diff options
| -rw-r--r-- | README.md | 12 | ||||
| -rw-r--r-- | dictionaries/README.dictionaries | 43 |
2 files changed, 6 insertions, 49 deletions
diff --git a/README.md b/README.md index 053f5fa5..30863b72 100644 --- a/README.md +++ b/README.md @@ -199,14 +199,14 @@ For C++ programs, you'd would also want to set `CXX=/path/to/afl/afl-g++`. The clang wrappers (afl-clang and afl-clang++) can be used in the same way; clang users may also opt to leverage a higher-performance instrumentation mode, -as described in [llvm_mode/README.llvm](llvm_mode/README.llvm). +as described in [llvm_mode/README.md](llvm_mode/README.md). Clang/LLVM has a much better performance and works with LLVM version 3.8.0 to 9. Using the LAF Intel performance enhancements are also recommended, see -[llvm_mode/README.laf-intel](llvm_mode/README.laf-intel) +[llvm_mode/README.laf-intel.md](llvm_mode/README.laf-intel.md) Using partial instrumentation is also recommended, see -[llvm_mode/README.whitelist](llvm_mode/README.whitelist) +[llvm_mode/README.whitelist.md](llvm_mode/README.whitelist.md) When testing libraries, you need to find or write a simple program that reads data from stdin or from a file and passes it to the tested library. In such a @@ -222,7 +222,7 @@ $ CC=/path/to/afl/afl-gcc ./configure --disable-shared Setting `AFL_HARDEN=1` when calling 'make' will cause the CC wrapper to automatically enable code hardening options that make it easier to detect simple memory bugs. Libdislocator, a helper library included with AFL (see -[libdislocator/README.dislocator](libdislocator/README.dislocator)) can help uncover heap corruption issues, too. +[libdislocator/README.md](libdislocator/README.md)) can help uncover heap corruption issues, too. PS. ASAN users are advised to review [docs/notes_for_asan.txt](docs/notes_for_asan.txt) file for important caveats. @@ -242,7 +242,7 @@ $ cd qemu_mode $ ./build_qemu_support.sh ``` -For additional instructions and caveats, see [qemu_mode/README.qemu](qemu_mode/README.qemu). +For additional instructions and caveats, see [qemu_mode/README.md](qemu_mode/README.md). The mode is approximately 2-5x slower than compile-time instrumentation, is less conductive to parallelization, and may have some other quirks. @@ -433,7 +433,7 @@ magic headers, or other special tokens associated with the targeted data type [http://lcamtuf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html](http://lcamtuf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html) To use this feature, you first need to create a dictionary in one of the two -formats discussed in [dictionaries/README.dictionaries](ictionaries/README.dictionaries); +formats discussed in [dictionaries/README.md](ictionaries/README.md); and then point the fuzzer to it via the -x option in the command line. (Several common dictionaries are already provided in that subdirectory, too.) diff --git a/dictionaries/README.dictionaries b/dictionaries/README.dictionaries deleted file mode 100644 index ea319733..00000000 --- a/dictionaries/README.dictionaries +++ /dev/null @@ -1,43 +0,0 @@ -================ -AFL dictionaries -================ - - (See ../docs/README for the general instruction manual.) - -This subdirectory contains a set of dictionaries that can be used in -conjunction with the -x option to allow the fuzzer to effortlessly explore the -grammar of some of the more verbose data formats or languages. The basic -principle behind the operation of fuzzer dictionaries is outlined in section 9 -of the "main" README for the project. - -Custom dictionaries can be added at will. They should consist of a -reasonably-sized set of rudimentary syntax units that the fuzzer will then try -to clobber together in various ways. Snippets between 2 and 16 bytes are usually -the sweet spot. - -Custom dictionaries can be created in two ways: - - - By creating a new directory and placing each token in a separate file, in - which case, there is no need to escape or otherwise format the data. - - - By creating a flat text file where tokens are listed one per line in the - format of name="value". The alphanumeric name is ignored and can be omitted, - although it is a convenient way to document the meaning of a particular - token. The value must appear in quotes, with hex escaping (\xNN) applied to - all non-printable, high-bit, or otherwise problematic characters (\\ and \" - shorthands are recognized, too). - -The fuzzer auto-selects the appropriate mode depending on whether the -x -parameter is a file or a directory. - -In the file mode, every name field can be optionally followed by @<num>, e.g.: - - keyword_foo@1 = "foo" - -Such entries will be loaded only if the requested dictionary level is equal or -higher than this number. The default level is zero; a higher value can be set -by appending @<num> to the dictionary file name, like so: - - -x path/to/dictionary.dct@2 - -Good examples of dictionaries can be found in xml.dict and png.dict. |