<commit_before># WinAFL

```
   Original AFL code written by <NAME> <<EMAIL>>

   Windows fork written and maintained by <NAME> <<EMAIL>>

   Copyright 2016 Google Inc. All Rights Reserved.

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
```

## Background

AFL is a popular fuzzing tool for coverage-guided fuzzing. The tool combines
fast target execution with clever heuristics to find new execution paths in
the target binary. It has been successfully used to find a large number of
vulnerabilities in real products. For more info about the original project,
please refer to the original documentation at:

http://lcamtuf.coredump.cx/afl/

Unfortunately, the original AFL does not work on Windows due to very
*nix-specific design (e.g. instrumentation, forkserver etc). This project is
a fork of AFL that uses different instrumentation approach which works on
Windows even for black box binary fuzzing.

## The WinAFL approach

Instead of instrumenting the code at compilation time, WinAFL supports the
following instrumentation modes:
 - Dynamic instrumentation using DynamoRIO (http://dynamorio.org/)
 - Hardware tracing using Intel PT
 - Static instrumentation via Syzygy

These instrumentation modes are described in more detail in the separate
documents.

<p align="center">
<img alt="afl-fuzz.exe" src="screenshots/afl-fuzz.gif"/>
</p>

To improve the process startup time, WinAFL relies heavily on persistent
fuzzing mode, that is, executing multiple input samples without restarting the
target process. This is accomplished by selecting a target function (that the
user wants to fuzz) and instrumenting it so that it runs in a loop.

#### Known CVEs

WinAFL has been successfully used to identify bugs in Windows software, such as

 * [Adobe] CVE-2018-4985, CVE-2018-5063, CVE-2018-5064, CVE-2018-5065, CVE-2018-5068, CVE-2018-5069, CVE-2018-5070, CVE-2018-12754, CVE-2018-12755, CVE-2018-12764, CVE-2018-12765, CVE-2018-12766, CVE-2018-12767, CVE-2018-12768, CVE-2018-12848, CVE-2018-12849, CVE-2018-12850, CVE-2018-12840, CVE-2018-15956, CVE-2018-15955, CVE-2018-15954,CVE-2018-15953, CVE-2018-15952, CVE-2018-15938, CVE-2018-15937, CVE-2018-15936, CVE-2018-15935, CVE-2018-15934, CVE-2018-15933, CVE-2018-15932 , CVE-2018-15931, CVE-2018-15930 , CVE-2018-15929, CVE-2018-15928, CVE-2018-15927, CVE-2018-12875, CVE-2018-12874 , CVE-2018-12873, CVE-2018-12872,CVE-2018-12871, CVE-2018-12870, CVE-2018-12869, CVE-2018-12867 , CVE-2018-12866, CVE-2018-12865 , CVE-2018-12864 , CVE-2018-12863, CVE-2018-12862, CVE-2018-12861, CVE-2018-12860, CVE-2018-12859, CVE-2018-12857, CVE-2018-12839 - found by <NAME> and <NAME> from Check Point Software Technologies
 * [Adobe] CVE-2018-12853, CVE-2018-16024, CVE-2018-16023, CVE-2018-15995 - found by <NAME> (guyio)
 * [Adobe] CVE-2018-16004, CVE-2018-16005, CVE-2018-16007, CVE-2018-16009, CVE-2018-16010, CVE-2018-16043, CVE-2018-16045, CVE-2018-16046, CVE-2018-19719, CVE-2018-19720, CVE-2019-7045 - found by <NAME> ([@bitshifter123](https://twitter.com/bitshifter123))
 * [Microsoft] CVE-2016-7212 - found by <NAME> of Noser Engineering AG
 * [Microsoft] CVE-2017-0073, CVE-2017-0190, CVE-2017-11816, CVE-2018-8472, CVE-2019-1311 - found by [<NAME>](https://twitter.com/symeonp)
 * [Microsoft] CVE-2018-8494 - found by Guy Inbar (guyio)
 * [Microsoft] CVE-2018-8464 - found by Omri Herscovici of Check Point
 * [Microsoft] CVE-2019-0576, CVE-2019-0577, CVE-2019-0579, CVE-2019-0538, CVE-2019-0580, CVE-2019-0879, CVE-2019-0889, CVE-2019-0891, CVE-2019-0899, CVE-2019-0902, CVE-2019-1243, CVE-2019-1250 - found by <NAME> of McAfee 
 * [Kollective Kontiki 10.0.1] CVE-2018-11672 - found by <NAME> from Salesforce
 * [Mozilla] CVE-2018-5177 - found by Guy Inbar (guyio)
 * [libxml2] CVE-2018-14404 - found by Guy Inbar (guyio)
 * [WinRAR] CVE-2018-20250, CVE-2018-20251, CVE-2018-20252, CVE-2018-20253 - found by Nad<NAME>man of Check Point Software Technologies
 * [Various image viewers] CVE-2019-13083, CVE-2019-13084, CVE-2019-13085, CVE-2019-13242, CVE-2019-13243, CVE-2019-13244, CVE-2019-13245, CVE-2019-13246, CVE-2019-13247, CVE-2019-13248, CVE-2019-13249, CVE-2019-13250, CVE-2019-13251, CVE-2019-13252, CVE-2019-13253, CVE-2019-13254, CVE-2019-13255, CVE-2019-13256, CVE-2019-13257, CVE-2019-13258, CVE-2019-13259, CVE-2019-13260, CVE-2019-13261, CVE-2019-13262 - found by found by [@expend20](https://twitter.com/expend20) and <NAME> of Apriorit
 * [Foxit] CVE-2019-13330, CVE-2019-13331, CVE-2020-8844 - found by <NAME> ([@NattiSamson](https://twitter.com/NattiSamson))
 
