to AATTjuppytt for reporting! - gcc_plugin: - Adacore submitted CMPLOG support to the gcc_plugin! :-) - llvm_mode: - laf cmp splitting fixed for more comparison types - frida_mode: - now works on Android! - afl-fuzz: - change post_process hook to allow returning NULL and 0 length to tell afl-fuzz to skip this mutated input
* Tue Jun 28 2022 Marcus Meissner - updated to 4.01c - fixed
*/build_...sh scripts to work outside of git - new custom_mutator: libafl with token fuzzing :) - afl-fuzz: - when you just want to compile once and set CMPLOG, then just set -c 0 to tell afl-fuzz that the fuzzing binary is also for CMPLOG. - new commandline options -g/G to set min/max length of generated fuzz inputs - you can set the time for syncing to other fuzzer now with AFL_SYNC_TIME - reintroduced AFL_PERSISTENT and AFL_DEFER_FORKSRV to allow persistent mode and manual forkserver support if these are not in the target binary (e.g. are in a shared library) - add AFL_EARLY_FORKSERVER to install the forkserver as earliest as possible in the target (for afl-gcc-fast/afl-clang-fast/ afl-clang-lto) - \"saved timeouts\" was wrong information, timeouts are still thrown away by default even if they have new coverage (hangs are always kept), unless AFL_KEEP_TIMEOUTS are set - AFL never implemented auto token inserts (but user token inserts, user token overwrite and auto token overwrite), added now! - fixed a mutation type in havoc mode - Mopt fix to always select the correct algorithm - fix effector map calculation (deterministic mode) - fix custom mutator post_process functionality - document and auto-activate pizza mode on condition - afl-cc: - due a bug in lld of llvm 15 LTO instrumentation wont work atm :-( - converted all passed to use the new llvm pass manager for llvm 11+ - AFL++ PCGUARD mode is not available for 10.0.1 anymore (11+ only) - trying to stay on top on all these #$&§!! changes in llvm 15 ... - frida_mode: - update to new frida release, handles now c++ throw/catch - unicorn_mode: - update unicorn engine, fix C example - utils: - removed optimin because it looses coverage due to a bug and is unmaintained :-(- removed upstream llvm14-fix-build.patch
* Sat Jun 04 2022 Aaron Puchert - Add llvm14-fix-build.patch: fix build with LLVM 14.
* Wed Feb 23 2022 Aaron Puchert - Fix build with armv7l on Leap: we have afl-llvm-rt-lto{,-32}.o.- Fix build with ppc64le: we don\'t seem to have the 32-bit object files available there and there is also no gcc-32bit.
* Mon Jan 31 2022 Marcus Meissner - updated to 4.00c - complete documentation restructuring, made possible by Google Season of Docs :) thank you Jana! - we renamed several UI and fuzzer_stat entries to be more precise, e.g. \"unique crashes\" -> \"saved crashes\", \"total paths\" -> \"corpus count\", \"current path\" -> \"current item\". This might need changing custom scripting! - Nyx mode (full system emulation with snapshot capability) has been added - thanks to AATTschumilo and AATTeqv! - unicorn_mode: - Moved to unicorn2! by Ziqiao Kong (AATTlazymio) - Faster, more accurate emulation (newer QEMU base), risc-v support - removed indirections in rust callbacks - new binary-only fuzzing mode: coresight_mode for aarch64 CPUs :) thanks to RICSecLab submitting! - if instrumented libaries are dlopen()\'ed after the forkserver you will now see a crash. Before you would have colliding coverage. We changed this to force fixing a broken setup rather then allowing ineffective fuzzing. - See docs/best_practices.md how to fix such setups. - afl-fuzz: - cmplog binaries will need to be recompiled for this version (it is better!) - fix a regression introduced in 3.10 that resulted in less coverage being detected. thanks to Collin May for reporting! - ensure all spawned targets are killed on exit - added AFL_IGNORE_PROBLEMS, plus checks to identify and abort on incorrect LTO usage setups and enhanced the READMEs for better information on how to deal with instrumenting libraries - fix -n dumb mode (nobody should use this mode though) - fix stability issue with LTO and cmplog - better banner - more effective cmplog mode - more often update the UI when in input2stage mode - qemu_mode/unicorn_mode: fixed OOB