{"repo":"googleprojectzero/winafl","free":true,"listed":false,"github":"https://github.com/googleprojectzero/winafl","clone":"git clone https://github.com/googleprojectzero/winafl.git","description":"A fork of AFL for fuzzing Windows binaries","language":"C","stars":2602,"topics":["fuzzing","security","afl"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"WinAFL Background AFL is a popular fuzzing tool for coverage-guided fuzzing. The tool combines fast target execution with clever heuristics to find new execution paths in the target binary. It has been successfully used to find a large number of vulnerabilities in real products. For more info about the original project, please refer to the original documentation at: http://lcamtuf.coredump.cx/afl/ Unfortunately, the original AFL does not work on Windows due to very nix-specific design (e.g. instrumentation, forkserver etc.). This project is a fork of AFL that uses different instrumentation approach which works on Windows even for black box binary fuzzing. The WinAFL approach Instead of instrumenting the code at compilation time, WinAFL supports the following instrumentation modes: - Dynamic instrumentation using DynamoRIO (http://dynamorio.org/) - Dynamic instrumentation using TinyInst (https://github.com/googleprojectzero/TinyInst) - Hardware tracing using Intel PT - Static instrumentation via Syzygy These instrumentation modes are described in more detail in the separate documents. To improve the process startup time, WinAFL relies heavily on persistent fuzzing mode, that is, executing multiple input samples without restarting the target process. This is accomplished by selecting a target function (that the user wants to fuzz) and instrumenting it so that it runs in a loop. Known CVEs WinAFL has been successfully used to identify bugs in Windows software, such as the follow","default_branch":null,"files":null,"tree":[],"storefront":"/r/googleprojectzero","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/googleprojectzero/winafl/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}