From 49b77207dd870bc2e2e1b283f46504e27fce432f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 30 Jul 2020 11:11:30 +0200
Subject: aflpp driver cpp -> c

---
 examples/aflpp_driver/GNUmakefile           |  16 +-
 examples/aflpp_driver/aflpp_driver.c        | 292 ++++++++++++++++++++++++++++
 examples/aflpp_driver/aflpp_driver.cpp      | 292 ----------------------------
 examples/aflpp_driver/aflpp_driver_test.c   |  23 +++
 examples/aflpp_driver/aflpp_driver_test.cpp |  22 ---
 5 files changed, 323 insertions(+), 322 deletions(-)
 create mode 100644 examples/aflpp_driver/aflpp_driver.c
 delete mode 100644 examples/aflpp_driver/aflpp_driver.cpp
 create mode 100644 examples/aflpp_driver/aflpp_driver_test.c
 delete mode 100644 examples/aflpp_driver/aflpp_driver_test.cpp

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile
index a993c8a9..2a61f743 100644
--- a/examples/aflpp_driver/GNUmakefile
+++ b/examples/aflpp_driver/GNUmakefile
@@ -11,17 +11,17 @@ FLAGS=-O3 -funroll-loops -g
 
 all:	libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
 
-aflpp_driver.o:	aflpp_driver.cpp
-	$(LLVM_BINDIR)clang++ $(FLAGS) -stdlib=libc++ -std=c++11 -c aflpp_driver.cpp
+aflpp_driver.o:	aflpp_driver.c
+	$(LLVM_BINDIR)clang -I. -I../../include $(FLAGS) -c aflpp_driver.c
 
 libAFLDriver.a:	aflpp_driver.o
 	ar ru libAFLDriver.a aflpp_driver.o
 
 debug:
-	$(LLVM_BINDIR)clang++ -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
-	$(LLVM_BINDIR)clang++ -I../../include -D_DEBUG=\"1\" -g -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp
-	#$(LLVM_BINDIR)clang++ -S -emit-llvm -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c
-	#$(LLVM_BINDIR)clang++ -S -emit-llvm -I../../include -D_DEBUG=\"1\" -g -stdlib=libc++ -funroll-loops -std=c++11 -c aflpp_driver.cpp
+	$(LLVM_BINDIR)clang -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
+	$(LLVM_BINDIR)clang -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
+	#$(LLVM_BINDIR)clang -S -emit-llvm -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c
+	#$(LLVM_BINDIR)clang -S -emit-llvm -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
 	ar ru libAFLDriver.a afl-performance.o aflpp_driver.o
 
 aflpp_qemu_driver.o:	aflpp_qemu_driver.c
@@ -37,8 +37,8 @@ aflpp_qemu_driver_hook.o:	aflpp_qemu_driver_hook.c
 	$(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
 
 test:	debug
-	#clang++ -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test.ll aflpp_driver_test.cpp
-	afl-clang-fast++ -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -stdlib=libc++ -funroll-loops -std=c++11 -o aflpp_driver_test aflpp_driver_test.cpp libAFLDriver.a
+	#clang -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test.ll aflpp_driver_test.c
+	afl-clang-fast -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test aflpp_driver_test.c libAFLDriver.a afl-performance.o
 
 clean:
 	rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
new file mode 100644
index 00000000..65fea404
--- /dev/null
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -0,0 +1,292 @@
+//===- afl_driver.cpp - a glue between AFL and libFuzzer --------*- C++ -* ===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//===----------------------------------------------------------------------===//
+
+/* This file allows to fuzz libFuzzer-style target functions
+ (LLVMFuzzerTestOneInput) with AFL using AFL's persistent (in-process) mode.
+
+Usage:
+################################################################################
+cat << EOF > test_fuzzer.cc
+#include <stddef.h>
+#include <stdint.h>
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  if (size > 0 && data[0] == 'H')
+    if (size > 1 && data[1] == 'I')
+       if (size > 2 && data[2] == '!')
+       __builtin_trap();
+  return 0;
+}
+EOF
+# Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang.
+clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c
+# Build afl-llvm-rt.o.c from the AFL distribution.
+clang -c -w $AFL_HOME/llvm_mode/afl-llvm-rt.o.c
+# Build this file, link it with afl-llvm-rt.o.o and the target code.
+clang++ afl_driver.cpp test_fuzzer.o afl-llvm-rt.o.o
+# Run AFL:
+rm -rf IN OUT; mkdir IN OUT; echo z > IN/z;
+$AFL_HOME/afl-fuzz -i IN -o OUT ./a.out
+################################################################################
+AFL_DRIVER_STDERR_DUPLICATE_FILENAME: Setting this *appends* stderr to the file
+specified. If the file does not exist, it is created. This is useful for getting
+stack traces (when using ASAN for example) or original error messages on hard
+to reproduce bugs. Note that any content written to stderr will be written to
+this file instead of stderr's usual location.
+
+AFL_DRIVER_CLOSE_FD_MASK: Similar to libFuzzer's -close_fd_mask behavior option.
+If 1, close stdout at startup. If 2 close stderr; if 3 close both.
+
+*/
+#include <assert.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <limits.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include "config.h"
+
+#ifdef _DEBUG
+#include "hash.h"
+#endif
+
+// Platform detection. Copied from FuzzerInternal.h
+#ifdef __linux__
+#define LIBFUZZER_LINUX 1
+#define LIBFUZZER_APPLE 0
+#define LIBFUZZER_NETBSD 0
+#define LIBFUZZER_FREEBSD 0
+#define LIBFUZZER_OPENBSD 0
+#elif __APPLE__
+#define LIBFUZZER_LINUX 0
+#define LIBFUZZER_APPLE 1
+#define LIBFUZZER_NETBSD 0
+#define LIBFUZZER_FREEBSD 0
+#define LIBFUZZER_OPENBSD 0
+#elif __NetBSD__
+#define LIBFUZZER_LINUX 0
+#define LIBFUZZER_APPLE 0
+#define LIBFUZZER_NETBSD 1
+#define LIBFUZZER_FREEBSD 0
+#define LIBFUZZER_OPENBSD 0
+#elif __FreeBSD__
+#define LIBFUZZER_LINUX 0
+#define LIBFUZZER_APPLE 0
+#define LIBFUZZER_NETBSD 0
+#define LIBFUZZER_FREEBSD 1
+#define LIBFUZZER_OPENBSD 0
+#elif __OpenBSD__
+#define LIBFUZZER_LINUX 0
+#define LIBFUZZER_APPLE 0
+#define LIBFUZZER_NETBSD 0
+#define LIBFUZZER_FREEBSD 0
+#define LIBFUZZER_OPENBSD 1
+#else
+#error "Support for your platform has not been implemented"
+#endif
+
+int __afl_sharedmem_fuzzing = 1;
+extern unsigned int *__afl_fuzz_len;
+extern unsigned char *__afl_fuzz_ptr;
+
+// libFuzzer interface is thin, so we don't include any libFuzzer headers.
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
+__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
+
+// Notify AFL about persistent mode.
+static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
+int __afl_persistent_loop(unsigned int);
+
+// Notify AFL about deferred forkserver.
+static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
+void __afl_manual_init();
+
+// Input buffer.
+static const size_t kMaxAflInputSize = 1 << 20;
+static uint8_t AflInputBuf[kMaxAflInputSize];
+
+// Use this optionally defined function to output sanitizer messages even if
+// user asks to close stderr.
+__attribute__((weak)) void __sanitizer_set_report_fd(void *);
+
+// Keep track of where stderr content is being written to, so that
+// dup_and_close_stderr can use the correct one.
+static FILE *output_file;
+
+// Experimental feature to use afl_driver without AFL's deferred mode.
+// Needs to run before __afl_auto_init.
+__attribute__((constructor(0))) static void __decide_deferred_forkserver(void) {
+  if (getenv("AFL_DRIVER_DONT_DEFER")) {
+    if (unsetenv("__AFL_DEFER_FORKSRV")) {
+      perror("Failed to unset __AFL_DEFER_FORKSRV");
+      abort();
+    }
+  }
+}
+
+// If the user asks us to duplicate stderr, then do it.
+static void maybe_duplicate_stderr() {
+  char *stderr_duplicate_filename =
+      getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+
+  if (!stderr_duplicate_filename)
+    return;
+
+  FILE *stderr_duplicate_stream =
+      freopen(stderr_duplicate_filename, "a+", stderr);
+
+  if (!stderr_duplicate_stream) {
+    fprintf(
+        stderr,
+        "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+    abort();
+  }
+  output_file = stderr_duplicate_stream;
+}
+
+// Most of these I/O functions were inspired by/copied from libFuzzer's code.
+static void discard_output(int fd) {
+  FILE *temp = fopen("/dev/null", "w");
+  if (!temp)
+    abort();
+  dup2(fileno(temp), fd);
+  fclose(temp);
+}
+
+static void close_stdout() { discard_output(STDOUT_FILENO); }
+
+// Prevent the targeted code from writing to "stderr" but allow sanitizers and
+// this driver to do so.
+static void dup_and_close_stderr() {
+  int output_fileno = fileno(output_file);
+  int output_fd = dup(output_fileno);
+  if (output_fd <= 0)
+    abort();
+  FILE *new_output_file = fdopen(output_fd, "w");
+  if (!new_output_file)
+    abort();
+  if (!__sanitizer_set_report_fd)
+    return;
+  __sanitizer_set_report_fd((void*)output_fd);
+  discard_output(output_fileno);
+}
+
+static void Printf(const char *Fmt, ...) {
+  va_list ap;
+  va_start(ap, Fmt);
+  vfprintf(output_file, Fmt, ap);
+  va_end(ap);
+  fflush(output_file);
+}
+
+// Close stdout and/or stderr if user asks for it.
+static void maybe_close_fd_mask() {
+  char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
+  if (!fd_mask_str)
+    return;
+  int fd_mask = atoi(fd_mask_str);
+  if (fd_mask & 2)
+    dup_and_close_stderr();
+  if (fd_mask & 1)
+    close_stdout();
+}
+
+// Define LLVMFuzzerMutate to avoid link failures for targets that use it
+// with libFuzzer's LLVMFuzzerCustomMutator.
+size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
+  //assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
+  return 0;
+}
+
+// Execute any files provided as parameters.
+static int ExecuteFilesOnyByOne(int argc, char **argv) {
+  unsigned char *buf = malloc(MAX_FILE);
+  for (int i = 1; i < argc; i++) {
+    int fd = open(argv[i], O_RDONLY);
+    if (fd == -1) continue;
+    ssize_t length = read(fd, buf, MAX_FILE);
+    if (length > 0) {
+      printf("Reading %zu bytes from %s\n", length, argv[i]);
+      LLVMFuzzerTestOneInput(buf, length);
+      printf("Execution successful.\n");
+    }
+  }
+  free(buf);
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  Printf(
+      "======================= INFO =========================\n"
+      "This binary is built for AFL-fuzz.\n"
+      "To run the target function on individual input(s) execute this:\n"
+      "  %s < INPUT_FILE\n"
+      "or\n"
+      "  %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
+      "To fuzz with afl-fuzz execute this:\n"
+      "  afl-fuzz [afl-flags] %s [-N]\n"
+      "afl-fuzz will run N iterations before "
+      "re-spawning the process (default: 1000)\n"
+      "======================================================\n",
+          argv[0], argv[0], argv[0]);
+
+  output_file = stderr;
+  maybe_duplicate_stderr();
+  maybe_close_fd_mask();
+  if (LLVMFuzzerInitialize)
+    LLVMFuzzerInitialize(&argc, &argv);
+
+  // Do any other expensive one-time initialization here.
+
+  uint8_t dummy_input[64] = {0};
+  memcpy(dummy_input, (void*)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
+  memcpy(dummy_input + 32, (void*)AFL_DEFER_FORKSVR, sizeof(AFL_DEFER_FORKSVR));
+  int N = INT_MAX;
+  if (argc == 2 && argv[1][0] == '-')
+      N = atoi(argv[1] + 1);
+  else if(argc == 2 && (N = atoi(argv[1])) > 0)
+      Printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
+  else if (argc > 1) {
+//    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
+      __afl_sharedmem_fuzzing = 0;
+      __afl_manual_init();
+//    }
+    return ExecuteFilesOnyByOne(argc, argv);
+    exit(0);
+  }
+
+  assert(N > 0);
+
+//  if (!getenv("AFL_DRIVER_DONT_DEFER"))
+  __afl_manual_init();
+
+  // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
+  // on the first execution of LLVMFuzzerTestOneInput is ignored.
+  LLVMFuzzerTestOneInput(dummy_input, 1);
+
+  int num_runs = 0;
+  while (__afl_persistent_loop(N)) {
+#ifdef _DEBUG
+    fprintf(stderr, "CLIENT crc: %016llx len: %u\n", hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len);
+    fprintf(stderr, "RECV:");
+    for (int i = 0; i < *__afl_fuzz_len; i++)
+      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
+    fprintf(stderr,"\n");
+#endif
+    if (*__afl_fuzz_len) {
+      num_runs++;
+      LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+    }
+  }
+  Printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
+}
diff --git a/examples/aflpp_driver/aflpp_driver.cpp b/examples/aflpp_driver/aflpp_driver.cpp
deleted file mode 100644
index d6163bdf..00000000
--- a/examples/aflpp_driver/aflpp_driver.cpp
+++ /dev/null
@@ -1,292 +0,0 @@
-//===- afl_driver.cpp - a glue between AFL and libFuzzer --------*- C++ -* ===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//===----------------------------------------------------------------------===//
-
-/* This file allows to fuzz libFuzzer-style target functions
- (LLVMFuzzerTestOneInput) with AFL using AFL's persistent (in-process) mode.
-
-Usage:
-################################################################################
-cat << EOF > test_fuzzer.cc
-#include <stddef.h>
-#include <stdint.h>
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-  if (size > 0 && data[0] == 'H')
-    if (size > 1 && data[1] == 'I')
-       if (size > 2 && data[2] == '!')
-       __builtin_trap();
-  return 0;
-}
-EOF
-# Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang.
-clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c
-# Build afl-llvm-rt.o.c from the AFL distribution.
-clang -c -w $AFL_HOME/llvm_mode/afl-llvm-rt.o.c
-# Build this file, link it with afl-llvm-rt.o.o and the target code.
-clang++ afl_driver.cpp test_fuzzer.o afl-llvm-rt.o.o
-# Run AFL:
-rm -rf IN OUT; mkdir IN OUT; echo z > IN/z;
-$AFL_HOME/afl-fuzz -i IN -o OUT ./a.out
-################################################################################
-AFL_DRIVER_STDERR_DUPLICATE_FILENAME: Setting this *appends* stderr to the file
-specified. If the file does not exist, it is created. This is useful for getting
-stack traces (when using ASAN for example) or original error messages on hard
-to reproduce bugs. Note that any content written to stderr will be written to
-this file instead of stderr's usual location.
-
-AFL_DRIVER_CLOSE_FD_MASK: Similar to libFuzzer's -close_fd_mask behavior option.
-If 1, close stdout at startup. If 2 close stderr; if 3 close both.
-
-*/
-#include <assert.h>
-#include <errno.h>
-#include <stdarg.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-#include <fstream>
-#include <iostream>
-#include <vector>
-
-#ifdef _DEBUG
-#include "hash.h"
-#endif
-
-// Platform detection. Copied from FuzzerInternal.h
-#ifdef __linux__
-#define LIBFUZZER_LINUX 1
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#elif __APPLE__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 1
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#elif __NetBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 1
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#elif __FreeBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 1
-#define LIBFUZZER_OPENBSD 0
-#elif __OpenBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 1
-#else
-#error "Support for your platform has not been implemented"
-#endif
-
-int __afl_sharedmem_fuzzing = 1;
-extern unsigned int *__afl_fuzz_len;
-extern unsigned char *__afl_fuzz_ptr;
-
-// libFuzzer interface is thin, so we don't include any libFuzzer headers.
-extern "C" {
-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
-__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
-}
-
-// Notify AFL about persistent mode.
-static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
-extern "C" int __afl_persistent_loop(unsigned int);
-static volatile char suppress_warning2 = AFL_PERSISTENT[0];
-
-// Notify AFL about deferred forkserver.
-static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
-extern "C" void __afl_manual_init();
-static volatile char suppress_warning1 = AFL_DEFER_FORKSVR[0];
-
-// Input buffer.
-static const size_t kMaxAflInputSize = 1 << 20;
-static uint8_t AflInputBuf[kMaxAflInputSize];
-
-// Use this optionally defined function to output sanitizer messages even if
-// user asks to close stderr.
-__attribute__((weak)) extern "C" void __sanitizer_set_report_fd(void *);
-
-// Keep track of where stderr content is being written to, so that
-// dup_and_close_stderr can use the correct one.
-static FILE *output_file = stderr;
-
-// Experimental feature to use afl_driver without AFL's deferred mode.
-// Needs to run before __afl_auto_init.
-__attribute__((constructor(0))) static void __decide_deferred_forkserver(void) {
-  if (getenv("AFL_DRIVER_DONT_DEFER")) {
-    if (unsetenv("__AFL_DEFER_FORKSRV")) {
-      perror("Failed to unset __AFL_DEFER_FORKSRV");
-      abort();
-    }
-  }
-}
-
-// If the user asks us to duplicate stderr, then do it.
-static void maybe_duplicate_stderr() {
-  char *stderr_duplicate_filename =
-      getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
-
-  if (!stderr_duplicate_filename)
-    return;
-
-  FILE *stderr_duplicate_stream =
-      freopen(stderr_duplicate_filename, "a+", stderr);
-
-  if (!stderr_duplicate_stream) {
-    fprintf(
-        stderr,
-        "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
-    abort();
-  }
-  output_file = stderr_duplicate_stream;
-}
-
-// Most of these I/O functions were inspired by/copied from libFuzzer's code.
-static void discard_output(int fd) {
-  FILE *temp = fopen("/dev/null", "w");
-  if (!temp)
-    abort();
-  dup2(fileno(temp), fd);
-  fclose(temp);
-}
-
-static void close_stdout() { discard_output(STDOUT_FILENO); }
-
-// Prevent the targeted code from writing to "stderr" but allow sanitizers and
-// this driver to do so.
-static void dup_and_close_stderr() {
-  int output_fileno = fileno(output_file);
-  int output_fd = dup(output_fileno);
-  if (output_fd <= 0)
-    abort();
-  FILE *new_output_file = fdopen(output_fd, "w");
-  if (!new_output_file)
-    abort();
-  if (!__sanitizer_set_report_fd)
-    return;
-  __sanitizer_set_report_fd(reinterpret_cast<void *>(output_fd));
-  discard_output(output_fileno);
-}
-
-static void Printf(const char *Fmt, ...) {
-  va_list ap;
-  va_start(ap, Fmt);
-  vfprintf(output_file, Fmt, ap);
-  va_end(ap);
-  fflush(output_file);
-}
-
-// Close stdout and/or stderr if user asks for it.
-static void maybe_close_fd_mask() {
-  char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
-  if (!fd_mask_str)
-    return;
-  int fd_mask = atoi(fd_mask_str);
-  if (fd_mask & 2)
-    dup_and_close_stderr();
-  if (fd_mask & 1)
-    close_stdout();
-}
-
-// Define LLVMFuzzerMutate to avoid link failures for targets that use it
-// with libFuzzer's LLVMFuzzerCustomMutator.
-extern "C" size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
-  assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
-  return 0;
-}
-
-// Execute any files provided as parameters.
-static int ExecuteFilesOnyByOne(int argc, char **argv) {
-  for (int i = 1; i < argc; i++) {
-    std::ifstream in(argv[i], std::ios::binary);
-    in.seekg(0, in.end);
-    size_t length = in.tellg();
-    in.seekg (0, in.beg);
-    std::cout << "Reading " << length << " bytes from " << argv[i] << std::endl;
-    // Allocate exactly length bytes so that we reliably catch buffer overflows.
-    std::vector<char> bytes(length);
-    in.read(bytes.data(), bytes.size());
-    assert(in);
-    LLVMFuzzerTestOneInput(reinterpret_cast<const uint8_t *>(bytes.data()),
-                           bytes.size());
-    std::cout << "Execution successful" << std::endl;
-  }
-  return 0;
-}
-
-int main(int argc, char **argv) {
-  Printf(
-      "======================= INFO =========================\n"
-      "This binary is built for AFL-fuzz.\n"
-      "To run the target function on individual input(s) execute this:\n"
-      "  %s < INPUT_FILE\n"
-      "or\n"
-      "  %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
-      "To fuzz with afl-fuzz execute this:\n"
-      "  afl-fuzz [afl-flags] %s [-N]\n"
-      "afl-fuzz will run N iterations before "
-      "re-spawning the process (default: 1000)\n"
-      "======================================================\n",
-          argv[0], argv[0], argv[0]);
-
-  maybe_duplicate_stderr();
-  maybe_close_fd_mask();
-  if (LLVMFuzzerInitialize)
-    LLVMFuzzerInitialize(&argc, &argv);
-  // Do any other expensive one-time initialization here.
-
-  uint8_t dummy_input[1] = {0};
-  int N = 100000;
-  if (argc == 2 && argv[1][0] == '-')
-      N = atoi(argv[1] + 1);
-  else if(argc == 2 && (N = atoi(argv[1])) > 0)
-      Printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
-  else if (argc > 1) {
-//    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
-      __afl_sharedmem_fuzzing = 0;
-      __afl_manual_init();
-//    }
-    return ExecuteFilesOnyByOne(argc, argv);
-    exit(0);
-  }
-
-  assert(N > 0);
-
-//  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  __afl_manual_init();
-
-  // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
-  // on the first execution of LLVMFuzzerTestOneInput is ignored.
-  LLVMFuzzerTestOneInput(dummy_input, 1);
-
-  int num_runs = 0;
-  while (__afl_persistent_loop(N)) {
-#ifdef _DEBUG
-    fprintf(stderr, "CLIENT crc: %016llx len: %u\n", hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len);
-    fprintf(stderr, "RECV:");
-    for (int i = 0; i < *__afl_fuzz_len; i++)
-      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
-    fprintf(stderr,"\n");
-#endif
-    if (*__afl_fuzz_len) {
-      num_runs++;
-      LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
-    }
-  }
-  Printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
-}
diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
new file mode 100644
index 00000000..83278f5c
--- /dev/null
+++ b/examples/aflpp_driver/aflpp_driver_test.c
@@ -0,0 +1,23 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+
+#include "hash.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+
+  fprintf(stderr, "FUNC crc: %016llx len: %lu\n", hash64((u8*)Data, (unsigned int) Size, (unsigned long long int) 0xa5b35705), Size);
+  
+  if (Size < 5)
+    return 0;
+
+  if (Data[0] == 'F')
+    if (Data[1] == 'A')
+      if (Data[2] == '$')
+        if (Data[3] == '$')
+          if (Data[4] == '$')
+            abort();
+          
+  return 0;
+
+}
diff --git a/examples/aflpp_driver/aflpp_driver_test.cpp b/examples/aflpp_driver/aflpp_driver_test.cpp
deleted file mode 100644
index 13dc09b9..00000000
--- a/examples/aflpp_driver/aflpp_driver_test.cpp
+++ /dev/null
@@ -1,22 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include "hash.h"
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
-
-  fprintf(stderr, "FUNC crc: %016llx len: %lu\n", hash64((u8*)Data, (unsigned int) Size, (unsigned long long int) 0xa5b35705), Size);
-  
-  if (Size < 5)
-    return 0;
-
-  if (Data[0] == 'F')
-    if (Data[1] == 'A')
-      if (Data[2] == '$')
-        if (Data[3] == '$')
-          if (Data[4] == '$')
-            abort();
-          
-  return 0;
-
-}
-- 
cgit 1.4.1


From fe39e4dfdf90ab36342786bfb37503b53a6a358e Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 30 Jul 2020 11:30:37 +0200
Subject: remove unneeded stuff

---
 examples/aflpp_driver/GNUmakefile    | 12 ++++++------
 examples/aflpp_driver/aflpp_driver.c | 18 +++---------------
 2 files changed, 9 insertions(+), 21 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile
index 2a61f743..b118a8b5 100644
--- a/examples/aflpp_driver/GNUmakefile
+++ b/examples/aflpp_driver/GNUmakefile
@@ -7,25 +7,25 @@ ifneq "" "$(LLVM_BINDIR)"
   LLVM_BINDIR := $(LLVM_BINDIR)/
 endif
 
-FLAGS=-O3 -funroll-loops -g
+CFLAGS := -O3 -funroll-loops -g
 
 all:	libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
 
 aflpp_driver.o:	aflpp_driver.c
-	$(LLVM_BINDIR)clang -I. -I../../include $(FLAGS) -c aflpp_driver.c
+	$(LLVM_BINDIR)clang -I. -I../../include $(CFLAGS) -c aflpp_driver.c
 
 libAFLDriver.a:	aflpp_driver.o
 	ar ru libAFLDriver.a aflpp_driver.o
 
 debug:
-	$(LLVM_BINDIR)clang -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
+	$(LLVM_BINDIR)clang -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
 	$(LLVM_BINDIR)clang -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
-	#$(LLVM_BINDIR)clang -S -emit-llvm -Wno-deprecated -I../../include $(FLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c
+	#$(LLVM_BINDIR)clang -S -emit-llvm -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c
 	#$(LLVM_BINDIR)clang -S -emit-llvm -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
 	ar ru libAFLDriver.a afl-performance.o aflpp_driver.o
 
 aflpp_qemu_driver.o:	aflpp_qemu_driver.c
-	$(LLVM_BINDIR)clang $(FLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
+	$(LLVM_BINDIR)clang $(CFLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
 
 libAFLQemuDriver.a:	aflpp_qemu_driver.o
 	ar ru libAFLQemuDriver.a aflpp_qemu_driver.o
@@ -34,7 +34,7 @@ aflpp_qemu_driver_hook.so:	aflpp_qemu_driver_hook.o
 	$(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so
 
 aflpp_qemu_driver_hook.o:	aflpp_qemu_driver_hook.c
-	$(LLVM_BINDIR)clang -fPIC $(FLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
+	$(LLVM_BINDIR)clang -fPIC $(CFLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
 
 test:	debug
 	#clang -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test.ll aflpp_driver_test.c
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 65fea404..eca3dcd1 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -111,10 +111,6 @@ int __afl_persistent_loop(unsigned int);
 static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
 void __afl_manual_init();
 
-// Input buffer.
-static const size_t kMaxAflInputSize = 1 << 20;
-static uint8_t AflInputBuf[kMaxAflInputSize];
-
 // Use this optionally defined function to output sanitizer messages even if
 // user asks to close stderr.
 __attribute__((weak)) void __sanitizer_set_report_fd(void *);
@@ -181,14 +177,6 @@ static void dup_and_close_stderr() {
   discard_output(output_fileno);
 }
 
-static void Printf(const char *Fmt, ...) {
-  va_list ap;
-  va_start(ap, Fmt);
-  vfprintf(output_file, Fmt, ap);
-  va_end(ap);
-  fflush(output_file);
-}
-
 // Close stdout and/or stderr if user asks for it.
 static void maybe_close_fd_mask() {
   char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
@@ -226,7 +214,7 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 }
 
 int main(int argc, char **argv) {
-  Printf(
+  printf(
       "======================= INFO =========================\n"
       "This binary is built for AFL-fuzz.\n"
       "To run the target function on individual input(s) execute this:\n"
@@ -255,7 +243,7 @@ int main(int argc, char **argv) {
   if (argc == 2 && argv[1][0] == '-')
       N = atoi(argv[1] + 1);
   else if(argc == 2 && (N = atoi(argv[1])) > 0)
-      Printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
+      printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 //    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
       __afl_sharedmem_fuzzing = 0;
@@ -288,5 +276,5 @@ int main(int argc, char **argv) {
       LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
     }
   }
-  Printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
+  printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
 }
-- 
cgit 1.4.1


From ea9ba53cdbc6d175f3f055c9a308668ebaacda1e Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 30 Jul 2020 17:09:22 +0200
Subject: fix oob reads, code-format

---
 examples/aflpp_driver/aflpp_driver.c      | 168 ++++++++++++++++++------------
 examples/aflpp_driver/aflpp_driver_test.c |  16 +--
 src/afl-fuzz-queue.c                      |  55 +++++-----
 src/afl-fuzz-redqueen.c                   |   3 +-
 test/test-floatingpoint.c                 |   8 +-
 5 files changed, 146 insertions(+), 104 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index eca3dcd1..86c7a69f 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -14,12 +14,15 @@ cat << EOF > test_fuzzer.cc
 #include <stddef.h>
 #include <stdint.h>
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+
   if (size > 0 && data[0] == 'H')
     if (size > 1 && data[1] == 'I')
        if (size > 2 && data[2] == '!')
        __builtin_trap();
   return 0;
+
 }
+
 EOF
 # Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang.
 clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c
@@ -57,46 +60,46 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 #include "config.h"
 
 #ifdef _DEBUG
-#include "hash.h"
+  #include "hash.h"
 #endif
 
 // Platform detection. Copied from FuzzerInternal.h
 #ifdef __linux__
-#define LIBFUZZER_LINUX 1
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
+  #define LIBFUZZER_LINUX 1
+  #define LIBFUZZER_APPLE 0
+  #define LIBFUZZER_NETBSD 0
+  #define LIBFUZZER_FREEBSD 0
+  #define LIBFUZZER_OPENBSD 0
 #elif __APPLE__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 1
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
+  #define LIBFUZZER_LINUX 0
+  #define LIBFUZZER_APPLE 1
+  #define LIBFUZZER_NETBSD 0
+  #define LIBFUZZER_FREEBSD 0
+  #define LIBFUZZER_OPENBSD 0
 #elif __NetBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 1
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
+  #define LIBFUZZER_LINUX 0
+  #define LIBFUZZER_APPLE 0
+  #define LIBFUZZER_NETBSD 1
+  #define LIBFUZZER_FREEBSD 0
+  #define LIBFUZZER_OPENBSD 0
 #elif __FreeBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 1
-#define LIBFUZZER_OPENBSD 0
+  #define LIBFUZZER_LINUX 0
+  #define LIBFUZZER_APPLE 0
+  #define LIBFUZZER_NETBSD 0
+  #define LIBFUZZER_FREEBSD 1
+  #define LIBFUZZER_OPENBSD 0
 #elif __OpenBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 1
+  #define LIBFUZZER_LINUX 0
+  #define LIBFUZZER_APPLE 0
+  #define LIBFUZZER_NETBSD 0
+  #define LIBFUZZER_FREEBSD 0
+  #define LIBFUZZER_OPENBSD 1
 #else
-#error "Support for your platform has not been implemented"
+  #error "Support for your platform has not been implemented"
 #endif
 
-int __afl_sharedmem_fuzzing = 1;
-extern unsigned int *__afl_fuzz_len;
+int                   __afl_sharedmem_fuzzing = 1;
+extern unsigned int * __afl_fuzz_len;
 extern unsigned char *__afl_fuzz_ptr;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
@@ -105,11 +108,11 @@ __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
 
 // Notify AFL about persistent mode.
 static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
-int __afl_persistent_loop(unsigned int);
+int                  __afl_persistent_loop(unsigned int);
 
 // Notify AFL about deferred forkserver.
 static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
-void __afl_manual_init();
+void                 __afl_manual_init();
 
 // Use this optionally defined function to output sanitizer messages even if
 // user asks to close stderr.
@@ -122,98 +125,121 @@ static FILE *output_file;
 // Experimental feature to use afl_driver without AFL's deferred mode.
 // Needs to run before __afl_auto_init.
 __attribute__((constructor(0))) static void __decide_deferred_forkserver(void) {
+
   if (getenv("AFL_DRIVER_DONT_DEFER")) {
+
     if (unsetenv("__AFL_DEFER_FORKSRV")) {
+
       perror("Failed to unset __AFL_DEFER_FORKSRV");
       abort();
+
     }
+
   }
+
 }
 
 // If the user asks us to duplicate stderr, then do it.
 static void maybe_duplicate_stderr() {
+
   char *stderr_duplicate_filename =
       getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
 
-  if (!stderr_duplicate_filename)
-    return;
+  if (!stderr_duplicate_filename) return;
 
   FILE *stderr_duplicate_stream =
       freopen(stderr_duplicate_filename, "a+", stderr);
 
   if (!stderr_duplicate_stream) {
+
     fprintf(
         stderr,
         "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
     abort();
+
   }
+
   output_file = stderr_duplicate_stream;
+
 }
 
 // Most of these I/O functions were inspired by/copied from libFuzzer's code.
 static void discard_output(int fd) {
+
   FILE *temp = fopen("/dev/null", "w");
-  if (!temp)
-    abort();
+  if (!temp) abort();
   dup2(fileno(temp), fd);
   fclose(temp);
+
 }
 
-static void close_stdout() { discard_output(STDOUT_FILENO); }
+static void close_stdout() {
+
+  discard_output(STDOUT_FILENO);
+
+}
 
 // Prevent the targeted code from writing to "stderr" but allow sanitizers and
 // this driver to do so.
 static void dup_and_close_stderr() {
+
   int output_fileno = fileno(output_file);
   int output_fd = dup(output_fileno);
-  if (output_fd <= 0)
-    abort();
+  if (output_fd <= 0) abort();
   FILE *new_output_file = fdopen(output_fd, "w");
-  if (!new_output_file)
-    abort();
-  if (!__sanitizer_set_report_fd)
-    return;
-  __sanitizer_set_report_fd((void*)output_fd);
+  if (!new_output_file) abort();
+  if (!__sanitizer_set_report_fd) return;
+  __sanitizer_set_report_fd((void *)output_fd);
   discard_output(output_fileno);
+
 }
 
 // Close stdout and/or stderr if user asks for it.
 static void maybe_close_fd_mask() {
+
   char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
-  if (!fd_mask_str)
-    return;
+  if (!fd_mask_str) return;
   int fd_mask = atoi(fd_mask_str);
-  if (fd_mask & 2)
-    dup_and_close_stderr();
-  if (fd_mask & 1)
-    close_stdout();
+  if (fd_mask & 2) dup_and_close_stderr();
+  if (fd_mask & 1) close_stdout();
+
 }
 
