about summary refs log tree commit diff
path: root/instrumentation/README.ctx.md
diff options
context:
space:
mode:
authorvan Hauser <vh@thc.org>2021-11-29 15:32:14 +0100
committerGitHub <noreply@github.com>2021-11-29 15:32:14 +0100
commit235bb3235e45a81eb2b524f3a76346d91a163e3d (patch)
treee44968d7d3d4267386d1c714e061e84bdfec9077 /instrumentation/README.ctx.md
parentce0edcff2e127f363b9eb7968b87f8343b8b62f3 (diff)
parente0c8a5c0c6ae67af3280c0ead8124a2ffe920241 (diff)
downloadafl++-235bb3235e45a81eb2b524f3a76346d91a163e3d.tar.gz
Merge pull request #1177 from llzmb/docs_cleanup_instrumentation_folder
Clean up instrumentation folder
Diffstat (limited to 'instrumentation/README.ctx.md')
-rw-r--r--instrumentation/README.ctx.md38
1 files changed, 0 insertions, 38 deletions
diff --git a/instrumentation/README.ctx.md b/instrumentation/README.ctx.md
deleted file mode 100644
index 335e9921..00000000
--- a/instrumentation/README.ctx.md
+++ /dev/null
@@ -1,38 +0,0 @@
-# AFL Context Sensitive Branch Coverage
-
-## What is this?
-
-This is an LLVM-based implementation of the context sensitive branch coverage.
-
-Basically every function gets its own ID and, every time when an edge is logged,
-all the IDs in the callstack are hashed and combined with the edge transition
-hash to augment the classic edge coverage with the information about the
-calling context.
-
-So if both function A and function B call a function C, the coverage
-collected in C will be different.
-
-In math the coverage is collected as follows:
-`map[current_location_ID ^ previous_location_ID >> 1 ^ hash_callstack_IDs] += 1`
-
-The callstack hash is produced XOR-ing the function IDs to avoid explosion with
-recursive functions.
-
-## Usage
-
-Set the `AFL_LLVM_INSTRUMENT=CTX` or `AFL_LLVM_CTX=1` environment variable.
-
-It is highly recommended to increase the MAP_SIZE_POW2 definition in
-config.h to at least 18 and maybe up to 20 for this as otherwise too
-many map collisions occur.
-
-## Caller Branch Coverage
-
-If the context sensitive coverage introduces too may collisions and becoming
-detrimental, the user can choose to augment edge coverage with just the
-called function ID, instead of the entire callstack hash.
-
-In math the coverage is collected as follows:
-`map[current_location_ID ^ previous_location_ID >> 1 ^ previous_callee_ID] += 1`
-
-Set the `AFL_LLVM_INSTRUMENT=CALLER` or `AFL_LLVM_CALLER=1` environment variable.