write when using libcompcov, thanks to kotee4ko for reporting! - frida_mode: - better performance, bug fixes - David Carlier added Android support :) - afl-showmap, afl-tmin and afl-analyze: - honor persistent mode for more speed. thanks to dloffre-snl for reporting! - fix bug where targets are not killed on timeouts - moved hidden afl-showmap -A option to -H to be used for coresight_mode - Prevent accidentaly killing non-afl/fuzz services when aborting afl-showmap and other tools. - afl-cc: - detect overflow reads on initial input buffer for asan - new cmplog mode (incompatible with older afl++ versions) - support llvm IR select instrumentation for default PCGUARD and LTO - fix for shared linking on MacOS - better selective instrumentation AFL_LLVM_{ALLOW|DENY}LIST on filename matching (requires llvm 11 or newer) - fixed a potential crash in targets for LAF string handling - fixed a bad assert in LAF split switches - added AFL_USE_TSAN thread sanitizer support - llvm and LTO mode modified to work with new llvm 14-dev (again.) - fix for AFL_REAL_LD - more -z defs filtering - make -v without options work - added the very good grammar mutator \"GramaTron\" to the custom_mutators - added optimin, a faster and better corpus minimizer by Adrian Herrera. Thank you! - added afl-persistent-config script to set perform permanent system configuration settings for fuzzing, for Linux and Macos. thanks to jhertz! - added xml, curl & exotic string functions to llvm dictionary feature - fix AFL_PRELOAD issues on MacOS - removed utils/afl_frida because frida_mode/ is now so much better - added uninstall target to makefile (todo: update new readme!)
* Sun Sep 26 2021 Marcus Meissner - enable gcc-plugin on factory- build with 32bit plugins on x86_64
* Mon Jul 19 2021 Marcus Meissner - updated to 3.14c - afl-fuzz: - fix -F when a \'/\' was part of the parameter - fixed a crash for cmplog for very slow inputs - fix for AFLfast schedule counting - removed implied -D determinstic from -M main - if the target becomes unavailable check out out/default/error.txt for an indicator why - AFL_CAL_FAST was a dead env, now does the same as AFL_FAST_CAL - reverse read the queue on resumes (more effective) - fix custom mutator trimming - afl-cc: - Update to COMPCOV/laf-intel that speeds up the instrumentation process a lot - thanks to Michael Rodler/f0rki for the PR! - Fix for failures for some sized string instrumentations - Fix to instrument global namespace functions in c++ - Fix for llvm 13 - support partial linking - do honor AFL_LLVM_{ALLOW/DENY}LIST for LTO autodictionary and DICT2FILE - We do support llvm versions from 3.8 to 5.0 again - frida_mode: - several fixes for cmplog - remove need for AFL_FRIDA_PERSISTENT_RETADDR_OFFSET - less coverage collision - feature parity of aarch64 with intel now (persistent, cmplog, in-memory testcases, asan) - afl-cmin and afl-showmap -i do now descend into subdirectories (like afl-fuzz does) - note that afl-cmin.bash does not! - afl_analyze: - fix timeout handling - add forkserver support for better performance - ensure afl-compiler-rt is built for gcc_module - always build aflpp_driver for libfuzzer harnesses - added `AFL_NO_FORKSRV` env variable support to afl-cmin, afl-tmin, and afl-showmap, by AATTjhertz - removed outdated documents, improved existing documentation
* Thu Jul 15 2021 Peace Peters - s390x added to the compiler files
* Tue Jun 08 2021 Andreas Schwab - Fix filelist for riscv64
* Tue Jun 01 2021 Marcus Meissner - updated to 3.13c - Note: plot_data switched to relative time from unix time in 3.10 - frida_mode - new mode that uses frida to fuzz binary-only targets, it currently supports persistent mode and cmplog. thanks to AATTWorksButNotTested! - create a fuzzing dictionary with the help of CodeQL thanks to AATTmicrosvuln! see utils/autodict_ql - afl-fuzz: - added patch by AATTrealmadsci to support AATTAATT as part of command line options, e.g. `afl-fuzz ... -- ./target --infile=AATTAATT` - add recording of previous fuzz attempts for persistent mode to allow replay of non-reproducable crashes, see AFL_PERSISTENT_RECORD in config.h and docs/envs.h - fixed a bug when trimming for stdin targets - cmplog -l: default cmplog level is now 2, better efficiency. level 3 now performs redqueen on everything. use with care. - better fuzzing strategy yield display for enabled options - ensure one fuzzer sync per cycle - fix afl_custom_queue_new_entry original file name when syncing from fuzzers - fixed a crash when more than one custom mutator was used together with afl_custom_post_process - on a crashing seed potentially the wrong input was disabled - added AFL_EXIT_ON_SEED_ISSUES env that will exit if a seed in - i dir crashes the target or results in a timeout. By default afl++ ignores these and uses them for splicing instead. - added AFL_EXIT_ON_TIME env that will make afl-fuzz exit fuzzing after no new paths have been found for n seconds - when AFL_FAST_CAL is set a variable path will now be calibrated 8 times instead of originally 40. Long calibration is now 20. - added AFL_TRY_AFFINITY to try to bind to CPUs but don\'t error if it fails - afl-cc: - We do not support llvm versions prior 6.0 anymore - added thread safe counters to all modes (`AFL_LLVM_THREADSAFE_INST`), note that this disables NeverZero counters. - Fix for -pie compiled binaries with default afl-clang-fast PCGUARD - Leak Sanitizer (AFL_USE_LSAN) added by Joshua Rogers, thanks! - Removed InsTrim instrumentation as it is not as good as PCGUARD - Removed automatic linking with -lc++ for LTO mode - Fixed a crash in llvm dict2file when a strncmp length was -1 - added --afl-noopt support - utils/aflpp_driver: - aflpp_qemu_driver_hook fixed to work with qemu_mode - aflpp_driver now compiled with -fPIC - unicornafl: - fix MIPS delay slot caching, thanks AATTJackGrence - fixed aarch64 exit address - execution no longer stops at address 0x0 - updated afl-system-config to support Arch Linux weirdness and increase MacOS shared memory - updated the grammar custom mutator to the newest version - add -d (add dead fuzzer stats) to afl-whatsup - added AFL_PRINT_FILENAMES to afl-showmap/cmin to print the current filename - afl-showmap/cmin will now process queue items in alphabetical order
* Fri Apr 09 2021 Guillaume GARDET - Fix packaging for aarch64 and %arm
* Sat Apr 03 2021 Niklas Haas - install `afl-clang-lto`, recommended by upstream as the best variant - add dependency on `lld` - bump llvm-devel up to >= 11.0.0- fix /usr/bin/env path in afl.cmin scripts- prevent stripping of runtime objects (fix bug 1184324)
* Mon Mar 29 2021 Guillaume GARDET - Fix packaging on aarch64 and %{arm}
* Wed Mar 24 2021 Marcus Meissner - updated to 3.12c - afl-fuzz: - added AFL_TARGET_ENV variable to pass extra env vars to the target (for things like LD_LIBRARY_PATH) - fix map detection, AFL_MAP_SIZE not needed anymore for most cases - fix counting favorites (just a display thing) - afl-cc: - fix cmplog rtn (rare crash and not being able to gather ptr data) - fix our own PCGUARD implementation to compile with llvm 10.0.1 - link runtime not to shared libs - ensure shared libraries are properly built and instrumented - AFL_LLVM_INSTRUMENT_ALLOW/DENY were not implemented for LTO, added - show correct LLVM PCGUARD NATIVE mode when auto switching to it and keep fsanitize-coverage-
*list=... Short mnemnonic NATIVE is now also accepted. - qemu_mode (thanks AATTrealmadsci): - move AFL_PRELOAD and AFL_USE_QASAN logic inside afl-qemu-trace - add AFL_QEMU_CUSTOM_BIN - unicorn_mode - accidently removed the subfolder from github, re-added - added DEFAULT_PERMISSION to config.h for all files created, default to 0600
* Tue Mar 16 2021 Marcus Meissner - updated to 3.11c - afl-fuzz: - better auto detection of map size - fix sanitizer settings (bug since 3.10c) - fix an off-by-one overwrite in cmplog - add non-unicode variants from unicode-looking dictionary entries - Rust custom mutator API improvements - Imported crash stats painted yellow on resume (only new ones are red) - afl-cc: - added AFL_NOOPT that will just pass everything to the normal gcc/clang compiler without any changes - to pass weird configure scripts - fixed a crash that can occur with ASAN + CMPLOG together plus better support for unicode (thanks to AATTstbergmann for reporting!) - fixed a crash in LAF transform for empty strings - handle