mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-09 08:41:32 +00:00
45 lines
1.1 KiB
Markdown
45 lines
1.1 KiB
Markdown
# CmpLog instrumentation
|
|
|
|
The CmpLog instrumentation enables logging of comparison operands in a
|
|
shared memory.
|
|
|
|
These values can be used by various mutators built on top of it.
|
|
At the moment we support the RedQueen mutator (input-2-state instructions only),
|
|
for details see [the RedQueen paper](https://www.syssec.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2018/12/17/NDSS19-Redqueen.pdf).
|
|
|
|
## Build
|
|
|
|
To use CmpLog, you have to build two versions of the instrumented target
|
|
program.
|
|
|
|
The first version is built using the regular AFL++ instrumentation.
|
|
|
|
The second one, the CmpLog binary, is built with setting AFL_LLVM_CMPLOG during the compilation.
|
|
|
|
For example:
|
|
|
|
```
|
|
./configure --cc=~/path/to/afl-clang-fast
|
|
make
|
|
cp ./program ./program.afl
|
|
make clean
|
|
export AFL_LLVM_CMPLOG=1
|
|
./configure --cc=~/path/to/afl-clang-fast
|
|
make
|
|
cp ./program ./program.cmplog
|
|
unset AFL_LLVM_CMPLOG
|
|
```
|
|
|
|
## Use
|
|
|
|
AFL++ has the new `-c` option that needs to be used to specify the CmpLog binary (the second
|
|
build).
|
|
|
|
For example:
|
|
|
|
```
|
|
afl-fuzz -i input -o output -c ./program.cmplog -m none -- ./program.afl @@
|
|
```
|
|
|
|
Be sure to use `-m none` because CmpLog can map a lot of pages.
|