--------------
Version 1.36b:
--------------
- Switched afl-cmin over to /bin/sh. Thanks to Jonathan Gray.
- Fixed an off-by-one bug in queue limit check when resuming sessions
(could cause NULL ptr deref if you are *really* unlucky).
- Fixed the QEMU script to tolerate i686 if returned by uname -i. Based on
a problem report from Sebastien Duquette.
- Added multiple references to Jakub's ppvm tool.
- Made several minor improvements to the Makefile.
- Believe it or not, fixed some typos. Thanks to Jakub Wilk.
--------------
Version 1.35b:
--------------
- Cleaned up regular expressions in some of the scripts to avoid errors
on *BSD systems. Spotted by Jonathan Gray.
--------------
Version 1.34b:
--------------
- Performed a substantial documentation and program output cleanup to
better explain the QEMU feature.
--------------
Version 1.33b:
--------------
- Added support for AFL_INST_RATIO and AFL_INST_LIBS in the QEMU mode.
- Fixed a stack allocation crash in QEMU mode (bug in QEMU, fixed with
an extra patch applied to the downloaded release).
- Added code to test the QEMU instrumentation once the afl-qemu-trace
binary is built.
- Modified afl-tmin and afl-showmap to search $PATH for binaries and to
better handle QEMU support.
- Added a check for instrumented binaries when passing -Q to afl-fuzz.
--------------
Version 1.32b:
--------------
- Fixed 'make install' following the QEMU changes. Spotted by Hanno Boeck.
- Fixed EXTRA_PAR handling in afl-cmin.
--------------
Version 1.31b:
--------------
- Hallelujah! Thanks to Andrew Griffiths, we now support very fast, black-box
instrumentation of binary-only code. See qemu_mode/README.qemu.
To use this feature, you need to follow the instructions in that
directory and then run afl-fuzz with -Q.
--------------
Version 1.30b:
--------------
- Added -s (summary) option to afl-whatsup. Suggested by Jodie Cunningham.
- Added a sanity check in afl-tmin to detect minimization to zero len or
excess hangs.
- Fixed alphabet size counter in afl-tmin.
- Slightly improved the handling of -B in afl-fuzz.
- Fixed process crash messages with -m none.
--------------
Version 1.29b:
--------------
- Improved the naming of test cases when orig: is already present in the file
name.
- Made substantial improvements to technical_details.txt.
--------------
Version 1.28b:
--------------
- Made a minor tweak to the instrumentation to preserve the directionality
of tuples (i.e., A -> B != B -> A) and to maintain the identity of tight
loops (A -> A). You need to recompile targeted binaries to leverage this.
- Cleaned up some of the afl-whatsup stats.
- Added several sanity checks to afl-cmin.
--------------
Version 1.27b:
--------------
- Made afl-tmin recursive. Thanks to Hanno Boeck for the tip.
- Added docs/technical_details.txt.
- Changed afl-showmap search strategy in afl-cmap to just look into the
same place that afl-cmin is executed from. Thanks to Jakub Wilk.
- Removed current_todo.txt and cleaned up the remaining docs.
--------------
Version 1.26b:
--------------
- Added total execs/sec stat for afl-whatsup.
- afl-cmin now auto-selects between cp or ln. Based on feedback from
Even Huus.
- Fixed a typo. Thanks to Jakub Wilk.
- Made afl-gotcpu a bit more accurate by using getrusage instead of
times. Thanks to Jakub Wilk.
- Fixed a memory limit issue during the build process on NetBSD-current.
Reported by Thomas Klausner.
--------------
Version 1.25b:
--------------
- Introduced afl-whatsup, a simple tool for querying the status of
local synced instances of afl-fuzz.
- Added -x compiler to clang options on Darwin. Suggested by Filipe
Cabecinhas.
- Improved exit codes for afl-gotcpu.
- Improved the checks for -m and -t values in afl-cmin. Bug report
from Evan Huus.
--------------
Version 1.24b:
--------------
- Introduced afl-getcpu, an experimental tool to empirically measure
CPU preemption rates. Thanks to Jakub Wilk for the idea.
--------------
Version 1.23b:
--------------
- Reverted one change to afl-cmin that actually made it slower.