(Let me know if you know of any others and I'll include them in the list)

## Building WinAFL

1. If you are building with DynamoRIO support, download and build
DynamoRIO sources or download DynamoRIO Windows binary package from
https://github.com/DynamoRIO/dynamorio/wiki/Downloads

2. If you are building with Intel PT support, pull third party dependencies by running `git submodule update --init --recursive` from the WinAFL source directory

3. Open Visual Studio Command Prompt (or Visual Studio x64 Win64 Command Prompt
if you want a 64-bit build). Note that you need a 64-bit winafl.dll build if
you are fuzzing 64-bit targets and vice versa.

4. Go to the directory containing the source
<commit_msg>new cve<commit_after># WinAFL

```
   Original AFL code written by <NAME> <<EMAIL>>

   Windows fork written and maintained by <NAME> <<EMAIL>>

   Copyright 2016 Google Inc. All Rights Reserved.

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
```

## Background

AFL is a popular fuzzing tool for coverage-guided fuzzing. The tool combines
fast target execution with clever heuristics to find new execution paths in
the target binary. It has been successfully used to find a large number of
vulnerabilities in real products. For more info about the original project,
please refer to the original documentation at:

http://lcamtuf.coredump.cx/afl/

Unfortunately, the original AFL does not work on Windows due to very
*nix-specific design (e.g. instrumentation, forkserver etc). This project is
a fork of AFL that uses different instrumentation approach which works on
Windows even for black box binary fuzzing.

## The WinAFL approach

Instead of instrumenting the code at compilation time, WinAFL supports the
following instrumentation modes:
 - Dynamic instrumentation using DynamoRIO (http://dynamorio.org/)
 - Hardware tracing using Intel PT
 - Static instrumentation via Syzygy

These instrumentation modes are described in more detail in the separate
documents.

<p align="center">
<img alt="afl-fuzz.exe" src="screenshots/afl-fuzz.gif"/>
</p>

To improve the process startup time, WinAFL relies heavily on persistent
fuzzing mode, that is, executing multiple input samples without restarting the
target process. This is accomplished by selecting a target function (that the
user wants to fuzz) and instrumenting it so that it runs in a loop.

