aboutsummaryrefslogtreecommitdiff
path: root/docs
diff options
context:
space:
mode:
authorllzmb <46303940+llzmb@users.noreply.github.com>2021-12-04 22:28:05 +0100
committerllzmb <46303940+llzmb@users.noreply.github.com>2021-12-04 22:28:05 +0100
commit3506077fd6f250f3c080b58ea3bae117c3b122da (patch)
treeaa2aa745f9eb3932d23b7a4ee6ec6715f55b6a75 /docs
parent415be06c54a61ae87fd8a99da2ee12d1ea5d1638 (diff)
downloadafl++-3506077fd6f250f3c080b58ea3bae117c3b122da.tar.gz
Add missing blank lines and remove double blank lines
Diffstat (limited to 'docs')
-rw-r--r--docs/custom_mutators.md8
-rw-r--r--docs/fuzzing_binary-only_targets.md3
-rw-r--r--docs/fuzzing_in_depth.md1
3 files changed, 9 insertions, 3 deletions
diff --git a/docs/custom_mutators.md b/docs/custom_mutators.md
index 0e94ab10..2f632e1f 100644
--- a/docs/custom_mutators.md
+++ b/docs/custom_mutators.md
@@ -23,6 +23,7 @@ The custom mutator is passed to `afl-fuzz` via the `AFL_CUSTOM_MUTATOR_LIBRARY`
or `AFL_PYTHON_MODULE` environment variable, and must export a fuzz function.
Now AFL++ also supports multiple custom mutators which can be specified in the
same `AFL_CUSTOM_MUTATOR_LIBRARY` environment variable like this.
+
```bash
export AFL_CUSTOM_MUTATOR_LIBRARY="full/path/to/mutator_first.so;full/path/to/mutator_second.so"
```
@@ -38,6 +39,7 @@ performed with the custom mutator.
## 2) APIs
C/C++:
+
```c
void *afl_custom_init(afl_state_t *afl, unsigned int seed);
unsigned int afl_custom_fuzz_count(void *data, const unsigned char *buf, size_t buf_size);
@@ -56,6 +58,7 @@ void afl_custom_deinit(void *data);
```
Python:
+
```python
def init(seed):
pass
@@ -233,7 +236,6 @@ Optionally, the following environment variables are supported:
combined with a custom trimming routine (see below) because trimming can
cause the same test breakage like havoc and splice.
-
- `AFL_PYTHON_ONLY`
Deprecated and removed, use `AFL_CUSTOM_MUTATOR_ONLY` instead.
@@ -268,9 +270,11 @@ In case your setup is different, set the necessary variables like this:
### Custom Mutator Preparation
For C/C++ mutators, the source code must be compiled as a shared object:
+
```bash
gcc -shared -Wall -O3 example.c -o example.so
```
+
Note that if you specify multiple custom mutators, the corresponding functions
will be called in the order in which they are specified. e.g. first
`post_process` function of `example_first.so` will be called and then that of
@@ -279,12 +283,14 @@ will be called in the order in which they are specified. e.g. first
### Run
C/C++
+
```bash
export AFL_CUSTOM_MUTATOR_LIBRARY="/full/path/to/example_first.so;/full/path/to/example_second.so"
afl-fuzz /path/to/program
```
Python
+
```bash
export PYTHONPATH=`dirname /full/path/to/example.py`
export AFL_PYTHON_MODULE=example
diff --git a/docs/fuzzing_binary-only_targets.md b/docs/fuzzing_binary-only_targets.md
index 15155111..eaed3a91 100644
--- a/docs/fuzzing_binary-only_targets.md
+++ b/docs/fuzzing_binary-only_targets.md
@@ -21,6 +21,7 @@ If your target is a library, then use FRIDA mode.
If your target is non-linux, then use unicorn_mode.
## Fuzzing binary-only targets with AFL++
+
### QEMU mode
QEMU mode is the "native" solution to the program. It is available in the
@@ -175,6 +176,7 @@ An alternative solution are binary rewriters. They are faster then the solutions
native to AFL++ but don't always work.
### ZAFL
+
ZAFL is a static rewriting platform supporting x86-64 C/C++,
stripped/unstripped, and PIE/non-PIE binaries. Beyond conventional
instrumentation, ZAFL's API enables transformation passes (e.g., laf-Intel,
@@ -277,7 +279,6 @@ There are many binary-only fuzzing frameworks. Some are great for CTFs but don't
work with large binaries, others are very slow but have good path discovery,
some are very hard to set-up...
-
* Jackalope:
[https://github.com/googleprojectzero/Jackalope](https://github.com/googleprojectzero/Jackalope)
* Manticore:
diff --git a/docs/fuzzing_in_depth.md b/docs/fuzzing_in_depth.md
index 2e030e7b..4a1ddf45 100644
--- a/docs/fuzzing_in_depth.md
+++ b/docs/fuzzing_in_depth.md
@@ -808,7 +808,6 @@ then color-codes the input based on which sections appear to be critical, and
which are not; while not bulletproof, it can often offer quick insights into
complex file formats.
-
## 5. CI fuzzing
Some notes on CI fuzzing - this fuzzing is different to normal fuzzing campaigns