diff options
| author | llzmb <46303940+llzmb@users.noreply.github.com> | 2021-10-10 16:32:43 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-10-10 16:32:43 +0200 |
| commit | 79d87f8544a0f67537b2169e3f6821f459659f61 (patch) | |
| tree | 15bfaef53f95696583ea12396a7e8e98b73f77e1 /docs/fuzzing_binary-only_targets.md | |
| parent | 228f6c5dad1a593b4113006e587e9885459a53c2 (diff) | |
| parent | da865cbb9d289d0f782a1c33d85261903c60d624 (diff) | |
| download | afl++-79d87f8544a0f67537b2169e3f6821f459659f61.tar.gz | |
Merge branch 'dev' into docs_edit_readme_fix_links
Diffstat (limited to 'docs/fuzzing_binary-only_targets.md')
| -rw-r--r-- | docs/fuzzing_binary-only_targets.md | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/docs/fuzzing_binary-only_targets.md b/docs/fuzzing_binary-only_targets.md index d568b976..ea262f6e 100644 --- a/docs/fuzzing_binary-only_targets.md +++ b/docs/fuzzing_binary-only_targets.md @@ -51,7 +51,7 @@ make ``` For additional instructions and caveats, see [frida_mode/README.md](../frida_mode/README.md). -If possible you should use the persistent mode, see [qemu_frida/README.persistent.md](../qemu_frida/README.persistent.md). +If possible you should use the persistent mode, see [qemu_frida/README.md](../qemu_frida/README.md). The mode is approximately 2-5x slower than compile-time instrumentation, and is less conducive to parallelization. @@ -71,7 +71,8 @@ cd unicorn_mode If the goal is to fuzz a dynamic library then there are two options available. For both you need to write a small harness that loads and calls the library. -Faster is the frida solution: [frida_mode/README.md](../frida_mode/README.md) +Then you fuzz this with either frida_mode or qemu_mode, and either use +`AFL_INST_LIBS=1` or `AFL_QEMU/FRIDA_INST_RANGES`. Another, less precise and slower option is using ptrace with debugger interrupt instrumentation: [utils/afl_untracer/README.md](../utils/afl_untracer/README.md). |