---------------------------
Version 2.51b (2017-08-30):
---------------------------
- Made afl-tmin call setsid to prevent glibc traceback junk from showing
up on the terminal in some distros. Suggested by Jakub Wilk.
---------------------------
Version 2.50b (2017-08-19):
---------------------------
- Fixed an interesting timing corner case spotted by Jakub Wilk.
- Addressed a libtokencap / pthreads incompatibility issue. Likewise, spotted
by Jakub Wilk.
- Added a mention of afl-kit and Pythia.
- Added AFL_FAST_CAL.
- In-place resume now preserves .synced. Suggested by Jakub Wilk.
---------------------------
Version 2.49b (2017-07-18):
---------------------------
- Added AFL_TMIN_EXACT to allow path constraint for crash minimization.
- Added dates for releases (retroactively for all of 2017).
---------------------------
Version 2.48b (2017-07-17):
---------------------------
- Added AFL_ALLOW_TMP to permit some scripts to run in /tmp.
- Fixed cwd handling in afl-analyze (similar to the quirk in afl-tmin).
- Made it possible to point -o and -f to the same file in afl-tmin.
---------------------------
Version 2.47b (2017-07-14):
---------------------------
- Fixed cwd handling in afl-tmin. Spotted by Jakub Wilk.
---------------------------
Version 2.46b (2017-07-10):
---------------------------
- libdislocator now supports AFL_LD_NO_CALLOC_OVER for folks who do not
want to abort on calloc() overflows.
- Made a minor fix to libtokencap. Reported by Daniel Stender.
- Added a small JSON dictionary, inspired on a dictionary done by Jakub Wilk.
---------------------------
Version 2.45b (2017-07-04):
---------------------------
- Added strstr, strcasestr support to libtokencap. Contributed by
Daniel Hodson.
- Fixed a resumption offset glitch spotted by Jakub Wilk.
- There are definitely no bugs in afl-showmap -c now.
--------------
Version 2.44b:
--------------
- Added a visual indicator of ASAN / MSAN mode when compiling. Requested
by Jakub Wilk.
- Added support for afl-showmap coredumps (-c). Suggested by Jakub Wilk.
- Added LD_BIND_NOW=1 for afl-showmap by default. Although not really useful,
it reportedly helps reproduce some crashes. Suggested by Jakub Wilk.
- Added a note about allocator_may_return_null=1 not always working with
ASAN. Spotted by Jakub Wilk.
Version 2.42b:
--------------
- Renamed the R() macro to avoid a problem with llvm_mode in the latest
versions of LLVM. Fix suggested by Christian Holler.
--------------
Version 2.41b:
--------------
- Addressed a major user complaint related to timeout detection. Timing out
inputs are now binned as "hangs" only if they exceed a far more generous
time limit than the one used to reject slow paths.
--------------
Version 2.40b:
--------------
- Fixed a minor oversight in the insertion strategy for dictionary words.
Spotted by Andrzej Jackowski.
- Made a small improvement to the havoc block insertion strategy.
- Adjusted color rules for "is it done yet?" indicators.
--------------
Version 2.39b:
--------------
- Improved error reporting in afl-cmin. Suggested by floyd.
- Made a minor tweak to trace-pc-guard support. Suggested by kcc.
- Added a mention of afl-monitor.
--------------
Version 2.38b:
--------------
- Added -mllvm -sanitizer-coverage-block-threshold=0 to trace-pc-guard
mode, as suggested by Kostya Serebryany.
--------------
Version 2.37b:
--------------
- Fixed a typo. Spotted by Jakub Wilk.
- Fixed support for make install when using trace-pc. Spotted by
Kurt Roeckx.
- Switched trace-pc to trace-pc-guard, which should be considerably
faster and is less quirky. Kudos to Konstantin Serebryany (and sorry
for dragging my feet).
Note that for some reason, this mode doesn't perform as well as
"vanilla" afl-clang-fast / afl-clang.
--------------
Version 2.36b:
--------------
- Fixed a cosmetic bad free() bug when aborting -S sessions. Spotted
by Johannes S.
- Made a small change to afl-whatsup to sort fuzzers by name.
- Fixed a minor issue with malloc(0) in libdislocator. Spotted by
Rene Freingruber.
- Changed the clobber pattern in libdislocator to a slightly more
reliable one. Suggested by Rene Freingruber.
- Added a note about THP performance. Suggested by Sergey Davidoff.
- Added a somewhat unofficial support for running afl-tmin with a
baseline "mask" that causes it to minimize only for edges that
are unique to the input file, but not to the "boring" baseline.
Suggested by Sami Liedes.
- "Fixed" a getPassName() problem with never versions of clang.