--------------
Version 1.22b:
--------------
- Reworked afl-showmap.c to support normal options, including -o, -q,
-e. Also added support for timeouts and memory limits.
- Made changes to afl-cmin and other scripts to accommodate the new
semantics.
- Officially retired AFL_EDGES_ONLY.
- Fixed another typo in afl-tmin, courtesy of Jakub Wilk.
--------------
Version 1.21b:
--------------
- Graduated minimize_corpus.sh to afl-cmin. It is now a first-class
utility bundled with the fuzzer.
- Made significant improvements to afl-cmin to make it faster, more
robust, and more versatile.
- Refactored some of afl-tmin code to make it a bit more readable.
- Made assorted changes to the doc to document afl-cmin and other stuff.
--------------
Version 1.20b:
--------------
- Added AFL_DUMB_FORKSRV, as requested by Jakub Wilk. This works only
in -n mode and allows afl-fuzz to run with "dummy" fork servers that
don't output any instrumentation, but follow the same protocol.
- Renamed AFL_SKIP_CHECKS to AFL_SKIP_BIN_CHECK to make it at least
somewhat descriptive.
- Switched to using clang as the default assembler on MacOS X to work
around Xcode issues with newer builds of clang. Testing and patch by
Nico Weber.
- Fixed a typo (via Jakub Wilk).
--------------
Version 1.19b:
--------------
- Improved exec failure detection in afl-fuzz and afl-showmap.
- Improved Ctrl-C handling in afl-showmap.
- Added afl-tmin, a handy instrumentation-enabled minimizer.
--------------
Version 1.18b:
--------------
- Fixed a serious but short-lived bug in the resumption behavior introduced
in version 1.16b.
- Added -t nn+ mode for soft-skipping timing-out paths.
--------------
Version 1.17b:
--------------
- Fixed a compiler warning introduced in 1.16b for newer versions of GCC.
Thanks to Jakub Wilk and Ilfak Guilfanov.
- Improved the consistency of saving fuzzer_stats, bitmap info, and
auto-dictionaries when aborting fuzzing sessions.
- Made several noticeable performance improvements to deterministic arith
and known int steps.
--------------
Version 1.16b:
--------------
- Added a bit of code to make resumption pick up from the last known
offset in the queue, rather than always rewinding to the start. Suggested
by Jakub Wilk.
- Switched to tighter timeout control for slow programs (3x rather than
5x average exec speed at init).
--------------
Version 1.15b:
--------------
- Added support for AFL_NO_VAR_CHECK to speed up resumption and inhibit
variable path warnings for some programs.
- Made the trimmer run even for variable paths, since there is no special
harm in doing so and it can be very beneficial if the trimming still
pans out.
- Made the UI a bit more descriptive by adding "n/a" instead of "0" in a
couple of corner cases.
--------------
Version 1.14b:
--------------
- Added a (partial) dictionary for JavaScript.
- Added AFL_NO_CPU_RED, as suggested by Jakub Wilk.
- Tweaked the havoc scaling logic added in 1.12b.
--------------
Version 1.13b:
--------------
- Improved the performance of minimize_corpus.sh by switching to a
sort-based approach.
- Made several minor revisions to the docs.
--------------
Version 1.12b:
--------------
- Made an improvement to dictionary generation to avoid runs of identical
bytes.
- Added havoc cycle scaling to help with slow binaries in -d mode. Based on
a thread with Sami Liedes.
- Added AFL_SYNC_FIRST for afl-fuzz. This is useful for those who obsess
over stats, no special purpose otherwise.
- Switched to more robust box drawing codes, suggested by Jakub Wilk.
- Created faster 64-bit variants of several critical-path bitmap functions
(sorry, no difference on 32 bits).
- Fixed moar typos, as reported by Jakub Wilk.
--------------
Version 1.11b:
--------------
- Added a bit more info about dictionary strategies to the status screen.
--------------
Version 1.10b:
--------------
- Revised the dictionary behavior to use insertion and overwrite in
deterministic steps, rather than just the latter. This improves coverage
with SQL and the like.
- Added a mention of "*" in status_screen.txt, as suggested by Jakub Wilk.
--------------
Version 1.09b:
--------------
- Corrected a cosmetic problem with 'extras' stage count not always being
accurate in the stage yields view.
