diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/ci_fuzzing.md | 2 | ||||
| -rw-r--r-- | docs/fuzzing_binary-only_targets.md | 5 | ||||
| -rw-r--r-- | docs/fuzzing_expert.md | 2 |
3 files changed, 5 insertions, 4 deletions
diff --git a/docs/ci_fuzzing.md b/docs/ci_fuzzing.md index 316059f8..8d1a2f99 100644 --- a/docs/ci_fuzzing.md +++ b/docs/ci_fuzzing.md @@ -26,4 +26,4 @@ Some notes on CI Fuzzing - this fuzzing is different to normal fuzzing campaigns `-M` enables old queue handling etc. which is good for a fuzzing campaign but not good for short CI runs. How this can look like can e.g. be seen at AFL++'s setup in Google's [oss-fuzz](https://github.com/google/oss-fuzz/blob/master/infra/base-images/base-builder/compile_afl) -and [clusterfuzz](https://github.com/google/clusterfuzz/blob/master/src/python/bot/fuzzers/afl/launcher.py). \ No newline at end of file +and [clusterfuzz](https://github.com/google/clusterfuzz/blob/master/src/clusterfuzz/_internal/bot/fuzzers/afl/launcher.py). diff --git a/docs/fuzzing_binary-only_targets.md b/docs/fuzzing_binary-only_targets.md index a39e40a0..8b3bbeff 100644 --- a/docs/fuzzing_binary-only_targets.md +++ b/docs/fuzzing_binary-only_targets.md @@ -51,7 +51,7 @@ make ``` For additional instructions and caveats, see [frida_mode/README.md](../frida_mode/README.md). -If possible you should use the persistent mode, see [qemu_frida/README.persistent.md](../qemu_frida/README.persistent.md). +If possible you should use the persistent mode, see [qemu_frida/README.md](../qemu_frida/README.md). The mode is approximately 2-5x slower than compile-time instrumentation, and is less conducive to parallelization. @@ -71,7 +71,8 @@ cd unicorn_mode If the goal is to fuzz a dynamic library then there are two options available. For both you need to write a small harness that loads and calls the library. -Faster is the frida solution: [utils/afl_frida/README.md](../utils/afl_frida/README.md) +Then you fuzz this with either frida_mode or qemu_mode, and either use +`AFL_INST_LIBS=1` or `AFL_QEMU/FRIDA_INST_RANGES` Another, less precise and slower option is using ptrace with debugger interrupt instrumentation: [utils/afl_untracer/README.md](../utils/afl_untracer/README.md). diff --git a/docs/fuzzing_expert.md b/docs/fuzzing_expert.md index 23b24ad0..7695e21f 100644 --- a/docs/fuzzing_expert.md +++ b/docs/fuzzing_expert.md @@ -472,7 +472,7 @@ If you are using AFL spinoffs or AFL conforming fuzzers, then just use the same -o directory and give it a unique `-S` name. Examples are: * [Fuzzolic](https://github.com/season-lab/fuzzolic) - * [symcc](https://github.com/eurecom-s/symcc/) + * [symcc](https://github.com/eurecom-s3/symcc/) * [Eclipser](https://github.com/SoftSec-KAIST/Eclipser/) * [AFLsmart](https://github.com/aflsmart/aflsmart) * [FairFuzz](https://github.com/carolemieux/afl-rb) |