Reported by Craig Young and several other folks.
Yep, I know I have a backlog on several other feature requests.
Stay tuned!
--------------
Version 2.35b:
--------------
- Fixed a minor cmdline reporting glitch, spotted by Leo Barnes.
- Fixed a silly bug in libdislocator. Spotted by Johannes Schultz.
-------------------------------------------------
Version 2.34b:
--------------
- Added a note about afl-tmin to technical_details.txt.
- Added support for AFL_NO_UI, as suggested by Leo Barnes.
--------------
Version 2.33b:
--------------
- Added code to strip -Wl,-z,defs and -Wl,--no-undefined for afl-clang-fast,
since they interfere with -shared. Spotted and diagnosed by Toby Hutton.
- Added some fuzzing tips for Android.
--------------
Version 2.32b:
--------------
- Added a check for AFL_HARDEN combined with AFL_USE_*SAN. Suggested by
Hanno Boeck.
- Made several other cosmetic adjustments to cycle timing in the wake of the
big tweak made in 2.31b.
--------------
Version 2.31b:
--------------
- Changed havoc cycle counts for a marked performance boost, especially
with -S / -d. See the discussion of FidgetyAFL in:
https://groups.google.com/forum/#!topic/afl-users/fOPeb62FZUg
While this does not implement the approach proposed by the authors of
the CCS paper, the solution is a result of digging into that research;
more improvements may follow as I do more experiments and get more
definitive data.
--------------
Version 2.30b:
--------------
- Made minor improvements to persistent mode to avoid the remote
possibility of "no instrumentation detected" issues with very low
instrumentation densities.
- Fixed a minor glitch with a leftover process in persistent mode.
Reported by Jakub Wilk and Daniel Stender.
- Made persistent mode bitmaps a bit more consistent and adjusted the way
this is shown in the UI, especially in persistent mode.
--------------
Version 2.29b:
--------------
- Made a minor #include fix to llvm_mode. Suggested by Jonathan Metzman.
- Made cosmetic updates to the docs.
--------------
Version 2.28b:
--------------
- Added "life pro tips" to docs/.
- Moved testcases/_extras/ to dictionaries/ for visibility.
- Made minor improvements to install scripts.
- Added an important safety tip.
--------------
Version 2.27b:
--------------
- Added libtokencap, a simple feature to intercept strcmp / memcmp and
generate dictionary entries that can help extend coverage.
- Moved libdislocator to its own dir, added README.
- The demo in experimental/instrumented_cmp is no more.
--------------
Version 2.26b:
--------------
- Made a fix for libdislocator.so to compile on MacOS X.
- Added support for DYLD_INSERT_LIBRARIES.
- Renamed AFL_LD_PRELOAD to AFL_PRELOAD.
--------------
Version 2.25b:
--------------
- Made some cosmetic updates to libdislocator.so, renamed one env
variable.
--------------
Version 2.24b:
--------------
- Added libdislocator.so, an experimental, abusive allocator. Try
it out with AFL_LD_PRELOAD=/path/to/libdislocator.so when running
afl-fuzz.
--------------
Version 2.23b:
--------------
- Improved the stability metric for persistent mode binaries. Problem
spotted by Kurt Roeckx.
- Made a related improvement that may bring the metric to 100% for those
targets.
--------------
Version 2.22b:
--------------
- Mentioned the potential conflicts between MSAN / ASAN and FORTIFY_SOURCE.
There is no automated check for this, since some distros may implicitly
set FORTIFY_SOURCE outside of the compiler's argv[].
- Populated the support for AFL_LD_PRELOAD to all companion tools.
- Made a change to the handling of ./afl-clang-fast -v. Spotted by
Jan Kneschke.
--------------
Version 2.21b:
--------------
- Added some crash reporting notes for Solaris in docs/INSTALL, as
investigated by Martin Carpenter.
- Fixed a minor UI mix-up with havoc strategy stats.
--------------
Version 2.20b:
--------------
- Revamped the handling of variable paths, replacing path count with a
"stability" score to give users a much better signal. Based on the
feedback from Vegard Nossum.
- Made a stability improvement to the syncing behavior with resuming
fuzzers. Based on the feedback from Vegard.
- Changed the UI to include current input bitmap density along with
total density. Ditto.
- Added experimental support for parallelizing -M.
The lowest currently recommended version is 2.18b.
--------------
Version 2.18b:
--------------
- Made several performance improvements to has_new_bits() and
classify_counts(). This should offer a robust performance bump with
fast targets.
--------------
Version 2.17b:
--------------
- Killed the error-prone and manual -Z option. On Linux, AFL will now
automatically bind to the first free core (or complain if there are no
free cores left).
- Made some doc updates along these lines.
