search

talos-vulndev / afl-dyninst

American Fuzzy Lop + Dyninst == AFL Fuzzing blackbox binaries
Apache License 2.0
186 stars 51 forks source link

does it support multi-threaded programs #16

Open X1aoR0 opened 1 year ago

X1aoR0 commented 1 year ago

I saw that AFL's frida-mode does not support multi-threading now, so I would like to ask if afl-dyninst also does not support multi-threading

ea commented 1 year ago

Technically it would work, but would definitely suffer from stability issues and nondeterminism. That's mostly true for any AFL-like fuzzer , multiple threads introduce non-determinism which messes up the fitness function. I'd suggest you take a look at a more up-to-date version of AFL , AFL++ which has support for a few different options for binary only fuzzing (such as Qemu mode) https://github.com/AFLplusplus/AFLplusplus/blob/869138aa41db5411535003fa575a35b75b857389/docs/fuzzing_binary-only_targets.md

Additionally, that group has an improved version of afl-dyninst (https://github.com/vanhauser-thc/afl-dyninst) which has seen more maintenance than this one.

Cheers

vanhauser-thc commented 1 year ago

the question is what you mean with "support threads". some loose coverage with threads because of race conditions to the coverage map, do you mean that? I recommend nyx_mode or qemu_mode, they are the most stable ones.