diff options
| -rw-r--r-- | docs/fuzzing_binary-only_targets.md | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/docs/fuzzing_binary-only_targets.md b/docs/fuzzing_binary-only_targets.md index 3d3e0ddb..874cf068 100644 --- a/docs/fuzzing_binary-only_targets.md +++ b/docs/fuzzing_binary-only_targets.md @@ -198,12 +198,15 @@ afl-clang-fast's. ### RetroWrite -If you have an x86_64 binary that still has its symbols (i.e., not stripped binary), is compiled with -position independent code (PIC/PIE), and does not contain C++ exceptions, +RetroWrite is a static binary rewriter that can be combined with AFL++. +If you have an x86_64 binary that still has its symbols (i.e., not stripped binary), +is compiled with position independent code (PIC/PIE), and does not contain C++ exceptions, then the RetroWrite solution might be for you. It decompiles to ASM files which can then be instrumented with afl-gcc. -It is at about 80-85% performance. +Binaries that are statically instrumented for fuzzing using RetroWrite are identical +in performance to compiler-instrumented binaries and outperform +the QEMU-based instrumentation by 4.5x. [https://github.com/HexHive/retrowrite](https://github.com/HexHive/retrowrite) |