erroneous setups in which multiple afl-compiler-rt are compiled into the target. This now also supports dlopen() instrumented libs loaded before the forkserver and even after the forkserver is started (then with collisions though) - the compiler rt was added also in object building (-c) which should have been fixed years ago but somewhere got lost :( - Renamed CTX to CALLER, added correct/real CTX implementation to CLASSIC - qemu_mode: - added AFL_QEMU_EXCLUDE_RANGES env by AATTrealmadsci, thanks! - if no new/updated checkout is wanted, build with: NO_CHECKOUT=1 ./build_qemu_support.sh - we no longer perform a \"git drop\" - afl-cmin: support filenames with spaces- afl-3.0c-fix-paths.patch: refreshed
* Mon Mar 01 2021 Marcus Meissner - update to 3.10c - Mac OS ARM64 support - Android support fixed and updated by Joey Jiaojg - thanks! - New selective instrumentation option with __AFL_COVERAGE_
* commands to be placed in the source code. Check out instrumentation/README.instrument_list.md - afl-fuzz - Making AFL_MAP_SIZE (mostly) obsolete - afl-fuzz now learns on start the target map size - upgraded cmplog/redqueen: solving for floating point, solving transformations (e.g. toupper, tolower, to/from hex, xor, arithmetics, etc.). This is costly hence new command line option `-l` that sets the intensity (values 1 to 3). Recommended is 2. - added `AFL_CMPLOG_ONLY_NEW` to not use cmplog on initial seeds from `-i` or resumes (these have most likely already been done) - fix crash for very, very fast targets+systems (thanks to mhlakhani for reporting) - on restarts (`-i`)/autoresume (AFL_AUTORESUME) the stats are now reloaded and used, thanks to Vimal Joseph for this patch! - changed the meaning of \'+\' of the \'-t\' option, it now means to auto-calculate the timeout with the value given being the max timeout. The original meaning of skipping timeouts instead of abort is now inherent to the -t option. - if deterministic mode is active (`-D`, or `-M` without `-d`) then we sync after every queue entry as this can take very long time otherwise - added minimum SYNC_TIME to include/config.h (30 minutes default) - better detection if a target needs a large shared map - fix for `-Z` - fixed a few crashes - switched to an even faster RNG - added hghwng\'s patch for faster trace map analysis - printing suggestions for mistyped `AFL_` env variables - added Rust bindings for custom mutators (thanks AATTjulihoh) - afl-cc - allow instrumenting LLVMFuzzerTestOneInput - fixed endless loop for allow/blocklist lines starting with a comment (thanks to Zherya for reporting) - cmplog/redqueen now also tracks floating point, _ExtInt() + 128bit - cmplog/redqueen can now process basic libc++ and libstdc++ std::string comparisons (no position or length type variants) - added support for __afl_coverage_interesting() for LTO and our own PCGUARD (llvm 10.0.1+), read more about this function and selective coverage in instrumentation/README.instrument_list.md - added AFL_LLVM_INSTRUMENT option NATIVE for native clang pc-guard support (less performant than our own), GCC for old afl-gcc and CLANG for old afl-clang - fixed a potential crash in the LAF feature - workaround for llvm bitcast lto bug - workaround for llvm 13 - qemuafl - QASan (address sanitizer for Qemu) ported to qemuafl! See qemu_mode/libqasan/README.md - solved some persistent mode bugs (thanks Dil4rd) - solved an issue when dumping the memory maps (thanks wizche) - Android support for QASan - unicornafl - Substantial speed gains in python bindings for certain use cases - Improved rust bindings - Added a new example harness to compare python, c and rust bindings - afl-cmin and afl-showmap now support the -f option - afl_plot now also generates a graph on the discovered edges - changed default: no memory limit for afl-cmin and afl-cmin.bash - warn on any _AFL and __AFL env vars. - set AFL_IGNORE_UNKNOWN_ENVS to not warn on unknown AFL_... env vars - added dummy Makefile to instrumentation/ - Updated utils/afl_frida to be 5% faster, 7% on x86_x64 - Added `AFL_KILL_SIGNAL` env variable (thanks AATTv-p-b) - AATTEdznux added a nice documentation on how to use rpc.statsd with afl++ in docs/rpc_statsd.md, thanks!