aflpp

Run AFL++ fuzzing campaigns to discover crashes and hangs in C/C++ programs.

Updated May 2, 2026
One-click install
npx skills add https://github.com/ayehiaa/my-travel-assistant --skill aflpp-ayehiaa
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: aflpp
Source: https://github.com/ayehiaa/my-travel-assistant/tree/main/.agents/skills/aflpp
Command: npx skills add https://github.com/ayehiaa/my-travel-assistant --skill aflpp-ayehiaa

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you run high-throughput fuzzing campaigns that uncover crashes and hangs in C/C++ programs without needing a handcrafted single-thread fuzzer workflow.

Core Features & Use Cases

  • Multi-core, stable fuzzing with AFL++: Use AFL++’s mature parallel campaign support to increase coverage and throughput for real codebases.
  • Harness-based fuzzing and sanitizer integration: Create libFuzzer-style harnesses and enable ASan/UBSan to detect memory corruptions and undefined behavior that may not crash immediately.
  • Corpus and results workflows: Manage seeds, minimize corpora, monitor campaigns, and re-run discovered crashes reliably.

Use case example: You maintain a C++ service that occasionally segfaults on certain inputs; you compile an AFL++-instrumented target with sanitizers, start a multi-core campaign with representative seeds, then re-execute and triage the exact crashing inputs from the crashes/ directory.

Quick Start

Ask the aflpp Skill to set up AFL++ and compile your C/C++ harness, then start an afl-fuzz campaign using your initial seed corpus to begin discovering crashes and coverage improvements.

Frequently Asked Questions about aflpp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a multi-core fuzzing campaign to find crashes in C/C++ programs?

Run a multi-core fuzzing campaign by compiling an instrumented C/C++ harness with an AFL++-compatible mode like afl-clang-lto, then starting afl-fuzz with a seed corpus to continuously mutate inputs and discover crashes.

Can I use ASan and UBSan with AFL++ to detect memory corruption during fuzzing?

Yes, you can enable ASan or UBSan during AFL++ fuzzing to detect memory corruptions and undefined behavior that may not immediately crash the instrumented target.

How do I manage and minimize a fuzzing corpus during an AFL++ campaign?

You can manage and minimize a fuzzing corpus by applying AFL++ corpus minimization workflows to reduce seed inputs while maintaining coverage, ensuring efficient continuous fuzzing execution.

What compiler modes do I need to build an instrumented harness for AFL++?

You need to use an AFL++-compatible compile mode such as afl-clang-fast++, afl-clang-lto, or afl-g++-fast to build an instrumented harness for mutating inputs and finding crashes.

How do I re-execute and triage crashing inputs found by AFL++?

After an AFL++ fuzzing campaign discovers crashes, you re-execute and triage the exact crashing inputs directly from the crashes/ output directory to analyze the identified hangs and segfaults.

What environment variables control timeouts and temporary directories in AFL++ fuzzing?

You can set environment variables like AFL_TMPDIR and AFL_FAST_CAL alongside campaign control parameters such as timeouts and execution limits to manage deterministic execution and calibration.