diff options
| author | van Hauser <vh@thc.org> | 2020-02-07 19:41:48 +0100 |
|---|---|---|
| committer | van Hauser <vh@thc.org> | 2020-02-07 19:41:48 +0100 |
| commit | e360726730aa9e4e54548f20f76da7de368fa35f (patch) | |
| tree | 0a670f2ed8583ff44b9287eaac3f87bb3db7683b | |
| parent | fd8fe4dd088464230df2dc456c5a9fbf905c907f (diff) | |
| download | afl++-e360726730aa9e4e54548f20f76da7de368fa35f.tar.gz | |
todo update
| -rw-r--r-- | TODO | 3 | ||||
| -rw-r--r-- | src/afl-fuzz.c | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/TODO b/TODO index d153f1b4..b9c209f8 100644 --- a/TODO +++ b/TODO @@ -18,6 +18,9 @@ qemu_mode: - instrim for QEMU mode via static analysis (with r2pipe? or angr?) Idea: The static analyzer outputs a map in which each edge that must be skipped is marked with 1. QEMU loads it at startup in the parent process. + - rename qemu specific envs to AFL_QEMU (espec. AFL_ENTRYPOINT) + - add AFL_QEMU_EXITPOINT (maybe multiple?) + - add/implement AFL_QEMU_INST_LIBLIST and AFL_QEMU_NOINST_PROGRAM custom_mutators: - rip what Superion is doing into custom mutators for js, php, etc. diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 8833244d..63d2b997 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -100,7 +100,7 @@ static void usage(u8* argv0) { " -f file - location read by the fuzzed program (stdin)\n" " -t msec - timeout for each run (auto-scaled, 50-%d ms)\n" " -m megs - memory limit for child process (%d MB)\n" - " -c program - enable CmpLog specifying a binary compiled for it\n" + " -c program - enable CmpLog by specifying a binary compiled for it\n" " -Q - use binary-only instrumentation (QEMU mode)\n" " -U - use unicorn-based instrumentation (Unicorn mode)\n" " -W - use qemu-based instrumentation with Wine (Wine " |