This repository contains the artifact accompanying our paper, including the source code of an extended version of AFLNet with support for configurable mutator switches. These switches allow fine-grained control over mutator categories and splicing during fuzzing.
-
The source code of extended AFLNet modified to support mutator switches.
-
Experimental Outputs (Link): The raw output from our experiments as presented in the paper.
Note: The uncompressed dataset occupies approximately 300 GB of disk space.
We introduce two command-line options to selectively enable or disable categories of havoc mutators in AFLNet:
-U<bitstring>— controls mutation type categories.-A<bitstring>— controls mutation granularity categories.
Only one of these options can be used in a single fuzzing run. Using both -U and -A simultaneously is not allowed.
Each <bitstring> is a sequence of 1s and 0s, with each bit (from right to left) representing whether a specific category is enabled (1) or disabled (0).
The bitstring for -U controls the following 8 mutation type categories, from right to left:
| Bit Position | Category Name |
|---|---|
| 0 (LSB) | TBitflip |
| 1 | TInteresting |
| 2 | TArithmetic |
| 3 | TRandomByte |
| 4 | TDelete |
| 5 | TBlockDup |
| 6 | TToken |
| 7 (MSB) | TRegion |
Example:
-U11111111enables all mutation type categories.-U10000000enables only the TRegion category.
The bitstring for -A controls the following 5 mutation granularity categories, again from right to left:
| Bit Position | Category Name |
|---|---|
| 0 (LSB) | GBit |
| 1 | GByte |
| 2 | GWord |
| 3 | GDword |
| 4 (MSB) | GS |
Example:
-A00001enables only GBit category.
To disable splicing during fuzzing, simply add the -H option.
Other than the added mutator switches, the usage of this AFLNet version remains identical to the original AFLNet.
For details on how to use AFLNet, please refer to README-AFLNet.md included in this repository.
This artifact is licensed under the Apache License 2.0.