-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathChangeLog
2870 lines (1950 loc) · 82.1 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
=========
ChangeLog
=========
This is the list of all noteworthy changes made in every public release of
the tool. See README for the general instruction manual.
----------------
Staying informed
----------------
Want to stay in the loop on major new features? Join our mailing list by
sending a mail to <[email protected]>.
--------------------------
Version ++2.59d (develop):
--------------------------
- fixed a critical bug in afl-tmin that was introduced during ++2.53d
- added test cases for afl-cmin and afl-tmin to test/test.sh
- added ./experimental/argv_fuzzing ld_preload library by Kjell Braden
- added preeny's desock_dup ld_preload library as
./experimental/socket_fuzzing for network fuzzing
- added AFL_AS_FORCE_INSTRUMENT environment variable for afl-as - this is
for the retrorewrite project
- we now set QEMU_SET_ENV from AFL_PRELOAD when qemu_mode is used
--------------------------
Version ++2.59c (release):
--------------------------
- qbdi_mode: fuzz android native libraries via QBDI framework
- unicorn_mode: switched to the new unicornafl, thanks domenukk
(see https://github.com/vanhauser-thc/unicorn)
- afl-fuzz:
- added radamsa as (an optional) mutator stage (-R[R])
- added -u command line option to not unlink the fuzz input file
- Python3 support (autodetect)
- AFL_DISABLE_TRIM env var to disable the trim stage
- CPU affinity support for DragonFly
- llvm_mode:
- float splitting is now configured via AFL_LLVM_LAF_SPLIT_FLOATS
- support for llvm 10 included now (thanks to devnexen)
- libtokencap:
- support for *BSD/OSX/Dragonfly added
- hook common *cmp functions from widely used libraries
- compcov:
- hook common *cmp functions from widely used libraries
- floating point splitting support for QEMU on x86 targets
- qemu_mode: AFL_QEMU_DISABLE_CACHE env to disable QEMU TranslationBlocks caching
- afl-analyze: added AFL_SKIP_BIN_CHECK support
- better random numbers for gcc_plugin and llvm_mode (thanks to devnexen)
- Dockerfile by courtesy of devnexen
- added regex.dictionary
- qemu and unicorn download scripts now try to download until the full
download succeeded. f*ckin travis fails downloading 40% of the time!
- more support for Android (please test!)
- added the few Android stuff we didnt have already from Google afl repository
- removed unnecessary warnings
--------------------------
Version ++2.58c (release):
--------------------------
- reverted patch to not unlink and recreate the input file, it resulted in
performance loss of ~10%
- added test/test-performance.sh script
- (re)added gcc_plugin, fast inline instrumentation is not yet finished,
however it includes the whitelisting and persistance feature! by hexcoder-
- gcc_plugin tests added to testing framework
--------------------------------
Version ++2.54d-2.57c (release):
--------------------------------
- we jump to 2.57 instead of 2.55 to catch up with Google's versioning
- persistent mode for QEMU (see qemu_mode/README.md)
- custom mutator library is now an additional mutator, to exclusivly use it
add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour)
- new library qemu_mode/unsigaction which filters sigaction events
- afl-fuzz: new command line option -I to execute a command on a new crash
- no more unlinking the input file, this way the input file can also be a
FIFO or disk partition
- setting LLVM_CONFIG for llvm_mode will now again switch to the selected
llvm version. If your setup is correct.
- fuzzing strategy yields for custom mutator were missing from the UI, added them :)
- added "make tests" which will perform checks to see that all functionality
is working as expected. this is currently the starting point, its not complete :)
- added mutation documentation feature ("make document"), creates afl-fuzz-document
and saves all mutations of the first run on the first file into out/queue/mutations
- libtokencap and libdislocator now compile to the afl_root directory and are
installed to the .../lib/afl directory when present during make install
- more BSD support, e.g. free CPU binding code for FreeBSD (thanks to devnexen)
- reducing duplicate code in afl-fuzz
- added "make help"
- removed compile warnings from python internal stuff
- added man page for afl-clang-fast[++]
- updated documentation
- Wine mode to run Win32 binaries with the QEMU instrumentation (-W)
- CompareCoverage for ARM target in QEMU/Unicorn
- laf-intel in llvm_mode now also handles floating point comparisons
--------------------------
Version ++2.54c (release):
--------------------------
- big code refactoring:
* all includes are now in include/
* all afl sources are now in src/ - see src/README.src
* afl-fuzz was splitted up in various individual files for including
functionality in other programs (e.g. forkserver, memory map, etc.)
for better readability.
