From 9063002af22e916701588248eca2fd2669e4d0df Mon Sep 17 00:00:00 2001 From: vanhauser-thc Date: Thu, 9 Dec 2021 13:22:10 +0100 Subject: rename path --- docs/afl-fuzz_approach.md | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) (limited to 'docs/afl-fuzz_approach.md') diff --git a/docs/afl-fuzz_approach.md b/docs/afl-fuzz_approach.md index 2da61cc4..058fe352 100644 --- a/docs/afl-fuzz_approach.md +++ b/docs/afl-fuzz_approach.md @@ -85,7 +85,7 @@ for parallel fuzzing. Second to last is the power schedule mode being run ``` +----------------------------------------------------+ | run time : 0 days, 8 hrs, 32 min, 43 sec | - | last new path : 0 days, 0 hrs, 6 min, 40 sec | + | last new find : 0 days, 0 hrs, 6 min, 40 sec | | last uniq crash : none seen yet | | last uniq hang : 0 days, 1 hrs, 24 min, 32 sec | +----------------------------------------------------+ @@ -485,20 +485,20 @@ directory. This includes: - `cycles_wo_finds` - number of cycles without any new paths found - `execs_done` - number of execve() calls attempted - `execs_per_sec` - overall number of execs per second -- `paths_total` - total number of entries in the queue -- `paths_favored` - number of queue entries that are favored -- `paths_found` - number of entries discovered through local fuzzing -- `paths_imported` - number of entries imported from other instances +- `corpus_count` - total number of entries in the queue +- `corpus_favored` - number of queue entries that are favored +- `corpus_found` - number of entries discovered through local fuzzing +- `corpus_imported` - number of entries imported from other instances - `max_depth` - number of levels in the generated data set -- `cur_path` - currently processed entry number +- `cur_item` - currently processed entry number - `pending_favs` - number of favored entries still waiting to be fuzzed - `pending_total` - number of all entries waiting to be fuzzed -- `variable_paths` - number of test cases showing variable behavior +- `corpus_variable` - number of test cases showing variable behavior - `stability` - percentage of bitmap bytes that behave consistently - `bitmap_cvg` - percentage of edge coverage found in the map so far -- `unique_crashes` - number of unique crashes recorded -- `unique_hangs` - number of unique hangs encountered -- `last_path` - seconds since the last path was found +- `saved_crashes` - number of unique crashes recorded +- `saved_hangs` - number of unique hangs encountered +- `last_find` - seconds since the last find was found - `last_crash` - seconds since the last crash was found - `last_hang` - seconds since the last hang was found - `execs_since_crash` - execs since the last crash was found @@ -531,9 +531,9 @@ last crash > X, etc.). The selected metrics are a subset of all the metrics found in the status and in the plot file. The list is the following: `cycle_done`, `cycles_wo_finds`, -`execs_done`,`execs_per_sec`, `paths_total`, `paths_favored`, `paths_found`, -`paths_imported`, `max_depth`, `cur_path`, `pending_favs`, `pending_total`, -`variable_paths`, `unique_crashes`, `unique_hangs`, `total_crashes`, +`execs_done`,`execs_per_sec`, `corpus_count`, `corpus_favored`, `corpus_found`, +`corpus_imported`, `max_depth`, `cur_item`, `pending_favs`, `pending_total`, +`corpus_variable`, `saved_crashes`, `saved_hangs`, `total_crashes`, `slowest_exec_ms`, `edges_found`, `var_byte_count`, `havoc_expansion`. Their definitions can be found in the addendum above. -- cgit 1.4.1 From 77ce31c8ba1f90d8895ba16a2bb509db88071a10 Mon Sep 17 00:00:00 2001 From: llzmb <46303940+llzmb@users.noreply.github.com> Date: Sat, 11 Dec 2021 19:13:22 +0100 Subject: Add docs