Fuzzing

Fuzzing tutorial with easy to learn labs.

Lessons

| Lesson | keyword | Lab | | ------------- | ------------- | ------------- | | Lesson 00 - Fuzzing with AFL++ | afl-cc, afl-clang-lto, fuzzing | :white_check_mark: | | Lesson 01 - Use sanitizer to catch silent bugs | AddressSanitizer(ASAN) | :white_check_mark: | | Lesson 02 - Improve code coverage using dictionary | dictionary, branch constraint, split-comparison | :white_check_mark: | | Lesson 03 - Parallel fuzzing: combine the advantages of each fuzzer | parallel fuzzing, seed pool syncing | :white_check_mark: | | Lesson 04 - Increase fuzzing performance by persistent mode | fuzzing harness, persistent mode | :white_check_mark: | | Lesson 05 - Write a LLVM Pass to do binary instrumentation | LLVM Pass, binary instrumentation | :white_check_mark: | | Lesson 06 - Integrate custom LLVM Pass into AFL++ | custom LLVM Pass in AFL++, integration example | :white_check_mark: | | Lesson 07 - Playing symbolic execution on a maze with KLEE | symbolic execution, KLEE | :white_check_mark: |

Setup

./setup.sh
make

Environment

| Name | Version | | ---- | ------- | | Ubuntu | 20.04, 22.04 | | LLVM (clang, lld) | 14.0.6 | | AFL++ | 4.01c | | KLEE | v2.3 |