diff options
author | vanhauser-thc <vh@thc.org> | 2021-12-09 13:22:10 +0100 |
---|---|---|
committer | vanhauser-thc <vh@thc.org> | 2021-12-09 13:22:10 +0100 |
commit | 9063002af22e916701588248eca2fd2669e4d0df (patch) | |
tree | 89dce15383ef3db54faddc39acf68551b3fefa98 /docs | |
parent | 4c6d94ea5f854071277ed9729de2d4ef7d07cc84 (diff) | |
download | afl++-9063002af22e916701588248eca2fd2669e4d0df.tar.gz |
rename path
Diffstat (limited to 'docs')
-rw-r--r-- | docs/Changelog.md | 2 | ||||
-rw-r--r-- | docs/afl-fuzz_approach.md | 26 | ||||
-rw-r--r-- | docs/fuzzing_in_depth.md | 8 | ||||
-rw-r--r-- | docs/resources/grafana-afl++.json | 12 | ||||
-rw-r--r-- | docs/rpc_statsd.md | 16 |
5 files changed, 32 insertions, 32 deletions
diff --git a/docs/Changelog.md b/docs/Changelog.md index 34b9affb..99768d1d 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -1566,7 +1566,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>. - Fixed a bug with installed copies of AFL trying to use QEMU mode. Spotted by G.M. Lime. - - Added last path / crash / hang times to fuzzer_stats, suggested by + - Added last find / crash / hang times to fuzzer_stats, suggested by Richard Hipp. - Fixed a typo, thanks to Jakub Wilk. diff --git a/docs/afl-fuzz_approach.md b/docs/afl-fuzz_approach.md index 2da61cc4..058fe352 100644 --- a/docs/afl-fuzz_approach.md +++ b/docs/afl-fuzz_approach.md @@ -85,7 +85,7 @@ for parallel fuzzing. Second to last is the power schedule mode being run ``` +----------------------------------------------------+ | run time : 0 days, 8 hrs, 32 min, 43 sec | - | last new path : 0 days, 0 hrs, 6 min, 40 sec | + | last new find : 0 days, 0 hrs, 6 min, 40 sec | | last uniq crash : none seen yet | | last uniq hang : 0 days, 1 hrs, 24 min, 32 sec | +----------------------------------------------------+ @@ -485,20 +485,20 @@ directory. This includes: - `cycles_wo_finds` - number of cycles without any new paths found - `execs_done` - number of execve() calls attempted - `execs_per_sec` - overall number of execs per second -- `paths_total` - total number of entries in the queue -- `paths_favored` - number of queue entries that are favored -- `paths_found` - number of entries discovered through local fuzzing -- `paths_imported` - number of entries imported from other instances +- `corpus_count` - total number of entries in the queue +- `corpus_favored` - number of queue entries that are favored +- `corpus_found` - number of entries discovered through local fuzzing +- `corpus_imported` - number of entries imported from other instances - `max_depth` - number of levels in the generated data set -- `cur_path` - currently processed entry number +- `cur_item` - currently processed entry number - `pending_favs` - number of favored entries still waiting to be fuzzed - `pending_total` - number of all entries waiting to be fuzzed -- `variable_paths` - number of test cases showing variable behavior +- `corpus_variable` - number of test cases showing variable behavior - `stability` - percentage of bitmap bytes that behave consistently - `bitmap_cvg` - percentage of edge coverage found in the map so far -- `unique_crashes` - number of unique crashes recorded -- `unique_hangs` - number of unique hangs encountered -- `last_path` - seconds since the last path was found +- `saved_crashes` - number of unique crashes recorded +- `saved_hangs` - number of unique hangs encountered +- `last_find` - seconds since the last find was found - `last_crash` - seconds since the last crash was found - `last_hang` - seconds since the last hang was found - `execs_since_crash` - execs since the last crash was found @@ -531,9 +531,9 @@ last crash > X, etc.). The selected metrics are a subset of all the metrics found in the status and in the plot file. The list is the following: `cycle_done`, `cycles_wo_finds`, -`execs_done`,`execs_per_sec`, `paths_total`, `paths_favored`, `paths_found`, -`paths_imported`, `max_depth`, `cur_path`, `pending_favs`, `pending_total`, -`variable_paths`, `unique_crashes`, `unique_hangs`, `total_crashes`, +`execs_done`,`execs_per_sec`, `corpus_count`, `corpus_favored`, `corpus_found`, +`corpus_imported`, `max_depth`, `cur_item`, `pending_favs`, `pending_total`, +`corpus_variable`, `saved_crashes`, `saved_hangs`, `total_crashes`, `slowest_exec_ms`, `edges_found`, `var_byte_count`, `havoc_expansion`. Their definitions can be found in the addendum above. diff --git a/docs/fuzzing_in_depth.md b/docs/fuzzing_in_depth.md index aaceb600..160258e0 100644 --- a/docs/fuzzing_in_depth.md +++ b/docs/fuzzing_in_depth.md @@ -11,7 +11,7 @@ Fuzzing source code is a three-step process: 2. Prepare the fuzzing by selecting and optimizing the input corpus for the target. 