- Fixed a typo reported by Jakub Wilk and made some minor documentation
improvements.
--------------
Version 1.08b:
--------------
- Fixed a div-by-zero bug in the newly-added code when using a dictionary.
--------------
Version 1.07b:
--------------
- Added code that automatically finds and extracts syntax tokens from the
input corpus.
- Fixed a problem with ld dead-code removal option on MacOS X, reported
by Filipe Cabecinhas.
- Corrected minor typos spotted by Jakub Wilk.
- Added a couple of more exotic archive format samples.
--------------
Version 1.06b:
--------------
- Switched to slightly more accurate (if still not very helpful) reporting
of short read and short write errors. These theoretically shouldn't happen
unless you kill the forkserver or run out of disk space. Suggested by
Jakub Wilk.
- Revamped some of the allocator and debug code, adding comments and
cleaning up other mess.
- Tweaked the odds of fuzzing non-favored test cases to make sure that
baseline coverage of all inputs is reached sooner.
--------------
Version 1.05b:
--------------
- Added a dictionary for WebP.
- Made some additional performance improvements to minimize_corpus.sh.
--------------
Version 1.04b:
--------------
- Made substantial performance improvements to minimize_corpus.sh with
large datasets, albeit at the expense of having to switch back to bash
(other shells may have limits on array sizes, etc).
- Tweaked afl-showmap to support the format used by the new script.
--------------
Version 1.03b:
--------------
- Added code to skip README.txt in the input directory to make the crash
exploration mode work better. Suggested by Jakub Wilk.
- Added a dictionary for SQLite.
--------------
Version 1.02b:
--------------
- Reverted the ./ search path in minimize_corpus.sh because people did
not like it.
- Added very explicit warnings not to run various shell scripts that
read or write to /tmp/ (since this is generally a pretty bad idea on
multi-user systems).
- Added a check for /tmp binaries and -f locations in afl-fuzz.
--------------
Version 1.01b:
--------------
- Added dictionaries for XML and GIF.
--------------
Version 1.00b:
--------------
- Slightly improved the performance of minimize_corpus.sh, especially on
Linux.
- Made a couple of improvements to calibration timeouts for resumed scans.
--------------
Version 0.99b:
--------------
- Fixed minimize_corpus.sh to work with dash, as suggested by Jakub Wilk.
- Modified minimize_corpus.sh to try locate afl-showmap in $PATH and ./.
The first part requested by Jakub Wilk.
- Added support for afl-as --version, as required by one funky build
script. Reported by William Robinet.
--------------
Version 0.98b:
--------------
- Added a dictionary for TIFF.
- Fixed another cosmetic snafu with stage exec counts for -x.
- Switched afl-plot to /bin/sh, since it seems bashism-free. Also tried
to remove any obvious bashisms from other experimental/ scripts,
most notably including minimize_corpus.sh and triage_crashes.sh.
Requested by Jonathan Gray.
--------------
Version 0.97b:
--------------
- Fixed cosmetic issues around the naming of -x strategy files.
- Added a dictionary for JPEG.
- Fixed a very rare glitch when running instrumenting 64-bit code that makes
heavy use of xmm registers that are also touched by glibc.
--------------
Version 0.96b:
--------------
- Added support for extra dictionaries, provided testcases/_extras/png/
as a demo.
- Fixed a minor bug in number formatting routines used by the UI.
- Added several additional PNG test cases that are relatively unlikely
to be hit by chance.
- Fixed afl-plot syntax for gnuplot 5.x. Reported by David Necas.
--------------
Version 0.95b:
--------------
- Cleaned up the OSX ReportCrash code. Thanks to Tobias Ospelt for help.
- Added some extra tips for AFL_NO_FORKSERVER on OSX.
- Refreshed the INSTALL file.
--------------
Version 0.94b:
--------------
- Added in-place resume (-i-) to address a common user complaint.
- Added an awful workaround for ReportCrash on MacOS X. Problem
spotted by Joseph Gentle.
--------------
Version 0.93b:
--------------
- Fixed the link() workaround, as reported by Jakub Wilk.
--------------
Version 0.92b:
--------------
- Added support for reading test cases from another filesystem.
Requested by Jakub Wilk.
- Added pointers to the mailing list.
