aflpp

Write an LLVMFuzzerTestOneInput harness that passes fuzzer data to your target function, compile it with afl-clang-fast++ using -fsanitize=fuzzer, create a seed corpus with at least one non-empty file, then run afl-fuzz with -i seeds and -o out directories.

AFL++ is better for multi-core fuzzing campaigns, diverse mutation strategies, and large production codebases that benefit from parallel execution. libFuzzer suits quick setup and single-threaded fuzzing with simple harnesses.

Start one primary instance with afl-fuzz -M primary and additional secondary instances with -S flags, all sharing the same output directory. AFL++ scales roughly linearly with physical cores and supports asymmetrical setups like one ASan job among non-sanitized jobs.

Yes, compile with AFL_USE_ASAN=1 to enable AddressSanitizer instrumentation. Note that the -m memory limit flag is incompatible with ASan because it reserves 20TB of virtual memory, and ASan jobs run slower so use only one per multi-core campaign.

Low executions per second usually means you are not using persistent mode with an LLVMFuzzerTestOneInput harness. Also set AFL_TMPDIR=/dev/shm to avoid disk I/O bottlenecks and run afl-system-config after each reboot for up to 15% more executions.

Avoid AFL++ when you need quick single-threaded prototyping, where libFuzzer is simpler, or when you need custom mutators and research-grade features, where LibAFL fits better. Also do not fuzz on production systems since system configuration scripts disable OS security features.