diff options
author | Khaled Yakdan <yakdan@code-intelligence.de> | 2019-08-01 14:22:48 +0200 |
---|---|---|
committer | Khaled Yakdan <yakdan@code-intelligence.de> | 2019-08-01 14:22:48 +0200 |
commit | ebf2c8caa590468e1eafbc257e44dc30af82e5f8 (patch) | |
tree | 2b277b9bde32b82c2cedf684869c96424baa005f /llvm_mode/README.instrim | |
parent | a949b40d11956f34c51f4546412a73e0400d1ffc (diff) | |
parent | 7ca22cd552ff21ac0ef7cc1ab5e6e71912752a58 (diff) | |
download | afl++-ebf2c8caa590468e1eafbc257e44dc30af82e5f8.tar.gz |
Merge remote-tracking branch 'github/master' into custom_mutator
# Conflicts: # Makefile # afl-fuzz.c
Diffstat (limited to 'llvm_mode/README.instrim')
-rw-r--r-- | llvm_mode/README.instrim | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/llvm_mode/README.instrim b/llvm_mode/README.instrim new file mode 100644 index 00000000..956a9856 --- /dev/null +++ b/llvm_mode/README.instrim @@ -0,0 +1,26 @@ +# InsTrim +InsTrim: Lightweight Instrumentation for Coverage-guided Fuzzing + + +## Introduction + +InsTrim uses CFG and markers to instrument just what is necessary in the +binary in llvm_mode. It is about 20-25% faster but as a cost has a lower +path discovery. + + +## Usage + +Set the environment variable AFL_LLVM_INSTRIM=1 + +There is also an advanced mode which instruments loops in a way so that +afl-fuzz can see which loop path has been selected but not being able to +see how often the loop has been rerun. +This again is a tradeoff for speed for less path information. +To enable this mode set AFL_LLVM_INSTRIM_LOOPHEAD=1 + + +## Background + +The paper: [InsTrim: Lightweight Instrumentation for Coverage-guided Fuzzing] +(https://www.ndss-symposium.org/wp-content/uploads/2018/07/bar2018_14_Hsu_paper.pdf) |