diff options
| author | van Hauser <vh@thc.org> | 2021-11-29 15:32:14 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-11-29 15:32:14 +0100 |
| commit | 235bb3235e45a81eb2b524f3a76346d91a163e3d (patch) | |
| tree | e44968d7d3d4267386d1c714e061e84bdfec9077 /instrumentation/README.ctx.md | |
| parent | ce0edcff2e127f363b9eb7968b87f8343b8b62f3 (diff) | |
| parent | e0c8a5c0c6ae67af3280c0ead8124a2ffe920241 (diff) | |
| download | afl++-235bb3235e45a81eb2b524f3a76346d91a163e3d.tar.gz | |
Merge pull request #1177 from llzmb/docs_cleanup_instrumentation_folder
Clean up instrumentation folder
Diffstat (limited to 'instrumentation/README.ctx.md')
| -rw-r--r-- | instrumentation/README.ctx.md | 38 |
1 files changed, 0 insertions, 38 deletions
diff --git a/instrumentation/README.ctx.md b/instrumentation/README.ctx.md deleted file mode 100644 index 335e9921..00000000 --- a/instrumentation/README.ctx.md +++ /dev/null @@ -1,38 +0,0 @@ -# AFL Context Sensitive Branch Coverage - -## What is this? - -This is an LLVM-based implementation of the context sensitive branch coverage. - -Basically every function gets its own ID and, every time when an edge is logged, -all the IDs in the callstack are hashed and combined with the edge transition -hash to augment the classic edge coverage with the information about the -calling context. - -So if both function A and function B call a function C, the coverage -collected in C will be different. - -In math the coverage is collected as follows: -`map[current_location_ID ^ previous_location_ID >> 1 ^ hash_callstack_IDs] += 1` - -The callstack hash is produced XOR-ing the function IDs to avoid explosion with -recursive functions. - -## Usage - -Set the `AFL_LLVM_INSTRUMENT=CTX` or `AFL_LLVM_CTX=1` environment variable. - -It is highly recommended to increase the MAP_SIZE_POW2 definition in -config.h to at least 18 and maybe up to 20 for this as otherwise too -many map collisions occur. - -## Caller Branch Coverage - -If the context sensitive coverage introduces too may collisions and becoming -detrimental, the user can choose to augment edge coverage with just the -called function ID, instead of the entire callstack hash. - -In math the coverage is collected as follows: -`map[current_location_ID ^ previous_location_ID >> 1 ^ previous_callee_ID] += 1` - -Set the `AFL_LLVM_INSTRUMENT=CALLER` or `AFL_LLVM_CALLER=1` environment variable. |
