3.1 KiB
Custom Mutators
Custom mutators enhance and alter the mutation strategies of AFL++. For further information and documentation on how to write your own, read the docs.
Examples
The ./examples folder contains examples for custom mutators in python and C.
Rust
In ./rust, you will find rust bindings, including a simple example in ./rust/example and an example for structured fuzzing, based on lain, in./rust/example_lain.
Production-Ready Custom Mutators
This directory holds ready to use custom mutators. Just type "make" in the individual subdirectories.
Use with e.g.
AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/radamsa/radamsa-mutator.so afl-fuzz ....
and add AFL_CUSTOM_MUTATOR_ONLY=1 if you only want to use the custom mutator.
Multiple custom mutators can be used by separating their paths with : in the environment variable.
The AFL++ grammar agnostic grammar mutator
In ./autotokens you find a token-level fuzzer that does not need to know
anything about the grammar of an input as long as it is in ascii and allows
whitespace.
It is very fast and effective.
If you are looking for an example of how to effectively create a custom mutator take a look at this one.
The AFL++ Grammar Mutator
If you use git to clone AFL++, then the following will incorporate our excellent grammar custom mutator:
git submodule update --init
Read the README in the Grammar-Mutator repository on how to use it.
Note that this custom mutator is not very good though!
Other Mutators
atnwalk and gramatron are grammar custom mutators. Example grammars are provided.
honggfuzz, libfuzzer and libafl are partial implementations based on the mutator implementations of the respective fuzzers. More for playing than serious usage.
radamsa is slow and not very good.
3rd Party Custom Mutators
Superion Mutators
Adrian Tiron ported the Superion grammar fuzzer to AFL++, it is WIP and requires cmake (among other things): https://github.com/adrian-rt/superion-mutator
libprotobuf Mutators
There are three WIP protobuf projects, that require work to be working though:
ASN.1 example: https://github.com/airbus-seclab/AFLplusplus-blogpost/tree/main/src/mutator
transforms protobuf raw: https://github.com/bruce30262/libprotobuf-mutator_fuzzing_learning/tree/master/4_libprotobuf_aflpp_custom_mutator
has a transform function you need to fill for your protobuf format, however needs to be ported to the updated AFL++ custom mutator API (not much work): https://github.com/thebabush/afl-libprotobuf-mutator
same as above but is for current AFL++: https://github.com/P1umer/AFLplusplus-protobuf-mutator