--------------
Version 2.16b:
--------------
- Improved support for older versions of clang (hopefully without
breaking anything).
- Moved version data from Makefile to config.h. Suggested by
Jonathan Metzman.
--------------
Version 2.15b:
--------------
- Added a README section on looking for non-crashing bugs.
- Added license data to several boring files. Contributed by
Jonathan Metzman.
--------------
Version 2.14b:
--------------
- Added FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION as a macro defined when
compiling with afl-gcc and friends. Suggested by Kostya Serebryany.
- Refreshed some of the non-x86 docs.
--------------
Version 2.13b:
--------------
- Fixed a spurious build test error with trace-pc and llvm_mode/Makefile.
Spotted by Markus Teufelberger.
- Fixed a cosmetic issue with afl-whatsup. Spotted by Brandon Perry.
--------------
Version 2.12b:
--------------
- Fixed a minor issue in afl-tmin that can make alphabet minimization less
efficient during passes > 1. Spotted by Daniel Binderman.
--------------
Version 2.11b:
--------------
- Fixed a minor typo in instrumented_cmp, spotted by Hanno Eissfeldt.
- Added a missing size check for deterministic insertion steps.
- Made an improvement to afl-gotcpu when -Z not used.
- Fixed a typo in post_library_png.so.c in experimental/. Spotted by Kostya
Serebryany.
--------------
Version 2.10b:
--------------
- Fixed a minor core counting glitch, reported by Tyler Nighswander.
--------------
Version 2.09b:
--------------
- Made several documentation updates.
- Added some visual indicators to promote and simplify the use of -Z.
--------------
Version 2.08b:
--------------
- Added explicit support for -m32 and -m64 for llvm_mode. Inspired by
a request from Christian Holler.
- Added a new benchmarking option, as requested by Kostya Serebryany.
--------------
Version 2.07b:
--------------
- Added CPU affinity option (-Z) on Linux. With some caution, this can
offer a significant (10%+) performance bump and reduce jitter.
Proposed by Austin Seipp.
- Updated afl-gotcpu to use CPU affinity where supported.
- Fixed confusing CPU_TARGET error messages with QEMU build. Spotted by
Daniel Komaromy and others.
--------------
Version 2.06b:
--------------
- Worked around LLVM persistent mode hiccups with -shared code.
Contributed by Christian Holler.
- Added __AFL_COMPILER as a convenient way to detect that something is
built under afl-gcc / afl-clang / afl-clang-fast and enable custom
optimizations in your code. Suggested by Pedro Corte-Real.
- Upstreamed several minor changes developed by Franjo Ivancic to
allow AFL to be built as a library. This is fairly use-specific and
may have relatively little appeal to general audiences.
--------------
Version 2.05b:
--------------
- Put __sanitizer_cov_module_init & co behind #ifdef to avoid problems
with ASAN. Spotted by Christian Holler.
--------------
Version 2.04b:
--------------
- Removed indirect-calls coverage from -fsanitize-coverage (since it's
redundant). Spotted by Kostya Serebryany.
--------------
Version 2.03b:
--------------
- Added experimental -fsanitize-coverage=trace-pc support that goes with
some recent additions to LLVM, as implemented by Kostya Serebryany.
Right now, this is cumbersome to use with common build systems, so
the mode remains undocumented.
- Made several substantial improvements to better support non-standard
map sizes in LLVM mode.
- Switched LLVM mode to thread-local execution tracing, which may offer
better results in some multithreaded apps.
- Fixed a minor typo, reported by Heiko Eissfeldt.
- Force-disabled symbolization for ASAN, as suggested by Christian Holler.
- AFL_NOX86 renamed to AFL_NO_X86 for consistency.
- Added AFL_LD_PRELOAD to allow LD_PRELOAD to be set for targets without
affecting AFL itself. Suggested by Daniel Godas-Lopez.
--------------
Version 2.02b:
--------------
- Fixed a "lcamtuf can't count to 16" bug in the havoc stage. Reported
by Guillaume Endignoux.
--------------
Version 2.01b:
--------------
- Made an improvement to cycle counter color coding, based on feedback
from Shai Sarfaty.
- Added a mention of aflize to sister_projects.txt.
- Fixed an installation issue with afl-as, as spotted by ilovezfs.
--------------
Version 2.00b:
--------------
- Cleaned up color handling after a minor snafu in 1.99b (affecting some
terminals).
- Made minor updates to the documentation.
--------------
Version 1.99b:
--------------
- Substantially revamped the output and the internal logic of afl-analyze.
- Cleaned up some of the color handling code and added support for
background colors.
- Removed some stray files (oops).
- Updated docs to better explain afl-analyze.
