libafl

Build LibAFL's libFuzzer compatibility runtime with build.sh to produce libFuzzer.a, then compile your existing harness with clang++ using -fsanitize=fuzzer-no-link and link against libFuzzer.a. Run the binary with a corpus directory as usual.

libFuzzer suits quick single-threaded setups, AFL++ handles multi-core general-purpose fuzzing, and LibAFL fits custom fuzzer development, novel techniques, and research. Choose LibAFL when standard fuzzers lack needed mutation strategies or architecture support.

LibAFL requires Clang/LLVM versions 15 through 18. Install a compatible version via apt.llvm.org and set RUSTFLAGS, CC, and CXX environment variables to point to the correct clang binaries.

Add a BacktraceObserver to the executor and combine CrashFeedback with NewHashFeedback in the objective using feedback_and. This stores only crashes with unique backtraces, avoiding duplicate reports from the same bug.

Missing coverage usually means instrumentation failed or the corpus lacks interesting seeds. Verify the compiler wrapper applied -fsanitize-coverage flags and provide seed inputs that exercise meaningful code paths.

Avoid LibAFL for simple fuzzing tasks where libFuzzer's quick setup or AFL++'s multi-core support suffices. Its high complexity and Rust development overhead only pay off for custom fuzzers or research needs.