- Added a sample PDF document.
--------------
Version 0.91b:
--------------
- Refactored minimize_corpus.sh to make it a bit more user-friendly and to
select for smallest files, not largest bitmaps. Offers a modest corpus
size improvement in most cases.
- Slightly improved the performance of splicing code.
--------------
Version 0.90b:
--------------
- Moved to an algorithm where paths are marked as preferred primarily based
on size and speed, rather than bitmap coverage. This should offer
noticeable performance gains in many use cases.
- Refactored path calibration code; calibration now takes place as soon as a
test case is discovered, to facilitate better prioritization decisions later
on.
- Changed the way of marking variable paths to avoid .state metadata
inconsistencies.
- Made sure that calibration routines always create a new test case to avoid
hypothetical problems with utilities that modify the input file.
- Added bitmap saturation to fuzzer stats and plot data.
- Added a testcase for JPEG XR.
- Added a tty check for the colors warning in Makefile, to keep distro build
logs tidy. Suggested by Jakub Wilk.
--------------
Version 0.89b:
--------------
- Renamed afl-plot.sh to afl-plot, as requested by Padraig Brady.
- Improved the compatibility of afl-plot with older versions of gnuplot.
- Added banner information to fuzzer_stats, populated it to afl-plot.
--------------
Version 0.88b:
--------------
- Added support for plotting, with design and implementation based on a
prototype design proposed by by Michael Rash. Huge thanks!
- Added afl-plot.sh, which allows you to, well, generate a nice plot using
this data.
- Refactored the code slightly to make more frequent updates to fuzzer_stats
and to provide more detail about synchronization.
- Added a fflush(stdout) call for non-tty operation, as requested by
Joonas Kuorilehto.
- Added some detail to fuzzer_stats for parity with plot_file.
--------------
Version 0.87b:
--------------
- Added support for MSAN, via AFL_USE_MSAN, same gotchas as for ASAN.
--------------
Version 0.86b:
--------------
- Added AFL_NO_FORKSRV, allowing the forkserver to be bypassed. Suggested
by Ryan Govostes.
- Simplified afl-showmap.c to make use of the no-forkserver mode.
- Made minor improvements to crash_triage.sh, as suggested by Jakub Wilk.
--------------
Version 0.85b:
--------------
- Fixed the CPU counting code - no sysctlbyname() on OpenBSD, d'oh. Bug
reported by Daniel Dickman.
- Made a slight correction to error messages - the advice on testing
with ulimit was a tiny bit off by a factor of 1024.
--------------
Version 0.84b:
--------------
- Added support for the CPU widget on some non-Linux platforms (I hope).
Based on feedback from Ryan Govostes.
- Cleaned up the changelog (very meta).
--------------
Version 0.83b:
--------------
- Added experimental/clang_asm_normalize/ and related notes in
env_variables.txt and afl-as.c. Thanks to Ryan Govostes for the idea.
- Added advice on hardware utilization in README.
--------------
Version 0.82b:
--------------
- Made additional fixes for Xcode support, juggling -Q and -q flags. Thanks to
Ryan Govostes.
- Added a check for __asm__ blocks and switches to .intel_syntax in assembly.
Based on feedback from Ryan Govostes.
--------------
Version 0.81b:
--------------
- A workaround for Xcode 6 as -Q flag glitch. Spotted by Ryan Govostes.
- Improved Solaris build instructions, as suggested by Martin Carpenter.
- Fix for a slightly busted path scoring conditional. Minor practical impact.
--------------
Version 0.80b:
--------------
- Added a check for $PATH-induced loops. Spotted by Kartik Agaram.
- Added AFL_KEEP_ASSEMBLY.
- Override for AFL_USE_ASAN if set at afl compile time. Requested by
Hanno Boeck.
--------------
Version 0.79b:
--------------
- Minor adjustment to path skipping logic.
- Several documentation updates to reflect the changes made yesterday.
--------------
Version 0.78b:
--------------
- CPU governor check. Problem spotted by Joe Zbiciak.
- Favored paths are now selected strictly based on new edges, not hit
counts. This speeds up the first pass by a factor of 3-6x without
significantly impacting ultimate coverage (tested with libgif, libpng,
libjpeg).
