afl-cc

afl-cc [compiler options] source_files...
afl-c++ [compiler options] source_files...

afl-cc --afl-MODE source.c

export AFL_CC_COMPILER=LTO  # or LLVM, GCC_PLUGIN, GCC, CLANG

# Compile with default instrumentation
afl-cc -o program program.c

# Compile C++ program
afl-c++ -o program program.cpp

# Use LTO for collision-free coverage
afl-clang-lto -o program program.c

# Or via environment variable
AFL_CC_COMPILER=LTO afl-cc -o program program.c

# Enable AddressSanitizer
AFL_USE_ASAN=1 afl-cc -o program program.c

# Multiple sanitizers
AFL_USE_ASAN=1 AFL_USE_UBSAN=1 afl-cc -o program program.c

# Build CmpLog binary for afl-fuzz -c option
AFL_LLVM_CMPLOG=1 afl-cc -o program.cmplog program.c

# Enable context-sensitive instrumentation
AFL_LLVM_INSTRUMENT=CTX afl-cc -o program program.c

# Split all comparisons
AFL_LLVM_LAF_ALL=1 afl-cc -o program program.c

# Only instrument specific files
echo "target_function" > allowlist.txt
AFL_LLVM_ALLOWLIST=allowlist.txt afl-cc -o program program.c

#include <unistd.h>

__AFL_FUZZ_INIT();

int main(int argc, char **argv) {
  __AFL_INIT();  // Optional: early forkserver
  
  unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
  
  while (__AFL_LOOP(10000)) {
    int len = __AFL_FUZZ_TESTCASE_LEN;
    
    // Fuzz target with buf[0..len-1]
    fuzz_target(buf, len);
  }
  
  return 0;
}