afl-fuzz(8) System Manager's Manual afl-fuzz(8) (NAME) afl-fuzz - AFL++ (SYNOPSIS) afl-fuzz [ ] -- /path/to/target_app [ ... ] (OPTIONS) : -i dir - ( '-' AFL_AUTORESUME ) -o dir - : -P strategy - : explore ( ) exploit ( /). exploit (: 1000) -p schedule - (power schedules) : explore () fast exploit seek rare mmopt coe lin quad -- docs/FAQ.md -f file - (: stdin @@) -t msec - ( 1000 ). '+' . -m megs - (0 0 = []) -O - ( FRIDA) -Q - ( QEMU) -U - Unicorn ( Unicorn) -W - QEMU Wine ( Wine) -X - ( NYX - ) -Y - ( NYX - ) -K dir - ( GUI) (Mutator): -a type - "text" "binary" (: generic) -g minlength - (: 1) -G maxlength - (: 1048576) -L minutes - MOpt(imize) (pacemaker) ( ). 0 = -1 = . : -u - (testcase splicing) -c program - CmpLog . QEMU/FRIDA CmpLog '-c 0' . CMPLOG '-c -' . -l cmplog_opts - CmpLog ( "2ATR"): 1= 2= () 3= A= T= X= R= M= ( ) Z= ( AFL_LLVM_BUG_ALLOCSIZE_DERIVE). : -Z - -N - ( unlink) ( ) -n - ( / non-instrumented) -x dict_file - ( README.md ) -w san_binary - (sanitizer) . docs/SAND.md . : -s seed - (seed) (RNG) -V seconds - ( !) -E execs - : . : -M/-S id - (-M -Z ) docs/fuzzing_in_depth.md#c-using-multiple-cores . -F path - ( -M ) -z - (deterministic) ( -d -D .) -T text - -I command - (crash) -C - ( peruvian rabbit) -b cpu_id - (bind) (0-...) -e ext - ( ) : LD_BIND_LAZY: LD_BIND_NOW ASAN_OPTIONS: ASAN ( abort_on_error=1 symbolize=0 ) MSAN_OPTIONS: MSAN ( exitcode=86 symbolize=0 ) AFL_ALLOW_CORES: core dump AFL_AUTORESUME: -o AFL_BENCH_JUST_ONE: AFL_BENCH_UNTIL_CRASH: (crash) AFL_CMPLOG_ONLY_NEW: cmplog ( !) AFL_CRASH_EXITCODE: AFL_CUSTOM_MUTATOR_LIBRARY: afl_custom_fuzz() AFL_CUSTOM_MUTATOR_ONLY: AFL++ AFL_CYCLE_SCHEDULES: -p AFL_DEBUG: (trimming) AFL_DEBUG_CHILD: stdout/stderr AFL_DISABLE_REDUNDANT: (redundant) AFL_DISABLE_TRIM: (trimming) AFL_DUMB_FORKSRV: fork AFL_EXIT_WHEN_DONE: AFL_EXIT_ON_TIME: AFL_EXIT_ON_SEED_ISSUES: AFL_EXPAND_HAVOC_NOW: (expand havoc) (: ) AFL_FAST_CAL: AFL_FORCE_UI: ( ) AFL_FORKSRV_INIT_TMOUT: forkserver ( ) AFL_FRAMESHIFT_DISABLE: FRAMESHIFT AFL_HANG_TMOUT: ( ) AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: core dump AFL_IGNORE_PROBLEMS: AFL_IGNORE_PROBLEMS_COVERAGE: AFL_IGNORE_PROBLEMS - AFL_IGNORE_SEED_PROBLEMS: AFL_IGNORE_TIMEOUTS: (timeout) AFL_IGNORE_UNKNOWN_ENVS: AFL_IMPORT_FIRST: (import) AFL_INPUT_LEN_MIN/AFL_INPUT_LEN_MAX: -g/-G / AFL_INPUT_PLACEHOLDER: (: @@) @@ AFL_PIZZA_MODE: 1 - -1 - 0 () - AFL_KILL_SIGNAL: (: SIGKILL) AFL_FORK_SERVER_KILL_SIGNAL: (kill) fork server (: SIGTERM). AFL_KILL_SIGNAL . AFL_MAP_SIZE: . >= AFL_MAX_DET_EXTRAS: . : 200. AFL_NO_AFFINITY: AFL_TRY_AFFINITY: AFL_NO_ARITH: (deterministic) AFL_NO_AUTODICT: AFL_NO_CPU_RED: CPU AFL_NO_FORKSRV: execve forkserver AFL_NO_SNAPSHOT: (snapshot) ( ) AFL_NO_STARTUP_CALIBRATION: AFL_NO_WARN_INSTABILITY: AFL_NO_UI: AFL_NYX_AUX_SIZE: Nyx. 4096 . . 4096 . AFL_NYX_DISABLE_SNAPSHOT_MODE: ( ) AFL_NYX_LOG: NYX hprintf AFL_NYX_REUSE_SNAPSHOT: Nyx AFL_OLD_CHILD_SYNC: (persistent-mode) + futex ( ) AFL_PATH: AFL AFL_PYTHON_MODULE: AFL_QUIET: forkserver AFL_POST_PROCESS_KEEP_ORIGINAL: AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES AFL_TARGET_ENV: AFL_SHUFFLE_QUEUE: AFL_SKIP_BIN_CHECK: afl AFL_SKIP_CPUFREQ: AFL_STATSD: StatsD AFL_STATSD_HOST: statsd ( 127.0.0.1) AFL_STATSD_PORT: statsd (: 8125) AFL_STATSD_TAGS_FLAVOR: statsd (: ) : dogstatsd librato signalfx influxdb AFL_FORCE_FASTRESUME: AFL_NO_FASTRESUME: AFL_NO_SYNC: AFL_SYNC_TIME: ( ) AFL_FINAL_SYNC: ( !) AFL_NO_CRASH_README: README AFL_TESTCACHE_SIZE: ( ) AFL_TMPDIR: ( ramdisk ) AFL_EARLY_FORKSERVER: forkserver afl-clang-fast/afl-clang-lto/afl-gcc-fast AFL_PERSISTENT: ( __AFL_LOOP ) AFL_DEFER_FORKSRV: forkserver (__AFL_INIT ) AFL_FUZZER_STATS_UPDATE_INTERVAL: fuzzer_stats (: 60 : 1) Python 3.14.5 docs/custom_mutators.md AFL_PERSISTENT_RECORD. shmat. docs/README.md :) (AUTHORS) AFL++ Michal "lcamtuf" Zalewski Marc "van Hauser" Heuse Dominik Maier Andrea Fioraldi Heiko "hexcoder-" Eissfeldt . AFL++ : https://github.com/AFLplusplus/AFLplusplus (LICENSE) AFL++ AGPL-3.0-or-later Apache-2.0 . : https://github.com/AFLplusplus/AFLplusplus/blob/stable/LICENSING.md AFL++ 2026-06-05 afl-fuzz(8)