 // Define LLVMFuzzerMutate to avoid link failures for targets that use it
 // with libFuzzer's LLVMFuzzerCustomMutator.
 size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
-  //assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
+
+  // assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
   return 0;
+
 }
 
 // Execute any files provided as parameters.
 static int ExecuteFilesOnyByOne(int argc, char **argv) {
+
   unsigned char *buf = malloc(MAX_FILE);
   for (int i = 1; i < argc; i++) {
+
     int fd = open(argv[i], O_RDONLY);
     if (fd == -1) continue;
     ssize_t length = read(fd, buf, MAX_FILE);
     if (length > 0) {
+
       printf("Reading %zu bytes from %s\n", length, argv[i]);
       LLVMFuzzerTestOneInput(buf, length);
       printf("Execution successful.\n");
+
     }
+
   }
+
   free(buf);
   return 0;
+
 }
 
 int main(int argc, char **argv) {
+
   printf(
       "======================= INFO =========================\n"
       "This binary is built for AFL-fuzz.\n"
@@ -226,36 +252,39 @@ int main(int argc, char **argv) {
       "afl-fuzz will run N iterations before "
       "re-spawning the process (default: 1000)\n"
       "======================================================\n",
-          argv[0], argv[0], argv[0]);
+      argv[0], argv[0], argv[0]);
 
   output_file = stderr;
   maybe_duplicate_stderr();
   maybe_close_fd_mask();
-  if (LLVMFuzzerInitialize)
-    LLVMFuzzerInitialize(&argc, &argv);
+  if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv);
 
   // Do any other expensive one-time initialization here.
 
   uint8_t dummy_input[64] = {0};
-  memcpy(dummy_input, (void*)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
-  memcpy(dummy_input + 32, (void*)AFL_DEFER_FORKSVR, sizeof(AFL_DEFER_FORKSVR));
+  memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
+  memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
+         sizeof(AFL_DEFER_FORKSVR));
   int N = INT_MAX;
   if (argc == 2 && argv[1][0] == '-')
-      N = atoi(argv[1] + 1);
-  else if(argc == 2 && (N = atoi(argv[1])) > 0)
-      printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
+    N = atoi(argv[1] + 1);
+  else if (argc == 2 && (N = atoi(argv[1])) > 0)
+    printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
-//    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
-      __afl_sharedmem_fuzzing = 0;
-      __afl_manual_init();
-//    }
+
+    //    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
+
+    __afl_sharedmem_fuzzing = 0;
+    __afl_manual_init();
+    //    }
     return ExecuteFilesOnyByOne(argc, argv);
     exit(0);
+
   }
 
   assert(N > 0);
 
-//  if (!getenv("AFL_DRIVER_DONT_DEFER"))
+  //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
@@ -264,17 +293,26 @@ int main(int argc, char **argv) {
 
   int num_runs = 0;
   while (__afl_persistent_loop(N)) {
+
 #ifdef _DEBUG
-    fprintf(stderr, "CLIENT crc: %016llx len: %u\n", hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len);
+    fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
+            hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705),
+            *__afl_fuzz_len);
     fprintf(stderr, "RECV:");
     for (int i = 0; i < *__afl_fuzz_len; i++)
       fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
-    fprintf(stderr,"\n");
+    fprintf(stderr, "\n");
 #endif
     if (*__afl_fuzz_len) {
+
       num_runs++;
       LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+
     }
+
   }
+
   printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
+
 }
+
diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
index 83278f5c..e4567bbf 100644
--- a/examples/aflpp_driver/aflpp_driver_test.c
+++ b/examples/aflpp_driver/aflpp_driver_test.c
@@ -6,18 +6,20 @@
 
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
-  fprintf(stderr, "FUNC crc: %016llx len: %lu\n", hash64((u8*)Data, (unsigned int) Size, (unsigned long long int) 0xa5b35705), Size);
-  
-  if (Size < 5)
-    return 0;
+  fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
+          hash64((u8 *)Data, (unsigned int)Size,
+                 (unsigned long long int)0xa5b35705),
+          Size);
+
+  if (Size < 5) return 0;
 
   if (Data[0] == 'F')
     if (Data[1] == 'A')
       if (Data[2] == '$')
         if (Data[3] == '$')
-          if (Data[4] == '$')
-            abort();
-          
+          if (Data[4] == '$') abort();
+
   return 0;
 
 }
+
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 38e95ac8..71874283 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -139,7 +139,8 @@ static u8 check_if_text(struct queue_entry *q) {
 
     // non-overlong 2-byte
     if (((0xC2 <= buf[offset + 0] && buf[offset + 0] <= 0xDF) &&
-         (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF))) {
+         (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF)) &&
+        len - offset > 1) {
 
       offset += 2;
       utf8++;
@@ -149,18 +150,19 @@ static u8 check_if_text(struct queue_entry *q) {
     }
 
     // excluding overlongs
-    if ((buf[offset + 0] == 0xE0 &&
-         (0xA0 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
-         (0x80 <= buf[offset + 2] &&
-          buf[offset + 2] <= 0xBF)) ||  // straight 3-byte
-        (((0xE1 <= buf[offset + 0] && buf[offset + 0] <= 0xEC) ||
-          buf[offset + 0] == 0xEE || buf[offset + 0] == 0xEF) &&
-         (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
-         (0x80 <= buf[offset + 2] &&
-          buf[offset + 2] <= 0xBF)) ||  // excluding surrogates
-        (buf[offset + 0] == 0xED &&
-         (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x9F) &&
-         (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF))) {
+    if ((len - offset > 2) &&
+        ((buf[offset + 0] == 0xE0 &&
+          (0xA0 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
+          (0x80 <= buf[offset + 2] &&
+           buf[offset + 2] <= 0xBF)) ||  // straight 3-byte
+         (((0xE1 <= buf[offset + 0] && buf[offset + 0] <= 0xEC) ||
+           buf[offset + 0] == 0xEE || buf[offset + 0] == 0xEF) &&
+          (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
+          (0x80 <= buf[offset + 2] &&
+           buf[offset + 2] <= 0xBF)) ||  // excluding surrogates
+         (buf[offset + 0] == 0xED &&
+          (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x9F) &&
+          (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF)))) {
 
       offset += 3;
       utf8++;
@@ -170,19 +172,20 @@ static u8 check_if_text(struct queue_entry *q) {
     }
 
     // planes 1-3
-    if ((buf[offset + 0] == 0xF0 &&
-         (0x90 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
-         (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
-         (0x80 <= buf[offset + 3] &&
-          buf[offset + 3] <= 0xBF)) ||  // planes 4-15
-        ((0xF1 <= buf[offset + 0] && buf[offset + 0] <= 0xF3) &&
-         (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
-         (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
-         (0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF)) ||  // plane 16
-        (buf[offset + 0] == 0xF4 &&
-         (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x8F) &&
-         (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
-         (0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF))) {
+    if ((len - offset > 3) &&
+        ((buf[offset + 0] == 0xF0 &&
+          (0x90 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
+          (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
+          (0x80 <= buf[offset + 3] &&
+           buf[offset + 3] <= 0xBF)) ||  // planes 4-15
+         ((0xF1 <= buf[offset + 0] && buf[offset + 0] <= 0xF3) &&
+          (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
+          (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
+          (0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF)) ||  // plane 16
+         (buf[offset + 0] == 0xF4 &&
+          (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x8F) &&
+          (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
+          (0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF)))) {
 
       offset += 4;
       utf8++;
diff --git a/src/afl-fuzz-redqueen.c b/src/afl-fuzz-redqueen.c
index 57e60c3d..a2e8f992 100644
--- a/src/afl-fuzz-redqueen.c
+++ b/src/afl-fuzz-redqueen.c
@@ -269,8 +269,7 @@ static long long strntoll(const char *str, size_t sz, char **end, int base) {
   long long   ret;
   const char *beg = str;
 
-  for (; beg && sz && *beg == ' '; beg++, sz--)
-    ;
+  for (; beg && sz && *beg == ' '; beg++, sz--) {};
 
   if (!sz || sz >= sizeof(buf)) {
 
diff --git a/test/test-floatingpoint.c b/test/test-floatingpoint.c
index d1709b90..3a699595 100644
--- a/test/test-floatingpoint.c
+++ b/test/test-floatingpoint.c
@@ -17,10 +17,10 @@ int main(void) {
     int len = __AFL_FUZZ_TESTCASE_LEN;
     if (len != sizeof(float)) return 1;
 
-                 /* 15 + 1/2                      = 15.5  */
-                 /* 15 + 1/2 + 1/8                = 15.625  */
-                 /* 15 + 1/2 + 1/8 + 1/32         = 15.65625  */
-                 /* 15 + 1/2 + 1/8 + 1/32 + 1/128 = 15.6640625  */
+    /* 15 + 1/2                      = 15.5  */
+    /* 15 + 1/2 + 1/8                = 15.625  */
+    /* 15 + 1/2 + 1/8 + 1/32         = 15.65625  */
+    /* 15 + 1/2 + 1/8 + 1/32 + 1/128 = 15.6640625  */
     if ((-*magic == 15.0 + 0.5 + 0.125 + 0.03125 + 0.0078125)) abort();
 
   }
-- 
cgit 1.4.1


From 08bcaa135f6fc9282a947e1c73ef0866cb4cf2d0 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 6 Aug 2020 18:44:12 +0200
Subject: dummy mem test

---
 examples/aflpp_driver/aflpp_driver.c | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 86c7a69f..eab6b52c 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -56,6 +56,7 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
+#include <sys/mman.h>
 
 #include "config.h"
 
@@ -101,6 +102,7 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 int                   __afl_sharedmem_fuzzing = 1;
 extern unsigned int * __afl_fuzz_len;
 extern unsigned char *__afl_fuzz_ptr;
+extern unsigned char *__afl_area_ptr;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
@@ -240,6 +242,10 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 int main(int argc, char **argv) {
 
+  uint8_t *dummy = (uint8_t*) mmap((void *)0x1000,250000, PROT_READ | PROT_WRITE,
+             MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  __afl_area_ptr = dummy;
+
   printf(
       "======================= INFO =========================\n"
       "This binary is built for AFL-fuzz.\n"
@@ -275,6 +281,7 @@ int main(int argc, char **argv) {
     //    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
 
     __afl_sharedmem_fuzzing = 0;
+    munmap(dummy, 256000);
     __afl_manual_init();
     //    }
     return ExecuteFilesOnyByOne(argc, argv);
@@ -285,6 +292,7 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
+  munmap(dummy, 256000);
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
-- 
cgit 1.4.1


From 8190436f8f78d0bef799461447ddd37e9290c0aa Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 6 Aug 2020 18:51:16 +0200
Subject: fix

---
 examples/aflpp_driver/aflpp_driver.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index eab6b52c..b9c1e7b3 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -64,6 +64,10 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #include "hash.h"
 #endif
 
+#ifndef MAP_FIXED_NOREPLACE
+#define MAP_FIXED_NOREPLACE	0x100000
+#endif
+
 // Platform detection. Copied from FuzzerInternal.h
 #ifdef __linux__
   #define LIBFUZZER_LINUX 1
@@ -245,6 +249,7 @@ int main(int argc, char **argv) {
   uint8_t *dummy = (uint8_t*) mmap((void *)0x1000,250000, PROT_READ | PROT_WRITE,
              MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
   __afl_area_ptr = dummy;
+  fprintf(stderr, "dummy: %p\n", __afl_area_ptr);
 
   printf(
       "======================= INFO =========================\n"
-- 
cgit 1.4.1


From 51f3a81037ccbd8cf00ef6b47a2e04201e1ed301 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 6 Aug 2020 19:05:57 +0200
Subject: fix

---
 examples/aflpp_driver/aflpp_driver.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index b9c1e7b3..adda48f1 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -248,27 +248,32 @@ int main(int argc, char **argv) {
 
   uint8_t *dummy = (uint8_t*) mmap((void *)0x1000,250000, PROT_READ | PROT_WRITE,
              MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  if ((uint64_t)dummy == -1)
+    dummy = (uint8_t*) mmap((void *)0x1000,250000, PROT_READ | PROT_WRITE,
+             MAP_SHARED | MAP_ANONYMOUS, -1, 0);
   __afl_area_ptr = dummy;
   fprintf(stderr, "dummy: %p\n", __afl_area_ptr);
 
   printf(
       "======================= INFO =========================\n"
-      "This binary is built for AFL-fuzz.\n"
+      "This binary is built for afl++.\n"
       "To run the target function on individual input(s) execute this:\n"
-      "  %s < INPUT_FILE\n"
-      "or\n"
       "  %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
       "To fuzz with afl-fuzz execute this:\n"
-      "  afl-fuzz [afl-flags] %s [-N]\n"
+      "  afl-fuzz [afl-flags] -- %s [-N]\n"
       "afl-fuzz will run N iterations before "
       "re-spawning the process (default: 1000)\n"
       "======================================================\n",
-      argv[0], argv[0], argv[0]);
+      argv[0], argv[0]);
 
   output_file = stderr;
   maybe_duplicate_stderr();
   maybe_close_fd_mask();
-  if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv);
+  if (LLVMFuzzerInitialize) {
+    fprintf(stderr, "Running LLVMFuzzerInitialize ...\n");
+    LLVMFuzzerInitialize(&argc, &argv);
+    fprintf(stderr, "continue...\n");
+  }
 
   // Do any other expensive one-time initialization here.
 
-- 
cgit 1.4.1


From 970d75d681208ed7e6d56343a99698ba76c04f68 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 6 Aug 2020 19:07:52 +0200
Subject: fix

---
 examples/aflpp_driver/aflpp_driver.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index adda48f1..8446b34c 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -246,10 +246,10 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 int main(int argc, char **argv) {
 
-  uint8_t *dummy = (uint8_t*) mmap((void *)0x1000,250000, PROT_READ | PROT_WRITE,
+  uint8_t *dummy = (uint8_t*) mmap((void *)0x1000, 256000, PROT_READ | PROT_WRITE,
              MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
   if ((uint64_t)dummy == -1)
-    dummy = (uint8_t*) mmap((void *)0x1000,250000, PROT_READ | PROT_WRITE,
+    dummy = (uint8_t*) mmap(0, 256000, PROT_READ | PROT_WRITE,
              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
   __afl_area_ptr = dummy;
   fprintf(stderr, "dummy: %p\n", __afl_area_ptr);
-- 
cgit 1.4.1


From e048d95660821c8b463dbdd85abe0ef8f0cf9df7 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 6 Aug 2020 19:13:04 +0200
Subject: fix

---
 examples/aflpp_driver/aflpp_driver.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 8446b34c..892e0779 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -68,6 +68,8 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 #define MAP_FIXED_NOREPLACE	0x100000
 #endif
 
+#define MAX_DUMMY_SIZE 256000
+
 // Platform detection. Copied from FuzzerInternal.h
 #ifdef __linux__
   #define LIBFUZZER_LINUX 1
@@ -246,10 +248,10 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 int main(int argc, char **argv) {
 
-  uint8_t *dummy = (uint8_t*) mmap((void *)0x1000, 256000, PROT_READ | PROT_WRITE,
+  uint8_t *dummy = (uint8_t*) mmap((void *)0x1000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
              MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
   if ((uint64_t)dummy == -1)
-    dummy = (uint8_t*) mmap(0, 256000, PROT_READ | PROT_WRITE,
+    dummy = (uint8_t*) mmap(0, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
   __afl_area_ptr = dummy;
   fprintf(stderr, "dummy: %p\n", __afl_area_ptr);
@@ -261,8 +263,7 @@ int main(int argc, char **argv) {
       "  %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
       "To fuzz with afl-fuzz execute this:\n"
       "  afl-fuzz [afl-flags] -- %s [-N]\n"
-      "afl-fuzz will run N iterations before "
-      "re-spawning the process (default: 1000)\n"
+      "afl-fuzz will run N iterations before re-spawning the process (default: 1000)\n"
       "======================================================\n",
       argv[0], argv[0]);
 
@@ -291,7 +292,7 @@ int main(int argc, char **argv) {
     //    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
 
     __afl_sharedmem_fuzzing = 0;
-    munmap(dummy, 256000);
+    munmap(dummy, MAX_DUMMY_SIZE);
     __afl_manual_init();
     //    }
     return ExecuteFilesOnyByOne(argc, argv);
@@ -302,7 +303,7 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  munmap(dummy, 256000);
+  munmap(dummy, MAX_DUMMY_SIZE);
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
-- 
cgit 1.4.1


From bbfff7d472cbe4a1c593c8340c99dde6c31a4a35 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 6 Aug 2020 19:37:13 +0200
Subject: fix

---
 examples/aflpp_driver/aflpp_driver.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 892e0779..2b35a46f 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -246,15 +246,21 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 }
 
-int main(int argc, char **argv) {
-
-  uint8_t *dummy = (uint8_t*) mmap((void *)0x1000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
+__attribute__((constructor(10))) void __afl_protect(void) {
+  __afl_area_ptr = (unsigned char*) mmap((void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
              MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)dummy == -1)
-    dummy = (uint8_t*) mmap(0, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
+  if ((uint64_t)__afl_area_ptr == -1)
+    __afl_area_ptr = (unsigned char*) mmap((void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  __afl_area_ptr = dummy;
-  fprintf(stderr, "dummy: %p\n", __afl_area_ptr);
+  if ((uint64_t)__afl_area_ptr == -1)
+    __afl_area_ptr = (unsigned char*) mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
+             MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+}
+
+
+int main(int argc, char **argv) {
+
+  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
 
   printf(
       "======================= INFO =========================\n"
@@ -292,7 +298,7 @@ int main(int argc, char **argv) {
     //    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
 
     __afl_sharedmem_fuzzing = 0;
-    munmap(dummy, MAX_DUMMY_SIZE);
+    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
     __afl_manual_init();
     //    }
     return ExecuteFilesOnyByOne(argc, argv);
@@ -303,7 +309,7 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  munmap(dummy, MAX_DUMMY_SIZE);
+  munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
-- 
cgit 1.4.1


From cb3631a3223806210a781f1138508b37d4f6d761 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 6 Aug 2020 20:02:47 +0200
Subject: add cmplog map to aflpp driver

---
 examples/aflpp_driver/aflpp_driver.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 2b35a46f..6ec37cda 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -59,6 +59,7 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 #include <sys/mman.h>
 
 #include "config.h"
+#include "cmplog.h"
 
 #ifdef _DEBUG
   #include "hash.h"
@@ -109,6 +110,7 @@ int                   __afl_sharedmem_fuzzing = 1;
 extern unsigned int * __afl_fuzz_len;
 extern unsigned char *__afl_fuzz_ptr;
 extern unsigned char *__afl_area_ptr;
+extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
@@ -255,6 +257,7 @@ __attribute__((constructor(10))) void __afl_protect(void) {
   if ((uint64_t)__afl_area_ptr == -1)
     __afl_area_ptr = (unsigned char*) mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  __afl_cmp_map = (struct cmp_map *) __afl_area_ptr;
 }
 
 
-- 
cgit 1.4.1


From e2434cf8c6db86e1e7b67cb3b73e417c2a7fd3bd Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 6 Aug 2020 23:27:50 +0200
Subject: remove datalen in havoc

---
 examples/aflpp_driver/aflpp_driver.c | 35 ++++++++++-------
 llvm_mode/afl-llvm-rt.o.c            |  2 +-
 src/afl-fuzz-one.c                   | 73 +++++++++++++++++-------------------
 3 files changed, 56 insertions(+), 54 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 6ec37cda..90f9cf99 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -66,7 +66,7 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 #endif
 
 #ifndef MAP_FIXED_NOREPLACE
-#define MAP_FIXED_NOREPLACE	0x100000
+  #define MAP_FIXED_NOREPLACE 0x100000
 #endif
 
 #define MAX_DUMMY_SIZE 256000
@@ -106,10 +106,10 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #error "Support for your platform has not been implemented"
 #endif
 
-int                   __afl_sharedmem_fuzzing = 1;
-extern unsigned int * __afl_fuzz_len;
-extern unsigned char *__afl_fuzz_ptr;
-extern unsigned char *__afl_area_ptr;
+int                    __afl_sharedmem_fuzzing = 1;
+extern unsigned int *  __afl_fuzz_len;
+extern unsigned char * __afl_fuzz_ptr;
+extern unsigned char * __afl_area_ptr;
 extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
@@ -249,17 +249,21 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 }
 
 __attribute__((constructor(10))) void __afl_protect(void) {
-  __afl_area_ptr = (unsigned char*) mmap((void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-             MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+
+  __afl_area_ptr = (unsigned char *)mmap(
+      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
+      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
   if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char*) mmap((void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-             MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
+                                           PROT_READ | PROT_WRITE,
+                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
   if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char*) mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-             MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  __afl_cmp_map = (struct cmp_map *) __afl_area_ptr;
-}
+    __afl_area_ptr =
+        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
+                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
 
+}
 
 int main(int argc, char **argv) {
 
@@ -272,7 +276,8 @@ int main(int argc, char **argv) {
       "  %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
       "To fuzz with afl-fuzz execute this:\n"
       "  afl-fuzz [afl-flags] -- %s [-N]\n"
-      "afl-fuzz will run N iterations before re-spawning the process (default: 1000)\n"
+      "afl-fuzz will run N iterations before re-spawning the process (default: "
+      "1000)\n"
       "======================================================\n",
       argv[0], argv[0]);
 
@@ -280,9 +285,11 @@ int main(int argc, char **argv) {
   maybe_duplicate_stderr();
   maybe_close_fd_mask();
   if (LLVMFuzzerInitialize) {
+
     fprintf(stderr, "Running LLVMFuzzerInitialize ...\n");
     LLVMFuzzerInitialize(&argc, &argv);
     fprintf(stderr, "continue...\n");
+
   }
 
   // Do any other expensive one-time initialization here.
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index d67862f8..0d498de7 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -101,7 +101,7 @@ __thread u32        __afl_cmp_counter;
 
 int __afl_sharedmem_fuzzing __attribute__((weak));
 
-struct cmp_map *__afl_cmp_map = (struct cmp_map *) __afl_area_initial;
+struct cmp_map *__afl_cmp_map = (struct cmp_map *)__afl_area_initial;
 
 /* Running in persistent mode? */
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 77bce7d0..1f0bf30e 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -1921,14 +1921,14 @@ havoc_stage:
 
           /* Flip a single bit somewhere. Spooky! */
 
-          FLIP_BIT(out_buf, rand_below_datalen(afl, temp_len << 3));
+          FLIP_BIT(out_buf, rand_below(afl, temp_len << 3));
           break;
 
         case 1:
 
           /* Set byte to interesting value. */
 
-          out_buf[rand_below_datalen(afl, temp_len)] =
+          out_buf[rand_below(afl, temp_len)] =
               interesting_8[rand_below(afl, sizeof(interesting_8))];
           break;
 
@@ -1940,12 +1940,12 @@ havoc_stage:
 
           if (rand_below(afl, 2)) {
 
-            *(u16 *)(out_buf + rand_below_datalen(afl, temp_len - 1)) =
+            *(u16 *)(out_buf + rand_below(afl, temp_len - 1)) =
                 interesting_16[rand_below(afl, sizeof(interesting_16) >> 1)];
 
           } else {
 
-            *(u16 *)(out_buf + rand_below_datalen(afl, temp_len - 1)) = SWAP16(
+            *(u16 *)(out_buf + rand_below(afl, temp_len - 1)) = SWAP16(
                 interesting_16[rand_below(afl, sizeof(interesting_16) >> 1)]);
 
           }
@@ -1960,12 +1960,12 @@ havoc_stage:
 
           if (rand_below(afl, 2)) {
 
-            *(u32 *)(out_buf + rand_below_datalen(afl, temp_len - 3)) =
+            *(u32 *)(out_buf + rand_below(afl, temp_len - 3)) =
                 interesting_32[rand_below(afl, sizeof(interesting_32) >> 2)];
 
           } else {
 
-            *(u32 *)(out_buf + rand_below_datalen(afl, temp_len - 3)) = SWAP32(
+            *(u32 *)(out_buf + rand_below(afl, temp_len - 3)) = SWAP32(
                 interesting_32[rand_below(afl, sizeof(interesting_32) >> 2)]);
 
           }
@@ -1976,16 +1976,14 @@ havoc_stage:
 
           /* Randomly subtract from byte. */
 
-          out_buf[rand_below_datalen(afl, temp_len)] -=
-              1 + rand_below(afl, ARITH_MAX);
+          out_buf[rand_below(afl, temp_len)] -= 1 + rand_below(afl, ARITH_MAX);
           break;
 
         case 5:
 
           /* Randomly add to byte. */
 
-          out_buf[rand_below_datalen(afl, temp_len)] +=
-              1 + rand_below(afl, ARITH_MAX);
+          out_buf[rand_below(afl, temp_len)] += 1 + rand_below(afl, ARITH_MAX);
           break;
 
         case 6:
@@ -1996,13 +1994,13 @@ havoc_stage:
 
           if (rand_below(afl, 2)) {
 
-            u32 pos = rand_below_datalen(afl, temp_len - 1);
+            u32 pos = rand_below(afl, temp_len - 1);
 
             *(u16 *)(out_buf + pos) -= 1 + rand_below(afl, ARITH_MAX);
 
           } else {
 
-            u32 pos = rand_below_datalen(afl, temp_len - 1);
+            u32 pos = rand_below(afl, temp_len - 1);
             u16 num = 1 + rand_below(afl, ARITH_MAX);
 
             *(u16 *)(out_buf + pos) =
@@ -2020,13 +2018,13 @@ havoc_stage:
 
           if (rand_below(afl, 2)) {
 
-            u32 pos = rand_below_datalen(afl, temp_len - 1);
+            u32 pos = rand_below(afl, temp_len - 1);
 
             *(u16 *)(out_buf + pos) += 1 + rand_below(afl, ARITH_MAX);
 
           } else {
 
-            u32 pos = rand_below_datalen(afl, temp_len - 1);
+            u32 pos = rand_below(afl, temp_len - 1);
             u16 num = 1 + rand_below(afl, ARITH_MAX);
 
             *(u16 *)(out_buf + pos) =
@@ -2044,13 +2042,13 @@ havoc_stage:
 
           if (rand_below(afl, 2)) {
 
-            u32 pos = rand_below_datalen(afl, temp_len - 3);
+            u32 pos = rand_below(afl, temp_len - 3);
 
             *(u32 *)(out_buf + pos) -= 1 + rand_below(afl, ARITH_MAX);
 
           } else {
 
-            u32 pos = rand_below_datalen(afl, temp_len - 3);
+            u32 pos = rand_below(afl, temp_len - 3);
             u32 num = 1 + rand_below(afl, ARITH_MAX);
 
             *(u32 *)(out_buf + pos) =
@@ -2068,13 +2066,13 @@ havoc_stage:
 
           if (rand_below(afl, 2)) {
 
-            u32 pos = rand_below_datalen(afl, temp_len - 3);
+            u32 pos = rand_below(afl, temp_len - 3);
 
             *(u32 *)(out_buf + pos) += 1 + rand_below(afl, ARITH_MAX);
 
           } else {
 
-            u32 pos = rand_below_datalen(afl, temp_len - 3);
+            u32 pos = rand_below(afl, temp_len - 3);
             u32 num = 1 + rand_below(afl, ARITH_MAX);
 
             *(u32 *)(out_buf + pos) =
@@ -2090,8 +2088,7 @@ havoc_stage:
              why not. We use XOR with 1-255 to eliminate the
              possibility of a no-op. */
 
-          out_buf[rand_below_datalen(afl, temp_len)] ^=
-              1 + rand_below(afl, 255);
+          out_buf[rand_below(afl, temp_len)] ^= 1 + rand_below(afl, 255);
           break;
 
         case 11 ... 12: {
@@ -2108,7 +2105,7 @@ havoc_stage:
 
           del_len = choose_block_len(afl, temp_len - 1);
 
-          del_from = rand_below_datalen(afl, temp_len - del_len + 1);
+          del_from = rand_below(afl, temp_len - del_len + 1);
 
           memmove(out_buf + del_from, out_buf + del_from + del_len,
                   temp_len - del_from - del_len);
@@ -2132,7 +2129,7 @@ havoc_stage:
             if (actually_clone) {
 
               clone_len = choose_block_len(afl, temp_len);
-              clone_from = rand_below_datalen(afl, temp_len - clone_len + 1);
+              clone_from = rand_below(afl, temp_len - clone_len + 1);
 
             } else {
 
@@ -2141,7 +2138,7 @@ havoc_stage:
 
             }
 
-            clone_to = rand_below_datalen(afl, temp_len);
+            clone_to = rand_below(afl, temp_len);
 
             new_buf =
                 ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
@@ -2159,9 +2156,8 @@ havoc_stage:
             } else {
 
               memset(new_buf + clone_to,
-                     rand_below(afl, 2)
-                         ? rand_below(afl, 256)
-                         : out_buf[rand_below_datalen(afl, temp_len)],
+                     rand_below(afl, 2) ? rand_below(afl, 256)
+                                        : out_buf[rand_below(afl, temp_len)],
                      clone_len);
 
             }
@@ -2190,8 +2186,8 @@ havoc_stage:
 
           copy_len = choose_block_len(afl, temp_len - 1);
 
-          copy_from = rand_below_datalen(afl, temp_len - copy_len + 1);
-          copy_to = rand_below_datalen(afl, temp_len - copy_len + 1);
+          copy_from = rand_below(afl, temp_len - copy_len + 1);
+          copy_to = rand_below(afl, temp_len - copy_len + 1);
 
           if (rand_below(afl, 4)) {
 
@@ -2204,9 +2200,8 @@ havoc_stage:
           } else {
 
             memset(out_buf + copy_to,
-                   rand_below(afl, 2)
-                       ? rand_below(afl, 256)
-                       : out_buf[rand_below_datalen(afl, temp_len)],
+                   rand_below(afl, 2) ? rand_below(afl, 256)
+                                      : out_buf[rand_below(afl, temp_len)],
                    copy_len);
 
           }
@@ -2238,7 +2233,7 @@ havoc_stage:
 
                 if (extra_len > temp_len) { break; }
 
-                insert_at = rand_below_datalen(afl, temp_len - extra_len + 1);
+                insert_at = rand_below(afl, temp_len - extra_len + 1);
                 memcpy(out_buf + insert_at, afl->a_extras[use_extra].data,
                        extra_len);
 
@@ -2252,7 +2247,7 @@ havoc_stage:
 
                 if (extra_len > temp_len) { break; }
 
-                insert_at = rand_below_datalen(afl, temp_len - extra_len + 1);
+                insert_at = rand_below(afl, temp_len - extra_len + 1);
                 memcpy(out_buf + insert_at, afl->extras[use_extra].data,
                        extra_len);
 
@@ -2263,7 +2258,7 @@ havoc_stage:
             } else {  // case 16
 
               u32 use_extra, extra_len,
-                  insert_at = rand_below_datalen(afl, temp_len + 1);
+                  insert_at = rand_below(afl, temp_len + 1);
               u8 *ptr;
 
               /* Insert an extra. Do the same dice-rolling stuff as for the
@@ -2367,8 +2362,8 @@ havoc_stage:
               copy_len = choose_block_len(afl, new_len - 1);
               if (copy_len > temp_len) copy_len = temp_len;
 
-              copy_from = rand_below_datalen(afl, new_len - copy_len + 1);
-              copy_to = rand_below_datalen(afl, temp_len - copy_len + 1);
+              copy_from = rand_below(afl, new_len - copy_len + 1);
+              copy_to = rand_below(afl, temp_len - copy_len + 1);
 
               memmove(out_buf + copy_to, new_buf + copy_from, copy_len);
 
@@ -2377,9 +2372,9 @@ havoc_stage:
               u32 clone_from, clone_to, clone_len;
 
               clone_len = choose_block_len(afl, new_len);
-              clone_from = rand_below_datalen(afl, new_len - clone_len + 1);
+              clone_from = rand_below(afl, new_len - clone_len + 1);
 
-              clone_to = rand_below_datalen(afl, temp_len);
+              clone_to = rand_below(afl, temp_len);
 
               u8 *temp_buf =
                   ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
@@ -2528,7 +2523,7 @@ retry_splicing:
 
     /* Split somewhere between the first and last differing byte. */
 
-    split_at = f_diff + rand_below_datalen(afl, l_diff - f_diff);
+    split_at = f_diff + rand_below(afl, l_diff - f_diff);
 
     /* Do the thing. */
 
-- 
cgit 1.4.1


From 5b0616614433b87b96bc72951b9a0828974e8a4e Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 7 Aug 2020 11:10:17 +0200
Subject: reverse cmplog temps

---
 examples/aflpp_driver/aflpp_driver.c | 23 +++++++++++------------
 llvm_mode/afl-llvm-rt.o.c            | 19 ++++++++++++-------
 2 files changed, 23 insertions(+), 19 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 90f9cf99..7d388799 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -106,11 +106,11 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #error "Support for your platform has not been implemented"
 #endif
 
-int                    __afl_sharedmem_fuzzing = 1;
-extern unsigned int *  __afl_fuzz_len;
-extern unsigned char * __afl_fuzz_ptr;
-extern unsigned char * __afl_area_ptr;
-extern struct cmp_map *__afl_cmp_map;
+int                   __afl_sharedmem_fuzzing = 1;
+extern unsigned int * __afl_fuzz_len;
+extern unsigned char *__afl_fuzz_ptr;
+extern unsigned char *__afl_area_ptr;
+// extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
@@ -248,8 +248,9 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 }
 
-__attribute__((constructor(10))) void __afl_protect(void) {
+__attribute__((constructor(1))) void __afl_protect(void) {
 
+  setenv("__AFL_DEFER_FORKSRV", "1", 1);
   __afl_area_ptr = (unsigned char *)mmap(
       (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
       MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
@@ -261,7 +262,7 @@ __attribute__((constructor(10))) void __afl_protect(void) {
     __afl_area_ptr =
         (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
                               MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
+  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
 
 }
 
@@ -305,14 +306,11 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
-    //    if (!getenv("AFL_DRIVER_DONT_DEFER")) {
-
     __afl_sharedmem_fuzzing = 0;
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
+    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
+    __afl_area_ptr = NULL;
     __afl_manual_init();
-    //    }
     return ExecuteFilesOnyByOne(argc, argv);
-    exit(0);
 
