aeondave/winafl
offensive-tools/fuzzing/winafl/SKILL.md
Auth/lab ref: Coverage-guided fuzzing framework for Windows binaries. For fuzzing desktop apps, DLL harnesses, or Windows services with DynamoRIO/TinyInst/Intel PT instrumentation and persistent-loop target functions.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill winaflInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 8, 2026, 3:52 AM150.5s1 file scanned
SKILL.md
- name:
- winafl
- description:
- Auth/lab ref: Coverage-guided fuzzing framework for Windows binaries. For fuzzing desktop apps, DLL harnesses, or Windows services with DynamoRIO/TinyInst/Intel PT instrumentation and persistent-loop target functions.
- license:
- Apache-2.0
- compatibility:
- Windows (primary), Visual Studio toolchain; supports DynamoRIO/TinyInst/Intel PT modes.
- author:
- GitHub Copilot
- version:
- 1.1
winafl
Windows-focused AFL fork designed for black-box and harnessed binary fuzzing.
Quick Start
# Typical shape (high-level)
afl-fuzz -i in -o out -- [instrumentation options] -- target_cmdline
# Example build (x64)
cmake -G"Visual Studio 16 2019" -A x64 .. -DDynamoRIO_DIR=C:\path\to\DynamoRIO\cmake -DINTELPT=1
cmake --build . --config Release
Operator Flow
- Choose instrumentation backend (DynamoRIO first, TinyInst/PT as needed).
- Select a target function that opens/parses/closes input and returns normally.
- Validate debug run before long fuzz sessions.
- Launch campaign with stable timeout/memory bounds.
- Periodically minimize corpus and verify reproductions.
Core Concepts
- Select a target function that:
- opens/parses/closes input each iteration,
- returns normally (no hard process exit),
- is reachable without manual UI interaction.
- Persistent loop behavior is central for throughput.
- Instrumentation choices: DynamoRIO, TinyInst, Intel PT, Syzygy.
Practical Tricks
- Prefer shared-memory sample delivery (
-s) when file locking causes rewrite failures. - For services you cannot launch directly, use attach mode (
-A <module>) with external process supervision. - Use
winafl-cmin.pyto control corpus growth and speed up cycles. - Keep target architecture aligned (32-bit vs 64-bit) across target, DLL, and instrumentation stack.
Useful Options
| Flag | Purpose |
|------|---------|
| -D <dir> | DynamoRIO binaries path |
| -w <dll> | winafl.dll path |
| -P | Intel PT mode |
| -s | Shared-memory sample delivery |
| -A <module> | Attach mode for running processes/services |
| -l <dll> | Custom testcase processing/mutator DLL |
Common Pitfalls
- Target function not closing input each iteration -> rewrite failures and false timeouts.
- Function exits process instead of returning -> broken persistent loop.
- Skipping debug mode before fuzzing -> difficult timeout diagnosis.
- Network-mode custom DLL workflows without restart hygiene -> unstable long runs.
Resources
- https://github.com/googleprojectzero/winafl
- https://github.com/googleprojectzero/winafl/blob/master/README.md
- https://github.com/googleprojectzero/TinyInst
- https://dynamorio.org/
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026