@@ -82,8 +82,12 @@ the output directory used by `afl-fuzz`, and the command to execute along with
82
82
associated arguments. This command and arguments should closely resemble the
83
83
manner in which ` afl-fuzz ` executes the targeted binary during the fuzzing
84
84
cycle. If there is already an existing directory of AFL fuzzing results, then
85
- just omit the ` --live ` argument to process the existing results. Here is an
86
- example:
85
+ just omit the ` --live ` argument to process the existing results.
86
+
87
+ NOTE: you can use both afl's "@@" or afl-cov's original "AFL_FILE" placeholder for
88
+ the --coverage-cmd line parameter.
89
+
90
+ Here is an example:
87
91
88
92
``` bash
89
93
$ cd /path/to/project-gcov/
@@ -98,6 +102,7 @@ The `AFL_FILE` string above refers to the test case file that AFL will
98
102
build in the ` queue/ ` directory under ` /path/to/afl-fuzz-output ` . Just leave this
99
103
string as-is since ` afl-cov ` will automatically substitute it with each AFL
100
104
` queue/id:NNNNNN* ` in succession as it builds the code coverage reports.
105
+ You can also use @@ instead of AFL_FILE, both notations work.
101
106
102
107
Also, in the above command, this handles the case where the AFL fuzzing cycle
103
108
is fuzzing the targeted binary via stdin. This explains the
@@ -107,7 +112,7 @@ fuzzing with AFL where a file is read from the filesystem, here is an example:
107
112
``` bash
108
113
$ cd /path/to/project-gcov/
109
114
$ afl-cov -d /path/to/afl-fuzz-output/ --live --coverage-cmd \
110
- " LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f AFL_FILE -a -b -c" \
115
+ " LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f @@ -a -b -c" \
111
116
--code-dir .
112
117
```
113
118
0 commit comments