aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorvanhauser-thc <vh@thc.org>2021-04-16 11:45:22 +0200
committervanhauser-thc <vh@thc.org>2021-04-16 11:45:22 +0200
commit89d4565092367753c70849bb85b220db48ed2710 (patch)
tree93ba0e8b94279cd4c4fde75e1942fcc16bb63506
parent624c1dce465ffd8d3971282cf136c3df259f62ec (diff)
downloadafl++-89d4565092367753c70849bb85b220db48ed2710.tar.gz
update docs
-rw-r--r--README.md10
-rw-r--r--TODO.md1
-rw-r--r--docs/Changelog.md6
-rw-r--r--docs/ideas.md43
4 files changed, 16 insertions, 44 deletions
diff --git a/README.md b/README.md
index e7582aff..583db85f 100644
--- a/README.md
+++ b/README.md
@@ -99,15 +99,15 @@ behaviours and defaults:
| Ngram prev_loc Coverage | | x(6) | | | | |
| Context Coverage | | x(6) | | | | |
| Auto Dictionary | | x(7) | | | | |
- | Snapshot LKM Support | | x(8) | x(8) | | (x)(5) | |
+ | Snapshot LKM Support | | (x)(8) | (x)(8) | | (x)(5) | |
- 1. default for LLVM >= 9.0, env var for older version due an efficiency bug in llvm <= 8
+ 1. default for LLVM >= 9.0, env var for older version due an efficiency bug in previous llvm versions
2. GCC creates non-performant code, hence it is disabled in gcc_plugin
3. (currently unassigned)
- 4. with pcguard mode and LTO mode for LLVM >= 11
+ 4. with pcguard mode and LTO mode for LLVM 11 and newer
5. upcoming, development in the branch
- 6. not compatible with LTO instrumentation and needs at least LLVM >= 4.1
- 7. automatic in LTO mode with LLVM >= 11, an extra pass for all LLVM version that writes to a file to use with afl-fuzz' `-x`
+ 6. not compatible with LTO instrumentation and needs at least LLVM v4.1
+ 7. automatic in LTO mode with LLVM 11 and newer, an extra pass for all LLVM version that writes to a file to use with afl-fuzz' `-x`
8. the snapshot LKM is currently unmaintained due to too many kernel changes coming too fast :-(
Among others, the following features and patches have been integrated:
diff --git a/TODO.md b/TODO.md
index 96b24521..c828d214 100644
--- a/TODO.md
+++ b/TODO.md
@@ -11,7 +11,6 @@
- intel-pt tracer
- better autodetection of shifting runtime timeout values
- cmplog: use colorization input for havoc?
- - cmplog: too much tainted bytes, directly add to dict and skip?
- parallel builds for source-only targets
## Further down the road
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 155eec66..9c9a3976 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -20,6 +20,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
to allow replay of non-reproducable crashes, see
AFL_PERSISTENT_RECORD in config.h and docs/envs.h
- default cmplog level (-l) is now 2, better efficiency.
+ - cmplog level 3 (-l 3) now performs redqueen on everything.
+ use with care.
- better fuzzing strategy yields for enabled options
- ensure one fuzzer sync per cycle
- fix afl_custom_queue_new_entry original file name when syncing
@@ -28,11 +30,11 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
-i dir crashes the target or results in a timeout. By default
afl++ ignores these and uses them for splicing instead.
- afl-cc:
- - Leak Sanitizer support (AFL_USE_LSAN) added by Joshua Rogers, thanks!
+ - Leak Sanitizer (AFL_USE_LSAN) added by Joshua Rogers, thanks!
- Removed InsTrim instrumentation as it is not as good as PCGUARD
- Removed automatic linking with -lc++ for LTO mode
- utils/aflpp_driver/aflpp_qemu_driver_hook fixed to work with qemu mode
- - add -d (dead fuzzer stats) to afl-whatsup
+ - add -d (add dead fuzzer stats) to afl-whatsup
### Version ++3.12c (release)
- afl-fuzz:
diff --git a/docs/ideas.md b/docs/ideas.md
index 11c78e49..e25d3ba6 100644
--- a/docs/ideas.md
+++ b/docs/ideas.md
@@ -3,42 +3,6 @@
In the following, we describe a variety of ideas that could be implemented
for future AFL++ versions.
-# GSoC 2021
-
-All GSoC 2021 projects will be in the Rust development language!
-
-## UI for libaflrs
-
-Write a user interface to libaflrs, the upcoming backend of afl++.
-This might look like the afl-fuzz UI, but you can improve on it - and should!
-
-## Schedulers for libaflrs
-
-Schedulers is a mechanism that selects items from the fuzzing corpus based
-on strategy and randomness. One scheduler might focus on long paths,
-another on rarity of edges discovered, still another on a combination on
-things. Some of the schedulers in afl++ have to be ported, but you are free
-to come up with your own if you want to - and see how it performs.
-
-## Forkserver support for libaflrs
-
-The current libaflrs implementation fuzzes in-memory, however obviously we
-want to support afl instrumented binaries as well.
-Hence a forkserver support needs to be implemented - forking off the target
-and talking to the target via a socketpair and the communication protocol
-within.
-
-## More Observers for libaflrs
-
-An observer is measuring functionality that looks at the target being fuzzed
-and documents something about it. In traditional fuzzing this is the coverage
-in the target, however we want to add various more observers, e.g. stack depth,
-heap usage, etc. - this is a topic for an experienced Rust developer.
-
-# Generic ideas and wishlist - NOT PART OF GSoC 2021 !
-
-The below list is not part of GSoC 2021.
-
## Analysis software
Currently analysis is done by using afl-plot, which is rather outdated.
@@ -65,6 +29,13 @@ the current Unicorn instrumentation.
Mentor: any
+## Support other programming languages
+
+Other programming languages also use llvm hence they could (easily?) supported
+for fuzzing, e.g. mono, swift, go, kotlin native, fortran, ...
+
+Mentor: vanhauser-thc
+
## Machine Learning
Something with machine learning, better than [NEUZZ](https://github.com/dongdongshe/neuzz) :-)