thisistfs/rogue-frameworkDesktop workbench for AFL++ fuzzing, cross-architecture QEMU emulation, harness development, Ghidra headless analysis, custom mutators, and patch comparison for exploit development.
Rogue Framework is a desktop workbench for AFL++, cross-architecture QEMU fuzzing, harness development, lightweight Ghidra headless analysis, custom mutators, and patch comparison. It is intentionally an auditable workbench rather than a button-only wrapper: every generated AFL++ command is visible before execution, and generated harnesses are ordinary source files that the researcher can edit. It suppose to be "The BurpSuite of exploit developers"
Rogue Framework currently targets Linux and Python 3.11+ with PyQt6.
On Kali Linux, the installer sets up the Python environment, clones the official
AFL++ stable branch and builds its complete distribution and instrumented QEMU
backend, then installs Ghidra headless, native/multiarch GDB, GDB server, QEMU
user/system emulation, compiler/build dependencies, a user launcher, and
persistent shell PATH entries. AFL++ is downloaded into the ignored local
AFLplusplus/ directory and is not distributed as part of Rogue Framework:
chmod +x install.sh
./install.sh
rogue-framework
Install common cross compilers and their guest sysroots as well (this is a much larger download) with:
./install.sh --with-cross-toolchains
The installer is idempotent. Use ./install.sh --check to audit an existing
installation or ./install.sh --rebuild-afl to force an AFL++/QEMU rebuild.
Use ./install.sh --update-afl to explicitly fast-forward the downloaded
checkout to the latest official stable revision.
Run it as the desktop user; it requests sudo only for apt packages. A newly
written PATH cannot alter the already-running parent shell, so either open a new
terminal, source ~/.zshrc/~/.bashrc, or launch Rogue through the absolute
~/.local/bin/rogue-framework path printed by the installer.
Manual startup from the checkout remains available:
python3 run.py
For an editable environment:
python3 -m pip install -e .
rogue-framework
Cross-architecture dynamic binaries need a matching guest sysroot selected with
QEMU_LD_PREFIX; this is inherently target/distribution-specific. Ghidra's
analyzeHeadless path can be overridden under Tools → External tools.
An .rgp project is readable, versioned JSON containing the portable project definition. Large and mutable artifacts live in its managed companion workspace:
example.rgp
example.rgp-work/
workspace.json
project.sqlite3
corpus/
output/
harnesses/
mutators/
analysis/
logs/
runs/
staging/
recovery/
backups/
objects/sha256/
This split keeps project files reviewable and avoids embedding crash corpora, findings, analysis indexes, or Ghidra state into JSON. workspace.json binds the manifest to the correct workspace identity, while project.sqlite3 stores operational/indexed state. Managed references use workspace://; explicitly external resources use external://. Machine-local tool paths and UI state are stored outside the portable project.
Save As creates an independent clone with new project and workspace identities. Rogue stages and validates the destination before switching the open document, so a failed clone leaves the source project unchanged. Canonical saves use an advisory writer lease plus revision/SHA-256 conflict checks, preserve previous-good manifests, publish files atomically with fsync, and maintain crash-recovery snapshots including active editor drafts. Generated harnesses, mutators, Ghidra JSON, patch-diff results, and minimized findings are also published transactionally so a failed replacement does not delete the prior valid artifact.
.fuzz projectsRogue can import legacy schema 0–2 .fuzz manifests and their .fuzz-work companions. The legacy source is never the canonical destination: the first save upgrades it to a sibling .rgp project and .rgp-work workspace while retaining the original legacy files. New projects and Save As destinations always use .rgp.