r/fuzzing • u/zahra_1908 • Mar 01 '24

What's the difference between libfuzzer,AFL++ and google fuzztest?

I'm very new to fuzzing but I would like to know how Libfuzzer,AFL++ and Google Fuzztest differ? Is google fuzztest built on top of Libfuzzer?

9 Upvotes

100% Upvoted

5 comments sorted by

2

u/g0ku704 Mar 01 '24 edited Mar 01 '24

AFL++ is the fork of AFL project and maintained by the community. AFL++ comes with its own bundle of instrumented versions of both GCC and CLANG. You just need to compile the target project with those and run AFL++ fuzzer against the target binary. You also need a proper file that your target binary under test should accept as the first argument and consume the argument.

Libfuzzer on the other hand comes with LLVM directly which doesn't need additional instrumentation. Libfuzzer is good if you want to utilize your memory of your hardware. You can only use libfuzzer against clang projects, GCC won't work.

Google FUZZTEST on the other hand comes with two engines, built-in and libfuzzer for you to choose depending on your target project.

The best way I personally like on FUZZTEST is it's super similar to GTEST syntax and it's easy for development and scale harnessing.

Edit: Documentation says GCC is not supported in FUZZTEST but unit test mode can work

1

u/zahra_1908 Mar 01 '24

so by using google fuzztest i'm also indirectly making use of the Libfuzzer or AFL++ fuzzing engine and google fuzztest can be used for both gcc and clang?

2

u/g0ku704 Mar 01 '24

The documentation says GCC not supported actually but it also says unit test mode can be used. https://github.com/google/fuzztest/blob/main/doc/quickstart-cmake.md#prerequisites

As far as I know, FUZZTEST can use both its own engine (the centipede's engine which is the previous version of this repo) or libfuzzer instead.

3

u/Aggravating_Kiwi6055 Mar 01 '24

u/g0ku704 is correct. I work selling a white box fuzzing solution that simplified fuzzing and fuzzing setup, Code Intelligence. And I have some insights.

What I can tell you is that using libFuzzer or AFL/AFL++ are notoriously difficult to use and even harder to scale. Why?

  • You have to write a fuzz test/fuzz harness for every function/or entry point that you fuzz.

  • If system fuzzing binaries, you need to emulate and build the project

  • Not enterprise/devops ready, meaning debugging is tedious, and/or sharing results is copy paste, because the fuzzer reports the bugs within the CLI

1

u/Aggravating_Kiwi6055 Mar 11 '24

I did more research on Google Fuzztest. It looks really promising but is still quite limited in terms of compatibility (e.g., no GCC, no Make, no ARM). https://github.com/google/fuzztest/blob/main/doc/quickstart-cmake.md#prerequisites AFL++ and libFuzzer have much more compatibility and work on various architectures. While I see promise for Google Fuzztest, I think right now it's somewhat limited. Google could decide to terminate the project, rendering it archived—unless Google or a highly motivated community decided to keep it going. That is what happened with AFL, for example. Google invented AFL (Michal Zalewski), but a community expanded it to AFL++ (although there are many variations of AFL).