LLVM ships with a fuzzing library, docs at https://llvm.org/docs/LibFuzzer.html https://llvm.org/docs/LibFuzzer.html. I get the impression that AFL is considere

LLVM ships with a fuzzing library, docs at https://llvm.org/docs/LibFuzzer.html https://llvm.org/docs/LibFuzzer.html. I get the impression that AFL is considered better. The authors of llvm fuzz stopped working on it in favour of some other thing, which they then stopped working on in favour of https://github.com/google/fuzztest https://github.com/google/fuzztest, which seems to be broadly useless as a fuzzer implementation. But whatever, the llvm fuzzer lives on and has uses in tree and occasional updates. I found it much easier to get started with than AFL. I wrote a program that takes a byte array as input and drives the library under test with it, attached that to llvm's fuzzer and left it running. You end up with a lot of files containing some bytes that did something vaguely interesting with the program. Good experience overall. You might get some meaning out of https://github.com/JonChesterfield/bigint/tree/trunk/fuzz_bigint https://github.com/JonChesterfield/bigint/tree/trunk/fuzz_bi... but ymmv, I got sidetracked by interesting stuff at work ~3 months back and don't currently remember what state that repo was in when I paused work on it.