mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-23 22:35:19 +00:00
62 lines
2.0 KiB
Plaintext
62 lines
2.0 KiB
Plaintext
Roadmap 2.53d:
|
|
==============
|
|
|
|
all:
|
|
- indent all the code: .clang-format?
|
|
(vh: tried, the variable definion look very ugly then, what to do?)
|
|
|
|
afl-fuzz:
|
|
- put mutator, scheduler, forkserver and input channels in individual files
|
|
- reuse forkserver for showmap, afl-cmin, etc.
|
|
- custom mutator lib: example and readme
|
|
- env var to exclusively run the custom lib/py mutator
|
|
|
|
gcc_plugin:
|
|
- needs to be rewritten
|
|
- whitelist support
|
|
- skip over uninteresting blocks
|
|
- laf-intel
|
|
- neverZero
|
|
|
|
qemu_mode:
|
|
- update to 4.x
|
|
- deferred mode with AFL_DEFERRED_QEMU=0xaddress
|
|
(vh: @andrea - dont we have that already with AFL_ENTRYPOINT?)
|
|
|
|
unit testing / or large testcase campaign
|
|
|
|
|
|
Roadmap 2.54d:
|
|
==============
|
|
Problem: Average targets (tiff, jpeg, unrar) go through 1500 edges.
|
|
At afl's default map that means ~16 collisions and ~3 wrappings.
|
|
Solution #1: increase map size.
|
|
every +1 decreases fuzzing speed by ~10% and halfs the collisions
|
|
birthday paradox predicts collisions at this # of edges:
|
|
mapsize => collisions
|
|
2^16 = 302
|
|
2^17 = 427
|
|
2^18 = 603
|
|
2^19 = 853
|
|
2^20 = 1207
|
|
2^21 = 1706
|
|
2^22 = 2412
|
|
2^23 = 3411
|
|
2^24 = 4823
|
|
Increasing the map is an easy solution but also not a good one.
|
|
Solution #2: use dynamic map size and collision free basic block IDs
|
|
This only works in llvm_mode and llvm >= 9 though
|
|
A potential good future solution. Heiko/hexcoder follows this up
|
|
Solution #3: write instruction pointers to a big shared map
|
|
512kb/1MB shared map and the instrumented code writes the instruction
|
|
pointer into the map. Map must be big enough but could be command line
|
|
controlled.
|
|
Good: complete coverage information, nothing is lost. choice of analysis
|
|
impacts speed, but this can be decided by user options
|
|
Neutral: a little bit slower but no loss of coverage
|
|
Bad: completely changes how afl uses the map and the scheduling.
|
|
Overall another very good solution, Marc Heuse/vanHauser follows this up
|
|
|
|
qemu_mode:
|
|
- persistent mode patching the return address (WinAFL style)
|