libfuzzer
Coverage-guided fuzzer built into LLVM for finding bugs in C/C++ code with minimal setup.
- In-process fuzzer that instruments code at compile time to track coverage; automatically minimizes crashing inputs and maintains a corpus of interesting test cases
- Supports AddressSanitizer, UndefinedBehaviorSanitizer, and MemorySanitizer for detecting memory errors, undefined behavior, and uninitialized reads
- Harnesses written for libFuzzer are compatible with AFL++, enabling easy migration to more advanced fuzzers if needed for multi-core campaigns
- Includes FuzzedDataProvider helper for extracting structured data from raw bytes, and supports fuzzing dictionaries to guide mutation toward valid inputs
- Best suited for quick single-project fuzzing on Linux; maintenance-only since 2022 but widely supported and stable for foreseeable future
libFuzzer
libFuzzer is an in-process, coverage-guided fuzzer that is part of the LLVM project. It's the recommended starting point for fuzzing C/C++ projects due to its simplicity and integration with the LLVM toolchain. While libFuzzer has been in maintenance-only mode since late 2022, it is easier to install and use than its alternatives, has wide support, and will be maintained for the foreseeable future.
When to Use
| Fuzzer | Best For | Complexity |
|---|---|---|
| libFuzzer | Quick setup, single-project fuzzing | Low |
| AFL++ | Multi-core fuzzing, diverse mutations | Medium |
| LibAFL | Custom fuzzers, research projects | High |
| Honggfuzz | Hardware-based coverage | Medium |
Choose libFuzzer when:
- You need a simple, quick setup for C/C++ code
- Project uses Clang for compilation
- Single-core fuzzing is sufficient initially
- Transitioning to AFL++ later is an option (harnesses are compatible)
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.2Ksemgrep
>-
3.8Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.8Kcodeql
>-
3.6Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.5Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.4K