This commit is contained in:
van Hauser
2020-02-03 16:10:16 +01:00
parent 1d8e772f6c
commit 542bea37fb
20 changed files with 41 additions and 55 deletions

View File

@ -410,17 +410,3 @@ endif
cp -r testcases/ $${DESTDIR}$(MISC_PATH) cp -r testcases/ $${DESTDIR}$(MISC_PATH)
cp -r dictionaries/ $${DESTDIR}$(MISC_PATH) cp -r dictionaries/ $${DESTDIR}$(MISC_PATH)
#publish: clean
# test "`basename $$PWD`" = "afl" || exit 1
# test -f ~/www/afl/releases/$(PROGNAME)-$(VERSION).tgz; if [ "$$?" = "0" ]; then echo; echo "Change program version in config.h, mmkay?"; echo; exit 1; fi
# cd ..; rm -rf $(PROGNAME)-$(VERSION); cp -pr $(PROGNAME) $(PROGNAME)-$(VERSION); \
# tar -cvz -f ~/www/afl/releases/$(PROGNAME)-$(VERSION).tgz $(PROGNAME)-$(VERSION)
# chmod 644 ~/www/afl/releases/$(PROGNAME)-$(VERSION).tgz
# ( cd ~/www/afl/releases/; ln -s -f $(PROGNAME)-$(VERSION).tgz $(PROGNAME)-latest.tgz )
# cat docs/README.md >~/www/afl/README.txt
# cat docs/status_screen.txt >~/www/afl/status_screen.txt
# cat docs/historical_notes.txt >~/www/afl/historical_notes.txt
# cat docs/technical_details.txt >~/www/afl/technical_details.txt
# cat docs/ChangeLog >~/www/afl/ChangeLog.txt
# cat docs/QuickStartGuide.txt >~/www/afl/QuickStartGuide.txt
# echo -n "$(VERSION)" >~/www/afl/version.txt

View File

@ -315,7 +315,7 @@ contains a good example of the input data normally expected by the targeted
application. There are two basic rules: application. There are two basic rules:
- Keep the files small. Under 1 kB is ideal, although not strictly necessary. - Keep the files small. Under 1 kB is ideal, although not strictly necessary.
For a discussion of why size matters, see [perf_tips.txt](docs/perf_tips.txt). For a discussion of why size matters, see [perf_tips.md](docs/perf_tips.md).
- Use multiple test cases only if they are functionally different from - Use multiple test cases only if they are functionally different from
each other. There is no point in using fifty different vacation photos each other. There is no point in using fifty different vacation photos
@ -359,7 +359,7 @@ You can use -t and -m to override the default timeout and memory limit for the
executed process; rare examples of targets that may need these settings touched executed process; rare examples of targets that may need these settings touched
include compilers and video decoders. include compilers and video decoders.
Tips for optimizing fuzzing performance are discussed in [perf_tips.txt](docs/perf_tips.txt). Tips for optimizing fuzzing performance are discussed in [perf_tips.md](docs/perf_tips.md).
Note that afl-fuzz starts by performing an array of deterministic fuzzing Note that afl-fuzz starts by performing an array of deterministic fuzzing
steps, which can take several days, but tend to produce neat test cases. If you steps, which can take several days, but tend to produce neat test cases. If you
@ -369,7 +369,7 @@ fuzzers - add the -d option to the command line.
## 8) Interpreting output ## 8) Interpreting output
See the [docs/status_screen.txt](docs/status_screen.txt) file for information on See the [docs/status_screen.md](docs/status_screen.md) file for information on
how to interpret the displayed stats and monitor the health of the process. Be how to interpret the displayed stats and monitor the health of the process. Be
sure to consult this file especially if any UI elements are highlighted in red. sure to consult this file especially if any UI elements are highlighted in red.
@ -521,7 +521,7 @@ file, attempts to sequentially flip bytes, and observes the behavior of the
tested program. It then color-codes the input based on which sections appear to tested program. It then color-codes the input based on which sections appear to
be critical, and which are not; while not bulletproof, it can often offer quick be critical, and which are not; while not bulletproof, it can often offer quick
insights into complex file formats. More info about its operation can be found insights into complex file formats. More info about its operation can be found
near the end of [docs/technical_details.txt](docs/technical_details.txt). near the end of [docs/technical_details.md](docs/technical_details.md).
## 12) Going beyond crashes ## 12) Going beyond crashes