3. Perform the fuzzing of the target by randomly mutating input and assessing if - a generated input was processed in a new path in the target binary. + that input was processed on a new path in the target binary. ## 0. Common sense risks @@ -354,7 +354,7 @@ You can find many good examples of starting files in the ### b) Making the input corpus unique Use the AFL++ tool `afl-cmin` to remove inputs from the corpus that do not -produce a new path in the target. +produce a new path/coverage in the target. Put all files from step a) into one directory, e.g., INPUTS. @@ -633,7 +633,7 @@ AFL_BENCH_JUST_ONE=1 AFL_FAST_CAL=1 afl-fuzz -i newseeds -o out -S newseeds -- . ### g) Checking the coverage of the fuzzing -The `paths found` value is a bad indicator for checking how good the coverage +The `corpus count` value is a bad indicator for checking how good the coverage is. A better indicator - if you use default llvm instrumentation with at least @@ -822,7 +822,7 @@ as these are much shorter runnings. will impact the speed by ~15% though. * `AFL_FAST_CAL` - Enable fast calibration, this halves the time the saturated corpus needs to be loaded. - * `AFL_CMPLOG_ONLY_NEW` - only perform cmplog on new found paths, not the + * `AFL_CMPLOG_ONLY_NEW` - only perform cmplog on new finds, not the initial corpus as this very likely has been done for them already. * Keep the generated corpus, use afl-cmin and reuse it every time! diff --git a/docs/resources/grafana-afl++.json b/docs/resources/grafana-afl++.json index 96e824de..7afe89b1 100644 --- a/docs/resources/grafana-afl++.json +++ b/docs/resources/grafana-afl++.json @@ -926,7 +926,7 @@ "steppedLine": false, "targets": [ { - "expr": "fuzzing{type=\"cur_path\"}", + "expr": "fuzzing{type=\"cur_item\"}", "interval": "", "legendFormat": "", "refId": "A" @@ -936,7 +936,7 @@ "timeFrom": null, "timeRegions": [], "timeShift": null, - "title": "Curent path", + "title": "Current fuzz item", "tooltip": { "shared": true, "sort": 0, @@ -1116,7 +1116,7 @@ "steppedLine": false, "targets": [ { - "expr": "fuzzing{type=\"paths_favored\"}", + "expr": "fuzzing{type=\"corpus_favored\"}", "interval": "", "legendFormat": "", "refId": "A" @@ -1135,7 +1135,7 @@ } ], "timeShift": null, - "title": "Path Favored", + "title": "Corpus Favored", "tooltip": { "shared": true, "sort": 0, @@ -1428,7 +1428,7 @@ "steppedLine": false, "targets": [ { - "expr": "fuzzing{type=\"paths_imported\"}", + "expr": "fuzzing{type=\"corpus_imported\"}", "interval": "", "legendFormat": "", "refId": "A" @@ -1447,7 +1447,7 @@ } ], "timeShift": null, - "title": "Path Imported", + "title": "Corpus Imported", "tooltip": { "shared": true, "sort": 0, diff --git a/docs/rpc_statsd.md b/docs/rpc_statsd.md index 003b9c79..d8f0fb67 100644 --- a/docs/rpc_statsd.md +++ b/docs/rpc_statsd.md @@ -26,7 +26,7 @@ StatsD allows you to receive and aggregate metrics from a wide range of applications and retransmit them to a backend of your choice. From AFL++, StatsD can receive the following metrics: -- cur_path +- cur_item - cycle_done - cycles_wo_finds - edges_found @@ -34,18 +34,18 @@ From AFL++, StatsD can receive the following metrics: - execs_per_sec - havoc_expansion - max_depth -- paths_favored -- paths_found -- paths_imported -- paths_total +- corpus_favored +- corpus_found +- corpus_imported +- corpus_count - pending_favs - pending_total - slowest_exec_ms - total_crashes -- unique_crashes -- unique_hangs +- saved_crashes +- saved_hangs - var_byte_count -- variable_paths +- corpus_variable Depending on your StatsD server, you will be able to monitor, trigger alerts, or perform actions based on these metrics (for example: alert on slow exec/s for a |