* new code indention everywhere
- auto-generating man pages for all (main) tools
- added AFL_FORCE_UI to show the UI even if the terminal is not detected
- llvm 9 is now supported (still needs testing)
- Android is now supported (thank to JoeyJiao!) - still need to modify the Makefile though
- fix building qemu on some Ubuntus (thanks to floyd!)
- custom mutator by a loaded library is now supported (thanks to kyakdan!)
- added PR that includes peak_rss_mb and slowest_exec_ms in the fuzzer_stats report
- more support for *BSD (thanks to devnexen!)
- fix building on *BSD (thanks to tobias.kortkamp for the patch)
- fix for a few features to support different map sized than 2^16
- afl-showmap: new option -r now shows the real values in the buckets (stock
afl never did), plus shows tuple content summary information now
- small docu updates
- NeverZero counters for QEMU
- NeverZero counters for Unicorn
- CompareCoverage Unicorn
- immediates-only instrumentation for CompareCoverage
--------------------------
Version ++2.53c (release):
--------------------------
- README is now README.md
- imported the few minor changes from the 2.53b release
- unicorn_mode got added - thanks to domenukk for the patch!
- fix llvm_mode AFL_TRACE_PC with modern llvm
- fix a crash in qemu_mode which also exists in stock afl
- added libcompcov, a laf-intel implementation for qemu! :)
see qemu_mode/libcompcov/README.libcompcov
- afl-fuzz now displays the selected core in the status screen (blue {#})
- updated afl-fuzz and afl-system-config for new scaling governor location
in modern kernels
- using the old ineffective afl-gcc will now show a deprecation warning
- all queue, hang and crash files now have their discovery time in their name
- if llvm_mode was compiled, afl-clang/afl-clang++ will point to these
instead of afl-gcc
- added instrim, a much faster llvm_mode instrumentation at the cost of
path discovery. See llvm_mode/README.instrim (https://github.com/csienslab/instrim)
- added MOpt (github.com/puppet-meteor/MOpt-AFL) mode, see docs/README.MOpt
- added code to make it more portable to other platforms than Intel Linux
- added never zero counters for afl-gcc and optionally (because of an
optimization issue in llvm < 9) for llvm_mode (AFL_LLVM_NEVER_ZERO=1)
- added a new doc about binary only fuzzing: docs/binaryonly_fuzzing.txt
- more cpu power for afl-system-config
- added forkserver patch to afl-tmin, makes it much faster (originally from
github.com/nccgroup/TriforceAFL)
- added whitelist support for llvm_mode via AFL_LLVM_WHITELIST to allow
only to instrument what is actually interesting. Gives more speed and less
map pollution (originally by choller@mozilla)
- added Python Module mutator support, python2.7-dev is autodetected.
see docs/python_mutators.txt (originally by choller@mozilla)
- added AFL_CAL_FAST for slow applications and AFL_DEBUG_CHILD_OUTPUT for
debugging
- added -V time and -E execs option to better comparison runs, runs afl-fuzz
for a specific time/executions.
- added a -s seed switch to allow afl run with a fixed initial
seed that is not updated. This is good for performance and path discovery
tests as the random numbers are deterministic then
- llvm_mode LAF_... env variables can now be specified as AFL_LLVM_LAF_...
that is longer but in line with other llvm specific env vars
-----------------------------
Version ++2.52c (2019-06-05):
-----------------------------
- Applied community patches. See docs/PATCHES for the full list.
LLVM and Qemu modes are now faster.
Important changes:
afl-fuzz: -e EXTENSION commandline option
llvm_mode: LAF-intel performance (needs activation, see llvm/README.laf-intel)
a few new environment variables for afl-fuzz, llvm and qemu, see docs/env_variables.txt
- Added the power schedules of AFLfast by Marcel Boehme, but set the default
to the AFL schedule, not to the FAST schedule. So nothing changes unless
you use the new -p option :-) - see docs/power_schedules.txt
- added afl-system-config script to set all system performance options for fuzzing
- llvm_mode works with llvm 3.9 up to including 8 !