   }
 
@@ -320,6 +318,7 @@ int main(int argc, char **argv) {
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
   munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
+  __afl_area_ptr = NULL;
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index 3e5db87d..22c34ae8 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -101,7 +101,7 @@ __thread u32        __afl_cmp_counter;
 
 int __afl_sharedmem_fuzzing __attribute__((weak));
 
-struct cmp_map *__afl_cmp_map = (struct cmp_map *)__afl_area_initial;
+struct cmp_map *__afl_cmp_map;
 
 /* Running in persistent mode? */
 
@@ -183,6 +183,11 @@ static void __afl_map_shm_fuzz() {
 
 static void __afl_map_shm(void) {
 
+  // we we are not running in afl ensure the map exists
+  fprintf(stderr, "Was: %p\n", __afl_area_ptr);
+  if (!__afl_area_ptr) __afl_area_ptr = __afl_area_initial;
+  fprintf(stderr, "Is: %p\n", __afl_area_ptr);
+
   char *id_str = getenv(SHM_ENV_VAR);
 
   if (__afl_final_loc) {
@@ -943,7 +948,7 @@ void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop) {
 
 void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2) {
 
-  if (unlikely(!__afl_cmp_map || (u8 *)__afl_cmp_map == __afl_area_ptr)) return;
+  if (unlikely(!__afl_cmp_map)) return;
 
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
@@ -966,7 +971,7 @@ void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2) {
 
 void __cmplog_ins_hook2(uint16_t arg1, uint16_t arg2) {
 
-  if (!__afl_cmp_map) return;
+  if (unlikely(!__afl_cmp_map)) return;
 
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
@@ -987,7 +992,7 @@ void __cmplog_ins_hook2(uint16_t arg1, uint16_t arg2) {
 
 void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2) {
 
-  if (unlikely(!__afl_cmp_map || (u8 *)__afl_cmp_map == __afl_area_ptr)) return;
+  if (unlikely(!__afl_cmp_map)) return;
 
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
@@ -1008,7 +1013,7 @@ void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2) {
 
 void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2) {
 
-  if (unlikely(!__afl_cmp_map || (u8 *)__afl_cmp_map == __afl_area_ptr)) return;
+  if (unlikely(!__afl_cmp_map)) return;
 
   uintptr_t k = (uintptr_t)__builtin_return_address(0);
   k = (k >> 4) ^ (k << 8);
@@ -1059,7 +1064,7 @@ void __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2)
 
 void __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) {
 
-  if (unlikely(!__afl_cmp_map || (u8 *)__afl_cmp_map == __afl_area_ptr)) return;
+  if (unlikely(!__afl_cmp_map)) return;
 
   for (uint64_t i = 0; i < cases[0]; i++) {
 
@@ -1098,7 +1103,7 @@ static int area_is_mapped(void *ptr, size_t len) {
 
 void __cmplog_rtn_hook(u8 *ptr1, u8 *ptr2) {
 
-  if (unlikely(!__afl_cmp_map || (u8 *)__afl_cmp_map == __afl_area_ptr)) return;
+  if (unlikely(!__afl_cmp_map)) return;
 
   if (!area_is_mapped(ptr1, 32) || !area_is_mapped(ptr2, 32)) return;
 
-- 
cgit 1.4.1


From a6521e89fc521a07013fd28896ac755f6b8c3a6b Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 01:04:50 +0200
Subject: different driver

---
 examples/aflpp_driver/aflpp_driver.c | 23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 7d388799..35b4f67f 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -106,9 +106,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #error "Support for your platform has not been implemented"
 #endif
 
-int                   __afl_sharedmem_fuzzing = 1;
-extern unsigned int * __afl_fuzz_len;
-extern unsigned char *__afl_fuzz_ptr;
 extern unsigned char *__afl_area_ptr;
 // extern struct cmp_map *__afl_cmp_map;
 
@@ -269,6 +266,7 @@ __attribute__((constructor(1))) void __afl_protect(void) {
 int main(int argc, char **argv) {
 
   fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
+  unsigned char buf[1024000];
 
   printf(
       "======================= INFO =========================\n"
@@ -306,7 +304,6 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
-    __afl_sharedmem_fuzzing = 0;
     munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
     __afl_area_ptr = NULL;
     __afl_manual_init();
@@ -328,25 +325,17 @@ int main(int argc, char **argv) {
   int num_runs = 0;
   while (__afl_persistent_loop(N)) {
 
-#ifdef _DEBUG
-    fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
-            hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705),
-            *__afl_fuzz_len);
-    fprintf(stderr, "RECV:");
-    for (int i = 0; i < *__afl_fuzz_len; i++)
-      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
-    fprintf(stderr, "\n");
-#endif
-    if (*__afl_fuzz_len) {
+    ssize_t n = read(0, buf, sizeof(buf));
+
+    if (n > 0) {
 
-      num_runs++;
-      LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+      LLVMFuzzerTestOneInput(buf, n);
 
     }
 
   }
 
-  printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
+  printf("%s: successfully executed input(s)\n", argv[0]);
 
 }
 
-- 
cgit 1.4.1


From 9945c1648b519b0ef1490ee5eba97665af7f4caf Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 01:34:45 +0200
Subject: fix driver

---
 examples/aflpp_driver/aflpp_driver.c | 20 --------------------
 1 file changed, 20 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 35b4f67f..a3a78b4e 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -106,9 +106,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #error "Support for your platform has not been implemented"
 #endif
 
-extern unsigned char *__afl_area_ptr;
-// extern struct cmp_map *__afl_cmp_map;
-
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
 __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
@@ -248,24 +245,11 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 __attribute__((constructor(1))) void __afl_protect(void) {
 
   setenv("__AFL_DEFER_FORKSRV", "1", 1);
-  __afl_area_ptr = (unsigned char *)mmap(
-      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
-                                           PROT_READ | PROT_WRITE,
-                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr =
-        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
 
 }
 
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
   unsigned char buf[1024000];
 
   printf(
@@ -304,8 +288,6 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-    __afl_area_ptr = NULL;
     __afl_manual_init();
     return ExecuteFilesOnyByOne(argc, argv);
 
@@ -314,8 +296,6 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
-  __afl_area_ptr = NULL;
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
-- 
cgit 1.4.1


From 9b71f7e5e49ee5fd9987fadbaca2f0e548680b33 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 08:47:52 +0200
Subject: debug

---
 examples/aflpp_driver/aflpp_driver.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index a3a78b4e..1e7978b3 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -252,6 +252,8 @@ int main(int argc, char **argv) {
 
   unsigned char buf[1024000];
 
+  printf("__afl_area_ptr is at %p\n", __afl_area_ptr);
+
   printf(
       "======================= INFO =========================\n"
       "This binary is built for afl++.\n"
@@ -297,6 +299,7 @@ int main(int argc, char **argv) {
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
   __afl_manual_init();
+  fprintf(stderr, "__afl_area_ptr is now at %p\n", __afl_area_ptr);
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
-- 
cgit 1.4.1


From 87da1e7af6b91c3e85f8ba0a846ed820713eda5f Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 09:16:55 +0200
Subject: fix driver

---
 examples/aflpp_driver/aflpp_driver.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 1e7978b3..2a3b7dab 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -118,6 +118,8 @@ int                  __afl_persistent_loop(unsigned int);
 static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
 void                 __afl_manual_init();
 
+extern unsigned int *__afl_area_ptr;
+
 // Use this optionally defined function to output sanitizer messages even if
 // user asks to close stderr.
 __attribute__((weak)) void __sanitizer_set_report_fd(void *);
-- 
cgit 1.4.1


From 3aa7d8081d20c824aa19c6383637ade7334e8353 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 11:23:33 +0200
Subject: fuzzbench integration

---
 examples/aflpp_driver/aflpp_driver.c | 41 ++++++++++++++++++++++++++----------
 llvm_mode/afl-llvm-rt.o.c            |  1 -
 2 files changed, 30 insertions(+), 12 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 2a3b7dab..397228ed 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -106,6 +106,10 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #error "Support for your platform has not been implemented"
 #endif
 
+int                   __afl_sharedmem_fuzzing = 0;
+extern unsigned char *__afl_area_ptr;
+// extern struct cmp_map *__afl_cmp_map;
+
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
 __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
@@ -118,8 +122,6 @@ int                  __afl_persistent_loop(unsigned int);
 static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
 void                 __afl_manual_init();
 
-extern unsigned int *__afl_area_ptr;
-
 // Use this optionally defined function to output sanitizer messages even if
 // user asks to close stderr.
 __attribute__((weak)) void __sanitizer_set_report_fd(void *);
@@ -247,14 +249,24 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 __attribute__((constructor(1))) void __afl_protect(void) {
 
   setenv("__AFL_DEFER_FORKSRV", "1", 1);
+  __afl_area_ptr = (unsigned char *)mmap(
+      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
+      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  if ((uint64_t)__afl_area_ptr == -1)
+    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
+                                           PROT_READ | PROT_WRITE,
+                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  if ((uint64_t)__afl_area_ptr == -1)
+    __afl_area_ptr =
+        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
+                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
 
 }
 
 int main(int argc, char **argv) {
 
-  unsigned char buf[1024000];
-
-  printf("__afl_area_ptr is at %p\n", __afl_area_ptr);
+  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
 
   printf(
       "======================= INFO =========================\n"
@@ -282,6 +294,7 @@ int main(int argc, char **argv) {
   // Do any other expensive one-time initialization here.
 
   uint8_t dummy_input[64] = {0};
+  uint8_t buf[1024000];
   memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
   memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
          sizeof(AFL_DEFER_FORKSVR));
@@ -292,6 +305,9 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
+    __afl_sharedmem_fuzzing = 0;
+    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
+    __afl_area_ptr = NULL;
     __afl_manual_init();
     return ExecuteFilesOnyByOne(argc, argv);
 
@@ -299,9 +315,12 @@ int main(int argc, char **argv) {
 
   assert(N > 0);
 
-  //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  __afl_manual_init();
-  fprintf(stderr, "__afl_area_ptr is now at %p\n", __afl_area_ptr);
+  if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
+    __afl_area_ptr = NULL;
+    __afl_manual_init();
+  }
+  fprintf(stderr, "dummy map is now at %p\n", __afl_area_ptr);
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
@@ -310,11 +329,11 @@ int main(int argc, char **argv) {
   int num_runs = 0;
   while (__afl_persistent_loop(N)) {
 
-    ssize_t n = read(0, buf, sizeof(buf));
+    ssize_t r = read(0, buf, sizeof(buf));
 
-    if (n > 0) {
+    if (r > 0) {
 
-      LLVMFuzzerTestOneInput(buf, n);
+      LLVMFuzzerTestOneInput(buf, r);
 
     }
 
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index 431eb4ac..5ffae39c 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -838,7 +838,6 @@ void __afl_manual_init(void) {
       fprintf(stderr,
               "DEBUG: disabled instrumenation because of "
               "AFL_DISABLE_LLVM_INSTRUMENTATION\n");
-    __afl_area_ptr = __afl_area_initial;
 
   }
 
-- 
cgit 1.4.1


From 464c27082a8c75b400d4387d46a86542630cac45 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Mon, 10 Aug 2020 11:45:32 +0200
Subject: fuzzbench integration

---
 examples/aflpp_driver/aflpp_driver.c | 16 +++++++++-------
 llvm_mode/afl-llvm-rt.o.c            |  7 +++++++
 2 files changed, 16 insertions(+), 7 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 397228ed..2b7be45f 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -266,7 +266,7 @@ __attribute__((constructor(1))) void __afl_protect(void) {
 
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
+  fprintf(stderr, "map is at %p\n", __afl_area_ptr);
 
   printf(
       "======================= INFO =========================\n"
@@ -305,10 +305,11 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
-    __afl_sharedmem_fuzzing = 0;
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-    __afl_area_ptr = NULL;
-    __afl_manual_init();
+    if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+      munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
+      __afl_area_ptr = NULL;
+      __afl_manual_init();
+    }
     return ExecuteFilesOnyByOne(argc, argv);
 
   }
@@ -318,9 +319,10 @@ int main(int argc, char **argv) {
   if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
     munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
     __afl_area_ptr = NULL;
-    __afl_manual_init();
+    fprintf(stderr, "performing manual init\n");
+  __afl_manual_init();
   }
-  fprintf(stderr, "dummy map is now at %p\n", __afl_area_ptr);
+  fprintf(stderr, "map is now at %p\n", __afl_area_ptr);
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index 5ffae39c..02dd8dc8 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -834,6 +834,11 @@ void __afl_manual_init(void) {
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
 
     init_done = 1;
+    is_persistent = 0;
+    __afl_sharedmem_fuzzing = 0;
+    if (__afl_area_ptr == NULL)
+      __afl_area_ptr = __afl_area_initial;
+    
     if (getenv("AFL_DEBUG"))
       fprintf(stderr,
               "DEBUG: disabled instrumenation because of "
@@ -855,6 +860,8 @@ void __afl_manual_init(void) {
 
 __attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
 
+  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
+
   is_persistent = !!getenv(PERSIST_ENV_VAR);
 
   if (getenv(DEFER_ENV_VAR)) return;
-- 
cgit 1.4.1


From 0ba09ee85a65878e70d1a224f9d41fcbac3ff1e5 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 11 Aug 2020 10:24:45 +0200
Subject: enhancements

---
 examples/aflpp_driver/aflpp_driver.c | 14 ++++++++------
 include/common.h                     |  2 +-
 llvm_mode/afl-llvm-rt.o.c            |  7 +++----
 src/afl-common.c                     | 30 +++++++++++++++++-------------
 src/afl-fuzz-one.c                   | 11 +++++------
 src/afl-fuzz.c                       | 11 +++++------
 6 files changed, 39 insertions(+), 36 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 2b7be45f..81782c67 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -306,10 +306,13 @@ int main(int argc, char **argv) {
   else if (argc > 1) {
 
     if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+
       munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
       __afl_area_ptr = NULL;
       __afl_manual_init();
+
     }
+
     return ExecuteFilesOnyByOne(argc, argv);
 
   }
@@ -317,11 +320,14 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+
     munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
     __afl_area_ptr = NULL;
     fprintf(stderr, "performing manual init\n");
-  __afl_manual_init();
+    __afl_manual_init();
+
   }
+
   fprintf(stderr, "map is now at %p\n", __afl_area_ptr);
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
@@ -333,11 +339,7 @@ int main(int argc, char **argv) {
 
     ssize_t r = read(0, buf, sizeof(buf));
 
-    if (r > 0) {
-
-      LLVMFuzzerTestOneInput(buf, r);
-
-    }
+    if (r > 0) { LLVMFuzzerTestOneInput(buf, r); }
 
   }
 
diff --git a/include/common.h b/include/common.h
index 42c79c62..c7d57e07 100644
--- a/include/common.h
+++ b/include/common.h
@@ -55,7 +55,7 @@ extern u8 *doc_path;                    /* path to documentation dir        */
    @returns the path, allocating the string */
 
 u8 *find_binary(u8 *fname);
-u8 *find_binary_own_loc(u8 *fname, u8 *own_loc);
+u8 *find_afl_binary(u8 *fname, u8 *own_loc);
 
 /* Read a bitmap from file fname to memory
    This is for the -B option again. */
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index c69d8bb7..20151aea 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -847,9 +847,8 @@ void __afl_manual_init(void) {
     init_done = 1;
     is_persistent = 0;
     __afl_sharedmem_fuzzing = 0;
-    if (__afl_area_ptr == NULL)
-      __afl_area_ptr = __afl_area_initial;
-    
+    if (__afl_area_ptr == NULL) __afl_area_ptr = __afl_area_initial;
+
     if (getenv("AFL_DEBUG"))
       fprintf(stderr,
               "DEBUG: disabled instrumenation because of "
@@ -886,7 +885,7 @@ __attribute__((constructor(0))) void __afl_auto_early(void) {
 
   is_persistent = !!getenv(PERSIST_ENV_VAR);
 
-    __afl_map_shm();
+  __afl_map_shm();
 
 }
 
diff --git a/src/afl-common.c b/src/afl-common.c
index dabeeedd..c1302080 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -138,7 +138,7 @@ void argv_cpy_free(char **argv) {
 
 }
 
-u8 *find_binary_own_loc(u8 *fname, u8 *own_loc) {
+u8 *find_afl_binary(u8 *fname, u8 *own_loc) {
 
   u8 *tmp, *rsl, *own_copy, *cp;
 
@@ -154,21 +154,25 @@ u8 *find_binary_own_loc(u8 *fname, u8 *own_loc) {
 
   }
 
-  own_copy = ck_strdup(own_loc);
-  rsl = strrchr(own_copy, '/');
+  if (own_loc) {
 
-  if (rsl) {
+    own_copy = ck_strdup(own_loc);
+    rsl = strrchr(own_copy, '/');
 
-    *rsl = 0;
+    if (rsl) {
 
-    cp = alloc_printf("%s/%s", own_copy, fname);
-    ck_free(own_copy);
+      *rsl = 0;
 
-    if (!access(cp, X_OK)) { return cp; }
+      cp = alloc_printf("%s/%s", own_copy, fname);
+      ck_free(own_copy);
 
-  } else {
+      if (!access(cp, X_OK)) { return cp; }
+
+    } else {
 
-    ck_free(own_copy);
+      ck_free(own_copy);
+
+    }
 
   }
 
@@ -196,7 +200,7 @@ char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 
   /* Now we need to actually find the QEMU binary to put in argv[0]. */
 
-  cp = find_binary_own_loc("afl-qemu-trace", own_loc);
+  cp = find_afl_binary("afl-qemu-trace", own_loc);
 
   if (cp) {
 
@@ -241,12 +245,12 @@ char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 
   /* Now we need to actually find the QEMU binary to put in argv[0]. */
 
-  cp = find_binary_own_loc("afl-qemu-trace", own_loc);
+  cp = find_afl_binary("afl-qemu-trace", own_loc);
 
   if (cp) {
 
     ck_free(cp);
-    cp = find_binary_own_loc("afl-wine-trace", own_loc);
+    cp = find_afl_binary("afl-wine-trace", own_loc);
 
     if (cp) {
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 9f38b8f8..2f724569 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -2236,8 +2236,8 @@ havoc_stage:
 
             clone_to = rand_below(afl, temp_len);
 
-            new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
-                                    temp_len + clone_len);
+            new_buf =
+                ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
 
             /* Head */
 
@@ -2403,8 +2403,7 @@ havoc_stage:
 
               if (temp_len + extra_len >= MAX_FILE) { break; }
 
-              out_buf =
-                  ck_maybe_grow(BUF_PARAMS(out), temp_len + extra_len);
+              out_buf = ck_maybe_grow(BUF_PARAMS(out), temp_len + extra_len);
 
               /* Tail */
               memmove(out_buf + insert_at + extra_len, out_buf + insert_at,
@@ -2499,8 +2498,8 @@ havoc_stage:
 
               clone_to = rand_below(afl, temp_len);
 
-              u8 *temp_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
-                                           temp_len + clone_len);
+              u8 *temp_buf =
+                  ck_maybe_grow(BUF_PARAMS(out_scratch), temp_len + clone_len);
 
               /* Head */
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 11db004d..d2b2c2d9 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1274,9 +1274,8 @@ int main(int argc, char **argv_orig, char **envp) {
 
     ck_free(afl->taint_fsrv.target_path);
     afl->argv_taint = ck_alloc(sizeof(char *) * (argc + 4 - optind));
-    afl->taint_fsrv.target_path =
-        find_binary_own_loc("afl-qemu-taint", argv[0]);
-    afl->argv_taint[0] = find_binary_own_loc("afl-qemu-taint", argv[0]);
+    afl->taint_fsrv.target_path = find_afl_binary("afl-qemu-taint", argv[0]);
+    afl->argv_taint[0] = find_afl_binary("afl-qemu-taint", argv[0]);
     if (!afl->argv_taint[0])
       FATAL(
           "Cannot find 'afl-qemu-taint', read qemu_taint/README.md on how to "
@@ -1308,19 +1307,19 @@ int main(int argc, char **argv_orig, char **envp) {
 
     OKF("Taint forkserver successfully started");
 
-    const rlim_t kStackSize = 256L * 1024L * 1024L;   // min stack size = 256 Mb
+    const rlim_t  kStackSize = 256L * 1024L * 1024L;  // min stack size = 256 Mb
     struct rlimit rl;
     rl.rlim_cur = kStackSize;
     if (getrlimit(RLIMIT_STACK, &rl) != 0)
       WARNF("Setting a higher stack size failed!");
 
-#define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size
+  #define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size
     u8 *tmp1 = ck_maybe_grow(BUF_PARAMS(eff), MAX_FILE + 4096);
     u8 *tmp2 = ck_maybe_grow(BUF_PARAMS(ex), MAX_FILE + 4096);
     u8 *tmp3 = ck_maybe_grow(BUF_PARAMS(in_scratch), MAX_FILE + 4096);
     u8 *tmp4 = ck_maybe_grow(BUF_PARAMS(out), MAX_FILE + 4096);
     u8 *tmp5 = ck_maybe_grow(BUF_PARAMS(out_scratch), MAX_FILE + 4096);
-#undef BUF_PARAMS
+  #undef BUF_PARAMS
     if (!tmp1 || !tmp2 || !tmp3 || !tmp4 || !tmp5)
       FATAL("memory issues. me hungry, feed me!");
 
-- 
cgit 1.4.1


From b604f5eafcebb816026e198df0ea66ebcbf18421 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Tue, 11 Aug 2020 18:06:18 +0200
Subject: finalize first beta! yay!

---
 README.md                            | 14 ++++++++------
 examples/aflpp_driver/aflpp_driver.c | 28 ----------------------------
 src/afl-fuzz-init.c                  |  9 +++++++--
 src/afl-fuzz-one.c                   |  2 +-
 src/afl-fuzz-queue.c                 |  2 +-
 5 files changed, 17 insertions(+), 38 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/README.md b/README.md
index 2b9bc588..6e324cb0 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # qemu_taint variant.
 
+UPDATE: **WORKS NOW** **PLEASE TEST** **:-)**
+
 ## HOWTO
 
 cd qemu_taint && ./build_qemu_taint.sh
@@ -8,13 +10,13 @@ afl-fuzz -A ...
 
 ## CAVEATS
 
- * segfaults ~10-15 minutes in ...
-
- * shmem persistent mode does not work
- * custom mutators? dunno if they work or not
- * MOpt works but totally ignores the taint information
+ * llvm shmem persistent mode does not and can not not work
+ * MOpt works but totally ignores the taint information, so disabled here
+ * custom mutators? dunno if they work or not. depends on how they work.
  * not tested with qemu_mode
- * if all seed entries are fully touched it might not work
+ * there are several debug checks to ensure the data is fine which slows down
+   fuzzing, if the beta experiment runs fine these will be improved and it
+   will result in quite a speed gain.
 
 ## THE TAINT
 
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 81782c67..8e0b554a 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -107,8 +107,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 #endif
 
 int                   __afl_sharedmem_fuzzing = 0;
-extern unsigned char *__afl_area_ptr;
-// extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
@@ -246,28 +244,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 }
 
-__attribute__((constructor(1))) void __afl_protect(void) {
-
-  setenv("__AFL_DEFER_FORKSRV", "1", 1);
-  __afl_area_ptr = (unsigned char *)mmap(
-      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
-                                           PROT_READ | PROT_WRITE,
-                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr =
-        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
-
-}
-
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "map is at %p\n", __afl_area_ptr);
-
   printf(
       "======================= INFO =========================\n"
       "This binary is built for afl++.\n"
@@ -307,8 +285,6 @@ int main(int argc, char **argv) {
 
     if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
 
-      munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-      __afl_area_ptr = NULL;
       __afl_manual_init();
 
     }
@@ -321,15 +297,11 @@ int main(int argc, char **argv) {
 
   if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
 
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
-    __afl_area_ptr = NULL;
     fprintf(stderr, "performing manual init\n");
     __afl_manual_init();
 
   }
 
-  fprintf(stderr, "map is now at %p\n", __afl_area_ptr);
-
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
   LLVMFuzzerTestOneInput(dummy_input, 1);
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 0150e18a..359eef85 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -771,9 +771,13 @@ void perform_dry_run(afl_state_t *afl) {
     close(fd);
 
     res = calibrate_case(afl, q, use_mem, 0, 1);
-    ck_free(use_mem);
 
-    if (afl->stop_soon) { return; }
+    if (afl->stop_soon) {
+
+      ck_free(use_mem);
+      return;
+
+    }
 
     if (res == afl->crash_mode || res == FSRV_RUN_NOBITS) {
 
@@ -962,6 +966,7 @@ void perform_dry_run(afl_state_t *afl) {
 
     /* perform taint gathering on the input seed */
     if (afl->taint_mode) perform_taint_run(afl, q, q->fname, use_mem, q->len);
+    ck_free(use_mem);
 
     q = q->next;
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 7718256f..4db6febf 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -2342,7 +2342,7 @@ havoc_stage:
             }
 
             /* Tail */
-            memcpy(new_buf + clone_to + clone_len, out_buf + clone_to,
+            memmove(new_buf + clone_to + clone_len, out_buf + clone_to,
                    temp_len - clone_to);
 
             swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index a1fe146b..43794018 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -122,7 +122,7 @@ void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
 
     afl->taint_fsrv.map_size = plen;  // speed :)
     write_to_testcase(afl, mem, len);
-    if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout,
+    if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout * 4,
                             &afl->stop_soon) == 0) {
 
       bytes = q->taint_bytes_all =
-- 
cgit 1.4.1


From 7a6867e2f8e8b698c08366f79d0c8751b09ce431 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Wed, 12 Aug 2020 16:06:30 +0200
Subject: split up __afl_manual_init, added internal
 AFL_DISABLE_LLVM_INSTRUMENTATION, skipping ctor+ifunc functions for all llvm,
 code-format

---
 TODO.md                                      |   2 +
 docs/Changelog.md                            |   2 +-
 examples/aflpp_driver/aflpp_driver.c         |  25 ----
 examples/aflpp_driver/aflpp_driver_test.c    |  16 ++-
 llvm_mode/LLVMInsTrim.so.cc                  |   2 +
 llvm_mode/afl-llvm-common.cc                 | 195 ++++++++++++++++++---------
 llvm_mode/afl-llvm-common.h                  |   1 +
 llvm_mode/afl-llvm-lto-instrumentation.so.cc |  94 +------------
 llvm_mode/afl-llvm-pass.so.cc                |   1 +
 llvm_mode/afl-llvm-rt.o.c                    |  38 +++++-
 src/afl-forkserver.c                         |  11 +-
 src/afl-fuzz-bitmap.c                        |   9 +-
 src/afl-fuzz-run.c                           |  10 +-
 13 files changed, 203 insertions(+), 203 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/TODO.md b/TODO.md
index e81b82a3..f8ef0e0f 100644
--- a/TODO.md
+++ b/TODO.md
@@ -4,6 +4,8 @@
 
  - AFL_MAP_SIZE for qemu_mode and unicorn_mode
  - CPU affinity for many cores? There seems to be an issue > 96 cores
+ - feature for afl-showmap to generate the coverage for all queue entries
+ - afl-plot to support multiple plot_data
 
 ## Further down the road
 
diff --git a/docs/Changelog.md b/docs/Changelog.md
index edcdac58..1c5b3f4a 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -29,9 +29,9 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
      - added neverzero counting to trace-pc/pcgard
      - fixes for laf-intel float splitting (thanks to mark-griffin for
        reporting)
+     - skipping ctors and ifuncs for instrumentation
      - LTO: switch default to the dynamic memory map, set AFL_LLVM_MAP_ADDR
             for a fixed map address (eg. 0x10000)
-     - LTO: skipping ctors and ifuncs in fix map address instrumentation
      - LTO: autodictionary mode is a default
      - LTO: instrim instrumentation disabled, only classic support used
             as it is always better
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 7d388799..b764338e 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -109,7 +109,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 int                   __afl_sharedmem_fuzzing = 1;
 extern unsigned int * __afl_fuzz_len;
 extern unsigned char *__afl_fuzz_ptr;
-extern unsigned char *__afl_area_ptr;
 // extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
@@ -248,28 +247,8 @@ static int ExecuteFilesOnyByOne(int argc, char **argv) {
 
 }
 
-__attribute__((constructor(1))) void __afl_protect(void) {
-
-  setenv("__AFL_DEFER_FORKSRV", "1", 1);
-  __afl_area_ptr = (unsigned char *)mmap(
-      (void *)0x10000, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-      MAP_FIXED_NOREPLACE | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr = (unsigned char *)mmap((void *)0x10000, MAX_DUMMY_SIZE,
-                                           PROT_READ | PROT_WRITE,
-                                           MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  if ((uint64_t)__afl_area_ptr == -1)
-    __afl_area_ptr =
-        (unsigned char *)mmap(NULL, MAX_DUMMY_SIZE, PROT_READ | PROT_WRITE,
-                              MAP_SHARED | MAP_ANONYMOUS, -1, 0);
-  // __afl_cmp_map = (struct cmp_map *)__afl_area_ptr;
-
-}
-
 int main(int argc, char **argv) {
 
-  fprintf(stderr, "dummy map is at %p\n", __afl_area_ptr);
-
   printf(
       "======================= INFO =========================\n"
       "This binary is built for afl++.\n"
@@ -307,8 +286,6 @@ int main(int argc, char **argv) {
   else if (argc > 1) {
 
     __afl_sharedmem_fuzzing = 0;
-    munmap(__afl_area_ptr, MAX_DUMMY_SIZE);  // we need to free 0x10000
-    __afl_area_ptr = NULL;
     __afl_manual_init();
     return ExecuteFilesOnyByOne(argc, argv);
 
@@ -317,8 +294,6 @@ int main(int argc, char **argv) {
   assert(N > 0);
 
   //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  munmap(__afl_area_ptr, MAX_DUMMY_SIZE);
-  __afl_area_ptr = NULL;
   __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
index e4567bbf..ddc3effb 100644
--- a/examples/aflpp_driver/aflpp_driver_test.c
+++ b/examples/aflpp_driver/aflpp_driver_test.c
@@ -4,6 +4,16 @@
 
 #include "hash.h"
 
+void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
+
+  if (Data[0] == 'F')
+    if (Data[1] == 'A')
+      if (Data[2] == '$')
+        if (Data[3] == '$')
+          if (Data[4] == '$') abort();
+
+}
+
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
   fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
@@ -13,11 +23,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
   if (Size < 5) return 0;
 
-  if (Data[0] == 'F')
-    if (Data[1] == 'A')
-      if (Data[2] == '$')
-        if (Data[3] == '$')
-          if (Data[4] == '$') abort();
+  crashme(Data, Size);
 
   return 0;
 
diff --git a/llvm_mode/LLVMInsTrim.so.cc b/llvm_mode/LLVMInsTrim.so.cc
index 4d8c4719..2ad7f171 100644
--- a/llvm_mode/LLVMInsTrim.so.cc
+++ b/llvm_mode/LLVMInsTrim.so.cc
@@ -256,6 +256,8 @@ struct InsTrim : public ModulePass {
     u64 total_rs = 0;
     u64 total_hs = 0;
 
+    scanForDangerousFunctions(&M);
+
     for (Function &F : M) {
 
       if (debug) {
diff --git a/llvm_mode/afl-llvm-common.cc b/llvm_mode/afl-llvm-common.cc
index 0b50c547..f12bbe31 100644
--- a/llvm_mode/afl-llvm-common.cc
+++ b/llvm_mode/afl-llvm-common.cc
@@ -67,8 +67,11 @@ bool isIgnoreFunction(const llvm::Function *F) {
       "__libc_csu",
       "__asan",
       "__msan",
+      "__cmplog",
+      "__sancov",
       "msan.",
       "LLVMFuzzer",
+      "__decide_deferred",
       "maybe_duplicate_stderr",
       "discard_output",
       "close_stdout",
@@ -253,21 +256,93 @@ void initInstrumentList() {
 
 }
 
+void scanForDangerousFunctions(llvm::Module *M) {
+
+  if (!M) return;
+
+  for (GlobalIFunc &IF : M->ifuncs()) {
+
+    StringRef ifunc_name = IF.getName();
+    Constant *r = IF.getResolver();
+    StringRef r_name = cast<Function>(r->getOperand(0))->getName();
+    if (!be_quiet)
+      fprintf(stderr,
+              "Info: Found an ifunc with name %s that points to resolver "
+              "function %s, we will not instrument this, putting it into the "
+              "block list.\n",
+              ifunc_name.str().c_str(), r_name.str().c_str());
+    denyListFunctions.push_back(r_name.str());
+
+  }
+
+  GlobalVariable *GV = M->getNamedGlobal("llvm.global_ctors");
+  if (GV && !GV->isDeclaration() && !GV->hasLocalLinkage()) {
+
+    ConstantArray *InitList = dyn_cast<ConstantArray>(GV->getInitializer());
+
+    if (InitList) {
+
+      for (unsigned i = 0, e = InitList->getNumOperands(); i != e; ++i) {
+
+        if (ConstantStruct *CS =
+                dyn_cast<ConstantStruct>(InitList->getOperand(i))) {
+
+          if (CS->getNumOperands() >= 2) {
+
+            if (CS->getOperand(1)->isNullValue())
+              break;  // Found a null terminator, stop here.
+
+            ConstantInt *CI = dyn_cast<ConstantInt>(CS->getOperand(0));
+            int          Priority = CI ? CI->getSExtValue() : 0;
+
+            Constant *FP = CS->getOperand(1);
+            if (ConstantExpr *CE = dyn_cast<ConstantExpr>(FP))
+              if (CE->isCast()) FP = CE->getOperand(0);
+            if (Function *F = dyn_cast<Function>(FP)) {
+
+              if (!F->isDeclaration() &&
+                  strncmp(F->getName().str().c_str(), "__afl", 5) != 0) {
+
+                if (!be_quiet)
+                  fprintf(stderr,
+                          "Info: Found constructor function %s with prio "
+                          "%u, we will not instrument this, putting it into a "
+                          "block list.\n",
+                          F->getName().str().c_str(), Priority);
+                denyListFunctions.push_back(F->getName().str());
+
+              }
+
+            }
+
+          }
+
+        }
+
+      }
+
+    }
+
+  }
+
+}
+
 bool isInInstrumentList(llvm::Function *F) {
 
