diff options
Diffstat (limited to 'docs/env_variables.md')
| -rw-r--r-- | docs/env_variables.md | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/docs/env_variables.md b/docs/env_variables.md index ed81c8a3..36e5a432 100644 --- a/docs/env_variables.md +++ b/docs/env_variables.md @@ -83,6 +83,10 @@ tools make fairly broad use of environmental variables: The native instrumentation helpers (llvm_mode and gcc_plugin) accept a subset of the settings discussed in section #1, with the exception of: + - Setting AFL_LLVM_SKIPSINGLEBLOCK=1 will skip instrumenting + functions with a single basic block. This is useful for most C and + some C++ targets. This works for all instrumentation modes. + - AFL_AS, since this toolchain does not directly invoke GNU as. - TMPDIR and AFL_KEEP_ASSEMBLY, since no temporary assembly files are @@ -116,6 +120,9 @@ Then there are a few specific features that are only available in llvm_mode: afl-clang-lto/afl-clang-lto++ instead of afl-clang-fast, but is only built if LLVM 11 or newer is used. + - AFL_LLVM_INSTRUMENT=CFG will use Control Flow Graph instrumentation. + (recommended) + - AFL_LLVM_LTO_AUTODICTIONARY will generate a dictionary in the target binary based on string compare and memory compare functions. afl-fuzz will automatically get these transmitted when starting to @@ -139,7 +146,13 @@ Then there are a few specific features that are only available in llvm_mode: ### INSTRIM - This feature increases the speed by ~15% without any disadvantages. + This feature increases the speed by ~15% without any disadvantages to the + classic instrumentation. + + Note that there is also an LTO version (if you have llvm 11 or higher) - + that is the best instrumentation we have. Use `afl-clang-lto` to activate. + The InsTrim LTO version additionally has all the options and features of + LTO (see above). - Setting AFL_LLVM_INSTRIM or AFL_LLVM_INSTRUMENT=CFG to activates this mode @@ -147,10 +160,6 @@ Then there are a few specific features that are only available in llvm_mode: afl-fuzz will only be able to see the path the loop took, but not how many times it was called (unless it is a complex loop). - - Setting AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK=1 will skip instrumenting - functions with a single basic block. This is useful for most C and - some C++ targets. - See llvm_mode/README.instrim.md ### NGRAM |