- qemu_mode got upgraded from 2.1 to 3.1 - incorporated from
https://github.com/andreafioraldi/afl and with community patches added
---------------------------
Version 2.52b (2017-11-04):
---------------------------
- Upgraded QEMU patches from 2.3.0 to 2.10.0. Required troubleshooting
several weird issues. All the legwork done by Andrew Griffiths.
- Added setsid to afl-showmap. See the notes for 2.51b.
- Added target mode (deferred, persistent, qemu, etc) to fuzzer_stats.
Requested by Jakub Wilk.
- afl-tmin should now save a partially minimized file when Ctrl-C
is pressed. Suggested by Jakub Wilk.
- Added an option for afl-analyze to dump offsets in hex. Suggested by
Jakub Wilk.
- Added support for parameters in triage_crashes.sh. Patch by Adam of
DC949.
---------------------------
Version 2.51b (2017-08-30):
---------------------------
- Made afl-tmin call setsid to prevent glibc traceback junk from showing
up on the terminal in some distros. Suggested by Jakub Wilk.
---------------------------
Version 2.50b (2017-08-19):
---------------------------
- Fixed an interesting timing corner case spotted by Jakub Wilk.
- Addressed a libtokencap / pthreads incompatibility issue. Likewise, spotted
by Jakub Wilk.
- Added a mention of afl-kit and Pythia.
- Added AFL_FAST_CAL.
- In-place resume now preserves .synced. Suggested by Jakub Wilk.
---------------------------
Version 2.49b (2017-07-18):
---------------------------
- Added AFL_TMIN_EXACT to allow path constraint for crash minimization.
- Added dates for releases (retroactively for all of 2017).
---------------------------
Version 2.48b (2017-07-17):
---------------------------
- Added AFL_ALLOW_TMP to permit some scripts to run in /tmp.
- Fixed cwd handling in afl-analyze (similar to the quirk in afl-tmin).
- Made it possible to point -o and -f to the same file in afl-tmin.
---------------------------
Version 2.47b (2017-07-14):
---------------------------
- Fixed cwd handling in afl-tmin. Spotted by Jakub Wilk.
---------------------------
Version 2.46b (2017-07-10):
---------------------------
- libdislocator now supports AFL_LD_NO_CALLOC_OVER for folks who do not
want to abort on calloc() overflows.
- Made a minor fix to libtokencap. Reported by Daniel Stender.
- Added a small JSON dictionary, inspired on a dictionary done by Jakub Wilk.
---------------------------
Version 2.45b (2017-07-04):
---------------------------
- Added strstr, strcasestr support to libtokencap. Contributed by
Daniel Hodson.
- Fixed a resumption offset glitch spotted by Jakub Wilk.
- There are definitely no bugs in afl-showmap -c now.
---------------------------
Version 2.44b (2017-06-28):
---------------------------
- Added a visual indicator of ASAN / MSAN mode when compiling. Requested
by Jakub Wilk.
- Added support for afl-showmap coredumps (-c). Suggested by Jakub Wilk.
- Added LD_BIND_NOW=1 for afl-showmap by default. Although not really useful,
it reportedly helps reproduce some crashes. Suggested by Jakub Wilk.
- Added a note about allocator_may_return_null=1 not always working with
ASAN. Spotted by Jakub Wilk.
---------------------------
Version 2.43b (2017-06-16):
---------------------------
- Added AFL_NO_ARITH to aid in the fuzzing of text-based formats.
Requested by Jakub Wilk.
---------------------------
Version 2.42b (2017-06-02):
---------------------------
- Renamed the R() macro to avoid a problem with llvm_mode in the latest
versions of LLVM. Fix suggested by Christian Holler.
---------------------------
Version 2.41b (2017-04-12):
---------------------------
- Addressed a major user complaint related to timeout detection. Timing out
inputs are now binned as "hangs" only if they exceed a far more generous
time limit than the one used to reject slow paths.
---------------------------
Version 2.40b (2017-04-02):
---------------------------
- Fixed a minor oversight in the insertion strategy for dictionary words.
Spotted by Andrzej Jackowski.
- Made a small improvement to the havoc block insertion strategy.
- Adjusted color rules for "is it done yet?" indicators.
