about summary refs log tree commit diff
path: root/docs/fuzzing_in_depth.md
diff options
context:
space:
mode:
authorvan Hauser <vh@thc.org>2021-12-09 14:39:00 +0100
committerGitHub <noreply@github.com>2021-12-09 14:39:00 +0100
commitcaf67efab14c5255fdd0ac7fb59dfaa64e6f36f4 (patch)
treec2c609fbbf9851f55813bae1842b33ac3a0c7a6c /docs/fuzzing_in_depth.md
parentdb360332c4cf92c3b90d8dfab9292763e677aebf (diff)
parent3b287b7b0c669bae5961f7c8ebc1c5dd1a2842f7 (diff)
downloadafl++-caf67efab14c5255fdd0ac7fb59dfaa64e6f36f4.tar.gz
Merge pull request #1200 from AFLplusplus/rename
Rename
Diffstat (limited to 'docs/fuzzing_in_depth.md')
-rw-r--r--docs/fuzzing_in_depth.md10
1 files changed, 5 insertions, 5 deletions
diff --git a/docs/fuzzing_in_depth.md b/docs/fuzzing_in_depth.md
index aaceb600..e1599c39 100644
--- a/docs/fuzzing_in_depth.md
+++ b/docs/fuzzing_in_depth.md
@@ -11,7 +11,7 @@ Fuzzing source code is a three-step process:
 2. Prepare the fuzzing by selecting and optimizing the input corpus for the
    target.
 3. Perform the fuzzing of the target by randomly mutating input and assessing if
-   a generated input was processed in a new path in the target binary.
+   that input was processed on a new path in the target binary.
 
 ## 0. Common sense risks
 
@@ -354,7 +354,7 @@ You can find many good examples of starting files in the
 ### b) Making the input corpus unique
 
 Use the AFL++ tool `afl-cmin` to remove inputs from the corpus that do not
-produce a new path in the target.
+produce a new path/coverage in the target.
 
 Put all files from step a) into one directory, e.g., INPUTS.
 
@@ -570,7 +570,7 @@ its name is unique, hence the recommendation for `-M main-$HOSTNAME`.
 
 Now there are three strategies on how you can sync between the servers:
 * never: sounds weird, but this makes every server an island and has the chance
-  the each follow different paths into the target. You can make this even more
+  that each follow different paths into the target. You can make this even more
   interesting by even giving different seeds to each server.
 * regularly (~4h): this ensures that all fuzzing campaigns on the servers "see"
   the same thing. It is like fuzzing on a huge server.
@@ -633,7 +633,7 @@ AFL_BENCH_JUST_ONE=1 AFL_FAST_CAL=1 afl-fuzz -i newseeds -o out -S newseeds -- .
 
 ### g) Checking the coverage of the fuzzing
 
-The `paths found` value is a bad indicator for checking how good the coverage
+The `corpus count` value is a bad indicator for checking how good the coverage
 is.
 
 A better indicator - if you use default llvm instrumentation with at least
@@ -822,7 +822,7 @@ as these are much shorter runnings.
       will impact the speed by ~15% though.
     * `AFL_FAST_CAL` - Enable fast calibration, this halves the time the
       saturated corpus needs to be loaded.
-    * `AFL_CMPLOG_ONLY_NEW` - only perform cmplog on new found paths, not the
+    * `AFL_CMPLOG_ONLY_NEW` - only perform cmplog on new finds, not the
       initial corpus as this very likely has been done for them already.
     * Keep the generated corpus, use afl-cmin and reuse it every time!