It also allows some performance & memory usage improvements by making
some of the in-memory bitmaps much smaller.
- Multiple significant performance improvements to bitmap checking functions,
plus a switch to a faster hash.
- Owing largely to these optimizations, bitmap size is bumped to 64 kB
and a warning is added to detect older binaries that rely on smaller
bitmaps.
--------------
Version 0.77b:
--------------
- Added AFL_SKIP_CHECKS to bypass binary checks when really warranted.
Requested by Jakub Wilk.
- Typo fixes.
- Warning for runs that are aborted early on.
--------------
Version 0.76b:
--------------
- Another signal handling fix for Solaris. Submitted by Martin Carpenter.
--------------
Version 0.75b:
--------------
- A slightly more "elegant" kludge for the %llu glitch (see types.h).
- CPU load warnings relaxed a bit.
--------------
Version 0.74b:
--------------
- More responsive exec speed averages and better UI speed scaling.
- Fix for interrupted reads on Solaris. Submitted by Martin Carpenter.
--------------
Version 0.73b:
--------------
- Fix a stray memcpy() instead of memmove() on overlapping buffers.
Mostly harmless but still dumb. Spotted thanks to David Higgs.
--------------
Version 0.72b:
--------------
- Map size bumped up to 32k. You may want to recompile instrumented
binaries (but nothing horrible will happen if you don't).
- Huge performance improvements for bit-counting functions.
- Default optimizations now include -funroll-loops. This should have
interesting effects on the instrumentation. Frankly, I'm just going to
ship it and see what happens next. I have a good feeling about this.
- Fix for stack alignment crash on MacOS X 10.10; looks like the
rhetorical question in the comments in afl-as.h has been answered.
Spotted by Mudge Zatko.
--------------
Version 0.71b:
--------------
- A fix for the nonsensical MacOS ELF check. Spotted by Mudge Zatko.
- Improvements to ASAN checks.
--------------
Version 0.70b:
--------------
- Explicit detection of ASAN.
- Patches to compile on Solaris. Contributed by Martin Carpenter.
--------------
Version 0.69b:
--------------
- Improved detection of non-instrumented binaries.
- Crash counter in -C mode is now accurate.
- Fix for an obscure install bug that made afl-as non-functional with the tool
installed to /usr/bin instead of /usr/local/bin. Found by Florian Kiersch.
- Fix for a cosmetic SIGFPE when Ctrl-C is pressed while the fork server
is spinning up.
--------------
Version 0.68b:
--------------
- Crash exploration mode! Woot!
--------------
Version 0.67b:
--------------
- Several more typos fixed, the project is now cartified 100% typo-free.
Thanks to Thomas Jarosch and Jakub Wilk.
- Write fuzzer_stats early on.
- Minor fix for MacOS X operation as root. Spotted by Tobias Ospelt.
- Make it possible to override -O3. Patch by Jakub Wilk.
--------------
Version 0.66b:
--------------
- Fix for a very obscure issue with build systems that use gcc as an assembler
for hand-written .s files, confusing afl-as. Affected nss. Reported by
Hanno Boeck.
- Fix for a bug when cleaning up synchronized fuzzer output dirs. Reported by
Thomas Jarosch.
--------------
Version 0.65b:
--------------
- Fix for shell printf escape codes in Makefile. Reported by Jakub Wilk.
- A bit more color to fuzzer_stats, short documentation of the file format,
and several other stats-related improvements.
--------------
Version 0.64b:
--------------
- Enable GCC support on MacOS X.
--------------
Version 0.63b:
--------------
- New, simplified way to pass data in files (@@). See README.
- Final fixes for 64-bit MacOS X, working around a crashing bug in their
linker (umpf) and several other things. It's alive!
- A minor workaround for a bug in 64-bit FreeBSD (clang -m32 -g doesn't work
on that platform, but clang -m32 does, so we no longer insert -g).
- Build-time warning for inverse video terminals and better instructions in
status_screen.txt.
American Fuzzy Lop is a brute-force fuzzer coupled with an exceedingly
simple but rock-solid instrumentation-guided genetic algorithm. It
uses an enhanced form of edge coverage to easily detect subtle,
local-scale changes to program control flow, without being bogged
down by complex comparisons between multiple long-winded execution
paths.
