diff options
Diffstat (limited to 'TODO')
| -rw-r--r-- | TODO | 35 |
1 files changed, 30 insertions, 5 deletions
diff --git a/TODO b/TODO index 3d1e444d..42987cb9 100644 --- a/TODO +++ b/TODO @@ -1,6 +1,6 @@ Roadmap 2.53d: ============== - - indent all the code: clang-format -style=Google + - indent all the code: .clang-format - update docs/sister_projects.txt @@ -18,16 +18,41 @@ gcc_plugin: qemu_mode: - deferred mode with AFL_DEFERRED_QEMU=0xaddress + @andrea - dont we have that already with AFL_ENTRYPOINT? unit testing / or large testcase campaign Roadmap 2.54d: ============== - - expand MAP size to 256k (current L2 cache size on processors) - -> 18 bit map - - llvm_mode: dynamic map size and collission free basic block IDs - +Problem: Average targets (tiff, jpeg, unrar) go through 1500 edges. + At afl's default map that means ~16 collisions and ~3 wrappings. + Solution #1: increase map size. + every +1 decreases fuzzing speed by ~10% and halfs the collisions + birthday paradox predicts at collisions at this # of edges: + 2^16 = 302 + 2^17 = 427 + 2^18 = 603 + 2^19 = 853 + 2^20 = 1207 + 2^21 = 1706 + 2^22 = 2412 + 2^23 = 3411 + 2^24 = 4823 + Its an easy solution but also not a good one. + Solution #2: use dynamic map size and collision free basic block IDs + This only works in llvm_mode and llvm >= 9 though + A potential good future solution + Solution #3: write instruction pointers to a big shared map + 512kb/1MB shared map and the instrumented code writes the instruction + pointer into the map. Map must be big enough but could be command line + controlled. + Good: complete coverage information, nothing is lost. choice of analysis + impacts speed, but this can be decided by user options + Neutral: a little bit slower but no loss of coverage + Bad: completely changes how afl uses the map and the scheduling. + Overall another very good solution + qemu_mode: - persistent mode patching the return address (WinAFL style) - instrument only comparison with immediate values by default when using compcov |