--------------
Version 1.98b:
--------------
- Improved to "boring string" detection in afl-analyze.
- Added technical_details.txt for afl-analyze.
--------------
Version 1.97b:
--------------
- Added afl-analyze, a nifty tool to analyze the structure of a file
based on the feedback from AFL instrumentation. This is kinda experimental,
so field reports welcome.
- Added a mention of afl-cygwin.
- Fixed a couple of typos, as reported by Jakub Wilk and others.
--------------
Version 1.96b:
--------------
- Added -fpic to CFLAGS for the clang plugin, as suggested by Hanno Boeck.
- Made another clang change (IRBuilder) suggested by Jeff Trull.
- Fixed several typos, spotted by Jakub Wilk.
- Added support for AFL_SHUFFLE_QUEUE, based on discussions with
Christian Holler.
--------------
Version 1.95b:
--------------
- Fixed a harmless bug when handling -B. Spotted by Jacek Wielemborek.
- Made the exit message a bit more accurate when AFL_EXIT_WHEN_DONE is set.
- Added some error-checking for old-style forkserver syntax. Suggested by
Ben Nagy.
- Switched from exit() to _exit() in injected code to avoid snafus with
destructors in C++ code. Spotted by sunblate.
- Made a change to avoid spuriously setting __AFL_SHM_ID when
AFL_DUMB_FORKSRV is set in conjunction with -n. Spotted by Jakub Wilk.
Issues found with existing distfiles:
distfiles/eclipse-sourceBuild-srcIncluded-3.0.1.zip
distfiles/fortran-utils-1.1.tar.gz
distfiles/ivykis-0.39.tar.gz
distfiles/enum-1.11.tar.gz
distfiles/pvs-3.2-libraries.tgz
distfiles/pvs-3.2-linux.tgz
distfiles/pvs-3.2-solaris.tgz
distfiles/pvs-3.2-system.tgz
No changes made to these distinfo files.
Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden). All existing
SHA1 digests retained for now as an audit trail.
--------------
Version 1.94b:
--------------
- Changed allocator alignment to improve support for non-x86 systems (now
that llvm_mode makes this more feasible).
- Fixed a minor typo in afl-cmin. Spotted by Jonathan Neuschafer.
- Fixed an obscure bug that would affect people trying to use afl-gcc
with $TMP set but $TMPDIR absent. Spotted by Jeremy Barnes.
--------------
Version 1.93b:
--------------
- Hopefully fixed a problem with MacOS X and persistent mode, spotted by
Leo Barnes.
--------------
Version 1.92b:
--------------
- Yet another C++ fix (namespaces). Reported by Daniel Lockyer.
--------------
Version 1.91b:
--------------
- Another fix to make 1.90b actually work properly with C++ (d'oh).
Problem spotted by Daniel Lockyer.
--------------
Version 1.90b:
--------------
- Fixed a minor typo spotted by Kai Zhao; and made several other minor updates
to docs.
- Updated the project URL for python-afl. Requested by Jakub Wilk.
- Fixed a potential problem with deferred mode signatures getting optimized
out by the linker (with --gc-sections).
--------------
Version 1.89b:
--------------
- Revamped the support for persistent and deferred forkserver modes.
Both now feature simpler syntax and do not require companion env
variables. Suggested by Jakub Wilk.
- Added a bit more info about afl-showmap. Suggested by Jacek Wielemborek.
--------------
Version 1.88b:
--------------
- Made AFL_EXIT_WHEN_DONE work in non-tty mode. Issue spotted by
Jacek Wielemborek.
--------------
Version 1.87b:
--------------
- Added QuickStartGuide.txt, a one-page quick start doc.
- Fixed several typos spotted by Dominique Pelle.
- Revamped several parts of README.
--------------
Version 1.86b:
--------------
- Added support for AFL_SKIP_CRASHES, which is a very hackish solution to
the problem of resuming sessions with intermittently crashing inputs.
- Removed the hard-fail terminal size check, replaced with a dynamic
warning shown in place of the UI. Based on feedback from Christian Holler.
- Fixed a minor typo in show_stats. Spotted by Dingbao Xie.
--------------
Version 1.85b:
--------------
- Fixed a garbled sentence in notes on parallel fuzzing. Thanks to Jakub Wilk.
- Fixed a minor glitch in afl-cmin. Spotted by Jonathan Foote.
--------------
Version 1.84b:
--------------
- Made SIMPLE_FILES behave as expected when naming backup directories for
crashes and hangs.
- Added the total number of favored paths to fuzzer_stats. Requested by
Ben Nagy.
- Made afl-tmin, afl-fuzz, and afl-cmin reject negative values passed to
-t and -m, since they generally won't work as expected.