View File

@ -1,9 +1,9 @@
# AFL quick start guide # AFL quick start guide
You should read docs/README.md - it's pretty short. If you really can't, here's You should read [README.md](README.md) - it's pretty short. If you really can't, here's
how to hit the ground running: how to hit the ground running:
1) Compile AFL with 'make'. If build fails, see docs/INSTALL for tips. 1) Compile AFL with 'make'. If build fails, see [INSTALL.md](INSTALL.md) for tips.
2) Find or write a reasonably fast and simple program that takes data from 2) Find or write a reasonably fast and simple program that takes data from
a file or stdin, processes it in a test-worthy way, then exits cleanly. a file or stdin, processes it in a test-worthy way, then exits cleanly.
@ -15,7 +15,7 @@ how to hit the ground running:
The program must crash properly when a fault is encountered. Watch out for The program must crash properly when a fault is encountered. Watch out for
custom SIGSEGV or SIGABRT handlers and background processes. For tips on custom SIGSEGV or SIGABRT handlers and background processes. For tips on
detecting non-crashing flaws, see section 11 in docs/README.md . detecting non-crashing flaws, see section 11 in [README.md](README.md) .
3) Compile the program / library to be fuzzed using afl-gcc. A common way to 3) Compile the program / library to be fuzzed using afl-gcc. A common way to
do this would be: do this would be:
@ -38,7 +38,7 @@ how to hit the ground running:
command line; AFL will put an auto-generated file name in there for you. command line; AFL will put an auto-generated file name in there for you.
6) Investigate anything shown in red in the fuzzer UI by promptly consulting 6) Investigate anything shown in red in the fuzzer UI by promptly consulting
docs/status_screen.txt. [status_screen.md](status_screen.md).
7) compile and use llvm_mode (afl-clang-fast/afl-clang-fast++) as it is way 7) compile and use llvm_mode (afl-clang-fast/afl-clang-fast++) as it is way
faster and has a few cool features faster and has a few cool features
@ -49,6 +49,6 @@ That's it. Sit back, relax, and - time permitting - try to skim through the
following files: following files:
- README.md - A general introduction to AFL, - README.md - A general introduction to AFL,
- docs/perf_tips.txt - Simple tips on how to fuzz more quickly, - docs/perf_tips.md - Simple tips on how to fuzz more quickly,
- docs/status_screen.txt - An explanation of the tidbits shown in the UI, - docs/status_screen.md - An explanation of the tidbits shown in the UI,
- docs/parallel_fuzzing.md - Advice on running AFL on multiple cores. - docs/parallel_fuzzing.md - Advice on running AFL on multiple cores.

