diff options
Diffstat (limited to 'TODO')
| -rw-r--r-- | TODO | 57 |
1 files changed, 42 insertions, 15 deletions
diff --git a/TODO b/TODO index 3d1e444d..26311713 100644 --- a/TODO +++ b/TODO @@ -1,34 +1,61 @@ Roadmap 2.53d: ============== - - indent all the code: clang-format -style=Google - - - update docs/sister_projects.txt afl-fuzz: - - put mutator, scheduler, forkserver and input channels in individual files - - reuse forkserver for showmap, afl-cmin, etc. + - custom mutator lib: example and readme + +man: + - man page for afl-clang-fast + + +Roadmap 2.54d: +============== gcc_plugin: - needs to be rewritten - - fix crashes when compiling :( - whitelist support - skip over uninteresting blocks - laf-intel - neverZero qemu_mode: - - deferred mode with AFL_DEFERRED_QEMU=0xaddress + - update to 4.x (probably this will be skipped :( ) unit testing / or large testcase campaign - -Roadmap 2.54d: -============== - - expand MAP size to 256k (current L2 cache size on processors) - -> 18 bit map - - llvm_mode: dynamic map size and collission free basic block IDs - +Problem: Average targets (tiff, jpeg, unrar) go through 1500 edges. + At afl's default map that means ~16 collisions and ~3 wrappings. + Solution #1: increase map size. + every +1 decreases fuzzing speed by ~10% and halfs the collisions + birthday paradox predicts collisions at this # of edges: + mapsize => collisions + 2^16 = 302 + 2^17 = 427 + 2^18 = 603 + 2^19 = 853 + 2^20 = 1207 + 2^21 = 1706 + 2^22 = 2412 + 2^23 = 3411 + 2^24 = 4823 + Increasing the map is an easy solution but also not a good one. + Solution #2: use dynamic map size and collision free basic block IDs + This only works in llvm_mode and llvm >= 9 though + A potential good future solution. Heiko/hexcoder follows this up + Solution #3: write instruction pointers to a big shared map + 512kb/1MB shared map and the instrumented code writes the instruction + pointer into the map. Map must be big enough but could be command line + controlled. + Good: complete coverage information, nothing is lost. choice of analysis + impacts speed, but this can be decided by user options + Neutral: a little bit slower but no loss of coverage + Bad: completely changes how afl uses the map and the scheduling. + Overall another very good solution, Marc Heuse/vanHauser follows this up + qemu_mode: - persistent mode patching the return address (WinAFL style) - - instrument only comparison with immediate values by default when using compcov + - deferred mode with AFL_DEFERRED_QEMU=0xaddress + (AFL_ENTRYPOINT let you to specify only a basic block address as starting + point. This will be implemented togheter with the logic for persistent + mode.) |