Performing Fuzzing with AFL++

Overview

AFL++ is a community-maintained fork of American Fuzzy Lop (AFL) that provides coverage-guided fuzzing for compiled binaries. It instruments targets at compile time or via QEMU/Unicorn mode for binary-only fuzzing, then mutates input corpora to discover new code paths. AFL++ includes advanced scheduling (MOpt, rare), custom mutators, CMPLOG for input-to-state comparison solving, and persistent mode for high-throughput fuzzing.

When to Use

• When conducting security assessments that involve performing fuzzing with aflplusplus
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Common Misconfigurations & Verification

A campaign that runs for hours with zero crashes is usually a setup problem, not a secure target.

• No sanitizer, so bugs go silent: instrument with AFL_USE_ASAN=1 afl-cc (or afl-clang-fast). Without ASAN/UBSAN a heap overflow corrupts memory without crashing and AFL++ never flags it.
• Empty or trivial seed corpus: starting -i with one tiny file leaves the fuzzer unable to reach parser logic. Provide diverse valid inputs, then prune with afl-cmin, and shrink each with afl-tmin.
• No dictionary for structured formats: without -x dict/ (magic bytes, keywords, tokens) AFL++ wastes cycles guessing format headers. Supply a format dictionary.
• Single-core run wastes the box: use -M main + several -S sec1 sec2 ... secondaries to fuzz in parallel and share finds via the sync dir.
• Coverage stall ignored: map density flat and pending near zero for hours means saturation, add CMPLOG (-c), MOpt, or new seeds rather than letting it spin.