- Made a fix for no lahf / sahf support on older versions of FreeBSD.
Patch contributed by Alex Moneger.
--------------
Version 1.83b:
--------------
- Fixed a problem with xargs -d on non-Linux systems in afl-cmin. Spotted by
teor2345 and Ben Nagy.
- Fixed an implicit declaration in LLVM mode on MacOS X. Reported by
Kai Zhao.
Version 1.82b:
--------------
- Fixed a harmless but annoying race condition in persistent mode - signal
delivery is a bit more finicky than I thought.
- Updated the documentation to explain persistent mode a bit better.
- Tweaked AFL_PERSISTENT to force AFL_NO_VAR_CHECK.
--------------
Version 1.81b:
--------------
- Added persistent mode for in-process fuzzing. See llvm_mode/README.llvm.
Inspired by Kostya Serebryany and Christian Holler.
- Changed the in-place resume code to preserve crashes/README.txt. Suggested
by Ben Nagy.
- Included a potential fix for LLVM mode issues on MacOS X, based on the
investigation done by teor2345.
--------------
Version 1.80b:
--------------
- Made afl-cmin tolerant of whitespaces in filenames. Suggested by
Jonathan Neuschafer and Ketil Froyn.
- Added support for AFL_EXIT_WHEN_DONE, as suggested by Michael Rash.
--------------
Version 1.79b:
--------------
- Added support for dictionary levels, see testcases/README.testcases.
- Reworked the SQL dictionary to use levels.
- Added a note about Preeny.
--------------
Version 1.78b:
--------------
- Added a dictionary for PDF, contributed by Ben Nagy.
- Added several references to afl-cov, a new tool by Michael Rash.
- Fixed a problem with crash reporter detection on MacOS X, as reported by
Louis Dassy.
--------------
Version 1.77b:
--------------
- Extended the -x option to support single-file dictionaries.
- Replaced factory-packaged dictionaries with file-based variants.
- Removed newlines from HTML keywords in testcases/_extras/html/.
--------------
Version 1.76b:
--------------
- Very significantly reduced the number of duplicate execs during
deterministic checks, chiefly in int16 and int32 stages. Confirmed
identical path yields. This should improve early-stage efficiency by
around 5-10%.
- Reduced the likelihood of duplicate non-deterministic execs by
bumping up lowest stacking factor from 1 to 2. Quickly confirmed
that this doesn't seem to have significant impact on coverage with
libpng.
- Added a note about integrating afl-fuzz with third-party tools.
--------------
Version 1.75b:
--------------
- Improved argv_fuzzing to allow it to emit empty args. Spotted by Jakub
Wilk.
- afl-clang-fast now defines __AFL_HAVE_MANUAL_INIT. Suggested by Jakub Wilk.
- Fixed a libtool-related bug with afl-clang-fast that would make some
./configure invocations generate incorrect output. Spotted by Jakub Wilk.
- Removed flock() on Solaris. This means no locking on this platform,
but so be it. Problem reported by Martin Carpenter.
- Fixed a typo. Reported by Jakub Wilk.
--------------
Version 1.74b:
--------------
- Added an example argv[] fuzzing wrapper in experimental/argv_fuzzing.
Reworked the bash example to be faster, too.
- Clarified llvm_mode prerequisites for FreeBSD.
- Improved afl-tmin to use /tmp if cwd is not writeable.
- Removed redundant includes for sys/fcntl.h, which caused warnings with
some nitpicky versions of libc.
- Added a corpus of basic HTML tags that parsers are likely to pay attention
to (no attributes).
- Added EP_EnabledOnOptLevel0 to llvm_mode, so that the instrumentation is
inserted even when AFL_DONT_OPTIMIZE=1 is set.
- Switched qemu_mode to use the newly-released QEMU 2.3.0, which contains
a couple of minor bugfixes.
--------------
Version 1.73b:
--------------
- Fixed a pretty stupid bug in effector maps that could sometimes cause
AFL to fuzz slightly more than necessary; and in very rare circumstances,
could lead to SEGV if eff_map is aligned with page boundary and followed
by an unmapped page. Spotted by Jonathan Gray.
--------------
Version 1.72b:
--------------
- Fixed a glitch in non-x86 install, spotted by Tobias Ospelt.
- Added a minor safeguard to llvm_mode Makefile following a report from
Kai Zhao.
--------------
Version 1.71b:
--------------
- Fixed a bug with installed copies of AFL trying to use QEMU mode. Spotted
by G.M. Lime.
- Added last path / crash / hang times to fuzzer_stats, suggested by
Richard Hipp.
- Fixed a typo, thanks to Jakub Wilk.