View File

@ -315,7 +315,7 @@ contains a good example of the input data normally expected by the targeted
application. There are two basic rules: application. There are two basic rules:
- Keep the files small. Under 1 kB is ideal, although not strictly necessary. - Keep the files small. Under 1 kB is ideal, although not strictly necessary.
For a discussion of why size matters, see [perf_tips.txt](docs/perf_tips.txt). For a discussion of why size matters, see [perf_tips.md](docs/perf_tips.md).
- Use multiple test cases only if they are functionally different from - Use multiple test cases only if they are functionally different from
each other. There is no point in using fifty different vacation photos each other. There is no point in using fifty different vacation photos
@ -359,7 +359,7 @@ You can use -t and -m to override the default timeout and memory limit for the
executed process; rare examples of targets that may need these settings touched executed process; rare examples of targets that may need these settings touched
include compilers and video decoders. include compilers and video decoders.
Tips for optimizing fuzzing performance are discussed in [perf_tips.txt](docs/perf_tips.txt). Tips for optimizing fuzzing performance are discussed in [perf_tips.md](docs/perf_tips.md).
Note that afl-fuzz starts by performing an array of deterministic fuzzing Note that afl-fuzz starts by performing an array of deterministic fuzzing
steps, which can take several days, but tend to produce neat test cases. If you steps, which can take several days, but tend to produce neat test cases. If you
@ -369,7 +369,7 @@ fuzzers - add the -d option to the command line.
## 8) Interpreting output ## 8) Interpreting output
See the [docs/status_screen.txt](docs/status_screen.txt) file for information on See the [docs/status_screen.md](docs/status_screen.md) file for information on
how to interpret the displayed stats and monitor the health of the process. Be how to interpret the displayed stats and monitor the health of the process. Be
sure to consult this file especially if any UI elements are highlighted in red. sure to consult this file especially if any UI elements are highlighted in red.
@ -521,7 +521,7 @@ file, attempts to sequentially flip bytes, and observes the behavior of the
tested program. It then color-codes the input based on which sections appear to tested program. It then color-codes the input based on which sections appear to
be critical, and which are not; while not bulletproof, it can often offer quick be critical, and which are not; while not bulletproof, it can often offer quick
insights into complex file formats. More info about its operation can be found insights into complex file formats. More info about its operation can be found
near the end of [docs/technical_details.txt](docs/technical_details.txt). near the end of [docs/technical_details.md](docs/technical_details.md).
## 12) Going beyond crashes ## 12) Going beyond crashes

View File

@ -43,7 +43,7 @@
emulation. Runtime environment and/or loaders have to be written from scratch, emulation. Runtime environment and/or loaders have to be written from scratch,
if needed. On top, block chaining has been removed. This means the speed boost if needed. On top, block chaining has been removed. This means the speed boost
introduced in the patched QEMU Mode of afl++ cannot simply be ported over to introduced in the patched QEMU Mode of afl++ cannot simply be ported over to
Unicorn. For further information, check out ./unicorn_mode.txt. Unicorn. For further information, check out [unicorn_mode/README.md](../unicorn_mode/README.md).
As it is included in afl++ this needs no URL. As it is included in afl++ this needs no URL.

View File

@ -22,7 +22,7 @@ tools make fairly broad use of environmental variables:
- Setting AFL_USE_ASAN automatically enables ASAN, provided that your - Setting AFL_USE_ASAN automatically enables ASAN, provided that your
compiler supports that. Note that fuzzing with ASAN is mildly challenging compiler supports that. Note that fuzzing with ASAN is mildly challenging
- see notes_for_asan.txt. - see [notes_for_asan.md](notes_for_asan.md).
(You can also enable MSAN via AFL_USE_MSAN; ASAN and MSAN come with the (You can also enable MSAN via AFL_USE_MSAN; ASAN and MSAN come with the
same gotchas; the modes are mutually exclusive. UBSAN and other exotic same gotchas; the modes are mutually exclusive. UBSAN and other exotic
@ -221,10 +221,10 @@ checks or alter some of the more exotic semantics of the tool:
- Setting AFL_CUSTOM_MUTATOR_LIBRARY to a shared library with - Setting AFL_CUSTOM_MUTATOR_LIBRARY to a shared library with
afl_custom_mutator() export run additional mutations though this library. afl_custom_mutator() export run additional mutations though this library.
If AFL_CUSTOM_MUTATOR_ONLY is also set, all mutations will solely be If AFL_CUSTOM_MUTATOR_ONLY is also set, all mutations will solely be
performed with/from the libary. see docs/custom_mutator.txt performed with/from the libary. see [custom_mutator.md](custom_mutator.md)
- For AFL_PYTHON_MODULE and AFL_PYTHON_ONLY - they require to be compiled - For AFL_PYTHON_MODULE and AFL_PYTHON_ONLY - they require to be compiled
with -DUSE_PYTHON. Please see docs/python_mutators.txt with -DUSE_PYTHON. Please see [python_mutators.md](python_mutators.md)
This feature allows to configure custom mutators which can be very helpful This feature allows to configure custom mutators which can be very helpful
in e.g. fuzzing XML or other highly flexible structured input. in e.g. fuzzing XML or other highly flexible structured input.