+  bool return_default = true;
+
   // is this a function with code? If it is external we dont instrument it
   // anyway and cant be in the the instrument file list. Or if it is ignored.
   if (!F->size() || isIgnoreFunction(F)) return false;
 
-  // if we do not have a the instrument file list return true
-  if (!allowListFiles.empty() || !allowListFunctions.empty()) {
+  if (!denyListFiles.empty() || !denyListFunctions.empty()) {
 
-    if (!allowListFunctions.empty()) {
+    if (!denyListFunctions.empty()) {
 
       std::string instFunction = F->getName().str();
 
-      for (std::list<std::string>::iterator it = allowListFunctions.begin();
-           it != allowListFunctions.end(); ++it) {
+      for (std::list<std::string>::iterator it = denyListFunctions.begin();
+           it != denyListFunctions.end(); ++it) {
 
         /* We don't check for filename equality here because
          * filenames might actually be full paths. Instead we
@@ -281,10 +356,10 @@ bool isInInstrumentList(llvm::Function *F) {
 
             if (debug)
               SAYF(cMGN "[D] " cRST
-                        "Function %s is in the allow function list, "
-                        "instrumenting ... \n",
+                        "Function %s is in the deny function list, "
+                        "not instrumenting ... \n",
                    instFunction.c_str());
-            return true;
+            return false;
 
           }
 
@@ -294,7 +369,7 @@ bool isInInstrumentList(llvm::Function *F) {
 
     }
 
-    if (!allowListFiles.empty()) {
+    if (!denyListFiles.empty()) {
 
       // let's try to get the filename for the function
       auto                 bb = &F->getEntryBlock();
@@ -328,8 +403,8 @@ bool isInInstrumentList(llvm::Function *F) {
         /* Continue only if we know where we actually are */
         if (!instFilename.str().empty()) {
 
-          for (std::list<std::string>::iterator it = allowListFiles.begin();
-               it != allowListFiles.end(); ++it) {
+          for (std::list<std::string>::iterator it = denyListFiles.begin();
+               it != denyListFiles.end(); ++it) {
 
             /* We don't check for filename equality here because
              * filenames might actually be full paths. Instead we
@@ -344,10 +419,10 @@ bool isInInstrumentList(llvm::Function *F) {
 
                 if (debug)
                   SAYF(cMGN "[D] " cRST
-                            "Function %s is in the allowlist (%s), "
+                            "Function %s is in the denylist (%s), not "
                             "instrumenting ... \n",
                        F->getName().str().c_str(), instFilename.str().c_str());
-                return true;
+                return false;
 
               }
 
@@ -359,8 +434,6 @@ bool isInInstrumentList(llvm::Function *F) {
 
       }
 
-    }
-
 #else
       if (!Loc.isUnknown()) {
 
@@ -373,8 +446,8 @@ bool isInInstrumentList(llvm::Function *F) {
         /* Continue only if we know where we actually are */
         if (!instFilename.str().empty()) {
 
-          for (std::list<std::string>::iterator it = allowListFiles.begin();
-               it != allowListFiles.end(); ++it) {
+          for (std::list<std::string>::iterator it = denyListFiles.begin();
+               it != denyListFiles.end(); ++it) {
 
             /* We don't check for filename equality here because
              * filenames might actually be full paths. Instead we
@@ -387,7 +460,7 @@ bool isInInstrumentList(llvm::Function *F) {
               if (fnmatch(("*" + *it).c_str(), instFilename.str().c_str(), 0) ==
                   0) {
 
-                return true;
+                return false;
 
               }
 
@@ -399,34 +472,34 @@ bool isInInstrumentList(llvm::Function *F) {
 
       }
 
-    }
-
 #endif
-    else {
+      else {
 
-      // we could not find out the location. in this case we say it is not
-      // in the the instrument file list
-      if (!be_quiet)
-        WARNF(
-            "No debug information found for function %s, will not be "
-            "instrumented (recompile with -g -O[1-3]).",
-            F->getName().str().c_str());
-      return false;
+        // we could not find out the location. in this case we say it is not
+        // in the the instrument file list
+        if (!be_quiet)
+          WARNF(
+              "No debug information found for function %s, will be "
+              "instrumented (recompile with -g -O[1-3]).",
+              F->getName().str().c_str());
 
-    }
+      }
 
-    return false;
+    }
 
   }
 
-  if (!denyListFiles.empty() || !denyListFunctions.empty()) {
+  // if we do not have a the instrument file list return true
+  if (!allowListFiles.empty() || !allowListFunctions.empty()) {
 
-    if (!denyListFunctions.empty()) {
+    return_default = false;
+
+    if (!allowListFunctions.empty()) {
 
       std::string instFunction = F->getName().str();
 
-      for (std::list<std::string>::iterator it = denyListFunctions.begin();
-           it != denyListFunctions.end(); ++it) {
+      for (std::list<std::string>::iterator it = allowListFunctions.begin();
+           it != allowListFunctions.end(); ++it) {
 
         /* We don't check for filename equality here because
          * filenames might actually be full paths. Instead we
@@ -440,10 +513,10 @@ bool isInInstrumentList(llvm::Function *F) {
 
             if (debug)
               SAYF(cMGN "[D] " cRST
-                        "Function %s is in the deny function list, "
-                        "not instrumenting ... \n",
+                        "Function %s is in the allow function list, "
+                        "instrumenting ... \n",
                    instFunction.c_str());
-            return false;
+            return true;
 
           }
 
@@ -453,7 +526,7 @@ bool isInInstrumentList(llvm::Function *F) {
 
     }
 
-    if (!denyListFiles.empty()) {
+    if (!allowListFiles.empty()) {
 
       // let's try to get the filename for the function
       auto                 bb = &F->getEntryBlock();
@@ -487,8 +560,8 @@ bool isInInstrumentList(llvm::Function *F) {
         /* Continue only if we know where we actually are */
         if (!instFilename.str().empty()) {
 
-          for (std::list<std::string>::iterator it = denyListFiles.begin();
-               it != denyListFiles.end(); ++it) {
+          for (std::list<std::string>::iterator it = allowListFiles.begin();
+               it != allowListFiles.end(); ++it) {
 
             /* We don't check for filename equality here because
              * filenames might actually be full paths. Instead we
@@ -503,10 +576,10 @@ bool isInInstrumentList(llvm::Function *F) {
 
                 if (debug)
                   SAYF(cMGN "[D] " cRST
-                            "Function %s is in the denylist (%s), not "
+                            "Function %s is in the allowlist (%s), "
                             "instrumenting ... \n",
                        F->getName().str().c_str(), instFilename.str().c_str());
-                return false;
+                return true;
 
               }
 
@@ -518,22 +591,20 @@ bool isInInstrumentList(llvm::Function *F) {
 
       }
 
-    }
-
 #else
       if (!Loc.isUnknown()) {
 
         DILocation cDILoc(Loc.getAsMDNode(F->getContext()));
 
         unsigned int instLine = cDILoc.getLineNumber();
-        StringRef instFilename = cDILoc.getFilename();
+        StringRef    instFilename = cDILoc.getFilename();
 
         (void)instLine;
         /* Continue only if we know where we actually are */
         if (!instFilename.str().empty()) {
 
-          for (std::list<std::string>::iterator it = denyListFiles.begin();
-               it != denyListFiles.end(); ++it) {
+          for (std::list<std::string>::iterator it = allowListFiles.begin();
+               it != allowListFiles.end(); ++it) {
 
             /* We don't check for filename equality here because
              * filenames might actually be full paths. Instead we
@@ -546,7 +617,7 @@ bool isInInstrumentList(llvm::Function *F) {
               if (fnmatch(("*" + *it).c_str(), instFilename.str().c_str(), 0) ==
                   0) {
 
-                return false;
+                return true;
 
               }
 
@@ -558,27 +629,25 @@ bool isInInstrumentList(llvm::Function *F) {
 
       }
 
-    }
-
 #endif
-    else {
+      else {
 
-      // we could not find out the location. in this case we say it is not
-      // in the the instrument file list
-      if (!be_quiet)
-        WARNF(
-            "No debug information found for function %s, will be "
-            "instrumented (recompile with -g -O[1-3]).",
-            F->getName().str().c_str());
-      return true;
+        // we could not find out the location. in this case we say it is not
+        // in the the instrument file list
+        if (!be_quiet)
+          WARNF(
+              "No debug information found for function %s, will not be "
+              "instrumented (recompile with -g -O[1-3]).",
+              F->getName().str().c_str());
+        return false;
 
-    }
+      }
 
-    return true;
+    }
 
   }
 
-  return true;  // not reached
+  return return_default;
 
 }
 
diff --git a/llvm_mode/afl-llvm-common.h b/llvm_mode/afl-llvm-common.h
index 5b96be43..a1561d9c 100644
--- a/llvm_mode/afl-llvm-common.h
+++ b/llvm_mode/afl-llvm-common.h
@@ -37,6 +37,7 @@ bool                   isIgnoreFunction(const llvm::Function *F);
 void                   initInstrumentList();
 bool                   isInInstrumentList(llvm::Function *F);
 unsigned long long int calculateCollisions(uint32_t edges);
+void                   scanForDangerousFunctions(llvm::Module *M);
 
 #ifndef IS_EXTERN
   #define IS_EXTERN
diff --git a/llvm_mode/afl-llvm-lto-instrumentation.so.cc b/llvm_mode/afl-llvm-lto-instrumentation.so.cc
index fd8e48a7..6bd232ab 100644
--- a/llvm_mode/afl-llvm-lto-instrumentation.so.cc
+++ b/llvm_mode/afl-llvm-lto-instrumentation.so.cc
@@ -217,79 +217,9 @@ bool AFLLTOPass::runOnModule(Module &M) {
 
   }
 
-    */
-
-  std::vector<std::string> module_block_list;
-
-  if (map_addr) {
-
-    for (GlobalIFunc &IF : M.ifuncs()) {
-
-      StringRef ifunc_name = IF.getName();
-      Constant *r = IF.getResolver();
-      StringRef r_name = cast<Function>(r->getOperand(0))->getName();
-      if (!be_quiet)
-        fprintf(stderr,
-                "Warning: Found an ifunc with name %s that points to resolver "
-                "function %s, we cannot instrument this, putting it into a "
-                "block list.\n",
-                ifunc_name.str().c_str(), r_name.str().c_str());
-      module_block_list.push_back(r_name.str());
-
-    }
-
-    GlobalVariable *GV = M.getNamedGlobal("llvm.global_ctors");
-    if (GV && !GV->isDeclaration() && !GV->hasLocalLinkage()) {
-
-      ConstantArray *InitList = dyn_cast<ConstantArray>(GV->getInitializer());
-
-      if (InitList) {
-
-        for (unsigned i = 0, e = InitList->getNumOperands(); i != e; ++i) {
-
-          if (ConstantStruct *CS =
-                  dyn_cast<ConstantStruct>(InitList->getOperand(i))) {
-
-            if (CS->getNumOperands() >= 2) {
-
-              if (CS->getOperand(1)->isNullValue())
-                break;  // Found a null terminator, stop here.
-
-              ConstantInt *CI = dyn_cast<ConstantInt>(CS->getOperand(0));
-              int          Priority = CI ? CI->getSExtValue() : 0;
-
-              Constant *FP = CS->getOperand(1);
-              if (ConstantExpr *CE = dyn_cast<ConstantExpr>(FP))
-                if (CE->isCast()) FP = CE->getOperand(0);
-              if (Function *F = dyn_cast<Function>(FP)) {
-
-                if (!F->isDeclaration() &&
-                    strncmp(F->getName().str().c_str(), "__afl", 5) != 0 &&
-                    Priority <= 5) {
-
-                  if (!be_quiet)
-                    fprintf(stderr,
-                            "Warning: Found constructor function %s with prio "
-                            "%u, we cannot instrument this, putting it into a "
-                            "block list.\n",
-                            F->getName().str().c_str(), Priority);
-                  module_block_list.push_back(F->getName().str());
-
-                }
-
-              }
-
-            }
-
-          }
-
-        }
-
-      }
+  */
 
-    }
-
-  }
+  scanForDangerousFunctions(&M);
 
   /* Instrument all the things! */
 
@@ -307,26 +237,6 @@ bool AFLLTOPass::runOnModule(Module &M) {
     if (F.size() < function_minimum_size) continue;
     if (isIgnoreFunction(&F)) continue;
 
-    if (module_block_list.size()) {
-
-      for (auto bname : module_block_list) {
-
-        std::string fname = F.getName().str();
-
-        if (fname.compare(bname) == 0) {
-
-          if (!be_quiet)
-            WARNF(
-                "Skipping instrumentation of dangerous early running function "
-                "%s",
-                fname.c_str());
-
-        }
-
-      }
-
-    }
-
     // the instrument file list check
     AttributeList Attrs = F.getAttributes();
     if (Attrs.hasAttribute(-1, StringRef("skipinstrument"))) {
diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc
index 618abe48..2ea9fd84 100644
--- a/llvm_mode/afl-llvm-pass.so.cc
+++ b/llvm_mode/afl-llvm-pass.so.cc
@@ -297,6 +297,7 @@ bool AFLCoverage::runOnModule(Module &M) {
   /* Instrument all the things! */
 
   int inst_blocks = 0;
+  scanForDangerousFunctions(&M);
 
   for (auto &F : M) {
 
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index a567593e..dacc46a6 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -35,6 +35,8 @@
 #include <string.h>
 #include <assert.h>
 #include <stdint.h>
+#include <stddef.h>
+#include <limits.h>
 #include <errno.h>
 
 #include <sys/mman.h>
@@ -842,9 +844,22 @@ void __afl_manual_init(void) {
 
   static u8 init_done;
 
+  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
+
+    init_done = 1;
+    is_persistent = 0;
+    __afl_sharedmem_fuzzing = 0;
+    if (__afl_area_ptr == NULL) __afl_area_ptr = __afl_area_initial;
+
+    if (getenv("AFL_DEBUG"))
+      fprintf(stderr,
+              "DEBUG: disabled instrumenation because of "
+              "AFL_DISABLE_LLVM_INSTRUMENTATION\n");
+
+  }
+
   if (!init_done) {
 
-    __afl_map_shm();
     __afl_start_forkserver();
     init_done = 1;
 
@@ -852,11 +867,11 @@ void __afl_manual_init(void) {
 
 }
 
-/* Proper initialization routine. */
+/* Initialization of the forkserver - latest possible */
 
-__attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
+__attribute__((constructor())) void __afl_auto_init(void) {
 
-  is_persistent = !!getenv(PERSIST_ENV_VAR);
+  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
 
   if (getenv(DEFER_ENV_VAR)) return;
 
@@ -864,6 +879,18 @@ __attribute__((constructor(CONST_PRIO))) void __afl_auto_init(void) {
 
 }
 
+/* Initialization of the shmem - earliest possible because of LTO fixed mem. */
+
+__attribute__((constructor(0))) void __afl_auto_early(void) {
+
+  if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
+
+  is_persistent = !!getenv(PERSIST_ENV_VAR);
+
+  __afl_map_shm();
+
+}
+
 /* The following stuff deals with supporting -fsanitize-coverage=trace-pc-guard.
    It remains non-operational in the traditional, plugin-backed LLVM mode.
    For more info about 'trace-pc-guard', see llvm_mode/README.md.
@@ -912,7 +939,8 @@ void __sanitizer_cov_trace_pc_guard(uint32_t *guard) {
 
 #else
 
-  __afl_area_ptr[*guard] = __afl_area_ptr[*guard] + 1 + (__afl_area_ptr[*guard] == 255 ? 1 : 0);
+  __afl_area_ptr[*guard] =
+      __afl_area_ptr[*guard] + 1 + (__afl_area_ptr[*guard] == 255 ? 1 : 0);
 
 #endif
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 6819fc8a..8684bcc0 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -58,6 +58,8 @@ static list_t fsrv_list = {.element_prealloc_count = 0};
 
 static void fsrv_exec_child(afl_forkserver_t *fsrv, char **argv) {
 
+  if (fsrv->qemu_mode) setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0);
+
   execv(fsrv->target_path, argv);
 
 }
@@ -122,8 +124,8 @@ void afl_fsrv_init_dup(afl_forkserver_t *fsrv_to, afl_forkserver_t *from) {
   Returns the time passed to read.
   If the wait times out, returns timeout_ms + 1;
   Returns 0 if an error occurred (fd closed, signal, ...); */
-static u32 __attribute__ ((hot)) read_s32_timed(s32 fd, s32 *buf, u32 timeout_ms,
-                          volatile u8 *stop_soon_p) {
+static u32 __attribute__((hot))
+read_s32_timed(s32 fd, s32 *buf, u32 timeout_ms, volatile u8 *stop_soon_p) {
 
   fd_set readfds;
   FD_ZERO(&readfds);
@@ -322,8 +324,9 @@ static void report_error_and_exit(int error) {
    cloning a stopped child. So, we just execute once, and then send commands
    through a pipe. The other part of this logic is in afl-as.h / llvm_mode */
 
-void __attribute__ ((hot)) afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
-                    volatile u8 *stop_soon_p, u8 debug_child_output) {
+void __attribute__((hot))
+afl_fsrv_start(afl_forkserver_t *fsrv, char **argv, volatile u8 *stop_soon_p,
+               u8 debug_child_output) {
 
   int st_pipe[2], ctl_pipe[2];
   s32 status;
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index f6389c06..1b9df624 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -57,7 +57,7 @@ void write_bitmap(afl_state_t *afl) {
    This function is called after every exec() on a fairly large buffer, so
    it needs to be fast. We do this in 32-bit and 64-bit flavors. */
 
-u8 __attribute__ ((hot)) has_new_bits(afl_state_t *afl, u8 *virgin_map) {
+u8 __attribute__((hot)) has_new_bits(afl_state_t *afl, u8 *virgin_map) {
 
 #ifdef WORD_SIZE_64
 
@@ -347,7 +347,7 @@ void init_count_class16(void) {
 
 #ifdef WORD_SIZE_64
 
-void __attribute__ ((hot)) classify_counts(afl_forkserver_t *fsrv) {
+void __attribute__((hot)) classify_counts(afl_forkserver_t *fsrv) {
 
   u64 *mem = (u64 *)fsrv->trace_bits;
 
@@ -376,7 +376,7 @@ void __attribute__ ((hot)) classify_counts(afl_forkserver_t *fsrv) {
 
 #else
 
-void __attribute__ ((hot)) classify_counts(afl_forkserver_t *fsrv) {
+void __attribute__((hot)) classify_counts(afl_forkserver_t *fsrv) {
 
   u32 *mem = (u32 *)fsrv->trace_bits;
 
@@ -534,7 +534,8 @@ static void write_crash_readme(afl_state_t *afl) {
    save or queue the input test case for further analysis if so. Returns 1 if
    entry is saved, 0 otherwise. */
 
-u8 __attribute__ ((hot)) save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
+u8 __attribute__((hot))
+save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
 
   if (unlikely(len == 0)) { return 0; }
 
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 97fcb3c8..d3f823c9 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -38,8 +38,8 @@ u64 time_spent_working = 0;
 /* Execute target application, monitoring for timeouts. Return status
    information. The called program will update afl->fsrv->trace_bits. */
 
-fsrv_run_result_t __attribute__ ((hot)) fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv,
-                                  u32 timeout) {
+fsrv_run_result_t __attribute__((hot))
+fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv, u32 timeout) {
 
 #ifdef PROFILING
   static u64      time_spent_start = 0;
@@ -72,7 +72,8 @@ fsrv_run_result_t __attribute__ ((hot)) fuzz_run_target(afl_state_t *afl, afl_fo
    old file is unlinked and a new one is created. Otherwise, afl->fsrv.out_fd is
    rewound and truncated. */
 
-void __attribute__ ((hot)) write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
+void __attribute__((hot))
+write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
 
 #ifdef _AFL_DOCUMENT_MUTATIONS
   s32  doc_fd;
@@ -858,7 +859,8 @@ abort_trimming:
    error conditions, returning 1 if it's time to bail out. This is
    a helper function for fuzz_one(). */
 
-u8 __attribute__ ((hot)) common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
+u8 __attribute__((hot))
+common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
 
   u8 fault;
 
-- 
cgit 1.4.1


From af14acf2c148b1aef10414d1dd6c929c49abc11e Mon Sep 17 00:00:00 2001
From: root <root@localhost.localdomain>
Date: Fri, 14 Aug 2020 14:35:05 +0200
Subject: Revert "Merge branch 'debug' into dev"

This reverts commit a7537b5511ad767d2240cf2dc6d3e261daa676f9, reversing
changes made to 15e799f7ae666418e75c6a79db833c5316b21f97.
---
 GNUmakefile                          |   3 -
 README.md                            |  33 ----
 afl_driver.cpp                       | 191 -----------------------
 examples/aflpp_driver/aflpp_driver.c |  40 ++---
 include/afl-fuzz.h                   |  36 +----
 include/common.h                     |   1 -
 include/envs.h                       |   1 -
 include/forkserver.h                 |   2 -
 qemu_taint/README.md                 |  42 ------
 qemu_taint/build_qemu_taint.sh       |   7 -
 qemu_taint/clean.sh                  |   3 -
 src/afl-common.c                     | 155 ++++++++++++-------
 src/afl-forkserver.c                 |  17 +--
 src/afl-fuzz-bitmap.c                |  62 +-------
 src/afl-fuzz-init.c                  |  42 +-----
 src/afl-fuzz-one.c                   | 284 ++++-------------------------------
 src/afl-fuzz-queue.c                 | 177 +---------------------
 src/afl-fuzz-run.c                   |  99 ++++--------
 src/afl-fuzz-state.c                 |  30 ++--
 src/afl-fuzz-stats.c                 |   5 +-
 src/afl-fuzz.c                       | 127 ++--------------
 21 files changed, 223 insertions(+), 1134 deletions(-)
 delete mode 100644 afl_driver.cpp
 delete mode 100644 qemu_taint/README.md
 delete mode 100755 qemu_taint/build_qemu_taint.sh
 delete mode 100755 qemu_taint/clean.sh

(limited to 'examples/aflpp_driver')

diff --git a/GNUmakefile b/GNUmakefile
index ae529ece..f9020a90 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -521,7 +521,6 @@ clean:
 	$(MAKE) -C examples/argv_fuzzing clean
 	$(MAKE) -C qemu_mode/unsigaction clean
 	$(MAKE) -C qemu_mode/libcompcov clean
-	test -d qemu_taint/qemu && { cd qemu_taint ; ./clean.sh ; }
 	rm -rf qemu_mode/qemu-3.1.1
 ifeq "$(IN_REPO)" "1"
 	test -d unicorn_mode/unicornafl && $(MAKE) -C unicorn_mode/unicornafl clean || true
@@ -532,7 +531,6 @@ endif
 
 deepclean:	clean
 	rm -rf qemu_mode/qemu-3.1.1.tar.xz
-	rm -rf qemu_taint/qemu
 	rm -rf unicorn_mode/unicornafl
 	git reset --hard >/dev/null 2>&1 || true
 
@@ -590,7 +588,6 @@ install: all $(MANPAGES)
 	install -m 755 $(PROGS) $(SH_PROGS) $${DESTDIR}$(BIN_PATH)
 	rm -f $${DESTDIR}$(BIN_PATH)/afl-as
 	if [ -f afl-qemu-trace ]; then install -m 755 afl-qemu-trace $${DESTDIR}$(BIN_PATH); fi
-	if [ -f afl-qemu-taint ]; then install -m 755 afl-qemu-taint $${DESTDIR}$(BIN_PATH); fi
 	if [ -f afl-gcc-fast ]; then set e; install -m 755 afl-gcc-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-gcc-fast $${DESTDIR}$(BIN_PATH)/afl-g++-fast; install -m 755 afl-gcc-pass.so afl-gcc-rt.o $${DESTDIR}$(HELPER_PATH); fi
 	if [ -f afl-clang-fast ]; then $(MAKE) -C llvm_mode install; fi
 	if [ -f libdislocator.so ]; then set -e; install -m 755 libdislocator.so $${DESTDIR}$(HELPER_PATH); fi
diff --git a/README.md b/README.md
index b3dc5e45..97c0a0d7 100644
--- a/README.md
+++ b/README.md
@@ -1,36 +1,3 @@
-# qemu_taint variant.
-
-UPDATE: **WORKS NOW** **PLEASE TEST** **:-)**
-
-## HOWTO
-
-cd qemu_taint && ./build_qemu_taint.sh
-
-afl-fuzz -A ...
-
-## CAVEATS
-
- * llvm shmem persistent mode does not and can not not work
- * MOpt works but totally ignores the taint information, so disabled here
- * custom mutators? dunno if they work or not. depends on how they work.
- * not tested with qemu_mode
- * there are several debug checks to ensure the data is fine which slows down
-   fuzzing, if the beta experiment runs fine these will be improved and it
-   will result in quite a speed gain.
-
-## THE TAINT
-
-taint can be seen in out/taint/
-
-the id:000 mirrors the out/queue entry, except the content it 0x00 for
-untainted bytes and '!' for tainted bytes.
-If a file has new tainted bytes compared to from which previous entry it
-was created then there is a id:000[...].new file where the new bytes are
-marked '!'.
-
-the mutation switches between fuzzing all tainted bytes in one cycle and
-only new bytes in the other cycle.
-
 # American Fuzzy Lop plus plus (afl++)
 
   <img align="right" src="https://raw.githubusercontent.com/andreafioraldi/AFLplusplus-website/master/static/logo_256x256.png" alt="AFL++ Logo">
diff --git a/afl_driver.cpp b/afl_driver.cpp
deleted file mode 100644
index 7d6a6fd4..00000000
--- a/afl_driver.cpp
+++ /dev/null
@@ -1,191 +0,0 @@
-#include <assert.h>
-#include <errno.h>
-#include <stdarg.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-// Platform detection. Copied from FuzzerInternal.h
-#ifdef __linux__
-#define LIBFUZZER_LINUX 1
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#elif __APPLE__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 1
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#elif __NetBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 1
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 0
-#elif __FreeBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 1
-#define LIBFUZZER_OPENBSD 0
-#elif __OpenBSD__
-#define LIBFUZZER_LINUX 0
-#define LIBFUZZER_APPLE 0
-#define LIBFUZZER_NETBSD 0
-#define LIBFUZZER_FREEBSD 0
-#define LIBFUZZER_OPENBSD 1
-#else
-#error "Support for your platform has not been implemented"
-#endif
-
-// libFuzzer interface is thin, so we don't include any libFuzzer headers.
-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
-__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
-
-// Notify AFL about persistent mode.
-static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
-int __afl_persistent_loop(unsigned int);
-static volatile char suppress_warning2 = AFL_PERSISTENT[0];
-
-// Notify AFL about deferred forkserver.
-static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
-void __afl_manual_init();
-static volatile char suppress_warning1 = AFL_DEFER_FORKSVR[0];
-
-// Input buffer.
-static const size_t kMaxAflInputSize = 1024000;
-static uint8_t AflInputBuf[kMaxAflInputSize];
-
-// Use this optionally defined function to output sanitizer messages even if
-// user asks to close stderr.
-__attribute__((weak)) void __sanitizer_set_report_fd(void *);
-
-// Keep track of where stderr content is being written to, so that
-// dup_and_close_stderr can use the correct one.
-static FILE *output_file = stderr;
-
-// Experimental feature to use afl_driver without AFL's deferred mode.
-// Needs to run before __afl_auto_init.
-__attribute__((constructor(0))) static void __decide_deferred_forkserver(void) {
-  if (getenv("AFL_DRIVER_DONT_DEFER")) {
-    if (unsetenv("__AFL_DEFER_FORKSRV")) {
-      perror("Failed to unset __AFL_DEFER_FORKSRV");
-      abort();
-    }
-  }
-}
-
-// If the user asks us to duplicate stderr, then do it.
-static void maybe_duplicate_stderr() {
-  char *stderr_duplicate_filename =
-      getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
-
-  if (!stderr_duplicate_filename)
-    return;
-
-  FILE *stderr_duplicate_stream =
-      freopen(stderr_duplicate_filename, "a+", stderr);
-
-  if (!stderr_duplicate_stream) {
-    fprintf(
-        stderr,
-        "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
-    abort();
-  }
-  output_file = stderr_duplicate_stream;
-}
-
-// Most of these I/O functions were inspired by/copied from libFuzzer's code.
-static void discard_output(int fd) {
-  FILE *temp = fopen("/dev/null", "w");
-  if (!temp)
-    abort();
-  dup2(fileno(temp), fd);
-  fclose(temp);
-}
-
-static void close_stdout() { discard_output(STDOUT_FILENO); }
-
-// Prevent the targeted code from writing to "stderr" but allow sanitizers and
-// this driver to do so.
-static void dup_and_close_stderr() {
-  int output_fileno = fileno(output_file);
-  int output_fd = dup(output_fileno);
-  if (output_fd <= 0)
-    abort();
-  FILE *new_output_file = fdopen(output_fd, "w");
-  if (!new_output_file)
-    abort();
-  if (!__sanitizer_set_report_fd)
-    return;
-  __sanitizer_set_report_fd(reinterpret_cast<void *>(output_fd));
-  discard_output(output_fileno);
-}
-
-// Close stdout and/or stderr if user asks for it.
-static void maybe_close_fd_mask() {
-  char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
-  if (!fd_mask_str)
-    return;
-  int fd_mask = atoi(fd_mask_str);
-  if (fd_mask & 2)
-    dup_and_close_stderr();
-  if (fd_mask & 1)
-    close_stdout();
-}
-
-// Define LLVMFuzzerMutate to avoid link failures for targets that use it
-// with libFuzzer's LLVMFuzzerCustomMutator.
-size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
-  assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
-  return 0;
-}
-
-int main(int argc, char **argv) {
-  printf(
-      "======================= INFO =========================\n"
-      "This binary is built for AFL-fuzz.\n"
-      "To run the target function on individual input(s) execute this:\n"
-      "  %s < INPUT_FILE\n"
-      "To fuzz with afl-fuzz execute this:\n"
-      "  afl-fuzz [afl-flags] %s [-N]\n"
-      "afl-fuzz will run N iterations before "
-      "re-spawning the process (default: 1000)\n"
-      "======================================================\n",
-          argv[0], argv[0]);
-
-  maybe_duplicate_stderr();
-  maybe_close_fd_mask();
-  if (LLVMFuzzerInitialize)
-    LLVMFuzzerInitialize(&argc, &argv);
-  // Do any other expensive one-time initialization here.
-
-  int N = 100000;
-  if (argc == 2 && argv[1][0] == '-')
-      N = atoi(argv[1] + 1);
-  else if(argc == 2 && (N = atoi(argv[1])) > 0)
-      printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
-
-  assert(N > 0);
-
-  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-    __afl_manual_init();
-
-  // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
-  // on the first execution of LLVMFuzzerTestOneInput is ignored.
-  uint8_t dummy_input[1] = {0};
-  LLVMFuzzerTestOneInput(dummy_input, 1);
-
-  while (__afl_persistent_loop(N)) {
-    ssize_t n_read = read(0, AflInputBuf, kMaxAflInputSize);
-    if (n_read > 0) {
-      LLVMFuzzerTestOneInput(AflInputBuf, n_read);
-    }
-  }
-
-  printf("%s: successfully executed input(s)\n", argv[0]);
-}
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 8e0b554a..b764338e 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -106,7 +106,10 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
   #error "Support for your platform has not been implemented"
 #endif
 
-int                   __afl_sharedmem_fuzzing = 0;
+int                   __afl_sharedmem_fuzzing = 1;
+extern unsigned int * __afl_fuzz_len;
+extern unsigned char *__afl_fuzz_ptr;
+// extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
@@ -272,7 +275,6 @@ int main(int argc, char **argv) {
   // Do any other expensive one-time initialization here.
 
   uint8_t dummy_input[64] = {0};
-  uint8_t buf[1024000];
   memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
   memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
          sizeof(AFL_DEFER_FORKSVR));
@@ -283,24 +285,16 @@ int main(int argc, char **argv) {
     printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
   else if (argc > 1) {
 
-    if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
-
-      __afl_manual_init();
-
-    }
-
+    __afl_sharedmem_fuzzing = 0;
+    __afl_manual_init();
     return ExecuteFilesOnyByOne(argc, argv);
 
   }
 
   assert(N > 0);
 
-  if (!getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) {
-
-    fprintf(stderr, "performing manual init\n");
-    __afl_manual_init();
-
-  }
+  //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
+  __afl_manual_init();
 
   // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
   // on the first execution of LLVMFuzzerTestOneInput is ignored.
@@ -309,13 +303,25 @@ int main(int argc, char **argv) {
   int num_runs = 0;
   while (__afl_persistent_loop(N)) {
 
-    ssize_t r = read(0, buf, sizeof(buf));
+#ifdef _DEBUG
+    fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
+            hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705),
+            *__afl_fuzz_len);
+    fprintf(stderr, "RECV:");
+    for (int i = 0; i < *__afl_fuzz_len; i++)
+      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
+    fprintf(stderr, "\n");
+#endif
+    if (*__afl_fuzz_len) {
+
+      num_runs++;
+      LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
 
-    if (r > 0) { LLVMFuzzerTestOneInput(buf, r); }
+    }
 
   }
 
-  printf("%s: successfully executed input(s)\n", argv[0]);
+  printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
 