--------------
Version 1.70b:
--------------
- Modified resumption code to reuse the original timeout value when resuming
a session if -t is not given. This prevents timeout creep in continuous
fuzzing.
- Added improved error messages for failed handshake when AFL_DEFER_FORKSRV
is set.
- Made a slight improvement to llvm_mode/Makefile based on feedback from
Jakub Wilk.
- Refreshed several bits of documentation.
- Added a more prominent note about the MacOS X trade-offs to Makefile.
--------------
Version 1.69b:
--------------
- Added support for deferred initialization in LLVM mode. Suggested by
Richard Godbee.
--------------
Version 1.68b:
--------------
- Fixed a minor PRNG glitch that would make the first seconds of a fuzzing
job deterministic. Thanks to Andreas Stieger.
- Made tmp[] static in the LLVM runtime to keep Valgrind happy (this had
no impact on anything else). Spotted by Richard Godbee.
- Clarified the footnote in README.
--------------
Version 1.67b:
--------------
- Made one more correction to llvm_mode Makefile, spotted by Jakub Wilk.
--------------
Version 1.66b:
--------------
- Added CC / CXX support to llvm_mode Makefile. Requested by Charlie Eriksen.
- Fixed 'make clean' with gmake. Suggested by Oliver Schneider.
- Fixed 'make -j n clean all'. Suggested by Oliver Schneider.
- Removed build date and time from banners to give people deterministic
builds. Requested by Jakub Wilk.
--------------
Version 1.65b:
--------------
- Fixed a snafu with some leftover code in afl-clang-fast.
- Corrected even moar typos.
--------------
Version 1.64b:
--------------
- Further simplified afl-clang-fast runtime by reverting .init_array to
__attribute__((constructor(0)). This should improve compatibility with
non-ELF platforms.
- Fixed a problem with afl-clang-fast and -shared libraries. Simplified
the code by getting rid of .preinit_array and replacing it with a .comm
object. Problem reported by Charlie Eriksen.
- Removed unnecessary instrumentation density adjustment for the LLVM mode.
Reported by Jonathan Neuschafer.
--------------
Version 1.63b:
--------------
- Updated cgroups_asan/ with a new version from Sam, made a couple changes
to streamline it and keep parallel afl instances in separate groups.
- Fixed typos, thanks to Jakub Wilk.
--------------
Version 1.62b:
--------------
- Improved the handling of -x in afl-clang-fast,
- Improved the handling of low AFL_INST_RATIO settings for QEMU and
LLVM modes.
- Fixed the llvm-config bug for good (thanks to Tobias Ospelt).
--------------
Version 1.61b:
--------------
- Fixed an obscure bug compiling OpenSSL with afl-clang-fast. Patch by
Laszlo Szekeres.
- Fixed a 'make install' bug on non-x86 systems, thanks to Tobias Ospelt.
- Fixed a problem with half-broken llvm-config on Odroid, thanks to
Tobias Ospelt. (There is another odd bug there that hasn't been fully
fixed - TBD).
--------------
Version 1.60b:
--------------
- Allowed experimental/llvm_instrumentation/ to graduate to llvm_mode/.
- Removed experimental/arm_support/, since it's completely broken and likely
unnecessary with LLVM support in place.
- Added ASAN cgroups script to experimental/asan_cgroups/, updated existing
docs. Courtesy Sam Hakim and David A. Wheeler.
- Refactored afl-tmin to reduce the number of execs in common use cases.
Ideas from Jonathan Neuschafer and Turo Lamminen.
- Added a note about CLAs at the bottom of README.
- Renamed testcases_readme.txt to README.testcases for some semblance of
consistency.
- Made assorted updates to docs.
- Added MEM_BARRIER() to afl-showmap and afl-tmin, just t be safe.
--------------
Version 1.59b:
--------------
- Imported Laszlo Szekeres' experimental LLVM instrumentation into
experimental/llvm_instrumentation. I'll work on including it in the
"mainstream" version soon.
- Fixed another typo, thanks to Jakub Wilk.
Version 1.58b:
--------------
- Added a workaround for abort() behavior in -lpthread programs in QEMU mode.
Spotted by Aidan Thornton.
- Made several documentation updates, including links to the static
instrumentation tool (sister_projects.txt).
--------------
Version 1.57b:
--------------
- Fixed a problem with exception handling on some versions of MacOS X.
Spotted by Samir Aguiar and Anders Wang Kristensen.
- Tweaked afl-gcc to use BIN_PATH instead of a fixed string in help
messages.
--------------
Version 1.56b:
--------------
- Renamed related_work.txt to historical_notes.txt.
- Made minor edits to the ASAN doc.
- Added docs/sister_projects.txt with a list of inspired or closely
related utilities.
--------------
Version 1.55b:
--------------
- Fixed a glitch with afl-showmap opening /dev/null with O_RDONLY when
running in quiet mode. Spotted by Tyler Nighswander.
--------------
Version 1.54b:
--------------
- Added another postprocessor example for PNG.
- Made a cosmetic fix to realloc() handling in experimental/post_library/,
suggested by Jakub Wilk.
- Improved -ldl handling. Suggested by Jakub Wilk.
--------------
Version 1.53b:
--------------
- Fixed an -l ordering issue that is apparently still a problem on Ubuntu.
Spotted by William Robinet.
--------------
Version 1.52b:
--------------
- Added support for file format postprocessors. Requested by Ben Nagy. This
feature is intentionally buried, since it's fairly easy to misuse and
useful only in some scenarios. See experimental/post_library/.
--------------
Version 1.51b:
--------------
- Made it possible to properly override LD_BIND_NOW after one very unusual
report of trouble.
- Cleaned up typos, thanks to Jakub Wilk.
- Fixed a bug in AFL_DUMB_FORKSRV.
--------------
Version 1.50b:
--------------
- Fixed a flock() bug that would prevent dir reuse errors from kicking
in every now and then.
- Renamed references to ppvm (the project is now called recidivm).
- Fixed a typo or two.
- Made improvements to file descriptor handling.
--------------
Version 1.49b:
--------------
- Added code save original command line in fuzzer_stats and
crashes/README.txt. Also saves fuzzer version in fuzzer_Stats.
Requested by Ben Nagy.
--------------
Version 1.48b:
--------------
- Fixed a bug with QEMU fork server crashes when translation is attempted
after a jump to an invalid pointer. Reported by Tyler Nighswander.
--------------
Version 1.47b:
--------------
- Fixed a bug with afl-cmin in -Q mode complaining about binary being not
instrumented. Thanks to Jonathan Neuschafer for the bug report.
- Fixed another bug with argv handling for afl-fuzz in -Q mode. Reported
by Jonathan Neuschafer.
- Improved the use of colors when showing crash counts in -C mode.
--------------
Version 1.46b:
--------------
- Improved instrumentation performance on 32-bit systems by getting rid of
xor-swap (oddly enough, xor-swap is still faster on 64-bit) and tweaking
alignment.
- Made path depth numbers more accurate with imported test cases.
--------------
Version 1.45b:
--------------
- Added support for SIMPLE_FILES in config.h for folks who don't like
descriptive file names. Generates very simple names without colons,
commas, plus signs, dashes, etc.
- Replaced zero-sized files with symlinks in the variable behavior state
dir to simplify examining the relevant test cases.
- Changed the period of limited-range block ops from 5 to 10 minutes based
on a couple of experiments. The basic goal of this delay timer behavior
is to better support jobs that are seeded with completely invalid files,
in which case, the first few queue cycles may be completed very quickly
without discovering new paths. Should have no effect on well-seeded jobs.
- Made several minor updates to docs.
--------------
Version 1.44b:
--------------
- Corrected two bungled attempts to get the -C mode work properly
with afl-cmin (accounting for the short-lived releases tagged 1.42 and
1.43b) - sorry.
- Removed AFL_ALLOW_CRASHES in favor of the -C mode in said tool.
- Said goodbye to Hello Kitty, as requested by Padraig Brady.
--------------
Version 1.41b:
--------------
- Added AFL_ALLOW_CRASHES=1 to afl-cmin. Allows crashing inputs in the
output corpus. Changed the default behavior to disallow it.
- Made the afl-cmin output dir default to 0700, not 0755, to be consistent
with afl-fuzz; documented the rationale for 0755 in afl-plot.
- Lowered the output dir reuse time limit to 25 minutes as a dice-roll
compromise after a discussion on afl-users@.
- Made afl-showmap accept -o /dev/null without borking out.
- Added support for crash / hang info in exit codes of afl-showmap.
- Tweaked block operation scaling to also factor in ballpark run time
in cases where queue passes take very little time.
- Fixed typos and made improvements to several docs.
--------------
Version 1.40b:
--------------
- Switched to smaller block op sizes during the first passes over the
queue. Helps keep test cases small.
- Added memory barrier for run_target(), just in case compilers get
smarter than they are today.
- Updated a bunch of docs.
--------------
Version 1.39b:
--------------
- Added the ability to skip inputs by sending SIGUSR1 to the fuzzer.
- Reworked several portions of the documentation.
- Changed the code to reset splicing perf scores between runs to keep
them closer to intended length.
- Reduced the minimum value of -t to 5 for afl-fuzz (~200 exec/sec)
and to 10 for auxiliary tools (due to the absence of a fork server).