View File

@ -40,7 +40,7 @@ coverage-driven fuzzer that relied on coverage as a fitness function.
Jared's approach was by no means identical to what afl-fuzz does, but it was in Jared's approach was by no means identical to what afl-fuzz does, but it was in
the same ballpark. His fuzzer tried to explicitly solve for the maximum coverage the same ballpark. His fuzzer tried to explicitly solve for the maximum coverage
with a single input file; in comparison, afl simply selects for cases that do with a single input file; in comparison, afl simply selects for cases that do
something new (which yields better results - see technical_details.txt). something new (which yields better results - see [technical_details.md](technical_details.md)).
A few years later, Gabriel Campana released fuzzgrind, a tool that relied purely A few years later, Gabriel Campana released fuzzgrind, a tool that relied purely
on Valgrind and a constraint solver to maximize coverage without any brute-force on Valgrind and a constraint solver to maximize coverage without any brute-force
@ -133,7 +133,7 @@ several itches that seemed impossible to scratch with other tools:
corpora of interesting test cases that can be fed into a manual testing corpora of interesting test cases that can be fed into a manual testing
process or a UI harness later on. process or a UI harness later on.
As mentioned in technical_details.txt, AFL does all this not by systematically As mentioned in [technical_details.md](technical_details.md), AFL does all this not by systematically
applying a single overarching CS concept, but by experimenting with a variety applying a single overarching CS concept, but by experimenting with a variety
of small, complementary methods that were shown to reliably yields results of small, complementary methods that were shown to reliably yields results
better than chance. The use of instrumentation is a part of that toolkit, but is better than chance. The use of instrumentation is a part of that toolkit, but is

View File

@ -5,15 +5,15 @@ to read or memorize every other piece of documentation for AFL.
## Get more bang for your buck by using fuzzing dictionaries. ## Get more bang for your buck by using fuzzing dictionaries.
See dictionaries/README.md to learn how. See [dictionaries/README.md](../dictionaries/README.md) to learn how.
## You can get the most out of your hardware by parallelizing AFL jobs. ## You can get the most out of your hardware by parallelizing AFL jobs.
See docs/parallel_fuzzing.md for step-by-step tips. See [parallel_fuzzing.md](parallel_fuzzing.md) for step-by-step tips.
## Improve the odds of spotting memory corruption bugs with libdislocator.so! ## Improve the odds of spotting memory corruption bugs with libdislocator.so!
It's easy. Consult libdislocator/README.md for usage tips. It's easy. Consult [libdislocator/README.md](../libdislocator/README.md) for usage tips.
## Want to understand how your target parses a particular input file? ## Want to understand how your target parses a particular input file?

View File

@ -25,7 +25,7 @@ cases on the fly.
Note that afl++ has AFLfast's power schedules implemented. Note that afl++ has AFLfast's power schedules implemented.
It is therefore a good idea to use different power schedules if you run It is therefore a good idea to use different power schedules if you run
several instances in parallel. See docs/power_schedules.txt several instances in parallel. See [power_schedules.md](power_schedules.md)
Alternatively running other AFL spinoffs in parallel can be of value, Alternatively running other AFL spinoffs in parallel can be of value,
e.g. Angora (https://github.com/AngoraFuzzer/Angora/) e.g. Angora (https://github.com/AngoraFuzzer/Angora/)

View File

@ -218,7 +218,7 @@ most of the time - and if it stays below 100, the job will probably take very
long. long.
The fuzzer will explicitly warn you about slow targets, too. If this happens, The fuzzer will explicitly warn you about slow targets, too. If this happens,
see the perf_tips.txt file included with the fuzzer for ideas on how to speed see the [perf_tips.md](perf_tips.md) file included with the fuzzer for ideas on how to speed
things up. things up.
### Findings in depth ### Findings in depth