content overview --- dictionaries/README.md | 2 +- docs/README.md | 41 ++++++++++++++++++++++ docs/afl-fuzz_approach.md | 2 +- docs/resources/fuzzing_process_overview.drawio.svg | 4 +++ instrumentation/README.gcc_plugin.md | 5 +-- instrumentation/README.llvm.md | 2 +- qemu_mode/README.md | 2 +- testcases/README.md | 2 +- utils/libdislocator/README.md | 2 +- utils/libtokencap/README.md | 2 +- 10 files changed, 55 insertions(+), 9 deletions(-) create mode 100644 docs/README.md create mode 100644 docs/resources/fuzzing_process_overview.drawio.svg (limited to 'docs/afl-fuzz_approach.md') diff --git a/dictionaries/README.md b/dictionaries/README.md index 0b3b4d90..ab0a6798 100644 --- a/dictionaries/README.md +++ b/dictionaries/README.md @@ -1,6 +1,6 @@ # AFL++ dictionaries -(See [../README.md](../README.md) for the general instruction manual.) +For the general instruction manual, see [docs/README.md](../docs/README.md). This subdirectory contains a set of dictionaries that can be used in conjunction with the -x option to allow the fuzzer to effortlessly explore the grammar of diff --git a/docs/README.md b/docs/README.md new file mode 100644 index 00000000..22f86de1 --- /dev/null +++ b/docs/README.md @@ -0,0 +1,41 @@ +# AFL++ documentation + +This is the overview of the AFL++ docs content. + +For general information on AFL++, see the +[README.md of the repository](../README.md). + +Also take a look at our [FAQ.md](FAQ.md) and +[best_practices.md](best_practices.md). + +## Fuzzing targets with the source code available + +You can find a quickstart for fuzzing targets with the source code available in +the [README.md of the repository](../README.md#quick-start-fuzzing-with-afl). + +For in-depth information on the steps of the fuzzing process, see +[fuzzing_in_depth.md](fuzzing_in_depth.md) or click on the following +image to select a step. + +![Fuzzing process overview](https://raw.githubusercontent.com/AFLplusplus/AFLplusplus/dev/docs/resources/fuzzing_process_overview.drawio.svg "Fuzzing process overview") + +For further information on instrumentation, see the +[READMEs in the instrumentation/ folder](../instrumentation/). + +## Fuzzing other targets + +To learn about fuzzing other targets, see: + +* Binary-only: [fuzzing_binary-only_targets.md](fuzzing_binary-only_targets.md) +* GUI programs: + [best_practices.md#fuzzing-a-gui-program](best_practices.md#fuzzing-a-gui-program) +* Libraries: [frida_mode/README.md](../frida_mode/README.md) +* Network services: + [best_practices.md#fuzzing-a-network-service](best_practices.md#fuzzing-a-network-service) +* Non-linux: [unicorn_mode/README.md](../unicorn_mode/README.md) + +## Additional information + +* Tools that help fuzzing with AFL++: + [third_party_tools.md](third_party_tools.md) +* Tutorials: [tutorials.md](tutorials.md) \ No newline at end of file diff --git a/docs/afl-fuzz_approach.md b/docs/afl-fuzz_approach.md index 058fe352..6af39769 100644 --- a/docs/afl-fuzz_approach.md +++ b/docs/afl-fuzz_approach.md @@ -40,7 +40,7 @@ superior to blind fuzzing or coverage-only tools. This section provides an overview of the status screen - plus tips for troubleshooting any warnings and red text shown in the UI. -For the general instruction manual, see [README.md](../README.md). +For the general instruction manual, see [README.md](README.md). ### A note about colors diff --git a/docs/resources/fuzzing_process_overview.drawio.svg b/docs/resources/fuzzing_process_overview.drawio.svg new file mode 100644 index 00000000..c46bfbbc --- /dev/null +++ b/docs/resources/fuzzing_process_overview.drawio.svg @@ -0,0 +1,4 @@ + + + +
Prepare campaign
Prepare campaign