 }
 
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index ad7b0cd6..ca7d10fe 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -133,10 +133,8 @@ extern s32
 
 struct queue_entry {
 
-  u8 *                fname;            /* File name for the test case      */
-  u8 *                fname_taint;      /* File name for taint data         */
-  u32                 len;              /* Input length                     */
-  struct queue_entry *prev;             /* previous queue entry, if any     */
+  u8 *fname;                            /* File name for the test case      */
+  u32 len;                              /* Input length                     */
 
   u8 cal_failed,                        /* Calibration failed?              */
       trim_done,                        /* Trimmed?                         */
@@ -150,10 +148,7 @@ struct queue_entry {
       is_ascii;                         /* Is the input just ascii text?    */
 
   u32 bitmap_size,                      /* Number of bits set in bitmap     */
-      fuzz_level,                       /* Number of fuzzing iterations     */
-      taint_bytes_all,                  /* Number of tainted bytes          */
-      taint_bytes_new,                  /* Number of new tainted bytes      */
-      taint_bytes_highest;              /* highest offset in input          */
+      fuzz_level;                       /* Number of fuzzing iterations     */
 
   u64 exec_us,                          /* Execution time (us)              */
       handicap,                         /* Number of queue cycles behind    */
@@ -385,8 +380,6 @@ typedef struct afl_state {
 
   char **argv;                                            /* argv if needed */
 
-  char **argv_taint;                                 /* argv for taint mode */
-
   /* MOpt:
     Lots of globals, but mostly for the status UI and other things where it
     really makes no sense to haul them around as function parameters. */
@@ -438,9 +431,7 @@ typedef struct afl_state {
       *in_bitmap,                       /* Input bitmap                     */
       *file_extension,                  /* File extension                   */
       *orig_cmdline,                    /* Original command line            */
-      *infoexec,                       /* Command to execute on a new crash */
-      *taint_input_file,                /* fuzz_input_one input file        */
-      *taint_src, *taint_map;
+      *infoexec;                       /* Command to execute on a new crash */
 
   u32 hang_tmout;                       /* Timeout used for hang det (ms)   */
 
@@ -451,9 +442,7 @@ typedef struct afl_state {
       custom_only,                      /* Custom mutator only mode         */
       python_only,                      /* Python-only mode                 */
       is_main_node,                     /* if this is the main node         */
-      is_secondary_node,                /* if this is a secondary instance  */
-      taint_needs_splode,               /* explode fuzz input               */
-      taint_mode;
+      is_secondary_node;                /* if this is a secondary instance  */
 
   u32 stats_update_freq;                /* Stats update frequency (execs)   */
 
@@ -514,8 +503,7 @@ typedef struct afl_state {
       useless_at_start,                 /* Number of useless starting paths */
       var_byte_count,                   /* Bitmap bytes with var behavior   */
       current_entry,                    /* Current queue entry ID           */
-      havoc_div,                        /* Cycle count divisor for havoc    */
-      taint_len, taint_count;
+      havoc_div;                        /* Cycle count divisor for havoc    */
 
   u64 total_crashes,                    /* Total number of crashes          */
       unique_crashes,                   /* Crashes with unique signatures   */
@@ -602,9 +590,6 @@ typedef struct afl_state {
   char *           cmplog_binary;
   afl_forkserver_t cmplog_fsrv;     /* cmplog has its own little forkserver */
 
-  /* Taint mode */
-  afl_forkserver_t taint_fsrv;  /* taint mode has its own little forkserver */
-
   /* Custom mutators */
   struct custom_mutator *mutator;
 
@@ -856,8 +841,7 @@ struct custom_mutator {
 
 };
 
-void afl_state_init_1(afl_state_t *, uint32_t map_size);
-void afl_state_init_2(afl_state_t *, uint32_t map_size);
+void afl_state_init(afl_state_t *, uint32_t map_size);
 void afl_state_deinit(afl_state_t *);
 
 /* Set stop_soon flag on all childs, kill all childs */
@@ -903,7 +887,7 @@ void   deinit_py(void *);
 void mark_as_det_done(afl_state_t *, struct queue_entry *);
 void mark_as_variable(afl_state_t *, struct queue_entry *);
 void mark_as_redundant(afl_state_t *, struct queue_entry *, u8);
-void add_to_queue(afl_state_t *, u8 *, u8 *, u32, struct queue_entry *, u8);
+void add_to_queue(afl_state_t *, u8 *, u32, u8);
 void destroy_queue(afl_state_t *);
 void update_bitmap_score(afl_state_t *, struct queue_entry *);
 void cull_queue(afl_state_t *);
@@ -913,9 +897,7 @@ u32  calculate_score(afl_state_t *, struct queue_entry *);
 
 void write_bitmap(afl_state_t *);
 u32  count_bits(afl_state_t *, u8 *);
-u32  count_bits_len(afl_state_t *, u8 *, u32);
 u32  count_bytes(afl_state_t *, u8 *);
-u32  count_bytes_len(afl_state_t *, u8 *, u32);
 u32  count_non_255_bytes(afl_state_t *, u8 *);
 #ifdef WORD_SIZE_64
 void simplify_trace(afl_state_t *, u64 *);
@@ -993,8 +975,6 @@ void   check_if_tty(afl_state_t *);
 void   setup_signal_handlers(void);
 void   save_cmdline(afl_state_t *, u32, char **);
 void   read_foreign_testcases(afl_state_t *, int);
-void   perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
-                         u8 *mem, u32 len);
 
 /* CmpLog */
 
diff --git a/include/common.h b/include/common.h
index c7d57e07..87a7425b 100644
--- a/include/common.h
+++ b/include/common.h
@@ -55,7 +55,6 @@ extern u8 *doc_path;                    /* path to documentation dir        */
    @returns the path, allocating the string */
 
 u8 *find_binary(u8 *fname);
-u8 *find_afl_binary(u8 *fname, u8 *own_loc);
 
 /* Read a bitmap from file fname to memory
    This is for the -B option again. */
diff --git a/include/envs.h b/include/envs.h
index bd97b9cd..96ae91ba 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -123,7 +123,6 @@ static char *afl_environment_variables[] = {
     "AFL_SKIP_BIN_CHECK",
     "AFL_SKIP_CPUFREQ",
     "AFL_SKIP_CRASHES",
-    "AFL_TAINT_INPUT",
     "AFL_TMIN_EXACT",
     "AFL_TMPDIR",
     "AFL_TOKEN_FILE",
diff --git a/include/forkserver.h b/include/forkserver.h
index 59a9f150..0a7390ed 100644
--- a/include/forkserver.h
+++ b/include/forkserver.h
@@ -80,8 +80,6 @@ typedef struct afl_forkserver {
 
   u8 qemu_mode;                         /* if running in qemu mode or not   */
 
-  u8 taint_mode;                        /* if running taint analysis or not */
-
   u32 *shmem_fuzz_len;                  /* length of the fuzzing test case  */
 
   u8 *shmem_fuzz;                       /* allocated memory for fuzzing     */
diff --git a/qemu_taint/README.md b/qemu_taint/README.md
deleted file mode 100644
index 6a7d19af..00000000
--- a/qemu_taint/README.md
+++ /dev/null
@@ -1,42 +0,0 @@
-# qemu_taint
-
-First level taint implementation with qemu for linux user mode
-
-**THIS IS NOT WORKING YET** **WIP**
-
-## What is this for
-
-On new queue entries (newly discovered paths into the target) this tainter
-is run with the new input and the data gathered which bytes in the input
-file are actually touched.
-
-Only touched bytes are then fuzzed by afl-fuzz
-
-## How to build
-
-./build_qemu_taint.sh
-
-## How to use
-
-Add the -A flag to afl-fuzz
-
-## Caveats
-
-For some targets this is amazing and improves fuzzing a lot, but if a target
-copies all input bytes first (e.g. for creating a crc checksum or just to
-safely work with the data), then this is not helping at all.
-
-## Future
-
-Two fuzz modes for a queue entry which will be switched back and forth:
-
-  1. fuzz all touched bytes
-  2. fuzz only bytes that are newly touched (compared to the one this queue
-     entry is based on)
-
-## TODO
-
-  * Direct trim: trim to highest touched byte, that is all we need to do
-  * add 5-25% dummy bytes to the queue entries? (maybe create a 2nd one?)
-  * Disable trim?
-
diff --git a/qemu_taint/build_qemu_taint.sh b/qemu_taint/build_qemu_taint.sh
deleted file mode 100755
index b54c3e04..00000000
--- a/qemu_taint/build_qemu_taint.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/bash
-test -d qemu ||  git clone https://github.com/vanhauser-thc/qemu_taint qemu || exit 1
-cd qemu || exit 1
-test -d .git && { git stash ; git pull ; }
-cp -fv ../../include/config.h ../../include/types.h . || exit 1
-./build.sh || exit 1
-cp -fv ./afl-qemu-taint ../..
diff --git a/qemu_taint/clean.sh b/qemu_taint/clean.sh
deleted file mode 100755
index 10c44cac..00000000
--- a/qemu_taint/clean.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-rm -f afl-qemu-taint qemu/afl-qemu-taint ../afl-qemu-taint
-test -d qemu && { cd qemu ; ./clean.sh ; }
diff --git a/src/afl-common.c b/src/afl-common.c
index cefed8dc..367dec72 100644
--- a/src/afl-common.c
+++ b/src/afl-common.c
@@ -138,73 +138,62 @@ void argv_cpy_free(char **argv) {
 
 }
 
-u8 *find_afl_binary(u8 *fname, u8 *own_loc) {
-
-  u8 *tmp, *rsl, *own_copy, *cp;
-
-  tmp = getenv("AFL_PATH");
-
-  if (tmp) {
-
-    cp = alloc_printf("%s/%s", tmp, fname);
-
-    if (access(cp, X_OK)) { FATAL("Unable to find '%s'", tmp); }
-
-    return cp;
+/* Rewrite argv for QEMU. */
 
-  }
+char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 
-  if (own_loc) {
+  char **new_argv = ck_alloc(sizeof(char *) * (argc + 4));
+  u8 *   tmp, *cp = NULL, *rsl, *own_copy;
 
-    own_copy = ck_strdup(own_loc);
-    rsl = strrchr(own_copy, '/');
+  memcpy(&new_argv[3], &argv[1], (int)(sizeof(char *)) * (argc - 1));
+  new_argv[argc - 1] = NULL;
 
-    if (rsl) {
+  new_argv[2] = *target_path_p;
+  new_argv[1] = "--";
 
-      *rsl = 0;
+  /* Now we need to actually find the QEMU binary to put in argv[0]. */
 
-      cp = alloc_printf("%s/%s", own_copy, fname);
-      ck_free(own_copy);
+  tmp = getenv("AFL_PATH");
 
-      if (!access(cp, X_OK)) { return cp; }
+  if (tmp) {
 
-    } else {
+    cp = alloc_printf("%s/afl-qemu-trace", tmp);
 
-      ck_free(own_copy);
+    if (access(cp, X_OK)) { FATAL("Unable to find '%s'", tmp); }
 
-    }
+    *target_path_p = new_argv[0] = cp;
+    return new_argv;
 
   }
 
-  cp = alloc_printf("%s/%s", BIN_PATH, fname);
-  if (!access(cp, X_OK)) { return cp; }
+  own_copy = ck_strdup(own_loc);
+  rsl = strrchr(own_copy, '/');
 
-  ck_free(cp);
+  if (rsl) {
 
-  return NULL;
+    *rsl = 0;
 
-}
+    cp = alloc_printf("%s/afl-qemu-trace", own_copy);
+    ck_free(own_copy);
 
-/* Rewrite argv for QEMU. */
+    if (!access(cp, X_OK)) {
 
-char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
+      *target_path_p = new_argv[0] = cp;
+      return new_argv;
 
-  char **new_argv = ck_alloc(sizeof(char *) * (argc + 4));
-  u8 *   cp = NULL;
+    }
 
-  memcpy(&new_argv[3], &argv[1], (int)(sizeof(char *)) * (argc - 1));
-  new_argv[argc - 1] = NULL;
+  } else {
 
-  new_argv[2] = *target_path_p;
-  new_argv[1] = "--";
+    ck_free(own_copy);
 
-  /* Now we need to actually find the QEMU binary to put in argv[0]. */
+  }
 
-  cp = find_afl_binary("afl-qemu-trace", own_loc);
+  if (!access(BIN_PATH "/afl-qemu-trace", X_OK)) {
 
-  if (cp) {
+    if (cp) { ck_free(cp); }
+    *target_path_p = new_argv[0] = ck_strdup(BIN_PATH "/afl-qemu-trace");
 
-    *target_path_p = new_argv[0] = cp;
     return new_argv;
 
   }
@@ -236,7 +225,7 @@ char **get_qemu_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 
   char **new_argv = ck_alloc(sizeof(char *) * (argc + 3));
-  u8 *   cp = NULL;
+  u8 *   tmp, *cp = NULL, *rsl, *own_copy;
 
   memcpy(&new_argv[2], &argv[1], (int)(sizeof(char *)) * (argc - 1));
   new_argv[argc - 1] = NULL;
@@ -245,16 +234,66 @@ char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
 
   /* Now we need to actually find the QEMU binary to put in argv[0]. */
 
-  cp = find_afl_binary("afl-qemu-trace", own_loc);
+  tmp = getenv("AFL_PATH");
+
+  if (tmp) {
+
+    cp = alloc_printf("%s/afl-qemu-trace", tmp);
 
-  if (cp) {
+    if (access(cp, X_OK)) { FATAL("Unable to find '%s'", tmp); }
 
     ck_free(cp);
-    cp = find_afl_binary("afl-wine-trace", own_loc);
 
-    if (cp) {
+    cp = alloc_printf("%s/afl-wine-trace", tmp);
 
-      *target_path_p = new_argv[0] = cp;
+    if (access(cp, X_OK)) { FATAL("Unable to find '%s'", tmp); }
+
+    *target_path_p = new_argv[0] = cp;
+    return new_argv;
+
+  }
+
+  own_copy = ck_strdup(own_loc);
+  rsl = strrchr(own_copy, '/');
+
+  if (rsl) {
+
+    *rsl = 0;
+
+    cp = alloc_printf("%s/afl-qemu-trace", own_copy);
+
+    if (cp && !access(cp, X_OK)) {
+
+      ck_free(cp);
+
+      cp = alloc_printf("%s/afl-wine-trace", own_copy);
+
+      if (!access(cp, X_OK)) {
+
+        *target_path_p = new_argv[0] = cp;
+        return new_argv;
+
+      }
+
+    }
+
+    ck_free(own_copy);
+
+  } else {
+
+    ck_free(own_copy);
+
+  }
+
+  u8 *ncp = BIN_PATH "/afl-qemu-trace";
+
+  if (!access(ncp, X_OK)) {
+
+    ncp = BIN_PATH "/afl-wine-trace";
+
+    if (!access(ncp, X_OK)) {
+
+      *target_path_p = new_argv[0] = ck_strdup(ncp);
       return new_argv;
 
     }
@@ -262,21 +301,25 @@ char **get_wine_argv(u8 *own_loc, u8 **target_path_p, int argc, char **argv) {
   }
 
   SAYF("\n" cLRD "[-] " cRST
-       "Oops, unable to find the afl-qemu-trace and afl-wine-trace binaries.\n"
-       "The afl-qemu-trace binary must be built separately by following the "
-       "instructions\n"
-       "in qemu_mode/README.md. If you already have the binary installed, you "
-       "may need\n"
-       "to specify the location via AFL_PATH in the environment.\n\n"
+       "Oops, unable to find the '%s' binary. The binary must be "
+       "built\n"
+       "    separately by following the instructions in "
+       "qemu_mode/README.md. "
+       "If you\n"
+       "    already have the binary installed, you may need to specify "
+       "AFL_PATH in the\n"
+       "    environment.\n\n"
+
        "    Of course, even without QEMU, afl-fuzz can still work with "
        "binaries that are\n"
        "    instrumented at compile time with afl-gcc. It is also possible to "
        "use it as a\n"
        "    traditional non-instrumented fuzzer by specifying '-n' in the "
        "command "
-       "line.\n");
+       "line.\n",
+       ncp);
 
-  FATAL("Failed to locate 'afl-qemu-trace' and 'afl-wine-trace'.");
+  FATAL("Failed to locate '%s'.", ncp);
 
 }
 
diff --git a/src/afl-forkserver.c b/src/afl-forkserver.c
index 173cc70f..25983f26 100644
--- a/src/afl-forkserver.c
+++ b/src/afl-forkserver.c
@@ -498,21 +498,11 @@ void afl_fsrv_start(afl_forkserver_t *fsrv, char **argv,
 
   char pid_buf[16];
   sprintf(pid_buf, "%d", fsrv->fsrv_pid);
-
-  if (fsrv->taint_mode) {
-
-    setenv("__AFL_TARGET_PID3", pid_buf, 1);
-
-  } else if (fsrv->cmplog_binary) {
-
+  if (fsrv->cmplog_binary)
     setenv("__AFL_TARGET_PID2", pid_buf, 1);
-
-  } else {
-
+  else
     setenv("__AFL_TARGET_PID1", pid_buf, 1);
 
-  }
-
   /* Close the unneeded endpoints. */
 
   close(ctl_pipe[0]);
@@ -947,7 +937,7 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
   } else {
 
-    s32 fd;
+    s32 fd = fsrv->out_fd;
 
     if (fsrv->out_file) {
 
@@ -966,7 +956,6 @@ void afl_fsrv_write_to_testcase(afl_forkserver_t *fsrv, u8 *buf, size_t len) {
 
     } else {
 
-      fd = fsrv->out_fd;
       lseek(fd, 0, SEEK_SET);
 
     }
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index db57061d..1b9df624 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -177,40 +177,6 @@ u32 count_bits(afl_state_t *afl, u8 *mem) {
 
 }
 
-u32 count_bits_len(afl_state_t *afl, u8 *mem, u32 len) {
-
-  u32 *ptr = (u32 *)mem;
-  u32  i = (len >> 2);
-  u32  ret = 0;
-
-  (void)(afl);
-
-  if (len % 4) i++;
-
-  while (i--) {
-
-    u32 v = *(ptr++);
-
-    /* This gets called on the inverse, virgin bitmap; optimize for sparse
-       data. */
-
-    if (v == 0xffffffff) {
-
-      ret += 32;
-      continue;
-
-    }
-
-    v -= ((v >> 1) & 0x55555555);
-    v = (v & 0x33333333) + ((v >> 2) & 0x33333333);
-    ret += (((v + (v >> 4)) & 0xF0F0F0F) * 0x01010101) >> 24;
-
-  }
-
-  return ret;
-
-}
-
 /* Count the number of bytes set in the bitmap. Called fairly sporadically,
    mostly to update the status screen or calibrate and examine confirmed
    new paths. */
@@ -237,32 +203,6 @@ u32 count_bytes(afl_state_t *afl, u8 *mem) {
 
 }
 
-u32 count_bytes_len(afl_state_t *afl, u8 *mem, u32 len) {
-
-  u32 *ptr = (u32 *)mem;
-  u32  i = (len >> 2);
-  u32  ret = 0;
-
-  (void)(afl);
-
-  if (len % 4) i++;
-
-  while (i--) {
-
-    u32 v = *(ptr++);
-
-    if (!v) { continue; }
-    if (v & 0x000000ff) { ++ret; }
-    if (v & 0x0000ff00) { ++ret; }
-    if (v & 0x00ff0000) { ++ret; }
-    if (v & 0xff000000) { ++ret; }
-
-  }
-
-  return ret;
-
-}
-
 /* Count the number of non-255 bytes set in the bitmap. Used strictly for the
    status screen, several calls per second or so. */
 
@@ -655,7 +595,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
 
 #endif                                                    /* ^!SIMPLE_FILES */
 
-    add_to_queue(afl, queue_fn, mem, len, afl->queue_top, 0);
+    add_to_queue(afl, queue_fn, len, 0);
 
     if (hnb == 2) {
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 359eef85..350a8599 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -712,7 +712,7 @@ void read_testcases(afl_state_t *afl) {
 
     if (!access(dfn, F_OK)) { passed_det = 1; }
 
-    add_to_queue(afl, fn2, NULL, st.st_size, NULL, passed_det);
+    add_to_queue(afl, fn2, st.st_size, passed_det);
 
   }
 
@@ -771,13 +771,9 @@ void perform_dry_run(afl_state_t *afl) {
     close(fd);
 
     res = calibrate_case(afl, q, use_mem, 0, 1);
+    ck_free(use_mem);
 
-    if (afl->stop_soon) {
-
-      ck_free(use_mem);
-      return;
-
-    }
+    if (afl->stop_soon) { return; }
 
     if (res == afl->crash_mode || res == FSRV_RUN_NOBITS) {
 
@@ -964,10 +960,6 @@ void perform_dry_run(afl_state_t *afl) {
 
     }
 
-    /* perform taint gathering on the input seed */
-    if (afl->taint_mode) perform_taint_run(afl, q, q->fname, use_mem, q->len);
-    ck_free(use_mem);
-
     q = q->next;
 
   }
@@ -1446,10 +1438,6 @@ static void handle_existing_out_dir(afl_state_t *afl) {
 
     u8 *orig_q = alloc_printf("%s/queue", afl->out_dir);
 
-    u8 *fnt = alloc_printf("%s/taint", afl->out_dir);
-    mkdir(fnt, 0755);  // ignore errors
-    ck_free(fnt);
-
     afl->in_dir = alloc_printf("%s/_resume", afl->out_dir);
 
     rename(orig_q, afl->in_dir);                           /* Ignore errors */
@@ -1506,20 +1494,6 @@ static void handle_existing_out_dir(afl_state_t *afl) {
   if (delete_files(fn, CASE_PREFIX)) { goto dir_cleanup_failed; }
   ck_free(fn);
 
-  if (afl->taint_mode) {
-
-    fn = alloc_printf("%s/taint", afl->out_dir);
-    mkdir(fn, 0755);  // ignore errors
-
-    u8 *fn2 = alloc_printf("%s/taint/.input", afl->out_dir);
-    unlink(fn2);  // ignore errors
-    ck_free(fn2);
-
-    if (delete_files(fn, CASE_PREFIX)) { goto dir_cleanup_failed; }
-    ck_free(fn);
-
-  }
-
   /* All right, let's do <afl->out_dir>/crashes/id:* and
    * <afl->out_dir>/hangs/id:*. */
 
@@ -1747,16 +1721,6 @@ void setup_dirs_fds(afl_state_t *afl) {
   if (mkdir(tmp, 0700)) { PFATAL("Unable to create '%s'", tmp); }
   ck_free(tmp);
 
-  /* Taint directory if taint_mode. */
-
-  if (afl->taint_mode) {
-
-    tmp = alloc_printf("%s/taint", afl->out_dir);
-    if (mkdir(tmp, 0700)) { PFATAL("Unable to create '%s'", tmp); }
-    ck_free(tmp);
-
-  }
-
   /* Top-level directory for queue metadata used for session
      resume and related tasks. */
 
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index 6d52b2b4..57b53c9f 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -458,171 +458,28 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   }
 
-  u32 tmp_val = 0;
-
-  if (unlikely(afl->taint_mode)) {
-
-    tmp_val = afl->queue_cycle % 2;  // starts with 1
-    ret_val = 0;
-
-    if (unlikely(afl->queue_cur->cal_failed && !tmp_val)) goto abandon_entry;
-    if (unlikely(!afl->skip_deterministic && !afl->queue_cur->passed_det &&
-                 !tmp_val))
-      goto abandon_entry;
-    if ((!afl->queue_cur->taint_bytes_new ||
-         afl->queue_cur->taint_bytes_new == afl->queue_cur->len) &&
-        !tmp_val)
-      goto abandon_entry;
-
-    ret_val = 1;
-
-    s32 dst = 0, i;
-    temp_len = len = afl->queue_cur->len;
-    s32 j = 0;  // tmp
-
-    fd = open(afl->queue_cur->fname, O_RDONLY);
-    afl->taint_src = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-    if (fd < 0 || (ssize_t)afl->taint_src == -1)
-      FATAL("unable to open '%s'", afl->queue_cur->fname);
-    close(fd);
-    afl->taint_needs_splode = 1;
-
-    switch (tmp_val) {
-
-      case 1:  // fuzz only tainted bytes
-
-        // special case: all or nothing tainted. in this case we act like
-        // nothing is special. this is not the taint you are looking for ...
-        if (!afl->queue_cur->taint_bytes_all ||
-            afl->queue_cur->taint_bytes_all == (u32)len) {
-
-          orig_in = in_buf = afl->taint_src;
-          afl->taint_needs_splode = 0;
-          break;
-
-        }
-
-        fd = open(afl->taint_input_file, O_RDONLY);
-        temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_all;
-        orig_in = in_buf =
-            mmap(0, len >= MAX_FILE - 65536 ? MAX_FILE : len + 65536,
-                 PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (ssize_t)in_buf == -1)
-          FATAL("unable to open '%s'", afl->taint_input_file);
-        close(fd);
-
-        fd = open(afl->queue_cur->fname_taint, O_RDONLY);
-        afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
-                              MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (ssize_t)in_buf == -1)
-          FATAL("unable to open '%s'", afl->queue_cur->fname_taint);
-        close(fd);
-
-        for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
-          if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
-
-        // FIXME DEBUG TODO XXX
-        for (i = 0; i < (s32)afl->queue_cur->len; i++) {
-
-          switch (afl->taint_map[i]) {
-
-            case 0x0:
-              break;
-            case '!':
-              j++;
-              break;
-            default:
-              FATAL(
-                  "invalid taint map entry byte 0x%02x at position %d "
-                  "(passed_det:%d)\n",
-                  afl->taint_map[i], i, afl->queue_cur->passed_det);
-
-          }
-
-        }
-
-        if (j != len)
-          FATAL("different taint values in map vs in queue (%d != %d)", j, len);
-
-        break;
-
-      case 0:  // fuzz only newly tainted bytes
-
-        fd = open(afl->taint_input_file, O_RDONLY);
-        temp_len = len = afl->taint_len = afl->queue_cur->taint_bytes_new;
-        orig_in = in_buf =
-            mmap(0, len >= MAX_FILE - 65536 ? MAX_FILE : len + 65536,
-                 PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (ssize_t)in_buf == -1)
-          FATAL("unable to open '%s'", afl->taint_input_file);
-        close(fd);
-
-        u8 *fn = alloc_printf("%s.new", afl->queue_cur->fname_taint);
-        if (!fn) FATAL("OOM");
-        fd = open(fn, O_RDWR);
-        afl->taint_map = mmap(0, afl->queue_cur->len, PROT_READ | PROT_WRITE,
-                              MAP_PRIVATE, fd, 0);
-        if (fd < 0 || (ssize_t)in_buf == -1)
-          FATAL("unable to open '%s' for %u bytes", fn, len);
-        close(fd);
-        ck_free(fn);
-
-        for (i = 0; i < (s32)afl->queue_cur->len && dst < len; i++)
-          if (afl->taint_map[i]) in_buf[dst++] = afl->taint_src[i];
-
-        // FIXME DEBUG TODO XXX
-        for (i = 0; i < (s32)afl->queue_cur->len; i++) {
-
-          switch (afl->taint_map[i]) {
-
-            case 0x0:
-              break;
-            case '!':
-              j++;
-              break;
-            default:
-              FATAL(
-                  "invalid taint map entry byte 0x%02x at position %d "
-                  "(passed_det:%d)\n",
-                  afl->taint_map[i], i, afl->queue_cur->passed_det);
-
-          }
-
-        }
-
-        if (j != len)
-          FATAL("different taint values in map vs in queue (%d != %d)", j, len);
-
-        break;
-
-    }
-
-  } else {
-
-    /* Map the test case into memory. */
-
-    fd = open(afl->queue_cur->fname, O_RDONLY);
+  /* Map the test case into memory. */
 
-    if (unlikely(fd < 0)) {
+  fd = open(afl->queue_cur->fname, O_RDONLY);
 
-      PFATAL("Unable to open '%s'", afl->queue_cur->fname);
+  if (unlikely(fd < 0)) {
 
-    }
+    PFATAL("Unable to open '%s'", afl->queue_cur->fname);
 
-    len = afl->queue_cur->len;
+  }
 
-    orig_in = in_buf = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+  len = afl->queue_cur->len;
 
-    if (unlikely(orig_in == MAP_FAILED)) {
+  orig_in = in_buf = mmap(0, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
 
-      PFATAL("Unable to mmap '%s' with len %d", afl->queue_cur->fname, len);
+  if (unlikely(orig_in == MAP_FAILED)) {
 
-    }
-
-    close(fd);
+    PFATAL("Unable to mmap '%s' with len %d", afl->queue_cur->fname, len);
 
   }
 
+  close(fd);
+
   /* We could mmap() out_buf as MAP_PRIVATE, but we end up clobbering every
      single byte anyway, so it wouldn't give us any performance or memory usage
      benefits. */
@@ -645,12 +502,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
       afl->queue_cur->exec_cksum = 0;
 
-      if (unlikely(afl->taint_needs_splode))
-        res = calibrate_case(afl, afl->queue_cur, afl->taint_src,
-                             afl->queue_cycle - 1, 0);
-      else
-        res = calibrate_case(afl, afl->queue_cur, in_buf, afl->queue_cycle - 1,
-                             0);
+      res =
+          calibrate_case(afl, afl->queue_cur, in_buf, afl->queue_cycle - 1, 0);
 
       if (unlikely(res == FSRV_RUN_ERROR)) {
 
@@ -673,8 +526,8 @@ u8 fuzz_one_original(afl_state_t *afl) {
    * TRIMMING *
    ************/
 
-  if (unlikely(!afl->non_instrumented_mode && !afl->queue_cur->trim_done &&
-               !afl->disable_trim && !afl->taint_needs_splode)) {
+  if (!afl->non_instrumented_mode && !afl->queue_cur->trim_done &&
+      !afl->disable_trim) {
 
     u8 res = trim_case(afl, afl->queue_cur, in_buf);
 
@@ -711,26 +564,13 @@ u8 fuzz_one_original(afl_state_t *afl) {
 
   if (afl->shm.cmplog_mode && !afl->queue_cur->fully_colorized) {
 
-    int res;
-    if (unlikely(afl->taint_needs_splode)) {
-
-      len = afl->queue_cur->len;
-      memcpy(out_buf, afl->taint_src, len);
-      res = input_to_state_stage(afl, afl->taint_src, out_buf, len,
-                                 afl->queue_cur->exec_cksum);
-      // just abandon as success
-      ret_val = 0;
-      res = 1;
-
-    } else {
+    if (input_to_state_stage(afl, in_buf, out_buf, len,
+                             afl->queue_cur->exec_cksum)) {
 
-      res = input_to_state_stage(afl, in_buf, out_buf, len,
-                                 afl->queue_cur->exec_cksum);
+      goto abandon_entry;
 
     }
 
-    if (unlikely(res)) { goto abandon_entry; }
-
   }
 
   /* Skip right away if -d is given, if it has not been chosen sufficiently
@@ -2293,18 +2133,8 @@ havoc_stage:
 
             if (actually_clone) {
 
-              if (unlikely(afl->taint_needs_splode)) {
-
-                clone_len = choose_block_len(afl, afl->queue_cur->len);
-                clone_from =
-                    rand_below(afl, afl->queue_cur->len - clone_len + 1);
-
-              } else {
-
-                clone_len = choose_block_len(afl, temp_len);
-                clone_from = rand_below(afl, temp_len - clone_len + 1);
-
-              }
+              clone_len = choose_block_len(afl, temp_len);
+              clone_from = rand_below(afl, temp_len - clone_len + 1);
 
             } else {
 
@@ -2326,11 +2156,7 @@ havoc_stage:
 
             if (actually_clone) {
 
-              if (unlikely(afl->taint_needs_splode))
-                memcpy(new_buf + clone_to, afl->taint_src + clone_from,
-                       clone_len);
-              else
-                memcpy(new_buf + clone_to, out_buf + clone_from, clone_len);
+              memcpy(new_buf + clone_to, out_buf + clone_from, clone_len);
 
             } else {
 
@@ -2342,7 +2168,7 @@ havoc_stage:
             }
 
             /* Tail */
-            memmove(new_buf + clone_to + clone_len, out_buf + clone_to,
+            memcpy(new_buf + clone_to + clone_len, out_buf + clone_to,
                    temp_len - clone_to);
 
             swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
@@ -2363,49 +2189,16 @@ havoc_stage:
 
           if (temp_len < 2) { break; }
 
-          if (unlikely(afl->taint_needs_splode)) {
-
-            copy_len = choose_block_len(afl, afl->queue_cur->len - 1);
-            copy_from = rand_below(afl, afl->queue_cur->len - copy_len + 1);
-            copy_to = rand_below(afl, temp_len + 1);
-
-          } else {
+          copy_len = choose_block_len(afl, temp_len - 1);
 
-            copy_len = choose_block_len(afl, temp_len - 1);
-            copy_from = rand_below(afl, temp_len - copy_len + 1);
-            copy_to = rand_below(afl, temp_len - copy_len + 1);
-
-          }
+          copy_from = rand_below(afl, temp_len - copy_len + 1);
+          copy_to = rand_below(afl, temp_len - copy_len + 1);
 
           if (rand_below(afl, 4)) {
 
             if (copy_from != copy_to) {
 
-              if (unlikely(afl->taint_needs_splode)) {
-
-                if (temp_len >= (s32)(copy_to + copy_len)) {
-
-                  memcpy(out_buf + copy_to, afl->taint_src + copy_from,
-                         copy_len);
-
-                } else {
-
-                  u8 *new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
-                                              copy_to + copy_len);
-                  memcpy(new_buf, in_buf, copy_to);
-                  memcpy(new_buf + copy_to, afl->taint_src + copy_from,
-                         copy_len);
-                  swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
-                  out_buf = new_buf;
-                  temp_len = copy_to + copy_len;
-
-                }
-
-              } else {
-
-                memmove(out_buf + copy_to, out_buf + copy_from, copy_len);
-
-              }
+              memmove(out_buf + copy_to, out_buf + copy_from, copy_len);
 
             }
 
@@ -2671,17 +2464,10 @@ havoc_stage:
      splices them together at some offset, then relies on the havoc
      code to mutate that blob. */
 
-  u32 saved_len;
-
-  if (unlikely(afl->taint_needs_splode))
-    saved_len = afl->taint_len;
-  else
-    saved_len = afl->queue_cur->len;
-
 retry_splicing:
 
   if (afl->use_splicing && splice_cycle++ < SPLICE_CYCLES &&
-      afl->queued_paths > 1 && saved_len > 1) {
+      afl->queued_paths > 1 && afl->queue_cur->len > 1) {
 
     struct queue_entry *target;
     u32                 tid, split_at;
@@ -2694,7 +2480,7 @@ retry_splicing:
     if (in_buf != orig_in) {
 
       in_buf = orig_in;
-      len = saved_len;
+      len = afl->queue_cur->len;
 