---------------------------
Version 2.39b (2017-02-02):
---------------------------
- Improved error reporting in afl-cmin. Suggested by floyd.
- Made a minor tweak to trace-pc-guard support. Suggested by kcc.
- Added a mention of afl-monitor.
---------------------------
Version 2.38b (2017-01-22):
---------------------------
- Added -mllvm -sanitizer-coverage-block-threshold=0 to trace-pc-guard
mode, as suggested by Kostya Serebryany.
---------------------------
Version 2.37b (2017-01-22):
---------------------------
- Fixed a typo. Spotted by Jakub Wilk.
- Fixed support for make install when using trace-pc. Spotted by
Kurt Roeckx.
- Switched trace-pc to trace-pc-guard, which should be considerably
faster and is less quirky. Kudos to Konstantin Serebryany (and sorry
for dragging my feet).
Note that for some reason, this mode doesn't perform as well as
"vanilla" afl-clang-fast / afl-clang.
---------------------------
Version 2.36b (2017-01-14):
---------------------------
- Fixed a cosmetic bad free() bug when aborting -S sessions. Spotted
by Johannes S.
- Made a small change to afl-whatsup to sort fuzzers by name.
- Fixed a minor issue with malloc(0) in libdislocator. Spotted by
Rene Freingruber.
- Changed the clobber pattern in libdislocator to a slightly more
reliable one. Suggested by Rene Freingruber.
- Added a note about THP performance. Suggested by Sergey Davidoff.
- Added a somewhat unofficial support for running afl-tmin with a
baseline "mask" that causes it to minimize only for edges that
are unique to the input file, but not to the "boring" baseline.
Suggested by Sami Liedes.
- "Fixed" a getPassName() problem with newer versions of clang.
Reported by Craig Young and several other folks.
Yep, I know I have a backlog on several other feature requests.
Stay tuned!
--------------
Version 2.35b:
--------------
- Fixed a minor cmdline reporting glitch, spotted by Leo Barnes.
- Fixed a silly bug in libdislocator. Spotted by Johannes Schultz.
--------------
Version 2.34b:
--------------
- Added a note about afl-tmin to technical_details.txt.
- Added support for AFL_NO_UI, as suggested by Leo Barnes.
--------------
Version 2.33b:
--------------
- Added code to strip -Wl,-z,defs and -Wl,--no-undefined for afl-clang-fast,
since they interfere with -shared. Spotted and diagnosed by Toby Hutton.
- Added some fuzzing tips for Android.
--------------
Version 2.32b:
--------------
- Added a check for AFL_HARDEN combined with AFL_USE_*SAN. Suggested by
Hanno Boeck.
- Made several other cosmetic adjustments to cycle timing in the wake of the
big tweak made in 2.31b.
--------------
Version 2.31b:
--------------
- Changed havoc cycle counts for a marked performance boost, especially
with -S / -d. See the discussion of FidgetyAFL in:
https://groups.google.com/forum/#!topic/afl-users/fOPeb62FZUg
While this does not implement the approach proposed by the authors of
the CCS paper, the solution is a result of digging into that research;
more improvements may follow as I do more experiments and get more
definitive data.
--------------
Version 2.30b:
--------------
- Made minor improvements to persistent mode to avoid the remote
possibility of "no instrumentation detected" issues with very low
instrumentation densities.
- Fixed a minor glitch with a leftover process in persistent mode.
Reported by Jakub Wilk and Daniel Stender.
- Made persistent mode bitmaps a bit more consistent and adjusted the way
this is shown in the UI, especially in persistent mode.
--------------
Version 2.29b:
--------------
- Made a minor #include fix to llvm_mode. Suggested by Jonathan Metzman.
- Made cosmetic updates to the docs.
--------------
Version 2.28b:
--------------
- Added "life pro tips" to docs/.
- Moved testcases/_extras/ to dictionaries/ for visibility.
- Made minor improvements to install scripts.
- Added an important safety tip.
--------------
Version 2.27b:
--------------
- Added libtokencap, a simple feature to intercept strcmp / memcmp and
generate dictionary entries that can help extend coverage.
- Moved libdislocator to its own dir, added README.
- The demo in experimental/instrumented_cmp is no more.
--------------
Version 2.26b:
--------------
- Made a fix for libdislocator.so to compile on MacOS X.
