How to set up afl.rs for fuzzing a Rust crate?

Use `cargo-afl` to build with fuzzing enabled, then run `cargo afl fuzz` with input seeds. First, run `cargo afl system-config` for optimization, but note it requires sudo.

afl.rs vs cargo-fuzz: which is better for Rust?

afl.rs uses AFLplusplus for coverage-guided fuzzing with features like CMPLOG, ideal for long campaigns. cargo-fuzz uses libFuzzer and might be simpler for quick integration, but afl.rs offers more advanced control.

Does afl.rs work on Windows or macOS?

AFLplusplus is primarily designed for Linux, so afl.rs may have limited support on other platforms. Check AFLplusplus documentation for cross-platform compatibility.

How to use IJON annotations in Rust with afl.rs?

Import macros like `afl::ijon_max` and apply them in your code to guide the fuzzer. Refer to the maze example in the repository for a practical implementation.

Can I disable CMPLOG in afl.rs?

Yes, by adding the command line parameter '-c -' when running instances, as CMPLOG is not recommended for more than two fuzzing processes.

How to handle crashes found by afl.rs?

AFLplusplus saves crash outputs in a directory; analyze them with debugging tools. The fuzzing campaign documentation recommends reviewing AFLplusplus crash handling features.

Open-Awesome

afl.rs

Apache-2.0Rust

A Rust library for fuzzing Rust code with AFLplusplus to find security and stability issues.

Visit Website GitHub

1.8k stars119 forks0 contributors

What is afl.rs?

afl.rs is a Rust library that enables fuzz testing of Rust code using AFLplusplus, a modern fuzzing tool. It helps developers find security vulnerabilities, crashes, and stability issues by generating pseudo-random inputs to test software robustness. The library integrates AFLplusplus's features like CMPLOG and IJON annotations to improve code coverage and fuzzing effectiveness.

Target Audience

Rust developers and security engineers who need to perform fuzz testing on Rust applications, libraries, or systems to uncover hidden bugs and security flaws.

Value Proposition

Developers choose afl.rs because it brings the powerful, coverage-guided fuzzing capabilities of AFLplusplus directly to Rust, with seamless Cargo integration and support for advanced features like IJON annotations, making it a robust tool for improving software security and stability.

Overview

🐇 Fuzzing Rust code with American Fuzzy Lop

Use Cases

Best For

Fuzzing Rust libraries for security vulnerabilities
Testing Rust applications for crash resistance
Improving code coverage in Rust projects through guided fuzzing
Integrating AFLplusplus into Rust development workflows
Using IJON annotations to guide fuzzer exploration in Rust code
Running long-term fuzzing campaigns on Rust codebases

Not Ideal For

Projects in environments without root access, as system optimization requires sudo
Rapid prototyping or simple testing where fuzzing overhead is unnecessary
Teams needing cross-platform fuzzing beyond Linux, due to AFLplusplus dependencies

Pros & Cons

Pros

Powerful AFLplusplus Integration

Leverages AFLplusplus, a modern fuzzing engine, for effective coverage-guided testing and crash detection, as highlighted in the documentation.

Seamless Cargo Workflow

Integrates with Cargo via `cargo-afl` for easy building and fuzzing, simplifying setup for Rust projects.

Enhanced Coverage with CMPLOG

Includes CMPLOG feature by default to improve code coverage during fuzzing campaigns, as noted in the README.

Advanced Fuzzer Guidance

Supports IJON annotations through Rust macros like `ijon_max` to direct fuzzer exploration, demonstrated in the maze example.

Cons

Root Access Barrier

Requires sudo for `cargo afl system-config` to optimize performance, which can be restrictive in locked-down or CI environments.

Limited CMPLOG Scaling

CMPLOG is not beneficial for more than two fuzzing instances, complicating parallel fuzzing setups as advised in the hints.

Steep Learning Curve

Demands familiarity with AFLplusplus features and system configuration, adding complexity beyond basic fuzzing.

Frequently Asked Questions

Related Projects

mockall

A powerful mock object library for Rust

Stars1,838

Forks82

Last commit5 days ago

synth

The Declarative Data Generator

Stars1,484

Forks111

Last commit1 year ago

cargo-mutants

:zombie: Inject bugs and see if your tests catch them!

Stars1,285

Forks56

Last commit15 days ago

trust

Travis CI and AppVeyor template to test your Rust crate on 5 architectures and publish binary releases of it for Linux, macOS and Windows

Stars1,275

Forks58

Last commit3 years ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub