A mutation-based coverage-guided fuzzer that increases branch coverage by solving path constraints without symbolic execution.
Angora is a mutation-based coverage-guided fuzzer designed to automatically find software bugs by generating test inputs that increase branch coverage. It solves path constraints without symbolic execution, making it more efficient for exploring complex program states and uncovering vulnerabilities like crashes or memory errors.
Security researchers, software testers, and developers focused on improving software reliability through automated testing, particularly those working on binary analysis or vulnerability discovery in C/C++ programs.
Developers choose Angora for its efficient constraint-solving approach that avoids the performance pitfalls of symbolic execution, combined with taint tracking and dual-instrumentation for precise, scalable fuzzing campaigns.
Angora is a mutation-based fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Angora solves path constraints without symbolic execution, using principled search techniques to increase branch coverage efficiently, as detailed in its S&P 2018 paper and overview documentation.
Supports precise data flow analysis via DFSan or libdft64, allowing for targeted input mutations that improve bug discovery, with documented options in the README and pin mode guide.
Compiles target programs into separate .taint and .fast binaries, balancing detailed taint analysis with performance during fuzzing runs, as explained in the build and running guides.
Prioritizes branch coverage feedback to systematically explore code paths, making it effective for uncovering vulnerabilities like crashes in C/C++ software, highlighted in its key features.
Requires compiling programs into two binaries with specific instrumentation (USE_TRACK and USE_FAST), which involves multiple steps and can fail, as noted in the README with fallbacks to wllvm/gllvm.
Only supports LLVM versions 4.0.0 to 12.0.1, restricting use with newer toolchains and requiring manual installation, as specified in the build requirements.
Designed and tested solely for Linux-amd64 (e.g., Ubuntu 16.04/18.04), with no support for other operating systems, limiting its applicability in heterogeneous environments.
While comprehensive, the documentation is split across many files in the docs/ directory, requiring cross-referencing and increasing the learning curve for new users.