Hi,

I started this in 2025 to speed up my fuzzing and got it stable enough to share it with the community.

Summary

This introduces Hardware-Accelerated CUDA GPU Mutation Offloading (Tier 1 GPU Havoc Engine) to WinAFL, enabling massive parallel input generation on NVIDIA GPUs while leaving CPU cores free for target execution and instrumentation tracing (DynamoRIO, Intel PT, TinyInst).
Contributed by Elias Ibrahim (elie.ibrahim@gmail.com), July 2026.

Key Architectural Features

1. Tier 1 GPU Havoc Mutator (afl-fuzz-gpu.cu / afl-fuzz-gpu.h)
   • Offloads seed havoc stage mutations (single/multi-bit flips, byte additions/subtractions, block overwrites, and dictionary insertions) across thousands of parallel CUDA threads.
   • Encapsulated in a singleton GPU manager context (gpu_init, gpu_mutate_batch_async, gpu_sync, gpu_get_mutation).
2. Double-Buffered Asynchronous Memory Pipeline
   • Allocates page-locked host memory (cudaMallocHost) for zero-copy DMA transfers over PCIe.
   • Uses dual CUDA streams (cudaStream_t) and cudaMemcpyAsync so the CPU evaluates testcase batch $N$ while the GPU concurrently mutates batch $N+1$.
3. Hardware cuRand & Memory Coalescing
   • Initializes per-thread hardware CUDA curandState generators for high-quality, lock-free parallel entropy.
   • Transposes VRAM mutation matrices for 100% warp memory coalescing efficiency.
4. Tier 2 GPU Target Execution Template (experimental/gpu_harness_template.cu)
   • Included template for pure-logic targets running entirely in VRAM with atomicOr() shared-memory coverage tracking.
5. Graceful Fallback & Full Backward Compatibility
   • If compiled without CUDA support or executed on hardware without an NVIDIA GPU, WinAFL falls back to standard CPU fuzzing without breaking existing DynamoRIO or Intel PT workflows.
6. Automated Target Analysis & Harness Tooling
   • winafl-target-finder.py: Automated scanning of Windows binaries, seed corpus builder, and harness launcher.
   • winafl-harness-builder.py: Automated C/C++ fuzzer harness code generator.
   • ghidra_bridge.py: Protocol-agnostic Ghidra MCP server bridge client.

Command Line Flags & Configuration

• CLI Flag: Pass -G (or /gpu) to afl-fuzz.exe to activate GPU mode.
• Environment Variable: AFL_GPU_BATCH_SIZE overrides the number of parallel GPU threads allocated per batch (default: 10000).
  Example:

bin\Release\afl-fuzz.exe -G -i in -o out -t 1000 -D C:\path\to\DynamoRIO\bin64 -- target.exe @@