Skip to content

Commit 25910eb

Browse files
committed
fix readme
1 parent 912a278 commit 25910eb

File tree

1 file changed

+12
-13
lines changed

1 file changed

+12
-13
lines changed

README.md

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,24 +19,24 @@ This is a modified afl-cov fork because the original author's account is
1919
inactive :-(
2020

2121
It has several improvements:
22-
* Much, much faster!
22+
* Much, much faster (thanks to @domenukk)!
2323
* afl-cov now accepts "@@" like AFL++ in the target command parameters
2424
* afl-cov now can send to targets that read on stdin (just omit @@)
25-
* afl-cov has a timeout -T option to hangs are not an issue, default 5s
25+
* afl-cov has a timeout -T option, so hangs are not an issue. default: 5s
2626
* afl-cov.sh makes using afl-cov easier (just needs two parameters)
27-
* afl-cov-build.sh makes builing a target for coverage easier, just type
28-
`afl-cov-build.sh make`
27+
* afl-cov-build.sh makes builing a target for coverage easier, just type e.g.
28+
`afl-cov-build.sh ./configure ; make`
2929
* afl-cov/afl-cov.sh/afl-cov-build.sh now support clang coverage, just add
30-
-c to afl-cov.sh/afl-cov-build.sh (--clang for afl-cov)
30+
-c to afl-cov.sh/afl-cov-build.sh and --clang for afl-cov
3131
* afl-stat.sh shows the statistics of a run (in progress or completed)
3232

3333
Enjoy!
3434

35-
Marc "vanHauser" Heuse
35+
Marc "van Hauser" Heuse
3636

3737
## Introduction
3838
`afl-cov` uses test case files produced by the
39-
[AFL fuzzer](http://lcamtuf.coredump.cx/afl/) `afl-fuzz` to generate gcov code
39+
[AFL++ fuzzer](http://github.com/AFLplusplus/aflplusplus) `afl-fuzz` to generate gcov code
4040
coverage results for a targeted binary. Code coverage is interpreted from one
4141
case to the next by `afl-cov` in order to determine which new functions and
4242
lines are hit by AFL with each new test case. Further, `afl-cov` allows for
@@ -116,22 +116,21 @@ Here is an example:
116116
```bash
117117
$ cd /path/to/project-gcov/
118118
$ afl-cov -d /path/to/afl-fuzz-output/ --live --coverage-cmd \
119-
"cat AFL_FILE | LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -a -b -c" \
119+
"LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -a -b -c" \
120120
--code-dir .
121121
```
122122

123123
`/path/to/afl-fuzz-output/` is the output directory of afl-fuzz.
124124

125-
The `AFL_FILE` string above refers to the test case file that AFL will
125+
The `AFL_FILE` string refers to the test case file that AFL will
126126
build in the `queue/` directory under `/path/to/afl-fuzz-output`. Just leave this
127127
string as-is since `afl-cov` will automatically substitute it with each AFL
128128
`queue/id:NNNNNN*` in succession as it builds the code coverage reports.
129129
You can also use @@ instead of AFL_FILE, both notations work.
130130

131131
Also, in the above command, this handles the case where the AFL fuzzing cycle
132-
is fuzzing the targeted binary via stdin. This explains the
133-
`cat AFL_FILE | ... ./bin/.lib/somebin ...` invocation. For the other style of
134-
fuzzing with AFL where a file is read from the filesystem, here is an example:
132+
is fuzzing the targeted binary via stdin.
133+
For the other style of fuzzing with AFL where a file is read from the filesystem, here is an example:
135134

136135
```bash
137136
$ cd /path/to/project-gcov/
@@ -166,7 +165,7 @@ the `--enable-branch-coverage` argument as described above):
166165

167166
```bash
168167
$ afl-cov -d /path/to/afl-fuzz-output/ --live --coverage-cmd \
169-
"LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f AFL_FILE -a -b -c" \
168+
"LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f @@ -a -b -c" \
170169
--code-dir . --enable-branch-coverage
171170
[+] Imported 184 files from: /path/to/afl-fuzz-output/queue
172171
[+] AFL file: id:000000,orig:somestr.start (1 / 184), cycle: 0

0 commit comments

Comments
 (0)