View File

@ -20,7 +20,7 @@
# This tool allows the amount of actual memory allocated to a program # This tool allows the amount of actual memory allocated to a program
# to be limited on Linux systems using cgroups, instead of the traditional # to be limited on Linux systems using cgroups, instead of the traditional
# setrlimit() API. This helps avoid the address space problems discussed in # setrlimit() API. This helps avoid the address space problems discussed in
# docs/notes_for_asan.txt. # docs/notes_for_asan.md.
# #
# Important: the limit covers *both* afl-fuzz and the fuzzed binary. In some # Important: the limit covers *both* afl-fuzz and the fuzzed binary. In some
# hopefully rare circumstances, afl-fuzz could be killed before the fuzzed # hopefully rare circumstances, afl-fuzz could be killed before the fuzzed

View File

@ -1,2 +1,2 @@
This is a simple example for the AFL_CUSTOM_MUTATOR_LIBRARY feature. This is a simple example for the AFL_CUSTOM_MUTATOR_LIBRARY feature.
For more information see docs/custom_mutator.txt For more information see [docs/custom_mutator.md](../docs/custom_mutator.md)

View File

@ -1,5 +1,5 @@
These are example and helper files for the AFL_PYTHON_MODULE feature. These are example and helper files for the AFL_PYTHON_MODULE feature.
See docs/python_mutators.txt for more information See [docs/python_mutators.md](../docs/python_mutators.md) for more information
Note that if you compile with python3.7 you must use python3 scripts, and if Note that if you compile with python3.7 you must use python3 scripts, and if
you use pyton2.7 to compile python2 scripts! you use pyton2.7 to compile python2 scripts!

View File

@ -56,7 +56,7 @@ standard operating mode of AFL, e.g.:
Be sure to also include CXX set to afl-g++-fast for C++ code. Be sure to also include CXX set to afl-g++-fast for C++ code.
The tool honors roughly the same environmental variables as afl-gcc (see The tool honors roughly the same environmental variables as afl-gcc (see
../docs/env_variables.txt). This includes AFL_INST_RATIO, AFL_USE_ASAN, [env_variables.md](../docs/env_variables.md). This includes AFL_INST_RATIO, AFL_USE_ASAN,
AFL_HARDEN, and AFL_DONT_OPTIMIZE. AFL_HARDEN, and AFL_DONT_OPTIMIZE.
Note: if you want the GCC plugin to be installed on your system for all Note: if you want the GCC plugin to be installed on your system for all

View File

@ -73,7 +73,7 @@ operating mode of AFL, e.g.:
Be sure to also include CXX set to afl-clang-fast++ for C++ code. Be sure to also include CXX set to afl-clang-fast++ for C++ code.
The tool honors roughly the same environmental variables as afl-gcc (see The tool honors roughly the same environmental variables as afl-gcc (see
../docs/env_variables.txt). This includes AFL_USE_ASAN, [docs/env_variables.md](../docs/env_variables.md)). This includes AFL_USE_ASAN,
AFL_HARDEN, and AFL_DONT_OPTIMIZE. However AFL_INST_RATIO is not honored AFL_HARDEN, and AFL_DONT_OPTIMIZE. However AFL_INST_RATIO is not honored
as it does not serve a good purpose with the more effective instrim CFG as it does not serve a good purpose with the more effective instrim CFG
analysis. analysis.

View File

@ -332,7 +332,7 @@ void init_forkserver(char **argv) {
"have a\n" "have a\n"
" restrictive memory limit configured, this is expected; please " " restrictive memory limit configured, this is expected; please "
"read\n" "read\n"
" %s/notes_for_asan.txt for help.\n", " %s/notes_for_asan.md for help.\n",
doc_path); doc_path);
} else if (!mem_limit) { } else if (!mem_limit) {
@ -408,7 +408,7 @@ void init_forkserver(char **argv) {
"with ASAN and\n" "with ASAN and\n"
" you have a restrictive memory limit configured, this is " " you have a restrictive memory limit configured, this is "
"expected; please\n" "expected; please\n"
" read %s/notes_for_asan.txt for help.\n", " read %s/notes_for_asan.md for help.\n",
doc_path); doc_path);
} else if (!mem_limit) { } else if (!mem_limit) {

