about summary refs log tree commit diff
diff options
context:
space:
mode:
authorvan Hauser <vh@thc.org>2020-02-06 17:12:59 +0100
committervan Hauser <vh@thc.org>2020-02-06 17:12:59 +0100
commit1ece4bb7dfc617dd03a9d416108aade97579a3c1 (patch)
tree8a9367e991d6eaa8ef5261c4d10dfdfc8a474452
parentb2191985765e58db4a3b7a2eb1e25f063733839a (diff)
downloadafl++-1ece4bb7dfc617dd03a9d416108aade97579a3c1.tar.gz
unicorn readme enhancements
-rw-r--r--unicorn_mode/README.md25
1 files changed, 15 insertions, 10 deletions
diff --git a/unicorn_mode/README.md b/unicorn_mode/README.md
index 07dca451..86683839 100644
--- a/unicorn_mode/README.md
+++ b/unicorn_mode/README.md
@@ -28,8 +28,10 @@ First, make afl++ as usual.
 Once that completes successfully you need to build and add in the Unicorn Mode 
 features:
 
-  $ cd unicorn_mode
-  $ ./build_unicorn_support.sh
+```
+$ cd unicorn_mode
+$ ./build_unicorn_support.sh
+```
 
 NOTE: This script checks out a Unicorn Engine fork as submodule that has been tested 
 and is stable-ish, based on the unicorn engine master. 
@@ -68,7 +70,9 @@ To really use unicorn-mode effectively you need to prepare the following:
 Once you have all those things ready to go you just need to run afl-fuzz in
 'unicorn-mode' by passing in the '-U' flag:
 
-	$ afl-fuzz -U -m none -i /path/to/inputs -o /path/to/results -- ./test_harness @@
+```
+$ afl-fuzz -U -m none -i /path/to/inputs -o /path/to/results -- ./test_harness @@
+```
 
 The normal afl-fuzz command line format applies to everything here. Refer to
 AFL's main documentation for more info about how to use afl-fuzz effectively.
@@ -77,14 +81,14 @@ For a much clearer vision of what all of this looks like, please refer to the
 sample provided in the 'unicorn_mode/samples' directory. There is also a blog
 post that goes over the basics at:
 
-https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf
+[https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf](https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf)
 
 The 'helper_scripts' directory also contains several helper scripts that allow you 
 to dump context from a running process, load it, and hook heap allocations. For details
 on how to use this check out the follow-up blog post to the one linked above.
 
 A example use of AFL-Unicorn mode is discussed in the paper Unicorefuzz:
-https://www.usenix.org/conference/woot19/presentation/maier
+[https://www.usenix.org/conference/woot19/presentation/maier](https://www.usenix.org/conference/woot19/presentation/maier)
 
 ## 3) Options
 
@@ -92,10 +96,11 @@ As for the QEMU-based instrumentation, the afl-unicorn twist of afl++
 comes with a sub-instruction based instrumentation similar in purpose to laf-intel.
 
 The options that enable Unicorn CompareCoverage are the same used for QEMU.
-AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate
-values. AFL_COMPCOV_LEVEL=2 instruments all
-comparison instructions. Comparison instructions are currently instrumented only
-for the x86, x86_64 and ARM targets.
+AFL_COMPCOV_LEVEL=1 is to instrument comparisons with only immediate values.
+
+AFL_COMPCOV_LEVEL=2 instruments all comparison instructions.
+
+Comparison instructions are currently instrumented only for the x86, x86_64 and ARM targets.
 
 ## 4) Gotchas, feedback, bugs
 
@@ -114,6 +119,6 @@ unicornafl.monkeypatch()
 
 This will replace all unicorn imports with unicornafl inputs.
 
-Refer to the unicorn_mode/samples/arm_example/arm_tester.c for an example
+Refer to the [samples/arm_example/arm_tester.c](samples/arm_example/arm_tester.c) for an example
 of how to do this properly! If you don't get this right, AFL will not 
 load any mutated inputs and your fuzzing will be useless!