- Added support for DYLD_INSERT_LIBRARIES.
- Renamed AFL_LD_PRELOAD to AFL_PRELOAD.
--------------
Version 2.25b:
--------------
- Made some cosmetic updates to libdislocator.so, renamed one env
variable.
--------------
Version 2.24b:
--------------
- Added libdislocator.so, an experimental, abusive allocator. Try
it out with AFL_LD_PRELOAD=/path/to/libdislocator.so when running
afl-fuzz.
--------------
Version 2.23b:
--------------
- Improved the stability metric for persistent mode binaries. Problem
spotted by Kurt Roeckx.
- Made a related improvement that may bring the metric to 100% for those
targets.
--------------
Version 2.22b:
--------------
- Mentioned the potential conflicts between MSAN / ASAN and FORTIFY_SOURCE.
There is no automated check for this, since some distros may implicitly
set FORTIFY_SOURCE outside of the compiler's argv[].
- Populated the support for AFL_LD_PRELOAD to all companion tools.
- Made a change to the handling of ./afl-clang-fast -v. Spotted by
Jan Kneschke.
--------------
Version 2.21b:
--------------
- Added some crash reporting notes for Solaris in docs/INSTALL, as
investigated by Martin Carpenter.
- Fixed a minor UI mix-up with havoc strategy stats.
--------------
Version 2.20b:
--------------
- Revamped the handling of variable paths, replacing path count with a
"stability" score to give users a much better signal. Based on the
feedback from Vegard Nossum.
- Made a stability improvement to the syncing behavior with resuming
fuzzers. Based on the feedback from Vegard.
- Changed the UI to include current input bitmap density along with
total density. Ditto.
- Added experimental support for parallelizing -M.
--------------
Version 2.19b:
--------------
- Made a fix to make sure that auto CPU binding happens at non-overlapping
times.
--------------
Version 2.18b:
--------------
- Made several performance improvements to has_new_bits() and
classify_counts(). This should offer a robust performance bump with
fast targets.
--------------
Version 2.17b:
--------------
- Killed the error-prone and manual -Z option. On Linux, AFL will now
automatically bind to the first free core (or complain if there are no
free cores left).
- Made some doc updates along these lines.
--------------
Version 2.16b:
--------------
- Improved support for older versions of clang (hopefully without
breaking anything).
- Moved version data from Makefile to config.h. Suggested by
Jonathan Metzman.
--------------
Version 2.15b:
--------------
- Added a README section on looking for non-crashing bugs.
- Added license data to several boring files. Contributed by
Jonathan Metzman.
--------------
Version 2.14b:
--------------
- Added FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION as a macro defined when
compiling with afl-gcc and friends. Suggested by Kostya Serebryany.
- Refreshed some of the non-x86 docs.
--------------
Version 2.13b:
--------------
- Fixed a spurious build test error with trace-pc and llvm_mode/Makefile.
Spotted by Markus Teufelberger.
- Fixed a cosmetic issue with afl-whatsup. Spotted by Brandon Perry.
--------------
Version 2.12b:
--------------
- Fixed a minor issue in afl-tmin that can make alphabet minimization less
efficient during passes > 1. Spotted by Daniel Binderman.
--------------
Version 2.11b:
--------------
- Fixed a minor typo in instrumented_cmp, spotted by Hanno Eissfeldt.
- Added a missing size check for deterministic insertion steps.
- Made an improvement to afl-gotcpu when -Z not used.
- Fixed a typo in post_library_png.so.c in experimental/. Spotted by Kostya
Serebryany.
--------------
Version 2.10b:
--------------
- Fixed a minor core counting glitch, reported by Tyler Nighswander.
--------------
Version 2.09b:
--------------
- Made several documentation updates.
- Added some visual indicators to promote and simplify the use of -Z.
--------------
Version 2.08b:
--------------
- Added explicit support for -m32 and -m64 for llvm_mode. Inspired by
a request from Christian Holler.
- Added a new benchmarking option, as requested by Kostya Serebryany.
--------------
Version 2.07b:
--------------
- Added CPU affinity option (-Z) on Linux. With some caution, this can
offer a significant (10%+) performance bump and reduce jitter.
Proposed by Austin Seipp.
- Updated afl-gotcpu to use CPU affinity where supported.
