Skip to content

Added GPU - CUDA support - #486

Open
nextep wants to merge 1 commit into
googleprojectzero:masterfrom
nextep:master
Open

Added GPU - CUDA support#486
nextep wants to merge 1 commit into
googleprojectzero:masterfrom
nextep:master

Conversation

@nextep

@nextep nextep commented Jul 23, 2026

Copy link
Copy Markdown

Hi,

I started this in 2025 to speed up my fuzzing and got it stable enough to share it with the community.

WithGPU

Summary

This introduces Hardware-Accelerated CUDA GPU Mutation Offloading (Tier 1 GPU Havoc Engine) to WinAFL, enabling massive parallel input generation on NVIDIA GPUs while leaving CPU cores free for target execution and instrumentation tracing (DynamoRIO, Intel PT, TinyInst).
Contributed by Elias Ibrahim (elie.ibrahim@gmail.com), July 2026.

Key Architectural Features

  1. Tier 1 GPU Havoc Mutator (afl-fuzz-gpu.cu / afl-fuzz-gpu.h)
    • Offloads seed havoc stage mutations (single/multi-bit flips, byte additions/subtractions, block overwrites, and dictionary insertions) across thousands of parallel CUDA threads.
    • Encapsulated in a singleton GPU manager context (gpu_init, gpu_mutate_batch_async, gpu_sync, gpu_get_mutation).
  2. Double-Buffered Asynchronous Memory Pipeline
    • Allocates page-locked host memory (cudaMallocHost) for zero-copy DMA transfers over PCIe.
    • Uses dual CUDA streams (cudaStream_t) and cudaMemcpyAsync so the CPU evaluates testcase batch $N$ while the GPU concurrently mutates batch $N+1$.
  3. Hardware cuRand & Memory Coalescing
    • Initializes per-thread hardware CUDA curandState generators for high-quality, lock-free parallel entropy.
    • Transposes VRAM mutation matrices for 100% warp memory coalescing efficiency.
  4. Tier 2 GPU Target Execution Template (experimental/gpu_harness_template.cu)
    • Included template for pure-logic targets running entirely in VRAM with atomicOr() shared-memory coverage tracking.
  5. Graceful Fallback & Full Backward Compatibility
    • If compiled without CUDA support or executed on hardware without an NVIDIA GPU, WinAFL falls back to standard CPU fuzzing without breaking existing DynamoRIO or Intel PT workflows.
  6. Automated Target Analysis & Harness Tooling
    • winafl-target-finder.py: Automated scanning of Windows binaries, seed corpus builder, and harness launcher.
    • winafl-harness-builder.py: Automated C/C++ fuzzer harness code generator.
    • ghidra_bridge.py: Protocol-agnostic Ghidra MCP server bridge client.

Command Line Flags & Configuration

  • CLI Flag: Pass -G (or /gpu) to afl-fuzz.exe to activate GPU mode.
  • Environment Variable: AFL_GPU_BATCH_SIZE overrides the number of parallel GPU threads allocated per batch (default: 10000).
    Example:
bin\Release\afl-fuzz.exe -G -i in -o out -t 1000 -D C:\path\to\DynamoRIO\bin64 -- target.exe @@

@ifratric

Copy link
Copy Markdown
Collaborator

The pull request adds a lot of unneeded build files so it's impossible to review as is. But in any case, it sounds like this should be a fork rather than merged into WinAFL repo.

@nextep

nextep commented Jul 24, 2026

Copy link
Copy Markdown
Author

Hi @ifratric, OMG my bad and apologies for the noise in the initial push!

A local CMake/MSBuild run generated build outputs directly in the root directory, which accidentally got staged by .gitignore.

I've updated the .gitignore, purged all build artifacts, and force-pushed a clean single commit containing only the source code modifications, CUDA device kernels, documentation, and tooling scripts.

19 files total.

Thanks for the feedback!

Happy to create another PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants