Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/0xricksanchez/AFL_Runner/llms.txt

Use this file to discover all available pages before exploring further.

aflr add-seed injects new inputs into the corpus of a live AFL++ campaign without interrupting or restarting any of the running fuzzer instances. It works by invoking afl-fuzz in a short-lived single-execution calibration mode (AFL_BENCH_JUST_ONE=1, AFL_FAST_CAL=1, AFL_AUTORESUME=1) against the existing output directory, which causes AFL++ to evaluate and import the new inputs through its standard minimization and deduplication pipeline. The new entries are then picked up by the running fuzzers automatically via the sync mechanism. Use aflr add-seed when you discover interesting inputs mid-campaign — for example, from a different fuzzer, a manual test case, or a newly obtained sample corpus — and want to make them available without discarding any existing fuzzer state.

​
Synopsis

aflr add-seed [OPTIONS] --seed <SEED(S)> [-- <TARGET_ARGS>...]

​
Options

​
Target

​
-t, --target
path
Path to the AFL++-instrumented target binary used in the running campaign. This should be the same binary that was passed to aflr run with -t. Either this flag or --config must be provided.

​
Directories

​
-o, --output-dir
path
default:"/tmp/afl_output"
Path to the AFL++ output directory of the running campaign — the same path passed as -o to aflr run. The new seed inputs are imported into this directory’s corpus. Defaults to /tmp/afl_output.

​
Seed Input

​
--seed
path
required
Path to a single seed file or a directory of seed files to add to the corpus. When a single file is provided, aflr copies it into a temporary directory before passing it to afl-fuzz as an input directory (AFL++ requires a directory for -i). When a directory is provided, it is passed directly. The path must exist at invocation time.

​
Configuration

​
--config
path
Path to a TOML configuration file. The [target] and [afl_cfg] sections are merged with CLI flags; explicit CLI flags take precedence.

​
Target Arguments

aflr add-seed [OPTIONS] --seed <SEED(S)> -- <TARGET_ARGS>...
Pass target binary arguments after a -- separator. Use @@ where AFL++ should substitute the input file path. These arguments must match the ones used in the running campaign — otherwise the calibration run may behave differently from the live fuzzers.

​
How It Works

Internally, aflr add-seed invokes afl-fuzz with a unique random secondary name (an 8-character UUID fragment via -S <uuid>) and the following environment variables set:
VariableValuePurpose
AFL_BENCH_JUST_ONE1Exit after a single calibration round
AFL_FAST_CAL1Use fast calibration to speed up the import
AFL_IGNORE_SEED_PROBLEMS1Skip inputs that trigger errors during calibration
AFL_AUTORESUME1Merge into the existing output directory rather than failing
After the short-lived afl-fuzz run exits, the imported inputs are visible in the output directory’s queue and will be picked up by the running fuzzer instances on their next sync cycle.

​
Examples

# Add a single seed file to a running campaign
aflr add-seed -t ./target_afl -o /tmp/afl_out --seed ./interesting_input.bin

# Add an entire directory of new seeds
aflr add-seed -t ./target_afl -o /tmp/afl_out --seed ./newly_found_corpus/

# Target that reads a file via @@
aflr add-seed -t ./target_afl -o /tmp/afl_out --seed ./new_sample.bin -- @@

# Load target and output paths from config, only specify the seed
aflr add-seed --config ./aflr_cfg.toml --seed ./extra_seeds/

# Multiple extra seeds from a crash triage directory
aflr add-seed -t ./target_afl -o /tmp/afl_out --seed ./triaged_crashes/
aflr add-seed is most useful when you obtain interesting inputs mid-campaign — for example, from a parallel fuzzer (libFuzzer, Honggfuzz), a public PoC, or a test case generated by a grammar-based tool. Rather than restarting the campaign and losing all accumulated fuzzer state, aflr add-seed lets you enrich the corpus in place while all running fuzzer instances continue uninterrupted.
The --seed path must exist at the time aflr add-seed is invoked. If a file is specified, aflr copies it into a temporary directory before import; if a directory is specified, it is used directly. Passing a non-existent path will cause the command to exit with an error before any afl-fuzz process is launched.
Keep your target arguments (-- <TARGET_ARGS>) consistent with those used in the running campaign. Mismatched arguments during the calibration run can cause AFL++ to reject seeds that would otherwise be valid, or import inputs that are not meaningful for the running fuzzers.

Build docs developers (and LLMs) love

Get started for freeTalk to us