#### Known CVEs

WinAFL has been successfully used to identify bugs in Windows software, such as

 * [Adobe] CVE-2018-4985, CVE-2018-5063, CVE-2018-5064, CVE-2018-5065, CVE-2018-5068, CVE-2018-5069, CVE-2018-5070, CVE-2018-12754, CVE-2018-12755, CVE-2018-12764, CVE-2018-12765, CVE-2018-12766, CVE-2018-12767, CVE-2018-12768, CVE-2018-12848, CVE-2018-12849, CVE-2018-12850, CVE-2018-12840, CVE-2018-15956, CVE-2018-15955, CVE-2018-15954,CVE-2018-15953, CVE-2018-15952, CVE-2018-15938, CVE-2018-15937, CVE-2018-15936, CVE-2018-15935, CVE-2018-15934, CVE-2018-15933, CVE-2018-15932 , CVE-2018-15931, CVE-2018-15930 , CVE-2018-15929, CVE-2018-15928, CVE-2018-15927, CVE-2018-12875, CVE-2018-12874 , CVE-2018-12873, CVE-2018-12872,CVE-2018-12871, CVE-2018-12870, CVE-2018-12869, CVE-2018-12867 , CVE-2018-12866, CVE-2018-12865 , CVE-2018-12864 , CVE-2018-12863, CVE-2018-12862, CVE-2018-12861, CVE-2018-12860, CVE-2018-12859, CVE-2018-12857, CVE-2018-12839 - found by <NAME> and <NAME> from Check Point Software Technologies
 * [Adobe] CVE-2018-12853, CVE-2018-16024, CVE-2018-16023, CVE-2018-15995 - found by <NAME> (guyio)
 * [Adobe] CVE-2018-16004, CVE-2018-16005, CVE-2018-16007, CVE-2018-16009, CVE-2018-16010, CVE-2018-16043, CVE-2018-16045, CVE-2018-16046, CVE-2018-19719, CVE-2018-19720, CVE-2019-7045 - found by <NAME> ([@bitshifter123](https://twitter.com/bitshifter123))
 * [Microsoft] CVE-2016-7212 - found by Aral Yaman of Noser Engineering AG
 * [Microsoft] CVE-2017-0073, CVE-2017-0190, CVE-2017-11816, CVE-2018-8472, CVE-2019-1311 - found by [<NAME>](https://twitter.com/symeonp)
 * [Microsoft] CVE-2018-8494 - found by Guy Inbar (guyio)
 * [Microsoft] CVE-2018-8464 - found by <NAME> of Check Point
 * [Microsoft] CVE-2019-0576, CVE-2019-0577, CVE-2019-0579, CVE-2019-0538, CVE-2019-0580, CVE-2019-0879, CVE-2019-0889, CVE-2019-0891, CVE-2019-0899, CVE-2019-0902, CVE-2019-1243, CVE-2019-1250,	CVE-2020-0874  - found by <NAME> of McAfee 
 * [Kollective Kontiki 10.0.1] CVE-2018-11672 - found by <NAME> from Salesforce
 * [Mozilla] CVE-2018-5177 - found by Guy Inbar (guyio)
 * [libxml2] CVE-2018-14404 - found by Gu<NAME>bar (guyio)
 * [WinRAR] CVE-2018-20250, CVE-2018-20251, CVE-2018-20252, CVE-2018-20253 - found by <NAME> of Check Point Software Technologies
 * [Various image viewers] CVE-2019-13083, CVE-2019-13084, CVE-2019-13085, CVE-2019-13242, CVE-2019-13243, CVE-2019-13244, CVE-2019-13245, CVE-2019-13246, CVE-2019-13247, CVE-2019-13248, CVE-2019-13249, CVE-2019-13250, CVE-2019-13251, CVE-2019-13252, CVE-2019-13253, CVE-2019-13254, CVE-2019-13255, CVE-2019-13256, CVE-2019-13257, CVE-2019-13258, CVE-2019-13259, CVE-2019-13260, CVE-2019-13261, CVE-2019-13262 - found by found by [@expend20](https://twitter.com/expend20) and <NAME> of Apriorit
 * [Foxit] CVE-2019-13330, CVE-2019-13331, CVE-2020-8844 - found by <NAME> ([@NattiSamson](https://twitter.com/NattiSamson))
 
(Let me know if you know of any others and I'll include them in the list)

## Building WinAFL

1. If you are building with DynamoRIO support, download and build
DynamoRIO sources or download DynamoRIO Windows binary package from
https://github.com/DynamoRIO/dynamorio/wiki/Downloads

2. If you are building with Intel PT support, pull third party dependencies by running `git submodule update --init --recursive` from the WinAFL source directory

3. Open Visual Studio Command Prompt (or Visual Studio x64 Win64 Command Prompt
if you want a 64-bit build). Note that you need a 64-bit winafl.dll build if
you are fuzzing 64-bit targets and vice versa.

4. Go to the directory containing the source

{'fraction_non_alphanumeric': 0.1114009913905557, 'fraction_numerical': 0.19306026611009652, 'mean_word_length': 4.177847816298964, 'pattern_counts': {'":': 0, '<': 44, '<?xml version=': 0, '>': 44, 'https://': 10, 'lorem ipsum': 0, 'www.': 2, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1385055', 'n_tokens_mistral': 5574, 'n_tokens_neox': 4023, 'n_words': 1279}