- Switched to more aggressive default timeouts (rounded up to 25 ms
versus 50 ms - ~40 execs/sec) and made several other cosmetic changes
to the timeout code.
--------------
Version 1.38b:
--------------
- Fixed a bug in the QEMU build script, spotted by William Robinet.
- Improved the reporting of skipped bitflips to keep the UI counters a bit
more accurate.
- Cleaned up related_work.txt and added some non-goals.
- Fixed typos, thanks to Jakub Wilk.
--------------
Version 1.37b:
--------------
- Added effector maps, which detect regions that do not seem to respond
to bitflips and subsequently exclude them from more expensive steps
(arithmetics, known ints, etc). This should offer significant performance
improvements with quite a few types of text-based formats, reducing the
number of deterministic execs by a factor of 2 or so.
- Cleaned up mem limit handling in afl-cmin.
- Switched from uname -i to uname -m to work around Gentoo-specific
issues with coreutils when building QEMU. Reported by William Robinet.
- Switched from PID checking to flock() to detect running sessions.
Problem, against all odds, bumped into by Jakub Wilk.
- Added SKIP_COUNTS and changed the behavior of COVERAGE_ONLY in config.h.
Useful only for internal benchmarking.
- Made improvements to UI refresh rates and exec/sec stats to make them
more stable.
- Made assorted improvements to the documentation and to the QEMU build
script.
- Switched from perror() to strerror() in error macros, thanks to Jakub
Wilk for the nag.
- Moved afl-cmin back to bash, wasn't thinking straight. It has to stay
on bash because other shells may have restrictive limits on array sizes.
--------------
Version 1.36b:
--------------
- Switched afl-cmin over to /bin/sh. Thanks to Jonathan Gray.
- Fixed an off-by-one bug in queue limit check when resuming sessions
(could cause NULL ptr deref if you are *really* unlucky).
- Fixed the QEMU script to tolerate i686 if returned by uname -i. Based on
a problem report from Sebastien Duquette.
- Added multiple references to Jakub's ppvm tool.
- Made several minor improvements to the Makefile.
- Believe it or not, fixed some typos. Thanks to Jakub Wilk.
--------------
Version 1.35b:
--------------
- Cleaned up regular expressions in some of the scripts to avoid errors
on *BSD systems. Spotted by Jonathan Gray.
--------------
Version 1.34b:
--------------
- Performed a substantial documentation and program output cleanup to
better explain the QEMU feature.
--------------
Version 1.33b:
--------------
- Added support for AFL_INST_RATIO and AFL_INST_LIBS in the QEMU mode.
- Fixed a stack allocation crash in QEMU mode (bug in QEMU, fixed with
an extra patch applied to the downloaded release).
- Added code to test the QEMU instrumentation once the afl-qemu-trace
binary is built.
- Modified afl-tmin and afl-showmap to search $PATH for binaries and to
better handle QEMU support.
- Added a check for instrumented binaries when passing -Q to afl-fuzz.
--------------
Version 1.32b:
--------------
- Fixed 'make install' following the QEMU changes. Spotted by Hanno Boeck.
- Fixed EXTRA_PAR handling in afl-cmin.
--------------
Version 1.31b:
--------------
- Hallelujah! Thanks to Andrew Griffiths, we now support very fast, black-box
instrumentation of binary-only code. See qemu_mode/README.qemu.
To use this feature, you need to follow the instructions in that
directory and then run afl-fuzz with -Q.
--------------
Version 1.30b:
--------------
- Added -s (summary) option to afl-whatsup. Suggested by Jodie Cunningham.
- Added a sanity check in afl-tmin to detect minimization to zero len or
excess hangs.
- Fixed alphabet size counter in afl-tmin.
- Slightly improved the handling of -B in afl-fuzz.
- Fixed process crash messages with -m none.
--------------
Version 1.29b:
--------------
- Improved the naming of test cases when orig: is already present in the file
name.
- Made substantial improvements to technical_details.txt.
--------------
Version 1.28b:
--------------
- Made a minor tweak to the instrumentation to preserve the directionality
of tuples (i.e., A -> B != B -> A) and to maintain the identity of tight
loops (A -> A). You need to recompile targeted binaries to leverage this.
- Cleaned up some of the afl-whatsup stats.
- Added several sanity checks to afl-cmin.
--------------
Version 1.27b:
--------------
- Made afl-tmin recursive. Thanks to Hanno Boeck for the tip.
- Added docs/technical_details.txt.
- Changed afl-showmap search strategy in afl-cmap to just look into the
same place that afl-cmin is executed from. Thanks to Jakub Wilk.
- Removed current_todo.txt and cleaned up the remaining docs.
