I don't know about their implementation, but I wrote exactly this plugin for GCC several months ago and announced it on the afl mailing list, as a patch to the

I don't know about their implementation, but I wrote exactly this plugin for GCC several months ago and announced it on the afl mailing list, as a patch to the source. The lack of replies lead me to believe it was mostly uninteresting to people - but maybe I should have advertised it more. You can find the source code here: https://github.com/thoughtpolice/afl/commit/e54c0237e934d7340d477a837eb891c4fe638b26 https://github.com/thoughtpolice/afl/commit/e54c0237e934d734... It should not be difficult to update this to work on more GCC versions (I only tested on GCC 4.8.x), but that will take some #ifdef'ery. Porting to newer AFLs should be relatively trivial. EDIT: I initially wrote this for no particular reason, mind you, other than to play around with writing GCC plugins, and the result wasn't so bad, modulo non-existant documentation. I also thought it would be nice to have an identical equivalent to 'afl-clang-fast' for GCC ('afl-gcc-fast'), in the hopes that perhaps one day the hacky, sed-inspired backends could be removed from afl. I initially wanted to use this on a POWER machine as proof of a portable GCC plugin for afl, although I lost interest in porting to a newer GCC, before losing access to the machine. Watching afl fly on 176 cores was fun, though.