- Fixed confusing CPU_TARGET error messages with QEMU build. Spotted by
Daniel Komaromy and others.
--------------
Version 2.06b:
--------------
- Worked around LLVM persistent mode hiccups with -shared code.
Contributed by Christian Holler.
- Added __AFL_COMPILER as a convenient way to detect that something is
built under afl-gcc / afl-clang / afl-clang-fast and enable custom
optimizations in your code. Suggested by Pedro Corte-Real.
- Upstreamed several minor changes developed by Franjo Ivancic to
allow AFL to be built as a library. This is fairly use-specific and
may have relatively little appeal to general audiences.
--------------
Version 2.05b:
--------------
- Put __sanitizer_cov_module_init & co behind #ifdef to avoid problems
with ASAN. Spotted by Christian Holler.
--------------
Version 2.04b:
--------------
- Removed indirect-calls coverage from -fsanitize-coverage (since it's
redundant). Spotted by Kostya Serebryany.
--------------
Version 2.03b:
--------------
- Added experimental -fsanitize-coverage=trace-pc support that goes with
some recent additions to LLVM, as implemented by Kostya Serebryany.
Right now, this is cumbersome to use with common build systems, so
the mode remains undocumented.
- Made several substantial improvements to better support non-standard
map sizes in LLVM mode.
- Switched LLVM mode to thread-local execution tracing, which may offer
better results in some multithreaded apps.
- Fixed a minor typo, reported by Heiko Eissfeldt.
- Force-disabled symbolization for ASAN, as suggested by Christian Holler.
- AFL_NOX86 renamed to AFL_NO_X86 for consistency.
- Added AFL_LD_PRELOAD to allow LD_PRELOAD to be set for targets without
affecting AFL itself. Suggested by Daniel Godas-Lopez.
--------------
Version 2.02b:
--------------
- Fixed a "lcamtuf can't count to 16" bug in the havoc stage. Reported
by Guillaume Endignoux.
--------------
Version 2.01b:
--------------
- Made an improvement to cycle counter color coding, based on feedback
from Shai Sarfaty.
- Added a mention of aflize to sister_projects.txt.
- Fixed an installation issue with afl-as, as spotted by ilovezfs.
--------------
Version 2.00b:
--------------
- Cleaned up color handling after a minor snafu in 1.99b (affecting some
terminals).
- Made minor updates to the documentation.
--------------
Version 1.99b:
--------------
- Substantially revamped the output and the internal logic of afl-analyze.
- Cleaned up some of the color handling code and added support for
background colors.
- Removed some stray files (oops).
- Updated docs to better explain afl-analyze.
--------------
Version 1.98b:
--------------
- Improved to "boring string" detection in afl-analyze.
- Added technical_details.txt for afl-analyze.
--------------
Version 1.97b:
--------------
- Added afl-analyze, a nifty tool to analyze the structure of a file
based on the feedback from AFL instrumentation. This is kinda experimental,
so field reports welcome.
- Added a mention of afl-cygwin.
- Fixed a couple of typos, as reported by Jakub Wilk and others.
--------------
Version 1.96b:
--------------
- Added -fpic to CFLAGS for the clang plugin, as suggested by Hanno Boeck.
- Made another clang change (IRBuilder) suggested by Jeff Trull.
- Fixed several typos, spotted by Jakub Wilk.
- Added support for AFL_SHUFFLE_QUEUE, based on discussions with
Christian Holler.
--------------
Version 1.95b:
--------------
- Fixed a harmless bug when handling -B. Spotted by Jacek Wielemborek.
- Made the exit message a bit more accurate when AFL_EXIT_WHEN_DONE is set.
- Added some error-checking for old-style forkserver syntax. Suggested by
Ben Nagy.
- Switched from exit() to _exit() in injected code to avoid snafus with
destructors in C++ code. Spotted by sunblate.
- Made a change to avoid spuriously setting __AFL_SHM_ID when
AFL_DUMB_FORKSRV is set in conjunction with -n. Spotted by Jakub Wilk.
--------------
Version 1.94b:
--------------
- Changed allocator alignment to improve support for non-x86 systems (now
that llvm_mode makes this more feasible).
- Fixed a minor typo in afl-cmin. Spotted by Jonathan Neuschafer.
- Fixed an obscure bug that would affect people trying to use afl-gcc
with $TMP set but $TMPDIR absent. Spotted by Jeremy Barnes.
--------------
Version 1.93b:
--------------
- Hopefully fixed a problem with MacOS X and persistent mode, spotted by
Leo Barnes.
--------------
Version 1.92b:
--------------
- Made yet another C++ fix (namespaces). Reported by Daniel Lockyer.
--------------
Version 1.91b:
--------------
- Made another fix to make 1.90b actually work properly with C++ (d'oh).
Problem spotted by Daniel Lockyer.
--------------
Version 1.90b:
--------------
- Fixed a minor typo spotted by Kai Zhao; and made several other minor updates
to docs.
- Updated the project URL for python-afl. Requested by Jakub Wilk.
- Fixed a potential problem with deferred mode signatures getting optimized
out by the linker (with --gc-sections).
--------------
Version 1.89b:
--------------
- Revamped the support for persistent and deferred forkserver modes.
Both now feature simpler syntax and do not require companion env
variables. Suggested by Jakub Wilk.
- Added a bit more info about afl-showmap. Suggested by Jacek Wielemborek.
--------------
Version 1.88b:
--------------
- Made AFL_EXIT_WHEN_DONE work in non-tty mode. Issue spotted by
Jacek Wielemborek.
--------------
Version 1.87b:
--------------
- Added QuickStartGuide.txt, a one-page quick start doc.
- Fixed several typos spotted by Dominique Pelle.
- Revamped several parts of README.
--------------
Version 1.86b:
--------------
- Added support for AFL_SKIP_CRASHES, which is a very hackish solution to
the problem of resuming sessions with intermittently crashing inputs.
- Removed the hard-fail terminal size check, replaced with a dynamic
warning shown in place of the UI. Based on feedback from Christian Holler.
- Fixed a minor typo in show_stats. Spotted by Dingbao Xie.
--------------
Version 1.85b:
--------------
- Fixed a garbled sentence in notes on parallel fuzzing. Thanks to Jakub Wilk.
- Fixed a minor glitch in afl-cmin. Spotted by Jonathan Foote.
--------------
Version 1.84b:
--------------
- Made SIMPLE_FILES behave as expected when naming backup directories for
crashes and hangs.
- Added the total number of favored paths to fuzzer_stats. Requested by
Ben Nagy.
- Made afl-tmin, afl-fuzz, and afl-cmin reject negative values passed to
-t and -m, since they generally won't work as expected.
- Made a fix for no lahf / sahf support on older versions of FreeBSD.
Patch contributed by Alex Moneger.
--------------
Version 1.83b:
--------------
- Fixed a problem with xargs -d on non-Linux systems in afl-cmin. Spotted by
teor2345 and Ben Nagy.
- Fixed an implicit declaration in LLVM mode on MacOS X. Reported by
Kai Zhao.
--------------
Version 1.82b:
--------------
- Fixed a harmless but annoying race condition in persistent mode - signal
delivery is a bit more finicky than I thought.
- Updated the documentation to explain persistent mode a bit better.
- Tweaked AFL_PERSISTENT to force AFL_NO_VAR_CHECK.
--------------
Version 1.81b:
--------------
- Added persistent mode for in-process fuzzing. See llvm_mode/README.llvm.
Inspired by Kostya Serebryany and Christian Holler.
- Changed the in-place resume code to preserve crashes/README.txt. Suggested
by Ben Nagy.
- Included a potential fix for LLVM mode issues on MacOS X, based on the
investigation done by teor2345.
--------------
Version 1.80b:
--------------
- Made afl-cmin tolerant of whitespaces in filenames. Suggested by
Jonathan Neuschafer and Ketil Froyn.
- Added support for AFL_EXIT_WHEN_DONE, as suggested by Michael Rash.
--------------
Version 1.79b:
--------------
- Added support for dictionary levels, see testcases/README.testcases.
- Reworked the SQL dictionary to use levels.
- Added a note about Preeny.
--------------
Version 1.78b:
--------------
- Added a dictionary for PDF, contributed by Ben Nagy.
- Added several references to afl-cov, a new tool by Michael Rash.
- Fixed a problem with crash reporter detection on MacOS X, as reported by
Louis Dassy.
--------------
Version 1.77b:
--------------