run AFL with pintool
This is the fastest pintool afl-fuzzer out there currently. And it runs with pintool 3.6 up to 3.11, so 4.x x64 kernels are fine. But ... pintool is super slow. So this is basically only if you have no other option. I am currently developing an alternative with DynamoRIO and is 10x faster - but still, afl qemu mode is 10-50x faster than that ...
-libs also instrument the dynamic libraries -exitpoint target exit the program when this address/function is reached. speeeed! -forkserver install a forkserver. You must set PIN_APP_LD_PRELOAD - or use afl-fuzz-pin.sh -entrypoint target function or address where you want to install the forkserver -alternative a little bit faster but less quality
Optional: 1. afl-dyninst.sh -i program -o program_instrumented -D It is a good idea to add -e and -E with well selected function addresses to make the fuzzing faster
When you have no source code, normal afl-dyninst is crashing the binary, qemu mode -Q is not an option and dynamorio is not working either. Pin is even 90% slower than my dynamorio implementation ...
Pin is super slow ... it is the tool of last resort on x86/x64.
Marc "van Hauser" Heuse [email protected] || [email protected] https://github.com/vanhauser-thc/afl-pin