@@ -19,24 +19,24 @@ This is a modified afl-cov fork because the original author's account is
19
19
inactive :-(
20
20
21
21
It has several improvements:
22
- * Much, much faster!
22
+ * Much, much faster (thanks to @ domenukk ) !
23
23
* afl-cov now accepts "@@" like AFL++ in the target command parameters
24
24
* afl-cov now can send to targets that read on stdin (just omit @@)
25
- * afl-cov has a timeout -T option to hangs are not an issue, default 5s
25
+ * afl-cov has a timeout -T option, so hangs are not an issue. default: 5s
26
26
* afl-cov.sh makes using afl-cov easier (just needs two parameters)
27
- * afl-cov-build.sh makes builing a target for coverage easier, just type
28
- ` afl-cov-build.sh make `
27
+ * afl-cov-build.sh makes builing a target for coverage easier, just type e.g.
28
+ ` afl-cov-build.sh ./configure ; make `
29
29
* afl-cov/afl-cov.sh/afl-cov-build.sh now support clang coverage, just add
30
- -c to afl-cov.sh/afl-cov-build.sh ( --clang for afl-cov)
30
+ -c to afl-cov.sh/afl-cov-build.sh and --clang for afl-cov
31
31
* afl-stat.sh shows the statistics of a run (in progress or completed)
32
32
33
33
Enjoy!
34
34
35
- Marc "vanHauser " Heuse
35
+ Marc "van Hauser " Heuse
36
36
37
37
## Introduction
38
38
` afl-cov ` uses test case files produced by the
39
- [ AFL fuzzer] ( http://lcamtuf.coredump.cx/afl/ ) ` afl-fuzz ` to generate gcov code
39
+ [ AFL++ fuzzer] ( http://github.com/AFLplusplus/aflplusplus ) ` afl-fuzz ` to generate gcov code
40
40
coverage results for a targeted binary. Code coverage is interpreted from one
41
41
case to the next by ` afl-cov ` in order to determine which new functions and
42
42
lines are hit by AFL with each new test case. Further, ` afl-cov ` allows for
@@ -116,22 +116,21 @@ Here is an example:
116
116
``` bash
117
117
$ cd /path/to/project-gcov/
118
118
$ afl-cov -d /path/to/afl-fuzz-output/ --live --coverage-cmd \
119
- " cat AFL_FILE | LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -a -b -c" \
119
+ " LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -a -b -c" \
120
120
--code-dir .
121
121
```
122
122
123
123
` /path/to/afl-fuzz-output/ ` is the output directory of afl-fuzz.
124
124
125
- The ` AFL_FILE ` string above refers to the test case file that AFL will
125
+ The ` AFL_FILE ` string refers to the test case file that AFL will
126
126
build in the ` queue/ ` directory under ` /path/to/afl-fuzz-output ` . Just leave this
127
127
string as-is since ` afl-cov ` will automatically substitute it with each AFL
128
128
` queue/id:NNNNNN* ` in succession as it builds the code coverage reports.
129
129
You can also use @@ instead of AFL_FILE, both notations work.
130
130
131
131
Also, in the above command, this handles the case where the AFL fuzzing cycle
132
- is fuzzing the targeted binary via stdin. This explains the
133
- ` cat AFL_FILE | ... ./bin/.lib/somebin ... ` invocation. For the other style of
134
- fuzzing with AFL where a file is read from the filesystem, here is an example:
132
+ is fuzzing the targeted binary via stdin.
133
+ For the other style of fuzzing with AFL where a file is read from the filesystem, here is an example:
135
134
136
135
``` bash
137
136
$ cd /path/to/project-gcov/
@@ -166,7 +165,7 @@ the `--enable-branch-coverage` argument as described above):
166
165
167
166
``` bash
168
167
$ afl-cov -d /path/to/afl-fuzz-output/ --live --coverage-cmd \
169
- " LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f AFL_FILE -a -b -c" \
168
+ " LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f @@ -a -b -c" \
170
169
--code-dir . --enable-branch-coverage
171
170
[+] Imported 184 files from: /path/to/afl-fuzz-output/queue
172
171
[+] AFL file: id:000000,orig:somestr.start (1 / 184), cycle: 0
0 commit comments