     }
 
@@ -2765,8 +2551,6 @@ retry_splicing:
 
   ret_val = 0;
 
-  goto abandon_entry;
-
 /* we are through with this queue entry - for this iteration */
 abandon_entry:
 
@@ -2786,17 +2570,7 @@ abandon_entry:
 
   ++afl->queue_cur->fuzz_level;
 
-  if (unlikely(afl->taint_needs_splode)) {
-
-    munmap(afl->taint_src, afl->queue_cur->len);
-    munmap(orig_in, afl->taint_len);
-    munmap(afl->taint_map, afl->queue_cur->len);
-
-  } else {
-
-    munmap(orig_in, afl->queue_cur->len);
-
-  }
+  munmap(orig_in, afl->queue_cur->len);
 
   return ret_val;
 
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 43794018..f35df914 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -103,169 +103,6 @@ void mark_as_redundant(afl_state_t *afl, struct queue_entry *q, u8 state) {
 
 }
 
-void perform_taint_run(afl_state_t *afl, struct queue_entry *q, u8 *fname,
-                       u8 *mem, u32 len) {
-
-  u8 *                ptr, *fn = fname;
-  u32                 bytes = 0, plen = len;
-  struct queue_entry *prev = q->prev;
-
-  if (plen % 4) plen = plen + 4 - (len % 4);
-
-  if ((ptr = strrchr(fname, '/')) != NULL) fn = ptr + 1;
-  q->fname_taint = alloc_printf("%s/taint/%s", afl->out_dir, fn);
-
-  if (q->fname_taint) {
-
-    u8 *save = ck_maybe_grow(BUF_PARAMS(out_scratch), afl->fsrv.map_size);
-    memcpy(save, afl->taint_fsrv.trace_bits, afl->fsrv.map_size);
-
-    afl->taint_fsrv.map_size = plen;  // speed :)
-    write_to_testcase(afl, mem, len);
-    if (afl_fsrv_run_target(&afl->taint_fsrv, afl->fsrv.exec_tmout * 4,
-                            &afl->stop_soon) == 0) {
-
-      bytes = q->taint_bytes_all =
-          count_bytes_len(afl, afl->taint_fsrv.trace_bits, plen);
-      if (afl->debug)
-        fprintf(stderr, "Debug: tainted %u out of %u bytes\n", bytes, len);
-
-      /* DEBUG FIXME TODO XXX */
-      u32 i;
-      for (i = 0; i < len; i++) {
-
-        if (afl->taint_fsrv.trace_bits[i] &&
-            afl->taint_fsrv.trace_bits[i] != '!')
-          FATAL("invalid taint map value %02x at pos %d",
-                afl->taint_fsrv.trace_bits[i], i);
-
-      }
-
-      if (len < plen)
-        for (i = len; i < plen; i++) {
-
-          if (afl->taint_fsrv.trace_bits[i])
-            FATAL("invalid taint map value %02x in padding at pos %d",
-                  afl->taint_fsrv.trace_bits[i], i);
-
-        }
-
-    }
-
-    // if all is tainted we do not need to write taint data away
-    if (bytes && bytes < len) {
-
-      // save the bytes away
-      int w = open(q->fname_taint, O_CREAT | O_WRONLY, 0644);
-      if (w >= 0) {
-
-        ck_write(w, afl->taint_fsrv.trace_bits, len, q->fname_taint);
-        close(w);
-
-        // find the highest tainted offset in the input (for trim opt)
-        s32 i = len;
-        while (i > 0 && !afl->taint_fsrv.trace_bits[i - 1])
-          i--;
-        q->taint_bytes_highest = i;
-
-        afl->taint_count++;
-
-      } else {
-
-        FATAL("could not create %s", q->fname_taint);
-        q->taint_bytes_all = bytes = 0;
-
-      }
-
-      // it is possible that there is no main taint file - if the whole file
-      // is tainted - but a .new taint file if it had new tainted bytes
-
-      // check if there is a previous queue entry and if it had taint
-      if (bytes && prev && prev->taint_bytes_all &&
-          prev->taint_bytes_all < prev->len) {
-
-        // check if there are new bytes in the taint vs the previous
-        int r = open(prev->fname_taint, O_RDONLY);
-
-        if (r >= 0) {
-
-          u8 *bufr = mmap(0, prev->len, PROT_READ, MAP_PRIVATE, r, 0);
-
-          if ((ssize_t)bufr != -1) {
-
-            u32 i;
-            u8 *tmp = ck_maybe_grow(BUF_PARAMS(in_scratch), plen);
-            memset(tmp, 0, plen);
-
-            for (i = 0; i < len; i++)
-              if (afl->taint_fsrv.trace_bits[i] && (i >= prev->len || !bufr[i]))
-                tmp[i] = '!';
-
-            q->taint_bytes_new = count_bytes_len(afl, tmp, plen);
-
-            if (afl->debug)
-              fprintf(stderr, "Debug: %u new taint out of %u bytes\n", bytes,
-                      len);
-
-            if (q->taint_bytes_new) {
-
-              u8 *fnw = alloc_printf("%s.new", q->fname_taint);
-              if (fnw) {
-
-                int w = open(fnw, O_CREAT | O_WRONLY, 0644);
-                if (w >= 0) {
-
-                  ck_write(w, tmp, plen, fnw);
-                  close(w);
-
-                } else {
-
-                  FATAL("count not create '%s'", fnw);
-                  q->taint_bytes_new = 0;
-
-                }
-
-                ck_free(fnw);
-
-              } else {
-
-                q->taint_bytes_new = 0;
-
-              }
-
-            }
-
-            munmap(bufr, prev->len);
-
-          }
-
-          close(r);
-
-        }
-
-      }
-
-    }
-
-    memcpy(afl->taint_fsrv.trace_bits, save, afl->fsrv.map_size);
-
-  }
-
-  if (!bytes) {
-
-    q->taint_bytes_highest = q->taint_bytes_all = q->taint_bytes_new = 0;
-
-    if (q->fname_taint) {
-
-      ck_free(q->fname_taint);
-      q->fname_taint = NULL;
-
-    }
-
-  }
-
-}
-
 /* check if ascii or UTF-8 */
 
 static u8 check_if_text(struct queue_entry *q) {
@@ -375,12 +212,10 @@ static u8 check_if_text(struct queue_entry *q) {
 
 /* Append new test case to the queue. */
 
-void add_to_queue(afl_state_t *afl, u8 *fname, u8 *mem, u32 len,
-                  struct queue_entry *prev_q, u8 passed_det) {
+void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
 
   struct queue_entry *q = ck_alloc(sizeof(struct queue_entry));
 
-  q->prev = prev_q;
   q->fname = fname;
   q->len = len;
   q->depth = afl->cur_depth + 1;
@@ -419,13 +254,6 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u8 *mem, u32 len,
 
   afl->last_path_time = get_cur_time();
 
-  /* trigger the tain gathering if this is not a dry run */
-  if (afl->taint_mode && mem) { perform_taint_run(afl, q, fname, mem, len); }
-
-  /* only redqueen currently uses is_ascii */
-  if (afl->shm.cmplog_mode) q->is_ascii = check_if_text(q);
-
-  /* run custom mutators afl_custom_queue_new_entry() */
   if (afl->custom_mutators_count) {
 
     LIST_FOREACH(&afl->custom_mutator_list, struct custom_mutator, {
@@ -445,6 +273,9 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u8 *mem, u32 len,
 
   }
 
+  /* only redqueen currently uses is_ascii */
+  if (afl->shm.cmplog_mode) q->is_ascii = check_if_text(q);
+
 }
 
 /* Destroy the entire queue. */
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 5381723d..d3f823c9 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -350,9 +350,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
 
   }
 
-  if (unlikely(afl->taint_mode))
-    q->exec_cksum = 0;
-  else if (q->exec_cksum) {
+  if (q->exec_cksum) {
 
     memcpy(afl->first_trace, afl->fsrv.trace_bits, afl->fsrv.map_size);
     hnb = has_new_bits(afl, afl->virgin_bits);
@@ -755,65 +753,56 @@ u8 trim_case(afl_state_t *afl, struct queue_entry *q, u8 *in_buf) {
     while (remove_pos < q->len) {
 
       u32 trim_avail = MIN(remove_len, q->len - remove_pos);
+      u64 cksum;
 
-      if (likely((!q->taint_bytes_highest) ||
-                 (q->len - trim_avail > q->taint_bytes_highest))) {
+      write_with_gap(afl, in_buf, q->len, remove_pos, trim_avail);
 
-        u64 cksum;
+      fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
+      ++afl->trim_execs;
 
-        write_with_gap(afl, in_buf, q->len, remove_pos, trim_avail);
+      if (afl->stop_soon || fault == FSRV_RUN_ERROR) { goto abort_trimming; }
 
-        fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
-        ++afl->trim_execs;
-
-        if (afl->stop_soon || fault == FSRV_RUN_ERROR) { goto abort_trimming; }
-
-        /* Note that we don't keep track of crashes or hangs here; maybe TODO?
-         */
-
-        cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size, HASH_CONST);
-
-        /* If the deletion had no impact on the trace, make it permanent. This
-           isn't perfect for variable-path inputs, but we're just making a
-           best-effort pass, so it's not a big deal if we end up with false
-           negatives every now and then. */
-
-        if (cksum == q->exec_cksum) {
+      /* Note that we don't keep track of crashes or hangs here; maybe TODO?
+       */
 
-          u32 move_tail = q->len - remove_pos - trim_avail;
+      cksum = hash64(afl->fsrv.trace_bits, afl->fsrv.map_size, HASH_CONST);
 
-          q->len -= trim_avail;
-          len_p2 = next_pow2(q->len);
+      /* If the deletion had no impact on the trace, make it permanent. This
+         isn't perfect for variable-path inputs, but we're just making a
+         best-effort pass, so it's not a big deal if we end up with false
+         negatives every now and then. */
 
-          memmove(in_buf + remove_pos, in_buf + remove_pos + trim_avail,
-                  move_tail);
+      if (cksum == q->exec_cksum) {
 
-          /* Let's save a clean trace, which will be needed by
-             update_bitmap_score once we're done with the trimming stuff. */
+        u32 move_tail = q->len - remove_pos - trim_avail;
 
-          if (!needs_write) {
+        q->len -= trim_avail;
+        len_p2 = next_pow2(q->len);
 
-            needs_write = 1;
-            memcpy(afl->clean_trace, afl->fsrv.trace_bits, afl->fsrv.map_size);
+        memmove(in_buf + remove_pos, in_buf + remove_pos + trim_avail,
+                move_tail);
 
-          }
+        /* Let's save a clean trace, which will be needed by
+           update_bitmap_score once we're done with the trimming stuff. */
 
-        } else {
+        if (!needs_write) {
 
-          remove_pos += remove_len;
+          needs_write = 1;
+          memcpy(afl->clean_trace, afl->fsrv.trace_bits, afl->fsrv.map_size);
 
         }
 
-        /* Since this can be slow, update the screen every now and then. */
-        if (!(trim_exec++ % afl->stats_update_freq)) { show_stats(afl); }
-        ++afl->stage_cur;
-
       } else {
 
         remove_pos += remove_len;
 
       }
 
+      /* Since this can be slow, update the screen every now and then. */
+
+      if (!(trim_exec++ % afl->stats_update_freq)) { show_stats(afl); }
+      ++afl->stage_cur;
+
     }
 
     remove_len >>= 1;
@@ -866,8 +855,6 @@ abort_trimming:
 
 }
 
-#define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size
-
 /* Write a modified test case, run program, process results. Handle
    error conditions, returning 1 if it's time to bail out. This is
    a helper function for fuzz_one(). */
@@ -877,32 +864,6 @@ common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
 
   u8 fault;
 
-  if (unlikely(afl->taint_needs_splode)) {
-
-    s32 new_len = afl->queue_cur->len + len - afl->taint_len;
-    if (new_len < 4)
-      new_len = 4;
-    else if (new_len > MAX_FILE)
-      new_len = MAX_FILE;
-    u8 *new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch), new_len);
-
-    u32 i, taint = 0;
-    for (i = 0; i < (u32)new_len; i++) {
-
-      if (i >= afl->taint_len || i >= afl->queue_cur->len || afl->taint_map[i])
-        new_buf[i] = out_buf[taint++];
-      else
-        new_buf[i] = afl->taint_src[i];
-
-    }
-
-    swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
-
-    out_buf = new_buf;
-    len = new_len;
-
-  }
-
   write_to_testcase(afl, out_buf, len);
 
   fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
@@ -950,5 +911,3 @@ common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
 
 }
 
-#undef BUF_PARAMS
-
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index a8416eb1..d4de91a4 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -75,7 +75,7 @@ static list_t afl_states = {.element_prealloc_count = 0};
 
 /* Initializes an afl_state_t. */
 
-void afl_state_init_1(afl_state_t *afl, uint32_t map_size) {
+void afl_state_init(afl_state_t *afl, uint32_t map_size) {
 
   /* thanks to this memset, growing vars like out_buf
   and out_size are NULL/0 by default. */
@@ -100,6 +100,16 @@ void afl_state_init_1(afl_state_t *afl, uint32_t map_size) {
   afl->cpu_aff = -1;                    /* Selected CPU core                */
 #endif                                                     /* HAVE_AFFINITY */
 
+  afl->virgin_bits = ck_alloc(map_size);
+  afl->virgin_tmout = ck_alloc(map_size);
+  afl->virgin_crash = ck_alloc(map_size);
+  afl->var_bytes = ck_alloc(map_size);
+  afl->top_rated = ck_alloc(map_size * sizeof(void *));
+  afl->clean_trace = ck_alloc(map_size);
+  afl->clean_trace_custom = ck_alloc(map_size);
+  afl->first_trace = ck_alloc(map_size);
+  afl->map_tmp_buf = ck_alloc(map_size);
+
   afl->fsrv.use_stdin = 1;
   afl->fsrv.map_size = map_size;
   // afl_state_t is not available in forkserver.c
@@ -151,24 +161,6 @@ void afl_state_init_1(afl_state_t *afl, uint32_t map_size) {
 
 }
 
-void afl_state_init_2(afl_state_t *afl, uint32_t map_size) {
-
-  afl->shm.map_size = map_size ? map_size : MAP_SIZE;
-
-  afl->virgin_bits = ck_alloc(map_size);
-  afl->virgin_tmout = ck_alloc(map_size);
-  afl->virgin_crash = ck_alloc(map_size);
-  afl->var_bytes = ck_alloc(map_size);
-  afl->top_rated = ck_alloc(map_size * sizeof(void *));
-  afl->clean_trace = ck_alloc(map_size);
-  afl->clean_trace_custom = ck_alloc(map_size);
-  afl->first_trace = ck_alloc(map_size);
-  afl->map_tmp_buf = ck_alloc(map_size);
-
-  afl->fsrv.map_size = map_size;
-
-}
-
 /*This sets up the environment variables for afl-fuzz into the afl_state
  * struct*/
 
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 0cc06e12..aeb290bd 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -116,7 +116,6 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
           "edges_found       : %u\n"
           "var_byte_count    : %u\n"
           "havoc_expansion   : %u\n"
-          "tainted_inputs    : %u\n"
           "afl_banner        : %s\n"
           "afl_version       : " VERSION
           "\n"
@@ -150,8 +149,8 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
 #else
           -1,
 #endif
-          t_bytes, afl->var_byte_count, afl->expand_havoc, afl->taint_count,
-          afl->use_banner, afl->unicorn_mode ? "unicorn" : "",
+          t_bytes, afl->var_byte_count, afl->expand_havoc, afl->use_banner,
+          afl->unicorn_mode ? "unicorn" : "",
           afl->fsrv.qemu_mode ? "qemu " : "",
           afl->non_instrumented_mode ? " non_instrumented " : "",
           afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 106aa550..5dd092f2 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -53,9 +53,6 @@ static void at_exit() {
   ptr = getenv("__AFL_TARGET_PID2");
   if (ptr && *ptr && (i = atoi(ptr)) > 0) kill(i, SIGKILL);
 
-  ptr = getenv("__AFL_TARGET_PID3");
-  if (ptr && *ptr && (i = atoi(ptr)) > 0) kill(i, SIGKILL);
-
   i = 0;
   while (list[i] != NULL) {
 
@@ -92,8 +89,6 @@ static void usage(u8 *argv0, int more_help) {
       "  -o dir        - output directory for fuzzer findings\n\n"
 
       "Execution control settings:\n"
-      "  -A            - use first level taint analysis (see "
-      "qemu_taint/README.md)\n"
       "  -p schedule   - power schedules compute a seed's performance score. "
       "<explore\n"
       "                  (default), fast, coe, lin, quad, exploit, mmopt, "
@@ -244,10 +239,9 @@ static int stricmp(char const *a, char const *b) {
 
 int main(int argc, char **argv_orig, char **envp) {
 
-  s32 opt;
-  u64 prev_queued = 0;
-  u32 sync_interval_cnt = 0, seek_to, show_help = 0, map_size = MAP_SIZE,
-      real_map_size = 0;
+  s32    opt;
+  u64    prev_queued = 0;
+  u32    sync_interval_cnt = 0, seek_to, show_help = 0, map_size = MAP_SIZE;
   u8 *   extras_dir = 0;
   u8     mem_limit_given = 0, exit_1 = 0, debug = 0;
   char **use_argv;
@@ -263,7 +257,7 @@ int main(int argc, char **argv_orig, char **envp) {
   if (get_afl_env("AFL_DEBUG")) { debug = afl->debug = 1; }
 
   map_size = get_map_size();
-  afl_state_init_1(afl, map_size);
+  afl_state_init(afl, map_size);
   afl->debug = debug;
   afl_fsrv_init(&afl->fsrv);
 
@@ -283,15 +277,10 @@ int main(int argc, char **argv_orig, char **envp) {
 
   while ((opt = getopt(
               argc, argv,
-              "+b:c:i:I:o:f:F:m:t:T:dDnCB:S:M:x:QANUWe:p:s:V:E:L:hRP:")) > 0) {
+              "+b:c:i:I:o:f:F:m:t:T:dDnCB:S:M:x:QNUWe:p:s:V:E:L:hRP:")) > 0) {
 
     switch (opt) {
 
-      case 'A':
-        afl->taint_mode = 1;
-        if (!mem_limit_given) { afl->fsrv.mem_limit = MEM_LIMIT_QEMU; }
-        break;
-
       case 'I':
         afl->infoexec = optarg;
         break;
@@ -499,7 +488,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
         if (!optarg) { FATAL("Wrong usage of -m"); }
 
-        if (!strcmp(optarg, "none") || !strcmp(optarg, "0")) {
+        if (!strcmp(optarg, "none")) {
 
           afl->fsrv.mem_limit = 0;
           break;
@@ -829,15 +818,6 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  if (afl->taint_mode && afl->fsrv.map_size < MAX_FILE) {
-
-    real_map_size = map_size;
-    map_size = MAX_FILE;
-
-  }
-
-  afl_state_init_2(afl, map_size);
-
   if (!mem_limit_given && afl->shm.cmplog_mode) afl->fsrv.mem_limit += 260;
 
   OKF("afl++ is maintained by Marc \"van Hauser\" Heuse, Heiko \"hexcoder\" "
@@ -845,7 +825,8 @@ int main(int argc, char **argv_orig, char **envp) {
   OKF("afl++ is open source, get it at "
       "https://github.com/AFLplusplus/AFLplusplus");
   OKF("Power schedules from github.com/mboehme/aflfast");
-  OKF("Python Mutator from github.com/choller/afl");
+  OKF("Python Mutator and llvm_mode instrument file list from "
+      "github.com/choller/afl");
   OKF("MOpt Mutator from github.com/puppet-meteor/MOpt-AFL");
 
   if (afl->sync_id && afl->is_main_node &&
@@ -891,19 +872,6 @@ int main(int argc, char **argv_orig, char **envp) {
     if (afl->crash_mode) { FATAL("-C and -n are mutually exclusive"); }
     if (afl->fsrv.qemu_mode) { FATAL("-Q and -n are mutually exclusive"); }
     if (afl->unicorn_mode) { FATAL("-U and -n are mutually exclusive"); }
-    if (afl->taint_mode) { FATAL("-A and -n are mutually exclusive"); }
-
-  }
-
-  if (afl->limit_time_sig != 0 && afl->taint_mode) {
-
-    FATAL("-A and -L are mutually exclusive");
-
-  }
-
-  if (afl->unicorn_mode != 0 && afl->taint_mode) {
-
-    FATAL("-A and -U are mutually exclusive");
 
   }
 
@@ -1004,7 +972,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
   if (afl->afl_env.afl_preload) {
 
-    if (afl->fsrv.qemu_mode || afl->taint_mode) {
+    if (afl->fsrv.qemu_mode) {
 
       u8 *qemu_preload = getenv("QEMU_SET_ENV");
       u8 *afl_preload = getenv("AFL_PRELOAD");
@@ -1100,13 +1068,6 @@ int main(int argc, char **argv_orig, char **envp) {
   afl->fsrv.trace_bits =
       afl_shm_init(&afl->shm, afl->fsrv.map_size, afl->non_instrumented_mode);
 
-  if (real_map_size && map_size != real_map_size) {
-
-    afl->fsrv.map_size = real_map_size;
-    if (afl->cmplog_binary) afl->cmplog_fsrv.map_size = real_map_size;
-
-  }
-
   if (!afl->in_bitmap) { memset(afl->virgin_bits, 255, afl->fsrv.map_size); }
   memset(afl->virgin_tmout, 255, afl->fsrv.map_size);
   memset(afl->virgin_crash, 255, afl->fsrv.map_size);
@@ -1262,6 +1223,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
     ACTF("Spawning cmplog forkserver");
     afl_fsrv_init_dup(&afl->cmplog_fsrv, &afl->fsrv);
+    // TODO: this is semi-nice
     afl->cmplog_fsrv.trace_bits = afl->fsrv.trace_bits;
     afl->cmplog_fsrv.qemu_mode = afl->fsrv.qemu_mode;
     afl->cmplog_fsrv.cmplog_binary = afl->cmplog_binary;
@@ -1272,70 +1234,6 @@ int main(int argc, char **argv_orig, char **envp) {
 
   }
 
-  if (afl->taint_mode) {
-
-    ACTF("Spawning qemu_taint forkserver");
-
-    u8 *disable = getenv("AFL_DISABLE_LLVM_INSTRUMENTATION");
-    setenv("AFL_DISABLE_LLVM_INSTRUMENTATION", "1", 0);
-
-    afl_fsrv_init_dup(&afl->taint_fsrv, &afl->fsrv);
-    afl->taint_fsrv.taint_mode = 1;
-    afl->taint_fsrv.trace_bits = afl->fsrv.trace_bits;
-
-    ck_free(afl->taint_fsrv.target_path);
-    afl->argv_taint = ck_alloc(sizeof(char *) * (argc + 4 - optind));
-    afl->taint_fsrv.target_path = find_afl_binary("afl-qemu-taint", argv[0]);
-    afl->argv_taint[0] = find_afl_binary("afl-qemu-taint", argv[0]);
-    if (!afl->argv_taint[0])
-      FATAL(
-          "Cannot find 'afl-qemu-taint', read qemu_taint/README.md on how to "
-          "build it.");
-    u32 idx = optind - 1, offset = 0;
-    do {
-
-      idx++;
-      offset++;
-      afl->argv_taint[offset] = argv[idx];
-
-    } while (argv[idx] != NULL);
-
-    if (afl->fsrv.use_stdin)
-      unsetenv("AFL_TAINT_INPUT");
-    else
-      setenv("AFL_TAINT_INPUT", afl->fsrv.out_file, 1);
-    afl_fsrv_start(&afl->taint_fsrv, afl->argv_taint, &afl->stop_soon,
-                   afl->afl_env.afl_debug_child_output);
-
-    afl->taint_input_file = alloc_printf("%s/taint/.input", afl->out_dir);
-    int fd = open(afl->taint_input_file, O_CREAT | O_TRUNC | O_RDWR, 0644);
-    if (fd < 0)
-      FATAL("Cannot create taint inpu file '%s'", afl->taint_input_file);
-    lseek(fd, MAX_FILE, SEEK_SET);
-    ck_write(fd, "\0", 1, afl->taint_input_file);
-
-    if (!disable) unsetenv("AFL_DISABLE_LLVM_INSTRUMENTATION");
-
-    OKF("Taint forkserver successfully started");
-
-    const rlim_t  kStackSize = 128L * 1024L * 1024L;  // min stack size = 128 Mb
-    struct rlimit rl;
-    rl.rlim_cur = kStackSize;
-    if (getrlimit(RLIMIT_STACK, &rl) != 0)
-      WARNF("Setting a higher stack size failed!");
-
-  #define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size
-    u8 *tmp1 = ck_maybe_grow(BUF_PARAMS(eff), MAX_FILE + 4096);
-    u8 *tmp2 = ck_maybe_grow(BUF_PARAMS(ex), MAX_FILE + 4096);
-    u8 *tmp3 = ck_maybe_grow(BUF_PARAMS(in_scratch), MAX_FILE + 4096);
-    u8 *tmp4 = ck_maybe_grow(BUF_PARAMS(out), MAX_FILE + 4096);
-    u8 *tmp5 = ck_maybe_grow(BUF_PARAMS(out_scratch), MAX_FILE + 4096);
-  #undef BUF_PARAMS
-    if (!tmp1 || !tmp2 || !tmp3 || !tmp4 || !tmp5)
-      FATAL("memory issues. me hungry, feed me!");
-
-  }
-
   perform_dry_run(afl);
 
   cull_queue(afl);
@@ -1410,7 +1308,7 @@ int main(int argc, char **argv_orig, char **envp) {
               break;
             case 1:
               if (afl->limit_time_sig == 0 && !afl->custom_only &&
-                  !afl->python_only && !afl->taint_mode) {
+                  !afl->python_only) {
 
                 afl->limit_time_sig = -1;
                 afl->limit_time_puppet = 0;
@@ -1598,11 +1496,8 @@ stop_fuzzing:
 
   }
 
-  if (afl->cmplog_binary) afl_fsrv_deinit(&afl->cmplog_fsrv);
-  if (afl->taint_mode) afl_fsrv_deinit(&afl->taint_fsrv);
   afl_fsrv_deinit(&afl->fsrv);
   if (afl->orig_cmdline) { ck_free(afl->orig_cmdline); }
-  if (afl->argv_taint) { ck_free(afl->argv_taint); }
   ck_free(afl->fsrv.target_path);
   ck_free(afl->fsrv.out_file);
   ck_free(afl->sync_id);
-- 
cgit 1.4.1


From 0a251f93e0842c92755e9bcba61e520669a6c2e6 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sat, 15 Aug 2020 13:34:51 +0200
Subject: increase initial memory sized

---
 docs/Changelog.md                    |  2 ++
 examples/aflpp_driver/aflpp_driver.c |  1 -
 include/config.h                     | 10 +++++-----
 llvm_mode/afl-llvm-rt.o.c            | 12 ++++--------
 4 files changed, 11 insertions(+), 14 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 3c28ff98..ea7c7caf 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -12,6 +12,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
 ### Version ++2.66d (devel)
   - Support for improved afl++ snapshot module:
     https://github.com/AFLplusplus/AFL-Snapshot-LKM
+  - Due to the instrumentation needing more memory, the initial memory sizes
+    for -m have been increased
   - afl-fuzz:
      - added -F option to allow -M main fuzzers to sync to foreign fuzzers,
        e.g. honggfuzz or libfuzzer
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index b764338e..ff5446e9 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -109,7 +109,6 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
 int                   __afl_sharedmem_fuzzing = 1;
 extern unsigned int * __afl_fuzz_len;
 extern unsigned char *__afl_fuzz_ptr;
-// extern struct cmp_map *__afl_cmp_map;
 
 // libFuzzer interface is thin, so we don't include any libFuzzer headers.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
diff --git a/include/config.h b/include/config.h
index 344a368f..a978a27c 100644
--- a/include/config.h
+++ b/include/config.h
@@ -70,21 +70,21 @@
 
 #ifndef __NetBSD__
   #ifndef WORD_SIZE_64
-    #define MEM_LIMIT 25
-  #else
     #define MEM_LIMIT 50
+  #else
+    #define MEM_LIMIT 75
   #endif                                                  /* ^!WORD_SIZE_64 */
 #else /* NetBSD's kernel needs more space for stack, see discussion for issue \
          #165 */
-  #define MEM_LIMIT 200
+  #define MEM_LIMIT 250
 #endif
 /* Default memory limit when running in QEMU mode (MB): */
 
-#define MEM_LIMIT_QEMU 200
+#define MEM_LIMIT_QEMU 250
 
 /* Default memory limit when running in Unicorn mode (MB): */
 
-#define MEM_LIMIT_UNICORN 200
+#define MEM_LIMIT_UNICORN 250
 
 /* Number of calibration cycles per every new test case (and for test
    cases that show variable behavior): */
diff --git a/llvm_mode/afl-llvm-rt.o.c b/llvm_mode/afl-llvm-rt.o.c
index 5479c3da..a56b54b2 100644
--- a/llvm_mode/afl-llvm-rt.o.c
+++ b/llvm_mode/afl-llvm-rt.o.c
@@ -902,15 +902,11 @@ __attribute__((constructor(0))) void __afl_auto_first(void) {
 
   if (getenv("AFL_DISABLE_LLVM_INSTRUMENTATION")) return;
   u8 *ptr;
+  u32 get_size = __afl_final_loc ? __afl_final_loc : 1024000;
 
-  if (__afl_final_loc > MAP_INITIAL_SIZE) {
-
-    ptr = (u8 *)mmap(NULL, __afl_final_loc, PROT_READ | PROT_WRITE, MAP_PRIVATE,
-                     -1, 0);
-
-    if (ptr && (ssize_t)ptr != -1) { __afl_area_ptr = ptr; }
-
-  }
+  ptr = (u8 *)mmap(NULL, __afl_final_loc, PROT_READ | PROT_WRITE, MAP_PRIVATE,
+                   -1, 0);
+  if (ptr && (ssize_t)ptr != -1) { __afl_area_ptr = ptr; }
 
 }
 
-- 
cgit 1.4.1


From 9532499ef5280ae4c7aa3d189dd7a924a38e8358 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Sun, 16 Aug 2020 14:14:24 +0200
Subject: install libafldrivers

---
 GNUmakefile                                  | 2 ++
 examples/aflpp_driver/GNUmakefile            | 2 ++
 llvm_mode/afl-llvm-lto-instrumentation.so.cc | 2 +-
 3 files changed, 5 insertions(+), 1 deletion(-)

(limited to 'examples/aflpp_driver')

diff --git a/GNUmakefile b/GNUmakefile
index f9020a90..3c5e10ed 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -597,6 +597,8 @@ install: all $(MANPAGES)
 	if [ -f socketfuzz32.so -o -f socketfuzz64.so ]; then $(MAKE) -C examples/socket_fuzzing install; fi
 	if [ -f argvfuzz32.so -o -f argvfuzz64.so ]; then $(MAKE) -C examples/argv_fuzzing install; fi
 	if [ -f examples/afl_network_proxy/afl-network-server ]; then $(MAKE) -C examples/afl_network_proxy install; fi
+	if [ -f libAFLDriver.a ]; then install -m 644 libAFLDriver.a $${DESTDIR}$(HELPER_PATH); fi
+	if [ -f libAFLQemuDriver.a ]; then install -m 644 libAFLQemuDriver.a $${DESTDIR}$(HELPER_PATH); fi
 
 	set -e; ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-g++
 	set -e; if [ -f afl-clang-fast ] ; then ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang++ ; else ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-clang++; fi
diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile
index b118a8b5..57e74be7 100644
--- a/examples/aflpp_driver/GNUmakefile
+++ b/examples/aflpp_driver/GNUmakefile
@@ -16,6 +16,7 @@ aflpp_driver.o:	aflpp_driver.c
 
 libAFLDriver.a:	aflpp_driver.o
 	ar ru libAFLDriver.a aflpp_driver.o
+	cp -vf libAFLDriver.a ../../
 
 debug:
 	$(LLVM_BINDIR)clang -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
@@ -29,6 +30,7 @@ aflpp_qemu_driver.o:	aflpp_qemu_driver.c
 
 libAFLQemuDriver.a:	aflpp_qemu_driver.o
 	ar ru libAFLQemuDriver.a aflpp_qemu_driver.o
+	cp -vf libAFLQemuDriver.a ../../
 
 aflpp_qemu_driver_hook.so:	aflpp_qemu_driver_hook.o
 	$(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so
diff --git a/llvm_mode/afl-llvm-lto-instrumentation.so.cc b/llvm_mode/afl-llvm-lto-instrumentation.so.cc
index 5320df09..300951fb 100644
--- a/llvm_mode/afl-llvm-lto-instrumentation.so.cc
+++ b/llvm_mode/afl-llvm-lto-instrumentation.so.cc
@@ -566,7 +566,7 @@ bool AFLLTOPass::runOnModule(Module &M) {
 
               std::string outstring;
               fprintf(stderr, "%s: length %zu/%zu \"", FuncName.c_str(), optLen,
-                      (unsigned int)thestring.length());
+                      thestring.length());
               for (uint8_t i = 0; i < thestring.length(); i++) {
 
                 uint8_t c = thestring[i];
-- 
cgit 1.4.1


From 6c846bcf2c5f83d7962774f6a5a431f5de740357 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 4 Sep 2020 15:27:02 +0200
Subject: fix driver test

---
 examples/aflpp_driver/aflpp_driver_test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
index ddc3effb..b66c3b37 100644
--- a/examples/aflpp_driver/aflpp_driver_test.c
+++ b/examples/aflpp_driver/aflpp_driver_test.c
@@ -16,13 +16,13 @@ void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
 
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
+  if (Size < 5) return 0;
+
   fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
           hash64((u8 *)Data, (unsigned int)Size,
                  (unsigned long long int)0xa5b35705),
           Size);
 
-  if (Size < 5) return 0;
-
   crashme(Data, Size);
 
   return 0;
-- 
cgit 1.4.1


From 8459bcdf85df975e7a755c8a64e0b04304d71634 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 4 Sep 2020 16:01:08 +0200
Subject: fix example

