about summary refs log tree commit diff
diff options
context:
space:
mode:
authorAndrea Fioraldi <andreafioraldi@gmail.com>2019-09-12 19:56:12 +0200
committerAndrea Fioraldi <andreafioraldi@gmail.com>2019-09-12 19:56:12 +0200
commit5d5ee85928fe710127a6341622f706e691daea08 (patch)
tree97b0a32333107e7d81ca3c35f663347de6c30125
parent820621baa27362efbee9be748f7a9c8f55bf7a54 (diff)
downloadafl++-5d5ee85928fe710127a6341622f706e691daea08.tar.gz
qemu mode readme update
-rw-r--r--qemu_mode/README.md7
1 files changed, 4 insertions, 3 deletions
diff --git a/qemu_mode/README.md b/qemu_mode/README.md
index afa2595a..3b714a6a 100644
--- a/qemu_mode/README.md
+++ b/qemu_mode/README.md
@@ -64,15 +64,16 @@ which can be a huge speed improvement. Note that the specified address
 must be an address of a basic block.
 
 QEMU mode support also persistent mode for x86 and x86_64 targets.
-The environment variable to enable it is AFL_QEMU_PERSISTENT_ADDR=<start addr>.
+The environment variable to enable it is AFL_QEMU_PERSISTENT_ADDR=`start addr`.
 In this variable you must specify the address of the function that must be
 the body of the persistent loop.
 The return address on stack is patched like in WinAFL in order to repeat the
 execution of such function.
 Another modality to execute the persistent loop is to specify also the
-AFL_QEMU_PERSISTENT_RET=<end addr> env variable.
+AFL_QEMU_PERSISTENT_RET=`end addr` env variable.
 With this variable assigned, instead of patching the return address, the
-specified instruction is transformed to a jump towards <start addr>.
+specified instruction is transformed to a jump towards `start addr`.
+Note that the format of the addresses in such variables is hex.
 
 Note that the base address of PIE binaries in QEMU user is 0x4000000000.