Required task
Required task
Optional task
Optional taskCheck coverageMonitor statusTriage crashesUse multiple coresUse multiple machinesRun afl-fuzzMake input corpus uniqueMinimize corpus fileCollect inputsSelect compilerSelect optionsSelect sanitizerCompile target source codeWrite and compile harnessModify target
Instrument target
Instrument target
Fuzz target
Fuzz target
Manage campaign
Manage campaignViewer does not support full SVG 1.1 \ No newline at end of file diff --git a/instrumentation/README.gcc_plugin.md b/instrumentation/README.gcc_plugin.md index ef38662b..ed39af9d 100644 --- a/instrumentation/README.gcc_plugin.md +++ b/instrumentation/README.gcc_plugin.md @@ -1,7 +1,8 @@ # GCC-based instrumentation for afl-fuzz -For the general instruction manual, see [../README.md](../README.md). For the -LLVM-based instrumentation, see [README.llvm.md](README.llvm.md). +For the general instruction manual, see [docs/README.md](../docs/README.md). + +For the LLVM-based instrumentation, see [README.llvm.md](README.llvm.md). This document describes how to build and use `afl-gcc-fast` and `afl-g++-fast`, which instrument the target with the help of gcc plugins. diff --git a/instrumentation/README.llvm.md b/instrumentation/README.llvm.md index d220e52c..7855a987 100644 --- a/instrumentation/README.llvm.md +++ b/instrumentation/README.llvm.md @@ -1,6 +1,6 @@ # Fast LLVM-based instrumentation for afl-fuzz -For the general instruction manual, see [../README.md](../README.md). +For the general instruction manual, see [docs/README.md](../docs/README.md). For the GCC-based instrumentation, see [README.gcc_plugin.md](README.gcc_plugin.md). diff --git a/qemu_mode/README.md b/qemu_mode/README.md index 8e04cbf9..a045ef4f 100644 --- a/qemu_mode/README.md +++ b/qemu_mode/README.md @@ -1,6 +1,6 @@ # High-performance binary-only instrumentation for afl-fuzz -For the general instruction manual, see [README.md](../README.md). +For the general instruction manual, see [docs/README.md](../docs/README.md). ## 1) Introduction diff --git a/testcases/README.md b/testcases/README.md index a2f74d68..119fd272 100644 --- a/testcases/README.md +++ b/testcases/README.md @@ -1,6 +1,6 @@ # AFL++ starting test cases - (See [../README.md](../README.md) for the general instruction manual.) +For the general instruction manual, see [docs/README.md](../docs/README.md). The archives/, images/, multimedia/, and others/ subdirectories contain small, standalone files that can be used to seed afl-fuzz when testing parsers for a diff --git a/utils/libdislocator/README.md b/utils/libdislocator/README.md index 7150c205..116a22ba 100644 --- a/utils/libdislocator/README.md +++ b/utils/libdislocator/README.md @@ -1,6 +1,6 @@ # libdislocator, an abusive allocator - (See ../../README.md for the general instruction manual.) +For the general instruction manual, see [docs/README.md](../../docs/README.md). This is a companion library that can be used as a drop-in replacement for the libc allocator in the fuzzed binaries. It improves the odds of bumping into diff --git a/utils/libtokencap/README.md b/utils/libtokencap/README.md index 343fcce0..4e7ed1d1 100644 --- a/utils/libtokencap/README.md +++ b/utils/libtokencap/README.md @@ -5,7 +5,7 @@ The afl-clang-fast AFL_LLVM_DICT2FILE feature is much better, afl-clang-lto has that feature automatically integrated. - (See ../../README.md for the general instruction manual.) +For the general instruction manual, see [docs/README.md](../../docs/README.md). This companion library allows you to instrument `strcmp()`, `memcmp()`, and related functions to automatically extract syntax tokens passed to any of -- cgit 1.4.1