AFL
ToolAFL is described in the provided evidence as a state-of-the-art coverage-guided fuzzer. It appears as a representative coverage-guided fuzzing tool alongside libFuzzer, and a processor-verification study compared unmodified AFL 2.56b, called Vanilla AFL, with an Enhanced AFL variant using problem-specific mutations.
First seen 5/25/2026
Last seen 7/20/2026
Evidence 52 chunks
Wiki v3
WIKI
Overview
AFL is described in the evidence as a coverage-guided fuzzer and as a notable representative of coverage-guided fuzzing alongside LLVM-based libFuzzer. The cited ISS-verification paper characterizes mutation-based fuzzing as a technique that mutates randomly created data and is guided by code coverage, avoiding the need to create an input model. [AFL as coverage-guided fuzzer]
A later cross-level processor-verification study refers to AFL as a state-of-the-art coverage-guided fuzzer and uses the unmodified AFL 2.56b release as its baseline, calling it Vanilla AFL. [AFL 2.56b baseline]
NEIGHBORHOOD
5 nodes · 7 edgesgraph · AFL · depth=1
RELATIONSHIPS
49 connectionsAFL implements coverage-guided fuzzing using branch coverage as feedback.
AFL uses QEMU for fuzzing non-native ISA targets.
AFL tracks edge coverage by instrumenting conditional branches and measuring basic block transitions.
Fast Exploration Mutation is a custom mutation designed to enhance AFL's fuzzing performance for processor verification.
The paper uses AFL as the base coverage-guided fuzzer, extended with custom mutations.
AFL is a coverage-guided grey box fuzzer.
TaPaFuzz is compared against AFL++ in terms of execution rate and coverage.
AFL was originally developed by Michal Zalewski.
The paper mentions AFL as the original fuzzer from which AFL++ and LibAFL derive.
AFL uses LLVM and GCC for compiler-based target instrumentation.
AFL uses fork system calls to optimize re-spawning processes for fuzzer runs.
AFL uses QEMU mode for ISA emulation to fuzz non-native ISA targets.
AFL++ uses persistent mode to reduce fork system call overhead.
RFuzz uses AFL as its underlying fuzzing engine with mux coverage as feedback.
AFL implements mutation-based fuzzing with bit flips, arithmetic operations, and splicing.
The CGM-Fuzz baseline is inspired by AFL++ style coverage-guided mutation fuzzing.
The AFL white-paper describes and introduces AFL as a coverage-guided fuzzer.
AFL implements the CGF algorithm with AssignEnergy and IsInteresting functions.
AFL uses bitflip mutation to flip bits in the test input.
AFL uses arithmetic mutation to add/subtract integers in the test input.
AFL uses havoc mutation as a combination of multiple individual mutations.
Enhanced Havoc Mutation is a custom mutation designed to enhance AFL's fuzzing performance for processor verification.
AFL is a widely-used coverage-based greybox fuzzer
AFL uses code coverage as its primary feedback metric
The paper uses AFL++ as a baseline for performance comparison.
AFL++ is a community fork of AFL with a newer codebase and more features.
AFL is the most iconic coverage-guided fuzzer that has inspired numerous fuzzing projects.
AFL uses source code instrumentation to trace coverage, incurring ~70% overhead.
AFL uses a specific edge encoding algorithm (Algorithm 1) based on XOR of random basic block IDs.
AFL uses DBI techniques for binary-only programs when source code is unavailable.
SNAP provides a clean interface for AFL-based fuzzers to adopt its hardware tracing.
The paper provides detailed analysis of AFL's tracing overhead as a motivating example.
AFL records coverage transitions in a shared memory array.
AFL assigns energy to seeds to determine mutation count
AFL is one of the first tools to popularize coverage-guided greybox fuzzing.
AFL stores coverage information in a coverage bitmap for efficient comparison across runs.
FuzzWiz uses AFL as one of its fuzzing engines.
save_if_interesting in afl-fuzz.c is AFL's implementation of the IsInteresting function.
Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM ← mentions 95% 1e
The paper mentions AFL as a fuzzing tool that uses QEMU mode and is relevant to emulator-based analysis.
has_new_bits in afl-fuzz.c is AFL's implementation of the IsInteresting function.
AFL++ is a popular fuzzer example in software testing that can be applied to hardware fuzzing contexts
AFL is classified as a grey-box fuzzer.
AFL uses branch coverage as its coverage metric injected when software is compiled.
AFL uses a FIFO queue of interesting seeds for mutation.
AFL uses mutation-based input generation strategies.
AFL is a general-purpose coverage-guided mutation-based fuzzing engine.
AFL uses instrumentation to obtain feedback for fuzzing.
AFL was developed at Google.
The software fuzzer incorporates AFL++ as a sophisticated coverage-guided fuzzing engine.
CITATIONS
9 sources9 citations — click to expand
[1] AFL is a representative coverage-guided fuzzer and mutation-based CGF mutates randomly created data guided by code coverage. Verifying Instruction Set Simulators using Coverage-guided Fuzzing
[2] The cross-level processor-verification study used unmodified AFL 2.56b as Vanilla AFL and compared it with Enhanced AFL. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[3] The study configured VexRiscv for RV32IM, used random seeds, used a 32-bit corpus value of 0x0000, and set a 24-hour runtime limit. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[4] The study defined #Queue as coverage-increasing non-mismatch test vectors and #Unique-Crash as unique mismatch-causing test vectors. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[5] Enhanced AFL used problem-specific mutations named Fast Exploration and Enhanced Havoc; Fast Exploration inserts each RISC-V instruction at the beginning of test vectors with x0 and immediate 0 arguments. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[6] The execution controller prevents infinite loops, detects processor-core mismatches, and applies a hard limit of 10,000 ISS instruction executions. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[7] The execution controller synchronizes comparisons on register-value changes and can stop simulation after detecting an ISS/RTL mismatch. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[8] Enhanced AFL generated fewer queue test vectors on average, but the Mann–Whitney U result for #Queue was not statistically significant at the stated 95% threshold. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[9] AFL++ is described as afl with community patches and additional features including QEMU 5.1 upgrade, collision-free coverage, enhanced laf-intel and redqueen, AFLfast++ power schedules, MOpt mutators, and unicorn_mode. AFLplusplus/AFLplusplus