---
 examples/aflpp_driver/aflpp_driver_test.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
index b66c3b37..020fb517 100644
--- a/examples/aflpp_driver/aflpp_driver_test.c
+++ b/examples/aflpp_driver/aflpp_driver_test.c
@@ -6,6 +6,8 @@
 
 void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
 
+  if (Size < 5);
+
   if (Data[0] == 'F')
     if (Data[1] == 'A')
       if (Data[2] == '$')
@@ -16,12 +18,11 @@ void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
 
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 
-  if (Size < 5) return 0;
-
-  fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
-          hash64((u8 *)Data, (unsigned int)Size,
-                 (unsigned long long int)0xa5b35705),
-          Size);
+  if (Size)
+    fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
+            hash64((u8 *)Data, (unsigned int)Size,
+                   (unsigned long long int)0xa5b35705),
+            Size);
 
   crashme(Data, Size);
 
-- 
cgit 1.4.1


From 6399f84ba2a15a4e41458509cd40a1d8658c8699 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Fri, 4 Sep 2020 16:02:02 +0200
Subject: fix example

---
 examples/aflpp_driver/aflpp_driver_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
index 020fb517..b4ff6bc6 100644
--- a/examples/aflpp_driver/aflpp_driver_test.c
+++ b/examples/aflpp_driver/aflpp_driver_test.c
@@ -6,7 +6,7 @@
 
 void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
 
-  if (Size < 5);
+  if (Size < 5) return;
 
   if (Data[0] == 'F')
     if (Data[1] == 'A')
-- 
cgit 1.4.1


From e30b2c6af6e369844c92c00a20ebdd53473a747c Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Sat, 5 Sep 2020 13:18:28 +0200
Subject: final changes for pre-3.0

---
 .gitignore                           |   6 ++
 Android.bp                           |   6 +-
 GNUmakefile                          |   3 +-
 GNUmakefile.gcc_plugin               |   1 +
 GNUmakefile.llvm                     |   8 ++-
 README.md                            |   2 +-
 docs/Changelog.md                    |  14 ++++
 docs/FAQ.md                          | 104 +++++++++++++++---------------
 docs/INSTALL.md                      |  19 +++---
 docs/env_variables.md                | 121 ++++++++++++++++++-----------------
 docs/ideas.md                        |  57 -----------------
 docs/life_pro_tips.md                |   4 +-
 docs/perf_tips.md                    |   8 +--
 docs/sister_projects.md              |   4 +-
 docs/status_screen.md                |   2 +-
 examples/README.md                   |   2 +-
 examples/aflpp_driver/aflpp_driver.c |   2 +-
 include/afl-fuzz.h                   |   3 +-
 include/config.h                     |   4 +-
 include/envs.h                       |   1 +
 qemu_mode/patches/afl-qemu-cpu-inl.h |   2 +-
 src/afl-fuzz-init.c                  |   3 +-
 src/afl-fuzz-queue.c                 |  13 ++--
 src/afl-fuzz-stats.c                 |   8 +--
 src/afl-fuzz.c                       |   3 +-
 test/test-gcc-plugin.sh              |   2 +-
 test/test-unittests.sh               |   2 +
 27 files changed, 188 insertions(+), 216 deletions(-)

(limited to 'examples/aflpp_driver')

diff --git a/.gitignore b/.gitignore
index 0527a0b2..e3adb6ef 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,6 +51,12 @@ afl-showmap.8
 afl-system-config.8
 afl-tmin.8
 afl-whatsup.8
+afl-c++
+afl-cc
+afl-lto
+afl-lto++
+afl-lto++.8
+afl-lto.8
 qemu_mode/libcompcov/compcovtest
 qemu_mode/qemu-*
 unicorn_mode/samples/*/\.test-*
diff --git a/Android.bp b/Android.bp
index e59129db..2c2114b2 100644
--- a/Android.bp
+++ b/Android.bp
@@ -101,7 +101,7 @@ cc_binary_host {
   ],
 
   srcs: [
-    "llvm_mode/afl-clang-fast.c",
+    "src/afl-cc.c",
   ],
 }
 
@@ -119,7 +119,7 @@ cc_binary_host {
   ],
 
   srcs: [
-    "llvm_mode/afl-clang-fast.c",
+    "src/afl-cc.c",
   ],
 }
 
@@ -136,6 +136,6 @@ cc_library_static {
   ],
 
   srcs: [
-    "llvm_mode/afl-llvm-rt.o.c",
+    "instrumentation/afl-llvm-rt.o.c",
   ],
 }
diff --git a/GNUmakefile b/GNUmakefile
index 0046a481..7455483c 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -533,7 +533,7 @@ endif
 deepclean:	clean
 	rm -rf qemu_mode/qemu-3.1.1.tar.xz
 	rm -rf unicorn_mode/unicornafl
-	git reset --hard >/dev/null 2>&1 || true
+	# NEVER EVER ACTIVATE THAT!!!!! git reset --hard >/dev/null 2>&1 || true
 
 .PHONY: distrib
 distrib: all
@@ -591,6 +591,7 @@ install: all $(MANPAGES)
 	@install -d -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(HELPER_PATH) $${DESTDIR}$(DOC_PATH) $${DESTDIR}$(MISC_PATH)
 	@rm -f $${DESTDIR}$(BIN_PATH)/afl-plot.sh
 	@rm -f $${DESTDIR}$(BIN_PATH)/afl-as
+	@rm -f $${DESTDIR}$(HELPER_PATH)/afl-llvm-rt.o $${DESTDIR}$(HELPER_PATH)/afl-llvm-rt-32.o $${DESTDIR}$(HELPER_PATH)/afl-llvm-rt-64.o $${DESTDIR}$(HELPER_PATH)/afl-gcc-rt.o
 	install -m 755 $(PROGS) $(SH_PROGS) $${DESTDIR}$(BIN_PATH)
 	@if [ -f afl-qemu-trace ]; then install -m 755 afl-qemu-trace $${DESTDIR}$(BIN_PATH); fi
 	@if [ -f libdislocator.so ]; then set -e; install -m 755 libdislocator.so $${DESTDIR}$(HELPER_PATH); fi
diff --git a/GNUmakefile.gcc_plugin b/GNUmakefile.gcc_plugin
index aeb1ef16..b73fcfda 100644
--- a/GNUmakefile.gcc_plugin
+++ b/GNUmakefile.gcc_plugin
@@ -158,6 +158,7 @@ vpath  % ..
 install: all
 	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-gcc-fast
 	ln -sf afl-c++ $${DESTDIR}$(BIN_PATH)/afl-g++-fast
+	ln -sf afl-compiler-rt.o $${DESTDIR}$(HELPER_PATH)/afl-gcc-rt.o
 	install -m 755 ./afl-gcc-pass.so $${DESTDIR}$(HELPER_PATH)
 	install -m 644 -T instrumentation/README.gcc_plugin.md $${DESTDIR}$(DOC_PATH)/README.gcc_plugin.md
 
diff --git a/GNUmakefile.llvm b/GNUmakefile.llvm
index d76e0b28..1bb3d265 100644
--- a/GNUmakefile.llvm
+++ b/GNUmakefile.llvm
@@ -423,10 +423,12 @@ document:
 ./afl-compiler-rt-32.o: instrumentation/afl-compiler-rt.o.c | test_deps
 	@printf "[*] Building 32-bit variant of the runtime (-m32)... "
 	@$(CLANG_BIN) $(CLANG_CFL) $(CFLAGS_SAFE) $(CPPFLAGS) -O3 -Wno-unused-result -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+	@test -e afl-compiler-rt-32.o && ln -sf afl-compiler-rt-32.o afl-llvm-rt-64.o
 
 ./afl-compiler-rt-64.o: instrumentation/afl-compiler-rt.o.c | test_deps
 	@printf "[*] Building 64-bit variant of the runtime (-m64)... "
 	@$(CLANG_BIN) $(CLANG_CFL) $(CFLAGS_SAFE) $(CPPFLAGS) -O3 -Wno-unused-result -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
+	@test -e afl-compiler-rt-64.o && ln -sf afl-compiler-rt-64.o afl-llvm-rt-64.o
 
 .PHONY: test_build
 test_build: $(PROGS)
@@ -448,11 +450,11 @@ all_done: test_build
 install: all
 	@install -d -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(HELPER_PATH) $${DESTDIR}$(DOC_PATH) $${DESTDIR}$(MISC_PATH)
 	@if [ -f ./afl-cc ]; then set -e; install -m 755 ./afl-cc $${DESTDIR}$(BIN_PATH); ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-c++; fi
-	@if [ -f ./afl-compiler-rt.o ]; then set -e; install -m 755 ./afl-compiler-rt.o $${DESTDIR}$(HELPER_PATH); fi
+	@if [ -f ./afl-compiler-rt.o ]; then set -e; install -m 755 ./afl-compiler-rt.o $${DESTDIR}$(HELPER_PATH); ln -sf afl-compiler-rt.o $${DESTDIR}$(HELPER_PATH)afl-llvm-rt.o ;fi
 	@if [ -f ./afl-lto ]; then set -e; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-lto; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-lto++; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang-lto; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang-lto++; install -m 755 ./afl-llvm-lto-instrumentation.so ./afl-llvm-rt-lto*.o ./afl-llvm-lto-instrumentlist.so $${DESTDIR}$(HELPER_PATH); fi
 	@if [ -f ./afl-ld-lto ]; then set -e; install -m 755 ./afl-ld-lto $${DESTDIR}$(BIN_PATH); fi
-	@if [ -f ./afl-compiler-rt-32.o ]; then set -e; install -m 755 ./afl-compiler-rt-32.o $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f ./afl-compiler-rt-64.o ]; then set -e; install -m 755 ./afl-compiler-rt-64.o $${DESTDIR}$(HELPER_PATH); fi
+	@if [ -f ./afl-compiler-rt-32.o ]; then set -e; install -m 755 ./afl-compiler-rt-32.o $${DESTDIR}$(HELPER_PATH); ln -sf afl-compiler-rt-32.o $${DESTDIR}$(HELPER_PATH)afl-llvm-rt-32.o ;fi
+	@if [ -f ./afl-compiler-rt-64.o ]; then set -e; install -m 755 ./afl-compiler-rt-64.o $${DESTDIR}$(HELPER_PATH); ln -sf afl-compiler-rt-64.o $${DESTDIR}$(HELPER_PATH)afl-llvm-rt-64.o ; fi
 	@if [ -f ./compare-transform-pass.so ]; then set -e; install -m 755 ./*.so $${DESTDIR}$(HELPER_PATH); fi
 	@if [ -f ./compare-transform-pass.so ]; then set -e; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang-fast ; ln -sf ./afl-c++ $${DESTDIR}$(BIN_PATH)/afl-clang-fast++ ; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf ./afl-c++ $${DESTDIR}$(BIN_PATH)/afl-clang++ ; fi
 	@if [ -f ./SanitizerCoverageLTO.so ]; then set -e; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang-lto ; ln -sf ./afl-c++ $${DESTDIR}$(BIN_PATH)/afl-clang-lto++ ; fi
diff --git a/README.md b/README.md
index 96b34260..c886489d 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
 
   Release Version: [2.67c](https://github.com/AFLplusplus/AFLplusplus/releases)
 
-  Github Version: 2.67d
+  Github Version: 3.00a
 
   Repository: [https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)
 
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 6321aee4..9de03e78 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -9,6 +9,20 @@ Want to stay in the loop on major new features? Join our mailing list by
 sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 
+### Version ++3.00a (develop)
+  - llvm_mode/ and gcc_plugin/ moved to instrumentation/
+  - all compilers combined to afl-cc which emulates the previous ones
+  - afl-llvm/gcc-rt.o merged into afl-compiler-rt.o
+  - afl-fuzz
+    - reading testcases from -i now descends into subdirectories
+    - allow up to 4 -x command line options
+    - loaded extras now have a duplicate protection
+  - instrumentation
+    - new llvm pass: dict2file via AFL_LLVM_DICT2FILE, create afl-fuzz
+      -x dictionary of string comparisons found during compilation
+    - not overriding -Ox or -fno-unroll-loops anymore
+
+
 ### Version ++2.68c (release)
   - added the GSoC excellent afl++ grammar mutator by Shengtuo to our
     custom_mutators/ (see custom_mutators/README.md) - or get it here:
diff --git a/docs/FAQ.md b/docs/FAQ.md
index 064638f4..24942492 100644
--- a/docs/FAQ.md
+++ b/docs/FAQ.md
@@ -4,11 +4,11 @@
 
   * [What is the difference between afl and afl++?](#what-is-the-difference-between-afl-and-afl)
   * [How to improve the fuzzing speed?](#how-to-improve-the-fuzzing-speed)
-  * [How do I fuzz a network service?](#how-do-i-fuzz-a-network-service)
-  * [How do I fuzz a GUI program?](#how-do-i-fuzz-a-gui-program)
+  * [How do I fuzz a network service?](#how-to-fuzz-a-network-service)
+  * [How do I fuzz a GUI program?](#how-to-fuzz-a-gui-program)
   * [What is an edge?](#what-is-an-edge)
   * [Why is my stability below 100%?](#why-is-my-stability-below-100)
-  * [How can I improve the stability value?](#how-can-i-improve-the-stability-value)
+  * [How can I improve the stability value](#how-can-i-improve-the-stability-value)
 
 If you find an interesting or important question missing, submit it via
 [https://github.com/AFLplusplus/AFLplusplus/issues](https://github.com/AFLplusplus/AFLplusplus/issues)
@@ -18,52 +18,51 @@ If you find an interesting or important question missing, submit it via
 American Fuzzy Lop (AFL) was developed by Michał "lcamtuf" Zalewski starting in
 2013/2014, and when he left Google end of 2017 he stopped developing it.
 
-At the end of 2019 the Google fuzzing team took over maintenance of AFL, however
-it is only accepting PRs from the community and is not developing enhancements
+At the end of 2019 the Google fuzzing team took over maintance of AFL, however
+it is only accepting PR from the community and is not developing enhancements
 anymore.
 
-In the second quarter of 2019, 1 1/2 year later when no further development of
-AFL had happened and it became clear there would none be coming, afl++
-was born, where initially community patches were collected and applied
-for bug fixes and enhancements. Then from various AFL spin-offs - mostly academic
+In the second quarter of 2019, 1 1/2 years after no further development of
+AFL had happened and it became clear there would be none coming, afl++
+was born, where initially first community patches were collected and applied
+for bugs and enhancements. Then from various AFL spin-offs - mostly academic
 research - features were integrated. This already resulted in a much advanced
 AFL.
 
 Until the end of 2019 the afl++ team had grown to four active developers which
-then implemented their own research and features, making it now by far the most
+then implemented their own research and feature, making it now by far the most
 flexible and feature rich guided fuzzer available as open source.
 And in independent fuzzing benchmarks it is one of the best fuzzers available,
 e.g. [Fuzzbench Report](https://www.fuzzbench.com/reports/2020-08-03/index.html)
 
-## How to improve the fuzzing speed?
+## How to improve the fuzzing speed
 
-  1. Use [llvm_mode](docs/llvm_mode/README.md): afl-clang-lto (llvm >= 11) or afl-clang-fast (llvm >= 9 recommended)
-  2. Use [persistent mode](llvm_mode/README.persistent_mode.md) (x2-x20 speed increase)
+  1. use [instrumentation](docs/README.llvm.md): afl-clang-lto (llvm >= 11) or afl-clang-fast (llvm >= 9 recommended)
+  2. Use [persistent mode](instrumentation/README.persistent_mode.md) (x2-x20 speed increase)
   3. Use the [afl++ snapshot module](https://github.com/AFLplusplus/AFL-Snapshot-LKM) (x2 speed increase)
-  4. If you do not use shmem persistent mode, use `AFL_TMPDIR` to put the input file directory on a tempfs location, see [docs/env_variables.md](docs/env_variables.md)
-  5. Improve Linux kernel performance: modify `/etc/default/grub`, set `GRUB_CMDLINE_LINUX_DEFAULT="ibpb=off ibrs=off kpti=off l1tf=off mds=off mitigations=off no_stf_barrier noibpb noibrs nopcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=off pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off"`; then `update-grub` and `reboot` (warning: makes the system less secure)
+  4. If you do not use shmem persistent mode, use `AFL_TMPDIR` to point the input file on a tempfs location, see [docs/env_variables.md](docs/env_variables.md)
+  5. Improve kernel performance: modify `/etc/default/grub`, set `GRUB_CMDLINE_LINUX_DEFAULT="ibpb=off ibrs=off kpti=off l1tf=off mds=off mitigations=off no_stf_barrier noibpb noibrs nopcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=off pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off"`; then `update-grub` and `reboot` (warning: makes the system more insecure)
   6. Running on an `ext2` filesystem with `noatime` mount option will be a bit faster than on any other journaling filesystem
   7. Use your cores! [README.md:3.b) Using multiple cores/threads](../README.md#b-using-multiple-coresthreads)
 
 ## How do I fuzz a network service?
 
-The short answer is - you cannot, at least not "out of the box".
+The short answer is - you cannot, at least "out of the box".
 
-Using a network channel is inadequate for several reasons:
-- it has a slow-down of x10-20 on the fuzzing speed
-- it does not scale to fuzzing multiple instances easily,
-- instead of one initial data packet often a back-and-forth interplay of packets is needed for stateful protocols (which is totally unsupported by most coverage aware fuzzers).
+Using network has a slow-down of x10-20 on the fuzzing speed, does not scale,
+and finally usually it is more than one initial data packet but a back-and-forth
+which is totally unsupported by most coverage aware fuzzers.
 
 The established method to fuzz network services is to modify the source code
 to read from a file or stdin (fd 0) (or even faster via shared memory, combine
-this with persistent mode [llvm_mode/README.persistent_mode.md](llvm_mode/README.persistent_mode.md)
+this with persistent mode [instrumentation/README.persistent_mode.md](instrumentation/README.persistent_mode.md)
 and you have a performance gain of x10 instead of a performance loss of over
-x10 - that is a x100 difference!).
+x10 - that is a x100 difference!
 
 If modifying the source is not an option (e.g. because you only have a binary
 and perform binary fuzzing) you can also use a shared library with AFL_PRELOAD
-to emulate the network. This is also much faster than the real network would be.
-See [examples/socket_fuzzing/](../examples/socket_fuzzing/).
+to emulate the network. This is also much faster than network would be.
+See [examples/socket_fuzzing/](../examples/socket_fuzzing/)
 
 There is an outdated afl++ branch that implements networking if you are
 desperate though: [https://github.com/AFLplusplus/AFLplusplus/tree/networking](https://github.com/AFLplusplus/AFLplusplus/tree/networking) - 
@@ -74,7 +73,7 @@ which allows you to define network state with different type of data packets.
 
 If the GUI program can read the fuzz data from a file (via the command line,
 a fixed location or via an environment variable) without needing any user
-interaction then it would be suitable for fuzzing.
+interaction then then yes.
 
 Otherwise it is not possible without modifying the source code - which is a
 very good idea anyway as the GUI functionality is a huge CPU/time overhead
@@ -83,13 +82,13 @@ for the fuzzing.
 So create a new `main()` that just reads the test case and calls the
 functionality for processing the input that the GUI program is using.
 
-## What is an "edge"?
+## What is an "edge"
 
 A program contains `functions`, `functions` contain the compiled machine code.
 The compiled machine code in a `function` can be in a single or many `basic blocks`.
 A `basic block` is the largest possible number of subsequent machine code
-instructions that has exactly one entrypoint (which can be be entered by multiple other basic blocks)
-and runs linearly without branching or jumping to other addresses (except at the end).
+instructions that runs independent, meaning it does not split up to different
+locations nor is it jumped into it from a different location:
 ```
 function() {
   A:
@@ -99,7 +98,7 @@ function() {
     if (x) goto C; else goto D;
   C:
     some code
-    goto E
+    goto D
   D:
     some code
     goto B
@@ -109,7 +108,7 @@ function() {
 ```
 Every code block between two jump locations is a `basic block`.
 
-An `edge` is then the unique relationship between two directly connected `basic blocks` (from the
+An `edge` is then the unique relationship between two `basic blocks` (from the
 code example above):
 ```
               Block A
@@ -124,9 +123,8 @@ code example above):
               Block E
 ```
 Every line between two blocks is an `edge`.
-Note that a few basic block loop to itself, this too would be an edge.
 
-## Why is my stability below 100%?
+## Why is my stability below 100%
 
 Stability is measured by how many percent of the edges in the target are
 "stable". Sending the same input again and again should take the exact same
@@ -134,37 +132,37 @@ path through the target every time. If that is the case, the stability is 100%.
 
 If however randomness happens, e.g. a thread reading other external data,
 reaction to timing, etc. then in some of the re-executions with the same data
-the edge coverage result will be different accross runs.
+the result in the edge information will be different accross runs.
 Those edges that change are then flagged "unstable".
 
 The more "unstable" edges, the more difficult for afl++ to identify valid new
 paths.
 
 A value above 90% is usually fine and a value above 80% is also still ok, and
-even a value above 20% can still result in successful finds of bugs.
-However, it is recommended that for values below 90% or 80% you should take
-countermeasures to improve stability.
+even above 20% can still result in successful finds of bugs.
+However, it is recommended that below 90% or 80% you should take measures to
+improve the stability.
 
-## How can I improve the stability value?
+## How can I improve the stability value
 
-For fuzzing a 100% stable target that covers all edges is the best case.
+For fuzzing a 100% stable target that covers all edges is the best.
 A 90% stable target that covers all edges is however better than a 100% stable
 target that ignores 10% of the edges.
 
 With instability you basically have a partial coverage loss on an edge, with
-ignored functions you have a full loss on that edges.
+ignore you have a full loss on that edge.
 
 There are functions that are unstable, but also provide value to coverage, eg
 init functions that use fuzz data as input for example.
-If however a function that has nothing to do with the input data is the
-source of instability, e.g. checking jitter, or is a hash map function etc.
-then it should not be instrumented.
+If however it is a function that has nothing to do with the input data is the
+source, e.g. checking jitter, or is a hash map function etc. then it should
+not be instrumented.
 
-To be able to exclude these functions (based on AFL++'s measured stability)
-the following process will allow to identify functions with variable edges.
+To be able to make this decision the following process will allow you to
+identify the functions with variable edges so you can make this decision.
 
-Four steps are required to do this and it also requires quite some knowledge
-of coding and/or disassembly and is effectively possible only with
+Four steps are required to do this and requires quite some knowledge of
+coding and/or disassembly and it is only effectively possible with
 afl-clang-fast PCGUARD and afl-clang-lto LTO instrumentation.
 
   1. First step: Identify which edge ID numbers are unstable
@@ -173,7 +171,7 @@ afl-clang-fast PCGUARD and afl-clang-lto LTO instrumentation.
      The out/fuzzer_stats file will then show the edge IDs that were identified
      as unstable.
 
-  2. Second step: Find the responsible function(s).
+  2. Second step: Find the responsible function.
 
      a) For LTO instrumented binaries this can be documented during compile
         time, just set `export AFL_LLVM_DOCUMENT_IDS=/path/to/a/file`.
@@ -182,10 +180,10 @@ afl-clang-fast PCGUARD and afl-clang-lto LTO instrumentation.
 
      b) For PCGUARD instrumented binaries it is much more difficult. Here you
         can either modify the __sanitizer_cov_trace_pc_guard function in
-        llvm_mode/afl-llvm-rt.o.c to write a backtrace to a file if the ID in
+        instrumentation/afl-llvm-rt.o.c to write a backtrace to a file if the ID in
         __afl_area_ptr[*guard] is one of the unstable edge IDs.
         (Example code is already there).
-        Then recompile and reinstall llvm_mode and rebuild your target.
+        Then recompile and reinstall instrumentation and rebuild your target.
         Run the recompiled target with afl-fuzz for a while and then check the
         file that you wrote with the backtrace information.
         Alternatively you can use `gdb` to hook __sanitizer_cov_trace_pc_guard_init
@@ -193,20 +191,20 @@ afl-clang-fast PCGUARD and afl-clang-lto LTO instrumentation.
         and set a write breakpoint to that address (`watch 0x.....`).
 
      c) in all other instrumentation types this is not possible. So just
-        recompile with the two mentioned above. This is just for
+        recompile with the the two mentioned above. This is just for
         identifying the functions that have unstable edges.
 
   3. Third step: create a text file with the filenames/functions
 
      Identify which source code files contain the functions that you need to
      remove from instrumentation, or just specify the functions you want to
-     skip for instrumentation. Note that optimization might inline functions!
+     skip instrumenting. Note that optimization might inline functions!
 
-     Simply follow this document on how to do this: [llvm_mode/README.instrument_list.md](llvm_mode/README.instrument_list.md)
+     Simply follow this document on how to do this: [instrumentation/README.instrument_list.md](instrumentation/README.instrument_list.md)
      If PCGUARD is used, then you need to follow this guide (needs llvm 12+!):
      [http://clang.llvm.org/docs/SanitizerCoverage.html#partially-disabling-instrumentation](http://clang.llvm.org/docs/SanitizerCoverage.html#partially-disabling-instrumentation)
 
-     Only exclude those functions from instrumentation that provide no value
+     Only deny those functions from instrumentation that provide no value
      for coverage - that is if it does not process any fuzz data directly
      or indirectly (e.g. hash maps, thread management etc.).
      If however a function directly or indirectly handles fuzz data then you
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index 766f24d7..fb7b5642 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -24,7 +24,7 @@ There are no special dependencies to speak of; you will need GNU make and a
 working compiler (gcc or clang). Some of the optional scripts bundled with the
 program may depend on bash, gdb, and similar basic tools.
 
-If you are using clang, please review llvm_mode/README.md; the LLVM
+If you are using clang, please review README.llvm.md; the LLVM
 integration mode can offer substantial performance gains compared to the
 traditional approach.
 
@@ -52,10 +52,10 @@ sudo gmake install
 Keep in mind that if you are using csh as your shell, the syntax of some of the
 shell commands given in the README.md and other docs will be different.
 
-The `llvm_mode` requires a dynamically linked, fully-operational installation of
+The `llvm` requires a dynamically linked, fully-operational installation of
 clang. At least on FreeBSD, the clang binaries are static and do not include
 some of the essential tools, so if you want to make it work, you may need to
-follow the instructions in llvm_mode/README.md.
+follow the instructions in README.llvm.md.
 
 Beyond that, everything should work as advertised.
 
@@ -97,27 +97,24 @@ and definitely don't look POSIX-compliant. This means two things:
 User emulation mode of QEMU does not appear to be supported on MacOS X, so
 black-box instrumentation mode (`-Q`) will not work.
 
-The llvm_mode requires a fully-operational installation of clang. The one that
+The llvm instrumentation requires a fully-operational installation of clang. The one that
 comes with Xcode is missing some of the essential headers and helper tools.
-See llvm_mode/README.md for advice on how to build the compiler from scratch.
+See README.llvm.md for advice on how to build the compiler from scratch.
 
 ## 4. Linux or *BSD on non-x86 systems
 
 Standard build will fail on non-x86 systems, but you should be able to
 leverage two other options:
 
-  - The LLVM mode (see llvm_mode/README.md), which does not rely on
+  - The LLVM mode (see README.llvm.md), which does not rely on
     x86-specific assembly shims. It's fast and robust, but requires a
     complete installation of clang.
   - The QEMU mode (see qemu_mode/README.md), which can be also used for
     fuzzing cross-platform binaries. It's slower and more fragile, but
     can be used even when you don't have the source for the tested app.
 
-If you're not sure what you need, you need the LLVM mode. To get it, try:
-
-```bash
-AFL_NO_X86=1 gmake && gmake -C llvm_mode
-```
+If you're not sure what you need, you need the LLVM mode, which is built by
+default.
 
 ...and compile your target program with afl-clang-fast or afl-clang-fast++
 instead of the traditional afl-gcc or afl-clang wrappers.
diff --git a/docs/env_variables.md b/docs/env_variables.md
index c47d10e8..9d289f6d 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -5,13 +5,25 @@
   users or for some types of custom fuzzing setups. See README.md for the general
   instruction manual.
 
-## 1) Settings for afl-gcc, afl-clang, and afl-as - and gcc_plugin afl-gcc-fast
+## 1) Settings for all compilers
 
-Because they can't directly accept command-line options, the compile-time
-tools make fairly broad use of environmental variables:
+Starting with afl++ 3.0 there is only one compiler: afl-cc
+To select the different instrumentation modes this can be done by
+  1. passing --afl-MODE command line options to the compiler
+  2. use a symlink to afl-cc: afl-gcc, afl-g++, afl-clang, afl-clang++,
+     afl-clang-fast, afl-clang-fast++, afl-clang-lto, afl-clang-lto++,
+     afl-gcc-fast, afl-g++-fast
+  3. using the environment variable AFL_CC_COMPILER with MODE
 
-  - Most afl tools do not print any output if stdout/stderr are redirected.
-    If you want to save the output in a file then set the AFL_DEBUG
+MODE can one of LTO (afl-clang-lto*), LLVM (afl-clang-fast*), GCC_PLUGIN
+(afl-g*-fast) or GCC (afl-gcc/afl-g++).
+
+Because beside the --afl-MODE command no afl specific command-line options
+are accepted, the compile-time tools make fairly broad use of environmental
+variables:
+
+  - Most afl tools do not print any ouput if stout/stderr are redirected.
+    If you want to have the output into a file then set the AFL_DEBUG
     environment variable.
     This is sadly necessary for various build processes which fail otherwise.
 
@@ -24,6 +36,8 @@ tools make fairly broad use of environmental variables:
     will cause problems in programs built with -Werror, simply because -O3
     enables more thorough code analysis and can spew out additional warnings.
     To disable optimizations, set AFL_DONT_OPTIMIZE.
+    However if -O... and/or -fno-unroll-loops are set, these are not
+    overriden.
 
   - Setting AFL_USE_ASAN automatically enables ASAN, provided that your
     compiler supports that. Note that fuzzing with ASAN is mildly challenging
@@ -44,7 +58,7 @@ tools make fairly broad use of environmental variables:
     you instrument hand-written assembly when compiling clang code by plugging
     a normalizer into the chain. (There is no equivalent feature for GCC.)
 
-  - Setting AFL_INST_RATIO to a percentage between 0% and 100% controls the
+  - Setting AFL_INST_RATIO to a percentage between 0 and 100% controls the
     probability of instrumenting every branch. This is (very rarely) useful
     when dealing with exceptionally complex programs that saturate the output
     bitmap. Examples include v8, ffmpeg, and perl.
@@ -55,19 +69,16 @@ tools make fairly broad use of environmental variables:
     Setting AFL_INST_RATIO to 0 is a valid choice. This will instrument only
     the transitions between function entry points, but not individual branches.
 
+    Note that this is an outdated variable. A few instances (e.g. afl-gcc)
+    still support these, but state-of-the-art (e.g. LLVM LTO and LLVM PCGUARD)
+    do not need this.
+
   - AFL_NO_BUILTIN causes the compiler to generate code suitable for use with
     libtokencap.so (but perhaps running a bit slower than without the flag).
 
   - TMPDIR is used by afl-as for temporary files; if this variable is not set,
     the tool defaults to /tmp.
 
-  - Setting AFL_KEEP_ASSEMBLY prevents afl-as from deleting instrumented
-    assembly files. Useful for troubleshooting problems or understanding how
-    the tool works. To get them in a predictable place, try something like:
-
-    mkdir assembly_here
-    TMPDIR=$PWD/assembly_here AFL_KEEP_ASSEMBLY=1 make clean all
-
   - If you are a weird person that wants to compile and instrument asm
     text files then use the AFL_AS_FORCE_INSTRUMENT variable:
       AFL_AS_FORCE_INSTRUMENT=1 afl-gcc foo.s -o foo
@@ -78,19 +89,24 @@ tools make fairly broad use of environmental variables:
   - Setting AFL_CAL_FAST will speed up the initial calibration, if the
     application is very slow
 
-## 2) Settings for afl-clang-fast / afl-clang-fast++ / afl-gcc-fast / afl-g++-fast
+## 2) Settings for LLVM and LTO: afl-clang-fast / afl-clang-fast++ / afl-clang-lto / afl-clang-lto++
 
-The native instrumentation helpers (llvm_mode and gcc_plugin) accept a subset
+The native instrumentation helpers (instrumentation and gcc_plugin) accept a subset
 of the settings discussed in section #1, with the exception of:
 
+  - LLVM modes support `AFL_LLVM_DICT2FILE=/absolute/path/file.txt` which will
+    write all constant string comparisons  to this file to be used with
+    afl-fuzz' `-x` option.
+
   - AFL_AS, since this toolchain does not directly invoke GNU as.
 
   - TMPDIR and AFL_KEEP_ASSEMBLY, since no temporary assembly files are
     created.
 
-  - AFL_INST_RATIO, as we by default use collision free instrumentation.
+  - AFL_INST_RATIO, as we by default collision free instrumentation is used.
+    Not all passes support this option though as it is an outdated feature.
 
-Then there are a few specific features that are only available in llvm_mode:
+Then there are a few specific features that are only available in instrumentation:
 
 ### Select the instrumentation mode
 
@@ -121,7 +137,7 @@ Then there are a few specific features that are only available in llvm_mode:
 
     None of the following options are necessary to be used and are rather for
     manual use (which only ever the author of this LTO implementation will use).
-    These are used if several seperated instrumentations are performed which
+    These are used if several seperated instrumentation are performed which
     are then later combined.
 
    - AFL_LLVM_DOCUMENT_IDS=file will document to a file which edge ID was given
@@ -136,7 +152,7 @@ Then there are a few specific features that are only available in llvm_mode:
    - AFL_LLVM_LTO_DONTWRITEID prevents that the highest location ID written
      into the instrumentation is set in a global variable
 
-    See llvm_mode/README.LTO.md for more information.
+    See instrumentation/README.LTO.md for more information.
 
 ### INSTRIM
 
@@ -154,7 +170,7 @@ Then there are a few specific features that are only available in llvm_mode:
       afl-fuzz will only be able to see the path the loop took, but not how
       many times it was called (unless it is a complex loop).
 
