AFL
ToolAFL is described in the provided evidence as a state-of-the-art coverage-guided fuzzer. It appears as a representative coverage-guided fuzzing tool alongside libFuzzer, and a processor-verification study compared unmodified AFL 2.56b, called Vanilla AFL, with an Enhanced AFL variant using problem-specific mutations.
First seen 5/25/2026
Last seen 8/25/2026
Evidence 96 chunks
Wiki v3
WIKI
Overview
AFL is described in the evidence as a coverage-guided fuzzer and as a notable representative of coverage-guided fuzzing alongside LLVM-based libFuzzer. The cited ISS-verification paper characterizes mutation-based fuzzing as a technique that mutates randomly created data and is guided by code coverage, avoiding the need to create an input model. [AFL as coverage-guided fuzzer]
A later cross-level processor-verification study refers to AFL as a state-of-the-art coverage-guided fuzzer and uses the unmodified AFL 2.56b release as its baseline, calling it Vanilla AFL. [AFL 2.56b baseline]
NEIGHBORHOOD
No graph connections found for this entity yet. It may appear in future ingestion runs.
explore full graph →RELATIONSHIPS
50 connectionsAFL++ implements coverage-guided fuzzing to discover new code paths.
The paper uses AFL as the baseline coverage-guided fuzzer and extends it with custom mutations.
SearchSYS uses AFL++ as its fuzzing engine.
AFL uses QEMU for fuzzing non-native ISA targets.
Fast Exploration Mutation is a custom extension to AFL's mutation procedures for processor verification.
AFL detects new behaviors through edge coverage.
AFL was originally developed by Michal Zalewski.
Enhanced Havoc Mutation is a custom extension to AFL's havoc mutation for processor verification.
AFL is a coverage-guided grey box fuzzer.
TaPaFuzz is compared against AFL++ in terms of execution rate and coverage.
AFL uses branch coverage as its primary guidance metric for fuzzing.
AFL implements mutation-based fuzzing with bit flips, arithmetic operations, and splicing.
The CGM-Fuzz baseline is inspired by AFL++ style coverage-guided mutation fuzzing.
The AFL white-paper describes and introduces AFL as a coverage-guided fuzzer.
RFuzz uses AFL as its underlying fuzzing engine with mux coverage as feedback.
AFL uses bitflip mutation to flip bits in the test input.
AFL uses arithmetic mutation to add/subtract integers in the test input.
AFL uses havoc mutation as a combination of multiple individual mutations.
AFL is a widely-used coverage-based greybox fuzzer
The paper uses AFL++ as a baseline for performance comparison.
The paper mentions AFL as the original fuzzer from which AFL++ and LibAFL derive.
AFL uses LLVM and GCC for compiler-based target instrumentation.
AFL uses fork system calls to optimize re-spawning processes for fuzzer runs.
AFL uses QEMU mode for ISA emulation to fuzz non-native ISA targets.
AFL++ uses persistent mode to reduce fork system call overhead.
AFL++ is a community fork of AFL with a newer codebase and more features.
AFL is the most iconic coverage-guided fuzzer that has inspired numerous fuzzing projects.
AFL uses source code instrumentation to trace coverage, incurring ~70% overhead.
AFL uses a specific edge encoding algorithm (Algorithm 1) based on XOR of random basic block IDs.
AFL uses DBI techniques for binary-only programs when source code is unavailable.
SNAP provides a clean interface for AFL-based fuzzers to adopt its hardware tracing.
The paper provides detailed analysis of AFL's tracing overhead as a motivating example.
AFL implements the CGF algorithm with AssignEnergy and IsInteresting functions.
AFL records coverage transitions in a shared memory array.
cm-gem5c.so is loaded and used by AFL++ as a custom mutator.
AFL++ uses binary instrumentation when building gem5 for fuzzing.
Experiment-ARM-24h.sh uses AFL++ to run fuzzing campaigns.
HeteroFuzz is compared to AFL-like naive fuzzing throughout the evaluation.
AFL is a well-known fuzz testing tool that implements coverage-guided fuzzing.
AFL++ is a coverage-guided fuzzer that provides the fuzzing core for SearchSYS.
RISC Whisk uses AFL++ as the software fuzzer for hardware binary fuzzing.
AFL++ implements feedback-based fuzzing by tracking coverage to guide mutations.
AFL is one of the first tools to popularize coverage-guided greybox fuzzing.
The hardware fuzzing approach in RISC Whisk uses AFL++ as the underlying fuzzer.
The custom mutator is used by AFL++ as a plugin to replace its default mutation logic.
AFL is a notable coverage-guided fuzzing tool
Examiner: Automatically Locating Inconsistent Instructions between Real Devices and CPU Emulators for ARM ← mentions 95% 1e
The paper mentions AFL as a fuzzing tool that uses QEMU mode and is relevant to emulator-based analysis.
AFL starts fuzzing from seed inputs and mutates them to generate new test inputs.
save_if_interesting in afl-fuzz.c is AFL's implementation of the IsInteresting function.
has_new_bits in afl-fuzz.c is AFL's implementation of the IsInteresting function.
CITATIONS
9 sources9 citations — click to expand
[1] AFL is a representative coverage-guided fuzzer and mutation-based CGF mutates randomly created data guided by code coverage. Verifying Instruction Set Simulators using Coverage-guided Fuzzing
[2] The cross-level processor-verification study used unmodified AFL 2.56b as Vanilla AFL and compared it with Enhanced AFL. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[3] The study configured VexRiscv for RV32IM, used random seeds, used a 32-bit corpus value of 0x0000, and set a 24-hour runtime limit. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[4] The study defined #Queue as coverage-increasing non-mismatch test vectors and #Unique-Crash as unique mismatch-causing test vectors. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[5] Enhanced AFL used problem-specific mutations named Fast Exploration and Enhanced Havoc; Fast Exploration inserts each RISC-V instruction at the beginning of test vectors with x0 and immediate 0 arguments. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[6] The execution controller prevents infinite loops, detects processor-core mismatches, and applies a hard limit of 10,000 ISS instruction executions. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[7] The execution controller synchronizes comparisons on register-value changes and can stop simulation after detecting an ISS/RTL mismatch. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[8] Enhanced AFL generated fewer queue test vectors on average, but the Mann–Whitney U result for #Queue was not statistically significant at the stated 95% threshold. Efficient Cross-Level Processor Verification using Coverage-guided Fuzzing
[9] AFL++ is described as afl with community patches and additional features including QEMU 5.1 upgrade, collision-free coverage, enhanced laf-intel and redqueen, AFLfast++ power schedules, MOpt mutators, and unicorn_mode. AFLplusplus/AFLplusplus