ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-10 17:21:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

update faq

Browse Source
This commit is contained in:
vanhauser-thc 2021-07-12 15:56:25 +02:00
parent fc3d7e821c
commit d16d8dbb85
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
docs/FAQ.md
View File

@ -188,13 +188,7 @@ Four steps are required to do this and it also requires quite some knowledge
of coding and/or disassembly and is effectively possible only with of coding and/or disassembly and is effectively possible only with
afl-clang-fast PCGUARD and afl-clang-lto LTO instrumentation. afl-clang-fast PCGUARD and afl-clang-lto LTO instrumentation.
1. First step: Identify which edge ID numbers are unstable 1. First step: Instrument to be able to find the responsible function(s).
run the target with `export AFL_DEBUG=1` for a few minutes then terminate.
The out/fuzzer_stats file will then show the edge IDs that were identified
as unstable.
2. Second step: Find the responsible function(s).
a) For LTO instrumented binaries this can be documented during compile a) For LTO instrumented binaries this can be documented during compile
time, just set `export AFL_LLVM_DOCUMENT_IDS=/path/to/a/file`. time, just set `export AFL_LLVM_DOCUMENT_IDS=/path/to/a/file`.
@ -217,6 +211,14 @@ afl-clang-fast PCGUARD and afl-clang-lto LTO instrumentation.
recompile with the two mentioned above. This is just for recompile with the two mentioned above. This is just for
identifying the functions that have unstable edges. identifying the functions that have unstable edges.
2. Second step: Identify which edge ID numbers are unstable
run the target with `export AFL_DEBUG=1` for a few minutes then terminate.
The out/fuzzer_stats file will then show the edge IDs that were identified
as unstable in the `var_bytes` entry. You can match these numbers
directly to the data you created in the first step.
Now you know which functions are responsible for the instability
3. Third step: create a text file with the filenames/functions 3. Third step: create a text file with the filenames/functions
Identify which source code files contain the functions that you need to Identify which source code files contain the functions that you need to