diff options
Diffstat (limited to 'qemu_mode/README.md')
| -rw-r--r-- | qemu_mode/README.md | 23 |
1 files changed, 16 insertions, 7 deletions
diff --git a/qemu_mode/README.md b/qemu_mode/README.md index 9bbeeb19..348f5bbc 100644 --- a/qemu_mode/README.md +++ b/qemu_mode/README.md @@ -90,7 +90,16 @@ fork() mode but, opposed to fork(), it can scale better with multicore. If the AFL++ Snaphsot kernel module is loaded, qemuafl will use it and, in this case, the speed is better than fork() and also the scaling capabilities. -## 6) CompareCoverage +## 6) Partial instrumentation + +You can tell QEMU to instrument only a part of the address space. + +Just set AFL_QEMU_INST_RANGES=A,B,C... + +The format of the iterms in the list is either a range of addresses like 0x123-0x321 +or a module name like module.so (that is mathed in the mapped object filename). + +## 7) CompareCoverage CompareCoverage is a sub-instrumentation with effects similar to laf-intel. @@ -111,7 +120,7 @@ on the x86, x86_64, arm and aarch64 targets. Highly recommended. -## 7) CMPLOG mode +## 8) CMPLOG mode Another new feature is CMPLOG, which is based on the redqueen project. Here all immidiates in CMP instructions are learned and put into a dynamic @@ -123,7 +132,7 @@ and aarch64. To enable it you must pass on the command line of afl-fuzz: -c /path/to/your/target -## 8) Wine mode +## 9) Wine mode AFL++ QEMU can use Wine to fuzz WIn32 PE binaries. Use the -W flag of afl-fuzz. @@ -131,7 +140,7 @@ Note that some binaries require user interaction with the GUI and must be patche For examples look [here](https://github.com/andreafioraldi/WineAFLplusplusDEMO). -## 9) Notes on linking +## 10) Notes on linking The feature is supported only on Linux. Supporting BSD may amount to porting the changes made to linux-user/elfload.c and applying them to @@ -152,7 +161,7 @@ practice, this means two things: Setting AFL_INST_LIBS=1 can be used to circumvent the .text detection logic and instrument every basic block encountered. -## 10) Benchmarking +## 11) Benchmarking If you want to compare the performance of the QEMU instrumentation with that of afl-gcc compiled code against the same target, you need to build the @@ -167,7 +176,7 @@ Comparative measurements of execution speed or instrumentation coverage will be fairly meaningless if the optimization levels or instrumentation scopes don't match. -## 11) Gotchas, feedback, bugs +## 12) Gotchas, feedback, bugs If you need to fix up checksums or do other cleanup on mutated test cases, see examples/custom_mutators/ for a viable solution. @@ -188,7 +197,7 @@ with -march=core2, can help. Beyond that, this is an early-stage mechanism, so fields reports are welcome. You can send them to <afl-users@googlegroups.com>. -## 12) Alternatives: static rewriting +## 13) Alternatives: static rewriting Statically rewriting binaries just once, instead of attempting to translate them at run time, can be a faster alternative. That said, static rewriting is |