diff options
| -rw-r--r-- | TODO | 3 | ||||
| -rw-r--r-- | src/afl-fuzz.c | 2 |
2 files changed, 4 insertions, 1 deletions
diff --git a/TODO b/TODO index d153f1b4..b9c209f8 100644 --- a/TODO +++ b/TODO @@ -18,6 +18,9 @@ qemu_mode: - instrim for QEMU mode via static analysis (with r2pipe? or angr?) Idea: The static analyzer outputs a map in which each edge that must be skipped is marked with 1. QEMU loads it at startup in the parent process. + - rename qemu specific envs to AFL_QEMU (espec. AFL_ENTRYPOINT) + - add AFL_QEMU_EXITPOINT (maybe multiple?) + - add/implement AFL_QEMU_INST_LIBLIST and AFL_QEMU_NOINST_PROGRAM custom_mutators: - rip what Superion is doing into custom mutators for js, php, etc. diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index 8833244d..63d2b997 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -100,7 +100,7 @@ static void usage(u8* argv0) { " -f file - location read by the fuzzed program (stdin)\n" " -t msec - timeout for each run (auto-scaled, 50-%d ms)\n" " -m megs - memory limit for child process (%d MB)\n" - " -c program - enable CmpLog specifying a binary compiled for it\n" + " -c program - enable CmpLog by specifying a binary compiled for it\n" " -Q - use binary-only instrumentation (QEMU mode)\n" " -U - use unicorn-based instrumentation (Unicorn mode)\n" " -W - use qemu-based instrumentation with Wine (Wine " |