Important changes in AFL++

This document lists important changes in AFL++, for example, major behavior changes.

From version 3.00 onwards

With AFL++ 4.00, we introduced the following changes from previous behaviors:

• the complete documentation was overhauled and restructured thanks to @llzmb!
• a new CMPLOG target format requires recompiling CMPLOG targets for use with AFL++ 4.0 onwards
• better naming for several fields in the UI

With AFL++ 3.15, we introduced the following changes from previous behaviors:

• afl-cmin and afl-showmap -Ci now descend into subdirectories like afl-fuzz -i does (but note that afl-cmin.bash does not)

With AFL++ 3.14, we introduced the following changes from previous behaviors:

• afl-fuzz: deterministic fuzzing is not a default for -M main anymore
• afl-cmin/afl-showmap -i now descends into subdirectories (afl-cmin.bash, however, does not)

With AFL++ 3.10, we introduced the following changes from previous behaviors:

• The ‘+’ feature of the -t option now means to auto-calculate the timeout with the value given being the maximum timeout. The original meaning of “skipping timeouts instead of abort” is now inherent to the -t option.

With AFL++ 3.00, we introduced changes that break some previous AFL and AFL++ behaviors and defaults:

• There are no llvm_mode and gcc_plugin subdirectories anymore and there is only one compiler: afl-cc. All previous compilers now symlink to this one. All instrumentation source code is now in the instrumentation/ folder.
• The gcc_plugin was replaced with a new version submitted by AdaCore that supports more features. Thank you!
• QEMU mode got upgraded to QEMU 5.1, but to be able to build this a current ninja build tool version and python3 setuptools are required. QEMU mode also got new options like snapshotting, instrumenting specific shared libraries, etc. Additionally QEMU 5.1 supports more CPU targets so this is really worth it.
• When instrumenting targets, afl-cc will not supersede optimizations anymore if any were given. This allows to fuzz targets build regularly like those for debug or release versions.
• afl-fuzz:
  • if neither -M or -S is specified, -S default is assumed, so more fuzzers can easily be added later
  • -i input directory option now descends into subdirectories. It also does not fail on crashes and too large files, instead it skips them and uses them for splicing mutations
  • -m none is now the default, set memory limits (in MB) with, e.g., -m 250
  • deterministic fuzzing is now disabled by default (unless using -M) and can be enabled with -D
  • a caching of test cases can now be performed and can be modified by editing config.h for TESTCASE_CACHE or by specifying the environment variable AFL_TESTCACHE_SIZE (in MB). Good values are between 50-500 (default: 50).
  • -M mains do not perform trimming
• examples/ got renamed to utils/
• libtokencap/, libdislocator/, and qdbi_mode/ were moved to utils/
• afl-cmin/afl-cmin.bash now search first in PATH and last in AFL_PATH