View File

@ -217,7 +217,7 @@ void init_cmplog_forkserver(char** argv) {
"have a\n" "have a\n"
" restrictive memory limit configured, this is expected; please " " restrictive memory limit configured, this is expected; please "
"read\n" "read\n"
" %s/notes_for_asan.txt for help.\n", " %s/notes_for_asan.md for help.\n",
doc_path); doc_path);
} else if (!mem_limit) { } else if (!mem_limit) {
@ -293,7 +293,7 @@ void init_cmplog_forkserver(char** argv) {
"with ASAN and\n" "with ASAN and\n"
" you have a restrictive memory limit configured, this is " " you have a restrictive memory limit configured, this is "
"expected; please\n" "expected; please\n"
" read %s/notes_for_asan.txt for help.\n", " read %s/notes_for_asan.md for help.\n",
doc_path); doc_path);
} else if (!mem_limit) { } else if (!mem_limit) {

View File

@ -601,7 +601,7 @@ void perform_dry_run(char** argv) {
"quickly\n" "quickly\n"
" estimate the required amount of virtual memory for the " " estimate the required amount of virtual memory for the "
"binary. Also,\n" "binary. Also,\n"
" if you are using ASAN, see %s/notes_for_asan.txt.\n\n" " if you are using ASAN, see %s/notes_for_asan.md.\n\n"
MSG_FORK_ON_APPLE MSG_FORK_ON_APPLE

View File

@ -747,7 +747,7 @@ void show_init_stats(void) {
SAYF("\n"); SAYF("\n");
if (avg_us > ((qemu_mode || unicorn_mode) ? 50000 : 10000)) if (avg_us > ((qemu_mode || unicorn_mode) ? 50000 : 10000))
WARNF(cLRD "The target binary is pretty slow! See %s/perf_tips.txt.", WARNF(cLRD "The target binary is pretty slow! See %s/perf_tips.md.",
doc_path); doc_path);
/* Let's keep things moving with slow binaries. */ /* Let's keep things moving with slow binaries. */
@ -762,10 +762,10 @@ void show_init_stats(void) {
if (!resuming_fuzz) { if (!resuming_fuzz) {
if (max_len > 50 * 1024) if (max_len > 50 * 1024)
WARNF(cLRD "Some test cases are huge (%s) - see %s/perf_tips.txt!", WARNF(cLRD "Some test cases are huge (%s) - see %s/perf_tips.md!",
DMS(max_len), doc_path); DMS(max_len), doc_path);
else if (max_len > 10 * 1024) else if (max_len > 10 * 1024)
WARNF("Some test cases are big (%s) - see %s/perf_tips.txt.", WARNF("Some test cases are big (%s) - see %s/perf_tips.md.",
DMS(max_len), doc_path); DMS(max_len), doc_path);
if (useless_at_start && !in_bitmap) if (useless_at_start && !in_bitmap)

View File

@ -96,7 +96,7 @@ static void usage(u8* argv0) {
"score.\n" "score.\n"
" <explore (default), fast, coe, lin, quad, or " " <explore (default), fast, coe, lin, quad, or "
"exploit>\n" "exploit>\n"
" see docs/power_schedules.txt\n" " see docs/power_schedules.md\n"
" -f file - location read by the fuzzed program (stdin)\n" " -f file - location read by the fuzzed program (stdin)\n"
" -t msec - timeout for each run (auto-scaled, 50-%d ms)\n" " -t msec - timeout for each run (auto-scaled, 50-%d ms)\n"
" -m megs - memory limit for child process (%d MB)\n" " -m megs - memory limit for child process (%d MB)\n"
@ -145,7 +145,7 @@ static void usage(u8* argv0) {
argv0, EXEC_TIMEOUT, MEM_LIMIT); argv0, EXEC_TIMEOUT, MEM_LIMIT);
#ifdef USE_PYTHON #ifdef USE_PYTHON
SAYF("Compiled with %s module support, see docs/python_mutators.txt\n", SAYF("Compiled with %s module support, see docs/python_mutators.md\n",
(char*)PYTHON_VERSION); (char*)PYTHON_VERSION);
#endif #endif