{"id":299,"date":"2025-12-22T16:30:15","date_gmt":"2025-12-22T16:30:15","guid":{"rendered":"https:\/\/haco.club\/?p=299"},"modified":"2025-12-22T16:30:15","modified_gmt":"2025-12-22T16:30:15","slug":"afl_skip_bin_check","status":"publish","type":"post","link":"https:\/\/haco.club\/?p=299","title":{"rendered":"AFL_SKIP_BIN_CHECK"},"content":{"rendered":"\n

export AFL_SKIP_BIN_CHECK=1<\/code> is an environment variable setting that tells AFL++ to stop complaining that your target program doesn’t look like it was compiled with AFL.<\/strong><\/p>\n\n\n\n

By default, AFL++ checks your target binary for specific “instrumentation” markers before it starts. If it doesn’t find them, it assumes you made a mistake (like compiling with gcc<\/code> instead of afl-cc<\/code>) and refuses to run to save you from wasting time.<\/p>\n\n\n\n

When should you use this?<\/h3>\n\n\n\n

You generally should not<\/strong> use this unless you know exactly why. However, here are the valid scenarios where it is required:<\/p>\n\n\n\n

1. You are fuzzing a script (Python, Bash, etc.)<\/strong>
AFL++ is designed for compiled binaries (C\/C++). If you are using a wrapper to fuzz a Python script, AFL checks the wrapper (e.g., \/usr\/bin\/python<\/code>), sees it wasn’t compiled with afl-cc<\/code>, and errors out.<\/p>\n\n\n\n

    \n
  • Solution:<\/strong> Set AFL_SKIP_BIN_CHECK=1<\/code> so AFL++ ignores that the python binary isn’t instrumented, trusting that your wrapper handles the fuzzing logic.<\/li>\n<\/ul>\n\n\n\n

    2. You are using “Blackbox” Fuzzing (QEMU\/Frida mode)<\/strong>
    Sometimes when using QEMU mode (-Q<\/code>) or Frida mode to fuzz a binary you don’t have source code for, AFL++ might still fail the initial check because the binary looks “weird” or stripped.<\/p>\n\n\n\n

      \n
    • Solution:<\/strong> Setting this bypasses the check so QEMU can handle the instrumentation dynamically.<\/li>\n<\/ul>\n\n\n\n

      3. You are using a custom wrapper<\/strong>
      If you wrote a C program that calls another program, or a shell script that pipes input to a binary, AFL++ might not detect the instrumentation in the final target.<\/p>\n\n\n\n

      The Danger<\/h3>\n\n\n\n

      If you set this variable when you are NOT<\/strong> in one of the above special scenarios, AFL++ will run, but it will not find any bugs.<\/strong><\/p>\n\n\n\n

        \n
      • It will run the program blindly.<\/li>\n\n\n\n
      • It will not receive coverage feedback (it won’t know which inputs are “good”).<\/li>\n\n\n\n
      • It will effectively be a random number generator throwing garbage at your program, which is extremely inefficient.<\/li>\n<\/ul>\n\n\n\n

        Summary:<\/strong> Only use export AFL_SKIP_BIN_CHECK=1<\/code> if AFL++ refuses to run and<\/em> you are sure you are using a special fuzzing mode (like scripts or binary-only) where standard instrumentation is not expected.<\/p>\n\n\n\n

        \n\n\n\n

        The specific “instrumentation” markers AFL++ checks<\/strong><\/p>\n\n\n\n

        AFL++ checks for two types<\/strong> of markers: Static Symbols<\/strong> (variables in the binary) and Runtime Behavior<\/strong> (the forkserver handshake).<\/p>\n\n\n\n

        When you set AFL_SKIP_BIN_CHECK=1<\/code>, you are telling AFL++ to ignore the absence of both.<\/p>\n\n\n\n

        1. Static Markers (Symbols)<\/h3>\n\n\n\n

        AFL++ inspects your binary (roughly equivalent to running nm<\/code> or readelf<\/code>) to see if specific variables injected by the compiler exist. If they are missing, it assumes the binary was compiled with standard gcc<\/code> instead of afl-cc<\/code>.<\/p>\n\n\n\n

        The most critical symbols it looks for are:<\/p>\n\n\n\n

          \n
        • __afl_area_ptr<\/code><\/strong>: This is a pointer to the “Shared Memory” map where code coverage is stored. It is the single most important variable for AFL.<\/li>\n\n\n\n
        • __afl_prev_loc<\/code><\/strong>: A thread-local variable that stores the ID of the previous<\/em> basic block executed (used to calculate edge coverage: A -> B).<\/li>\n\n\n\n
        • __afl_map_size<\/code><\/strong>: Stores the size of the coverage map (usually 64KB).<\/li>\n<\/ul>\n\n\n\n

          If you strip your binary (using strip<\/code>), these symbols might be removed from the symbol table, causing AFL++ to think the binary is not instrumented, even if it actually is.<\/p>\n\n\n\n

          2. Runtime Markers (The Forkserver Handshake)<\/h3>\n\n\n\n

          This is the functionality check. When afl-fuzz<\/code> starts, it tries to “wake up” the instrumentation inside your target.<\/p>\n\n\n\n

            \n
          1. The Handshake:<\/strong> AFL++ sends a signal to your target program via a specific file descriptor (Control Pipe, usually FD 198).<\/li>\n\n\n\n
          2. The Response:<\/strong> It expects the target to pause immediately (before main<\/code> typically starts) and send exactly 4 bytes<\/strong> back via another file descriptor (Status Pipe, usually FD 199).<\/li>\n<\/ol>\n\n\n\n

            If the program just runs normally and doesn’t send those 4 bytes back, AFL++ concludes: “This program doesn’t have the forkserver built-in,” and aborts.<\/p>\n\n\n\n

            Summary<\/h3>\n\n\n\n

            When you use export AFL_SKIP_BIN_CHECK=1<\/code>:<\/p>\n\n\n\n

              \n
            • It skips the symbol check:<\/strong> It won’t complain if __afl_area_ptr<\/code> is missing.<\/li>\n\n\n\n
            • It skips the handshake requirement:<\/strong> It will run the program blindly (using execve<\/code> every time instead of the forkserver), which is much slower and provides no coverage feedback unless you are using QEMU (-Q<\/code>) or Frida mode.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

              export AFL_SKIP_BIN_CHECK=1 is an environment variable setting that tells AFL++ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[42],"tags":[49],"class_list":["post-299","post","type-post","status-publish","format-standard","hentry","category-knowledge-base","tag-afl"],"_links":{"self":[{"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/posts\/299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/haco.club\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=299"}],"version-history":[{"count":1,"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/posts\/299\/revisions"}],"predecessor-version":[{"id":300,"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/posts\/299\/revisions\/300"}],"wp:attachment":[{"href":"https:\/\/haco.club\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/haco.club\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/haco.club\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}