Android greybox fuzzing with AFL++ Frida mode

Introduction

We detail here a convenient way to do greybox¹ fuzzing on native Android binaries. Several approaches exist, mainly:

• fuzz directly on the Android system;


• fuzz by emulating all or part of the Android system.

The method discussed here allows to fuzz directly on the Android device. To do so, the AFL++² fuzzer is chosen. Greybox fuzzing requires binary instrumentation to use coverage and improve the fuzzer's effectiveness. AFL++ offers a Frida mode, which makes that possible. …

afl amp android android device article binary device frida fuzz fuzzer fuzzing instrumentation introduction mode system