aflpp

# AFL++ ## Contract | Field | Bound contract | |---|---| | Trigger | User needs AFL++ setup, multi-core campaign operation, corpus handling, or AFL++ crash triage for a C/C++ target. | | Authority | Reversible local execution of AFL++ binaries and writes to build artifacts, corpora, logs, and output directories under the working directory. The skill must request explicit user approval before any system-level change: package installation, Docker image pull, kernel tuning, GRUB mutation, or reboot. Roll back by killing campaign processes and removing the output and state directories. | | Side effect | Local writes to compiled artifacts, seed and output corpora, log files, and short-lived Docker containers. No mutation of source under test beyond compilation. | | Done | AFL++ target runs against a seed corpus with the intended instrumentation and produces interpretable campaign output. | ## Inputs - Target source tree (C/C++) with a fuzz harness or a program that reads stdin, files, or argv. Required. - Seed corpus directory with at least one non-empty file. Required; created if absent. - Run location: host or Docker. Required; default Docker. - Compilation mode preference (LTO, LLVM, or GCC). Optional; default tries LTO, falls back to LLVM. - Core count for multi-core campaigns. Optional; default is a single instance. - Dictionary file for format-aware fuzzing. Optional. - Sanitizer selection (ASan, UBSan, none). Optional; default none. ## Procedure ### 1. Select run loca...