diff options
Diffstat (limited to 'instrumentation')
| -rw-r--r-- | instrumentation/README.lto.md | 12 | ||||
| -rw-r--r-- | instrumentation/README.persistent_mode.md | 17 |
2 files changed, 15 insertions, 14 deletions
diff --git a/instrumentation/README.lto.md b/instrumentation/README.lto.md index 38252308..3e9d7585 100644 --- a/instrumentation/README.lto.md +++ b/instrumentation/README.lto.md @@ -146,22 +146,22 @@ afl-clang-lto instead of shared libraries! To make instrumented shared libraries work with afl-clang-lto you have to do quite some extra steps. -Every shared library you want to instrument has to be individually compiled- +Every shared library you want to instrument has to be individually compiled. The environment variable `AFL_LLVM_LTO_DONTWRITEID=1` has to be set during compilation. Additionally the environment variable `AFL_LLVM_LTO_STARTID` has to be set to -the combined edge values of all previous compiled instrumented shared +the added edge count values of all previous compiled instrumented shared libraries for that target. E.g. for the first shared library this would be `AFL_LLVM_LTO_STARTID=0` and afl-clang-lto will then report how many edges have been instrumented (let's say it reported 1000 instrumented edges). The second shared library then has to be set to that value -(`AFL_LLVM_LTO_STARTID=1000` in our example), the third to all previous -combined, etc. +(`AFL_LLVM_LTO_STARTID=1000` in our example), for the third to all previous +counts added, etc. The final program compilation step then may *not* have `AFL_LLVM_LTO_DONTWRITEID` -set, and `AFL_LLVM_LTO_STARTID` must be set to all combined edges of all shared -libaries it will be linked to. +set, and `AFL_LLVM_LTO_STARTID` must be set to all edge counts added of all shared +libraries it will be linked to. This is quite some hands-on work, so better stay away from instrumenting shared libraries :-) diff --git a/instrumentation/README.persistent_mode.md b/instrumentation/README.persistent_mode.md index 0517886b..c6ba2103 100644 --- a/instrumentation/README.persistent_mode.md +++ b/instrumentation/README.persistent_mode.md @@ -2,17 +2,18 @@ ## 1) Introduction -In persistent mode, AFL++ fuzzes a target multiple times -in a single process, instead of forking a new process for each fuzz execution. -This is the most effective way to fuzz, as the speed can easily -be x10 or x20 times faster without any disadvanges. +In persistent mode, AFL++ fuzzes a target multiple times in a single forked +process, instead of forking a new process for each fuzz execution. +This is the most effective way to fuzz, as the speed can easily be x10 or x20 +times faster without any disadvanges. *All professional fuzzing uses this mode.* - Persistent mode requires that the target can be called in one or more functions, -and that its state can be reset so that multiple calls can be performed -without resource leaks and earlier runs will have no impact on future runs -(this can be seen by the `stability` indicator in the `afl-fuzz` UI). +and that it's state can be completely reset so that multiple calls can be +performed without resource leaks, and that earlier runs will have no impact on +future runs (an indicator for this is the `stability` value in the `afl-fuzz` +UI, if this decreases to lower values in persistent mode compared to +non-persistent mode, that the fuzz target keeps state). Examples can be found in [utils/persistent_mode](../utils/persistent_mode). |