diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/README.md b/README.md index 7268f5d1..c6893fa0 100644 --- a/README.md +++ b/README.md @@ -193,6 +193,7 @@ Here are some good writeups to show how to effectively use AFL++: * [https://aflplus.plus/docs/tutorials/libxml2_tutorial/](https://aflplus.plus/docs/tutorials/libxml2_tutorial/) * [https://bananamafia.dev/post/gb-fuzz/](https://bananamafia.dev/post/gb-fuzz/) * [https://securitylab.github.com/research/fuzzing-challenges-solutions-1](https://securitylab.github.com/research/fuzzing-challenges-solutions-1) + * [https://securitylab.github.com/research/fuzzing-software-2](https://securitylab.github.com/research/fuzzing-software-2) * [https://securitylab.github.com/research/fuzzing-sockets-FTP](https://securitylab.github.com/research/fuzzing-sockets-FTP) If you are interested in fuzzing structured data (where you define what the @@ -232,7 +233,7 @@ anything below 9 is not recommended. | clang/clang++ 11+ is available | --> use afl-clang-lto and afl-clang-lto++ +--------------------------------+ see [llvm/README.lto.md](llvm/README.lto.md) | - | if not, or if the target fails with with afl-clang-lto/++ + | if not, or if the target fails with afl-clang-lto/++ | v +---------------------------------+ @@ -435,6 +436,9 @@ more useful. If you just use one CPU for fuzzing, then you are fuzzing just for fun and not seriously :-) +Pro tip: load the [afl++ snapshot module](https://github.com/AFLplusplus/AFL-Snapshot-LKM) before start afl-fuzz as this improves +performance by a x2 speed increase! + #### a) running afl-fuzz Before to do even a test run of afl-fuzz execute `sudo afl-system-config` (on @@ -561,8 +565,20 @@ then you can expect that your fuzzing won't be fruitful anymore. However often this just means that you should switch out secondaries for others, e.g. custom mutator modules, sync to very different fuzzers, etc. +#### f) improve the speed! + + * Use [persistent mode](llvm_mode/README.persistent_mode.md) (x2-x20 speed increase) + * Use the [afl++ snapshot module](https://github.com/AFLplusplus/AFL-Snapshot-LKM) (x2 speed increase) + * If you do not use shmem persistent mode, use `AFL_TMPDIR` to point the input file on a tempfs location, see [docs/env_variables.md](docs/env_variables.md) + * Improve kernel performance: modify `/etc/default/grub`, set `GRUB_CMDLINE_LINUX_DEFAULT="ibpb=off ibrs=off kpti=off l1tf=off mds=off mitigations=off no_stf_barrier noibpb noibrs nopcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=off pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off"`; then `update-grub` and `reboot` (warning: makes the system more insecure) + * Running on an `ext2` filesystem with `noatime` mount option will be a bit faster than on any other journaling filesystem + * Use your cores! [3.b) Using multiple cores/threads](#b-using-multiple-coresthreads) + ### The End +Check out the [docs/FAQ](docs/FAQ.md) if it maybe answers your question (that +you might not even have known you had ;-) ). + This is basically all you need to know to professionally run fuzzing campaigns. If you want to know more, the rest of this README and the tons of texts in [docs/](docs/) will have you covered. |