diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/Changelog.md | 4 | ||||
| -rw-r--r-- | docs/custom_mutators.md | 2 | ||||
| -rw-r--r-- | docs/env_variables.md | 23 |
3 files changed, 26 insertions, 3 deletions
diff --git a/docs/Changelog.md b/docs/Changelog.md index 2a5e36d8..177054e2 100644 --- a/docs/Changelog.md +++ b/docs/Changelog.md @@ -25,8 +25,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>. - llvm_mode InsTrim mode: - removed workaround for bug where paths were not instrumented and imported fix by author - - made skipping 1 block functions an option and is disable by default --> TODO: document this! + - made skipping 1 block functions an option and is disable by default, + set AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK=1 to renable this - qemu_mode: - qemu_mode now uses solely the internal capstone version to fix builds on modern Linux distributions diff --git a/docs/custom_mutators.md b/docs/custom_mutators.md index 7f95b4af..14d8f518 100644 --- a/docs/custom_mutators.md +++ b/docs/custom_mutators.md @@ -15,7 +15,7 @@ cases beyond those available in AFL. For example, to enable structure-aware fuzzing by using libraries that perform mutations according to a given grammar. The custom mutator is passed to `afl-fuzz` via the `AFL_CUSTOM_MUTATOR_LIBRARY` -or `AFL_PYTHON_MODULE` environment variable., and must export a fuzz function. +or `AFL_PYTHON_MODULE` environment variable, and must export a fuzz function. Please see [APIs](#2-apis) and [Usage](#3-usage) for detail. The custom mutation stage is set to be the first non-deterministic stage (right before the havoc stage). diff --git a/docs/env_variables.md b/docs/env_variables.md index d1cf6977..8c7510cd 100644 --- a/docs/env_variables.md +++ b/docs/env_variables.md @@ -91,6 +91,25 @@ of the settings discussed in section #1, with the exception of: Then there are a few specific features that are only available in llvm_mode: +### LTO + +This is a different kind way of instrumentation: first it compiles all +code in LTO (link time optimization) and then performs an edge inserting +instrumentation which is 100% collision free (collisions are a big issue +in afl and afl-like instrumentations). This is performed by using +afl-clang-lto/afl-clang-lto++ instead of afl-clang-fast, but is only +built if LLVM 9 or newer is used. + +None of these options are necessary to be used and are rather for manual +use (which only ever the author of this LTO implementation will use ;-) +These are used if several seperated instrumentation are performed which +are then later combined. + + - AFL_LLVM_LTO_STARTID sets the starting location ID for the instrumentation. + This defaults to 1 + - AFL_LLVM_LTO_DONTWRITEID prevents that the highest location ID written + into the instrumentation is set in a global variable + ### LAF-INTEL This great feature will split compares to series of single byte comparisons @@ -126,6 +145,10 @@ Then there are a few specific features that are only available in llvm_mode: afl-fuzz will only be able to see the path the loop took, but not how many times it was called (unless it is a complex loop). + - Setting AFL_LLVM_INSTRIM_SKIPSINGLEBLOCK=1 will skip instrumenting + functions with a single basic block. This is useful for most C and + some C++ targets. + See llvm_mode/README.instrim.md ### NOT_ZERO |