-    See llvm_mode/README.instrim.md
+    See instrumentation/README.instrim.md
 
 ### NGRAM
 
@@ -165,7 +181,7 @@ Then there are a few specific features that are only available in llvm_mode:
       config.h to at least 18 and maybe up to 20 for this as otherwise too
       many map collisions occur.
 
-    See llvm_mode/README.ctx.md
+    See instrumentation/README.ctx.md
 
 ### CTX
 
@@ -176,7 +192,7 @@ Then there are a few specific features that are only available in llvm_mode:
       config.h to at least 18 and maybe up to 20 for this as otherwise too
       many map collisions occur.
 
-    See llvm_mode/README.ngram.md
+    See instrumentation/README.ngram.md
 
 ### LAF-INTEL
 
@@ -196,17 +212,17 @@ Then there are a few specific features that are only available in llvm_mode:
 
     - Setting AFL_LLVM_LAF_ALL sets all of the above
 
-    See llvm_mode/README.laf-intel.md for more information.
+    See instrumentation/README.laf-intel.md for more information.
 
 ### INSTRUMENT LIST (selectively instrument files and functions)
 
-    This feature allows selective instrumentation of the source
+    This feature allows selectively instrumentation of the source
 
     - Setting AFL_LLVM_ALLOWLIST or AFL_LLVM_DENYLIST with a filenames and/or
       function will only instrument (or skip) those files that match the names
       listed in the specified file.
 
-    See llvm_mode/README.instrument_list.md for more information.
+    See instrumentation/README.instrument_list.md for more information.
 
 ### NOT_ZERO
 
@@ -220,27 +236,34 @@ Then there are a few specific features that are only available in llvm_mode:
       test. If the target performs only few loops then this will give a
       small performance boost.
 
-    See llvm_mode/README.neverzero.md
+    See instrumentation/README.neverzero.md
 
 ### CMPLOG
 
     - Setting AFL_LLVM_CMPLOG=1 during compilation will tell afl-clang-fast to
-      produce a CmpLog binary. See llvm_mode/README.cmplog.md
+      produce a CmpLog binary. See instrumentation/README.cmplog.md
 
-    See llvm_mode/README.neverzero.md
+    See instrumentation/README.neverzero.md
 
-Then there are a few specific features that are only available in the gcc_plugin:
+## 3) Settings for GCC / GCC_PLUGIN modes
 
-### INSTRUMENT_FILE
+Then there are a few specific features that are only available in GCC and
+GCC_PLUGIN mode.
 
-    This feature allows selective instrumentation of the source
+  - Setting AFL_KEEP_ASSEMBLY prevents afl-as from deleting instrumented
+    assembly files. Useful for troubleshooting problems or understanding how
+    the tool works. (GCC mode only)
+    To get them in a predictable place, try something like:
 
-    - Setting AFL_GCC_INSTRUMENT_FILE with a filename will only instrument those
-      files that match the names listed in this file (one filename per line).
+    mkdir assembly_here
+    TMPDIR=$PWD/assembly_here AFL_KEEP_ASSEMBLY=1 make clean all
 
+  - Setting AFL_GCC_INSTRUMENT_FILE with a filename will only instrument those
+    files that match the names listed in this file (one filename per line).
     See gcc_plugin/README.instrument_list.md for more information.
+    (GCC_PLUGIN mode only)
 
-## 3) Settings for afl-fuzz
+## 4) Settings for afl-fuzz
 
 The main fuzzer binary accepts several options that disable a couple of sanity
 checks or alter some of the more exotic semantics of the tool:
@@ -278,14 +301,6 @@ checks or alter some of the more exotic semantics of the tool:
     don't want AFL to spend too much time classifying that stuff and just
     rapidly put all timeouts in that bin.
 
-  - Setting AFL_FORKSRV_INIT_TMOUT allows yout to specify a different timeout
-    to wait for the forkserver to spin up. The default is the `-t` value times
-    `FORK_WAIT_MULT` from `config.h` (usually 10), so for a `-t 100`, the
-    default would wait `1000` milis. Setting a different time here is useful
-    if the target has a very slow startup time, for example when doing
-    full-system fuzzing or emulation, but you don't want the actual runs
-    to wait too long for timeouts.
-
   - AFL_NO_ARITH causes AFL to skip most of the deterministic arithmetics.
     This can be useful to speed up the fuzzing of text-based file formats.
 
@@ -377,22 +392,12 @@ checks or alter some of the more exotic semantics of the tool:
     Note that this setting inhibits some of the user-friendly diagnostics
     normally done when starting up the forkserver and causes a pretty
     significant performance drop.
-  
-  - Setting AFL_MAX_DET_EXTRAS changes the count of dictionary entries/extras
-    (default 200), after which the entries will be used probabilistically.
-    So, if the dict/extras file (`-x`) contains more tokens than this threshold,
-    not all of the tokens will be used in each fuzzing step, every time.
-    Instead, there is a chance that the entry will be skipped during fuzzing.
-    This makes sure that the fuzzer doesn't spend all its time only inserting
-    the extras, but will still do other mutations. However, it decreases the
-    likelihood for each token to be inserted, before the next queue entry is fuzzed.
-    Either way, all tokens will be used eventually, in a longer fuzzing campaign.
 
   - Outdated environment variables that are that not supported anymore:
     AFL_DEFER_FORKSRV
     AFL_PERSISTENT
 
-## 4) Settings for afl-qemu-trace
+## 5) Settings for afl-qemu-trace
 
 The QEMU wrapper used to instrument binary-only code supports several settings:
 
@@ -446,7 +451,7 @@ The QEMU wrapper used to instrument binary-only code supports several settings:
     stack pointer in which QEMU can find the return address when `start addr` is
     hitted.
 
-## 5) Settings for afl-cmin
+## 6) Settings for afl-cmin
 
 The corpus minimization script offers very little customization:
 
@@ -472,12 +477,12 @@ to match when minimizing crashes. This will make minimization less useful, but
 may prevent the tool from "jumping" from one crashing condition to another in
 very buggy software. You probably want to combine it with the -e flag.
 
-## 7) Settings for afl-analyze
+## 8) Settings for afl-analyze
 
 You can set AFL_ANALYZE_HEX to get file offsets printed as hexadecimal instead
 of decimal.
 
-## 8) Settings for libdislocator
+## 9) Settings for libdislocator
 
 The library honors these environmental variables:
 
@@ -499,12 +504,12 @@ The library honors these environmental variables:
   - AFL_ALIGNED_ALLOC=1 will force the alignment of the allocation size to
     max_align_t to be compliant with the C standard.
 
-## 9) Settings for libtokencap
+## 10) Settings for libtokencap
 
 This library accepts AFL_TOKEN_FILE to indicate the location to which the
 discovered tokens should be written.
 
-## 10) Third-party variables set by afl-fuzz & other tools
+## 11) Third-party variables set by afl-fuzz & other tools
 
 Several variables are not directly interpreted by afl-fuzz, but are set to
 optimal values if not already present in the environment:
diff --git a/docs/ideas.md b/docs/ideas.md
index 65e2e8e6..a5d40963 100644
--- a/docs/ideas.md
+++ b/docs/ideas.md
@@ -3,49 +3,6 @@
 In the following, we describe a variety of ideas that could be implemented
 for future AFL++ versions.
 
-For GSOC2020 interested students please see
-[https://github.com/AFLplusplus/AFLplusplus/issues/208](https://github.com/AFLplusplus/AFLplusplus/issues/208)
-
-## Flexible Grammar Mutator (currently in development)
-
-Currently, AFL++'s mutation does not have deeper knowledge about the fuzzed
-binary, apart from feedback, even though the developer may have insights
-about the target.
-
-A developer may choose to provide dictionaries and implement own mutations
-in python or C, but an easy mutator that behaves according to a given grammar,
-does not exist.
-
-State-of-the-art research on grammar fuzzing has some problems in their
-implementations like code quality, scalability, or ease of use and other
-common issues of the academic code.
-
-We aim to develop a pluggable grammar mutator for afl++ that combines
-various results.
-
-Mentor: andreafioraldi 
-
-## perf-fuzz Linux Kernel Module
-
-Expand on [snapshot LKM](https://github.com/AFLplusplus/AFL-Snapshot-LKM)
-To make it thread safe, can snapshot several processes at once and increase
-overall performance.
-
-Mentor: any
-
-## QEMU 5-based Instrumentation
-
-First tests to use QEMU 4 for binary-only AFL++ showed that caching behavior
-changed, which vastly decreases fuzzing speeds.
-
-In this task test if QEMU 5 performs better and port the afl++ QEMU 3.1
-patches to QEMU 5.
-
-Understanding the current instrumentation and fixing the current caching
-issues will be needed.
-
-Mentor: andreafioraldi
-
 ## WASM Instrumentation
 
 Currently, AFL++ can be used for source code fuzzing and traditional binaries.
@@ -66,20 +23,6 @@ Either improve a single mutator thorugh learning of many different bugs
 
 Mentor: domenukk
 
-## Reengineer `afl-fuzz` as Thread Safe, Embeddable Library (currently in development)
-
-Right now, afl-fuzz is single threaded, cannot safely be embedded in tools,
-and not multi-threaded. It makes use of a large number of globals, must always
-be the parent process and exec child processes. 
-Instead, afl-fuzz could be refactored to contain no global state and globals.
-This allows for different use cases that could be implemented during this
-project.
-Note that in the mean time a lot has happened here already, but e.g. making
-it all work and implement multithreading in afl-fuzz ... there is still quite
-some work to do.
-
-Mentor: hexcoder- or vanhauser-thc
-
 ## Collision-free Binary-Only Maps
 
 AFL++ supports collison-free maps using an LTO (link-time-optimization) pass.
diff --git a/docs/life_pro_tips.md b/docs/life_pro_tips.md
index a5bd7286..0004c297 100644
--- a/docs/life_pro_tips.md
+++ b/docs/life_pro_tips.md
@@ -30,10 +30,10 @@ Check out the `fuzzer_stats` file in the AFL output dir or try `afl-whatsup`.
 It could be important - consult docs/status_screen.md right away!
 
 ## Know your target? Convert it to persistent mode for a huge performance gain!
-Consult section #5 in llvm_mode/README.md for tips.
+Consult section #5 in README.llvm.md for tips.
 
 ## Using clang? 
-Check out llvm_mode/ for a faster alternative to afl-gcc!
+Check out instrumentation/ for a faster alternative to afl-gcc!
 
 ## Did you know that AFL can fuzz closed-source or cross-platform binaries?
 Check out qemu_mode/README.md and unicorn_mode/README.md for more.
diff --git a/docs/perf_tips.md b/docs/perf_tips.md
index 731dc238..fbcb4d8d 100644
--- a/docs/perf_tips.md
+++ b/docs/perf_tips.md
@@ -51,7 +51,7 @@ a file.
 ## 3. Use LLVM instrumentation
 
 When fuzzing slow targets, you can gain 20-100% performance improvement by
-using the LLVM-based instrumentation mode described in [the llvm_mode README](../llvm_mode/README.md).
+using the LLVM-based instrumentation mode described in [the instrumentation README](../instrumentation/README.llvm.md).
 Note that this mode requires the use of clang and will not work with GCC.
 
 The LLVM mode also offers a "persistent", in-process fuzzing mode that can
@@ -62,12 +62,12 @@ modes require you to edit the source code of the fuzzed program, but the
 changes often amount to just strategically placing a single line or two.
 
 If there are important data comparisons performed (e.g. `strcmp(ptr, MAGIC_HDR)`)
-then using laf-intel (see llvm_mode/README.laf-intel.md) will help `afl-fuzz` a lot
+then using laf-intel (see instrumentation/README.laf-intel.md) will help `afl-fuzz` a lot
 to get to the important parts in the code.
 
 If you are only interested in specific parts of the code being fuzzed, you can
 instrument_files the files that are actually relevant. This improves the speed and
-accuracy of afl. See llvm_mode/README.instrument_list.md
+accuracy of afl. See instrumentation/README.instrument_list.md
 
 Also use the InsTrim mode on larger binaries, this improves performance and
 coverage a lot.
@@ -110,7 +110,7 @@ e.g.:
   https://launchpad.net/libeatmydata
 
 In programs that are slow due to unavoidable initialization overhead, you may
-want to try the LLVM deferred forkserver mode (see llvm_mode/README.md),
+want to try the LLVM deferred forkserver mode (see README.llvm.md),
 which can give you speed gains up to 10x, as mentioned above.
 
 Last but not least, if you are using ASAN and the performance is unacceptable,
diff --git a/docs/sister_projects.md b/docs/sister_projects.md
index a501ecbd..640e59f7 100644
--- a/docs/sister_projects.md
+++ b/docs/sister_projects.md
@@ -52,7 +52,7 @@ options.
 Provides an evolutionary instrumentation-guided fuzzing harness that allows
 some programs to be fuzzed without the fork / execve overhead. (Similar
 functionality is now available as the "persistent" feature described in
-[the llvm_mode readme](../llvm_mode/README.md))
+[the llvm_mode readme](../instrumentation/README.llvm.md))
 
 http://llvm.org/docs/LibFuzzer.html
 
@@ -245,7 +245,7 @@ https://code.google.com/p/address-sanitizer/wiki/AsanCoverage#Coverage_counters
 ### AFL JS (Han Choongwoo)
 
 One-off optimizations to speed up the fuzzing of JavaScriptCore (now likely
-superseded by LLVM deferred forkserver init - see llvm_mode/README.md).
+superseded by LLVM deferred forkserver init - see README.llvm.md).
 
 https://github.com/tunz/afl-fuzz-js
 
diff --git a/docs/status_screen.md b/docs/status_screen.md
index b89468ce..2eeb8f3f 100644
--- a/docs/status_screen.md
+++ b/docs/status_screen.md
@@ -324,7 +324,7 @@ there are several things to look at:
   - Multiple threads executing at once in semi-random order. This is harmless
     when the 'stability' metric stays over 90% or so, but can become an issue
     if not. Here's what to try:
-    * Use afl-clang-fast from [llvm_mode](../llvm_mode/) - it uses a thread-local tracking
+    * Use afl-clang-fast from [instrumentation](../instrumentation/) - it uses a thread-local tracking
       model that is less prone to concurrency issues,
     * See if the target can be compiled or run without threads. Common
       `./configure` options include `--without-threads`, `--disable-pthreads`, or
diff --git a/examples/README.md b/examples/README.md
index d28aadbe..46a92c6e 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -47,7 +47,7 @@ Here's a quick overview of the stuff you can find in this directory:
 
 Note that the minimize_corpus.sh tool has graduated from the examples/
 directory and is now available as ../afl-cmin. The LLVM mode has likewise
-graduated to ../llvm_mode/*.
+graduated to ../instrumentation/*.
 
 Most of the tools in this directory are meant chiefly as examples that need to
 be tweaked for your specific needs. They come with some basic documentation,
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index ff5446e9..82e55fc4 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -27,7 +27,7 @@ EOF
 # Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang.
 clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c
 # Build afl-llvm-rt.o.c from the AFL distribution.
-clang -c -w $AFL_HOME/llvm_mode/afl-llvm-rt.o.c
+clang -c -w $AFL_HOME/instrumentation/afl-llvm-rt.o.c
 # Build this file, link it with afl-llvm-rt.o.o and the target code.
 clang++ afl_driver.cpp test_fuzzer.o afl-llvm-rt.o.o
 # Run AFL:
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 4281c554..9e469864 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -935,6 +935,7 @@ u8 has_new_bits(afl_state_t *, u8 *);
 
 void load_extras_file(afl_state_t *, u8 *, u32 *, u32 *, u32);
 void load_extras(afl_state_t *, u8 *);
+void dedup_extras(afl_state_t *);
 void add_extra(afl_state_t *afl, u8 *mem, u32 len);
 void maybe_add_auto(afl_state_t *, u8 *, u32);
 void save_auto(afl_state_t *);
@@ -972,7 +973,7 @@ u8   fuzz_one(afl_state_t *);
 void bind_to_free_cpu(afl_state_t *);
 #endif
 void   setup_post(afl_state_t *);
-void   read_testcases(afl_state_t *);
+void   read_testcases(afl_state_t *, u8 *);
 void   perform_dry_run(afl_state_t *);
 void   pivot_inputs(afl_state_t *);
 u32    find_start_position(afl_state_t *);
diff --git a/include/config.h b/include/config.h
index 77407d50..8cc70075 100644
--- a/include/config.h
+++ b/include/config.h
@@ -28,7 +28,7 @@
 /* Version string: */
 
 // c = release, d = volatile github dev, e = experimental branch
-#define VERSION "++2.68c"
+#define VERSION "++3.00a"
 
 /******************************************************
  *                                                    *
@@ -195,7 +195,7 @@
    steps; past this point, the "extras/user" step will be still carried out,
    but with proportionally lower odds: */
 
-#define MAX_DET_EXTRAS 200
+#define MAX_DET_EXTRAS 256
 
 /* Maximum number of auto-extracted dictionary tokens to actually use in fuzzing
    (first value), and to keep in memory as candidates. The latter should be much
diff --git a/include/envs.h b/include/envs.h
index 2dc1dbbf..d9968fcd 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -69,6 +69,7 @@ static char *afl_environment_variables[] = {
     "AFL_LLVM_CMPLOG",
     "AFL_LLVM_INSTRIM",
     "AFL_LLVM_CTX",
+    "AFL_LLVM_DICT2FILE",
     "AFL_LLVM_DOCUMENT_IDS",
     "AFL_LLVM_INSTRUMENT",
     "AFL_LLVM_INSTRIM_LOOPHEAD",
diff --git a/qemu_mode/patches/afl-qemu-cpu-inl.h b/qemu_mode/patches/afl-qemu-cpu-inl.h
index 63b7581d..0e38f38b 100644
--- a/qemu_mode/patches/afl-qemu-cpu-inl.h
+++ b/qemu_mode/patches/afl-qemu-cpu-inl.h
@@ -466,7 +466,7 @@ void afl_forkserver(CPUState *cpu) {
 }
 
 /* A simplified persistent mode handler, used as explained in
- * llvm_mode/README.md. */
+ * instrumentation/README.llvm.md */
 
 void afl_persistent_loop(void) {
 
diff --git a/src/afl-fuzz-init.c b/src/afl-fuzz-init.c
index 713849a1..1351d274 100644
--- a/src/afl-fuzz-init.c
+++ b/src/afl-fuzz-init.c
@@ -626,6 +626,7 @@ if (dir == NULL) {
   if (!access(fn1, F_OK)) {
 
     afl->in_dir = fn1;
+    subdirs = 0;
 
   } else {
 
@@ -1063,7 +1064,7 @@ restart_outer_cull_loop:
 
     }
 
-    afl->q_prev100 = afl->queue = afl->queue_top = afl->queue;
+    afl->queue = afl->queue_top = afl->queue;
 
   }
 
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index db91813b..af52aa45 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -138,8 +138,7 @@ static u8 check_if_text(struct queue_entry *q) {
     }
 
     // non-overlong 2-byte
-    if (len - offset > 1 &&
-        ((0xC2 <= buf[offset + 0] && buf[offset + 0] <= 0xDF) &&
+    if (len - offset > 1 && ((0xC2 <= buf[offset + 0] && buf[offset + 0] <= 0xDF) &&
          (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF))) {
 
       offset += 2;
@@ -230,7 +229,7 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
 
   } else {
 
-    afl->q_prev100 = afl->queue = afl->queue_top = q;
+    afl->queue = afl->queue_top = q;
 
   }
 
@@ -274,15 +273,15 @@ void add_to_queue(afl_state_t *afl, u8 *fname, u32 len, u8 passed_det) {
 
 void destroy_queue(afl_state_t *afl) {
 
-  struct queue_entry *q = afl->queue, *n;
+  struct queue_entry *q;
+  u32                 i;
 
-  while (q) {
+  for (i = 0; i < afl->queued_paths; i++) {
 
-    n = q->next;
+    q = afl->queue_buf[i];
     ck_free(q->fname);
     ck_free(q->trace_mini);
     ck_free(q);
-    q = n;
 
   }
 
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 51eed14b..c60c65aa 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -982,10 +982,9 @@ void show_stats(afl_state_t *afl) {
 void show_init_stats(afl_state_t *afl) {
 
   struct queue_entry *q = afl->queue;
-  u32                 min_bits = 0, max_bits = 0;
+  u32                 min_bits = 0, max_bits = 0, max_len = 0, count = 0;
   u64                 min_us = 0, max_us = 0;
   u64                 avg_us = 0;
-  u32                 max_len = 0;
 
   u8 val_bufs[4][STRINGIFY_VAL_SIZE_MAX];
 #define IB(i) val_bufs[(i)], sizeof(val_bufs[(i)])
@@ -1006,6 +1005,7 @@ void show_init_stats(afl_state_t *afl) {
 
     if (q->len > max_len) { max_len = q->len; }
 
+    ++count;
     q = q->next;
 
   }
@@ -1072,10 +1072,10 @@ void show_init_stats(afl_state_t *afl) {
   OKF("Here are some useful stats:\n\n"
 
       cGRA "    Test case count : " cRST
-      "%u favored, %u variable, %u total\n" cGRA "       Bitmap range : " cRST
+      "%u favored, %u variable, %u ignored, %u total\n" cGRA "       Bitmap range : " cRST
       "%u to %u bits (average: %0.02f bits)\n" cGRA
       "        Exec timing : " cRST "%s to %s us (average: %s us)\n",
-      afl->queued_favored, afl->queued_variable, afl->queued_paths, min_bits,
+      afl->queued_favored, afl->queued_variable, afl->queued_paths - count, afl->queued_paths, min_bits,
       max_bits,
       ((double)afl->total_bitmap_size) /
           (afl->total_bitmap_entries ? afl->total_bitmap_entries : 1),
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index bfaa22e8..73ca6aaa 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1133,8 +1133,9 @@ int main(int argc, char **argv_orig, char **envp) {
 
   setup_cmdline_file(afl, argv + optind);
 
-  read_testcases(afl);
+  read_testcases(afl, NULL);
   // read_foreign_testcases(afl, 1); for the moment dont do this
+  OKF("Loaded a total of %u seeds.", afl->queued_paths);
 
   load_auto(afl);
 
diff --git a/test/test-gcc-plugin.sh b/test/test-gcc-plugin.sh
index 2ed10a72..8b8cbd8e 100755
--- a/test/test-gcc-plugin.sh
+++ b/test/test-gcc-plugin.sh
@@ -3,7 +3,7 @@
 . ./test-pre.sh
 
 $ECHO "$BLUE[*] Testing: gcc_plugin"
-test -e ../afl-gcc-fast -a -e ../afl-gcc-rt.o && {
+test -e ../afl-gcc-fast -a -e ../afl-compiler-rt.o && {
   SAVE_AFL_CC=${AFL_CC}
   export AFL_CC=`command -v gcc`
   ../afl-gcc-fast -o test-instr.plain.gccpi ../test-instr.c > /dev/null 2>&1
diff --git a/test/test-unittests.sh b/test/test-unittests.sh
index f540b5f8..58c2eea9 100755
--- a/test/test-unittests.sh
+++ b/test/test-unittests.sh
@@ -7,3 +7,5 @@ unset AFL_CC
 make -C .. unit || CODE=1 INCOMPLETE=1 :
 
 . ./test-post.sh
+
+rm -rf unittests/unit_hash unittests/unit_rand
-- 
cgit 1.4.1


From d4b04f07904ca202586133facba5406cf10aa1be Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Thu, 29 Oct 2020 20:06:55 +0100
Subject: fix compile warning in FreeBSD

---
 examples/aflpp_driver/aflpp_driver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
index 82e55fc4..017aa72b 100644
--- a/examples/aflpp_driver/aflpp_driver.c
+++ b/examples/aflpp_driver/aflpp_driver.c
@@ -197,7 +197,7 @@ static void dup_and_close_stderr() {
   FILE *new_output_file = fdopen(output_fd, "w");
   if (!new_output_file) abort();
   if (!__sanitizer_set_report_fd) return;
-  __sanitizer_set_report_fd((void *)output_fd);
+  __sanitizer_set_report_fd((void *)(long int)output_fd);
   discard_output(output_fileno);
 
 }
-- 
cgit 1.4.1


From 61fe059ba2d1cd0106c0ffa4eaf1896c7912e275 Mon Sep 17 00:00:00 2001
From: hexcoder- <heiko@hexco.de>
Date: Thu, 5 Nov 2020 21:11:31 +0100
Subject: ignore build error (unsupported platform), so top level 'make tests'
 can be run

---
 examples/aflpp_driver/GNUmakefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'examples/aflpp_driver')

diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile
index 57e74be7..c1a087d7 100644
--- a/examples/aflpp_driver/GNUmakefile
+++ b/examples/aflpp_driver/GNUmakefile
@@ -12,7 +12,7 @@ CFLAGS := -O3 -funroll-loops -g
 all:	libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
 
 aflpp_driver.o:	aflpp_driver.c
-	$(LLVM_BINDIR)clang -I. -I../../include $(CFLAGS) -c aflpp_driver.c
+	-$(LLVM_BINDIR)clang -I. -I../../include $(CFLAGS) -c aflpp_driver.c
 
 libAFLDriver.a:	aflpp_driver.o
 	ar ru libAFLDriver.a aflpp_driver.o
-- 
cgit 1.4.1


From c05e4efbe9b4e7d1ff078b7a392621f2ca7572e6 Mon Sep 17 00:00:00 2001
From: vanhauser-thc <vh@thc.org>
Date: Tue, 1 Dec 2020 14:40:30 +0100
Subject: renamed examples/ to utils/

---
 GNUmakefile                                       |  36 +-
 README.md                                         |   7 +-
 docs/Changelog.md                                 |   1 +
 docs/FAQ.md                                       |   2 +-
 docs/binaryonly_fuzzing.md                        |   6 +-
 docs/custom_mutators.md                           |   4 +-
 docs/env_variables.md                             |   2 +-
 docs/life_pro_tips.md                             |   4 +-
 docs/notes_for_asan.md                            |   4 +-
 docs/parallel_fuzzing.md                          |   2 +-
 examples/README.md                                |  54 --
 examples/afl_frida/GNUmakefile                    |  23 -
 examples/afl_frida/Makefile                       |   2 -
 examples/afl_frida/README.md                      |  34 -
 examples/afl_frida/afl-frida.c                    | 542 ---------------
 examples/afl_frida/afl-frida.h                    |  53 --
 examples/afl_frida/libtestinstr.c                 |  35 -
 examples/afl_network_proxy/GNUmakefile            |  43 --
 examples/afl_network_proxy/Makefile               |   2 -
 examples/afl_network_proxy/README.md              |  61 --
 examples/afl_network_proxy/afl-network-client.c   | 415 ------------
 examples/afl_network_proxy/afl-network-server.c   | 720 --------------------
 examples/afl_proxy/Makefile                       |   7 -
 examples/afl_proxy/README.md                      |   9 -
 examples/afl_proxy/afl-proxy.c                    | 238 -------
 examples/afl_untracer/Makefile                    |  16 -
 examples/afl_untracer/README.md                   |  60 --
 examples/afl_untracer/TODO                        |   2 -
 examples/afl_untracer/afl-untracer.c              | 768 ----------------------
 examples/afl_untracer/ghidra_get_patchpoints.java |  84 ---
 examples/afl_untracer/ida_get_patchpoints.py      |  62 --
 examples/afl_untracer/libtestinstr.c              |  35 -
 examples/afl_untracer/libtestinstr.so             | Bin 17152 -> 0 bytes
 examples/afl_untracer/patches.txt                 |  34 -
 examples/aflpp_driver/GNUmakefile                 |  46 --
 examples/aflpp_driver/Makefile                    |   2 -
 examples/aflpp_driver/aflpp_driver.c              | 326 ---------
 examples/aflpp_driver/aflpp_driver_test.c         |  32 -
 examples/aflpp_driver/aflpp_qemu_driver.c         |  38 --
 examples/aflpp_driver/aflpp_qemu_driver_hook.c    |  22 -
 examples/analysis_scripts/queue2csv.sh            | 122 ----
 examples/argv_fuzzing/Makefile                    |  58 --
 examples/argv_fuzzing/README.md                   |  16 -
 examples/argv_fuzzing/argv-fuzz-inl.h             |  90 ---
 examples/argv_fuzzing/argvfuzz.c                  |  49 --
 examples/asan_cgroups/limit_memory.sh             | 157 -----
 examples/bash_shellshock/shellshock-fuzz.diff     |  59 --
 examples/canvas_harness/canvas_harness.html       | 170 -----
 examples/clang_asm_normalize/as                   |  75 ---
 examples/crash_triage/triage_crashes.sh           | 115 ----
 examples/custom_mutators/Makefile                 |   7 -
 examples/custom_mutators/README.md                |  35 -
 examples/custom_mutators/XmlMutatorMin.py         | 332 ----------
 examples/custom_mutators/common.py                |  40 --
 examples/custom_mutators/custom_mutator_helpers.h | 342 ----------
 examples/custom_mutators/example.c                | 376 -----------
 examples/custom_mutators/example.py               | 186 ------
 examples/custom_mutators/post_library_gif.so.c    | 165 -----
 examples/custom_mutators/post_library_png.so.c    | 163 -----
 examples/custom_mutators/simple-chunk-replace.py  |  64 --
 examples/custom_mutators/simple_example.c         |  74 ---
 examples/custom_mutators/wrapper_afl_min.py       | 118 ----
 examples/defork/Makefile                          |  64 --
 examples/defork/README.md                         |  11 -
 examples/defork/defork.c                          |  50 --
 examples/defork/forking_target.c                  |  49 --
 examples/distributed_fuzzing/sync_script.sh       |  97 ---
 examples/libpng_no_checksum/libpng-nocrc.patch    |  15 -
 examples/persistent_mode/Makefile                 |  10 -
 examples/persistent_mode/persistent_demo.c        | 112 ----
 examples/persistent_mode/persistent_demo_new.c    | 117 ----
 examples/persistent_mode/test-instr.c             |  69 --
 examples/qemu_persistent_hook/Makefile            |   6 -
 examples/qemu_persistent_hook/README.md           |  19 -
 examples/qemu_persistent_hook/read_into_rdi.c     |  34 -
 examples/qemu_persistent_hook/test.c              |  35 -
 examples/socket_fuzzing/Makefile                  |  61 --
 examples/socket_fuzzing/README.md                 |  11 -
 examples/socket_fuzzing/socketfuzz.c              | 110 ----
 instrumentation/README.gcc_plugin.md              |   2 +-
 instrumentation/README.persistent_mode.md         |   4 +-
 qemu_mode/README.md                               |   2 +-
 qemu_mode/README.persistent.md                    |   2 +-
 src/afl-as.c                                      |   2 +-
 test/test-custom-mutators.sh                      |   8 +-
 test/test-gcc-plugin.sh                           |   2 +-
 test/test-llvm-lto.sh                             |   2 +-
 test/test-llvm.sh                                 |   2 +-
 utils/README.md                                   |  54 ++
 utils/afl_frida/GNUmakefile                       |  23 +
 utils/afl_frida/Makefile                          |   2 +
 utils/afl_frida/README.md                         |  34 +
 utils/afl_frida/afl-frida.c                       | 542 +++++++++++++++
 utils/afl_frida/afl-frida.h                       |  53 ++
 utils/afl_frida/libtestinstr.c                    |  35 +
 utils/afl_network_proxy/GNUmakefile               |  43 ++
 utils/afl_network_proxy/Makefile                  |   2 +
 utils/afl_network_proxy/README.md                 |  61 ++
 utils/afl_network_proxy/afl-network-client.c      | 415 ++++++++++++
 utils/afl_network_proxy/afl-network-server.c      | 720 ++++++++++++++++++++
 utils/afl_proxy/Makefile                          |   7 +
 utils/afl_proxy/README.md                         |   9 +
 utils/afl_proxy/afl-proxy.c                       | 238 +++++++
 utils/afl_untracer/Makefile                       |  16 +
 utils/afl_untracer/README.md                      |  60 ++
 utils/afl_untracer/TODO                           |   2 +
 utils/afl_untracer/afl-untracer.c                 | 768 ++++++++++++++++++++++
 utils/afl_untracer/ghidra_get_patchpoints.java    |  84 +++
 utils/afl_untracer/ida_get_patchpoints.py         |  62 ++
 utils/afl_untracer/libtestinstr.c                 |  35 +
 utils/afl_untracer/patches.txt                    |  34 +
 utils/aflpp_driver/GNUmakefile                    |  46 ++
 utils/aflpp_driver/Makefile                       |   2 +
 utils/aflpp_driver/aflpp_driver.c                 | 326 +++++++++
 utils/aflpp_driver/aflpp_driver_test.c            |  32 +
 utils/aflpp_driver/aflpp_qemu_driver.c            |  38 ++
 utils/aflpp_driver/aflpp_qemu_driver_hook.c       |  22 +
 utils/analysis_scripts/queue2csv.sh               | 122 ++++
 utils/argv_fuzzing/Makefile                       |  58 ++
 utils/argv_fuzzing/README.md                      |  16 +
 utils/argv_fuzzing/argv-fuzz-inl.h                |  90 +++
 utils/argv_fuzzing/argvfuzz.c                     |  49 ++
 utils/asan_cgroups/limit_memory.sh                | 157 +++++
 utils/bash_shellshock/shellshock-fuzz.diff        |  59 ++
 utils/canvas_harness/canvas_harness.html          | 170 +++++
 utils/clang_asm_normalize/as                      |  75 +++
 utils/crash_triage/triage_crashes.sh              | 115 ++++
 utils/custom_mutators/Makefile                    |   7 +
 utils/custom_mutators/README.md                   |  35 +
 utils/custom_mutators/XmlMutatorMin.py            | 332 ++++++++++
 utils/custom_mutators/common.py                   |  40 ++
 utils/custom_mutators/custom_mutator_helpers.h    | 342 ++++++++++
 utils/custom_mutators/example.c                   | 376 +++++++++++
 utils/custom_mutators/example.py                  | 186 ++++++
 utils/custom_mutators/post_library_gif.so.c       | 165 +++++
 utils/custom_mutators/post_library_png.so.c       | 163 +++++
 utils/custom_mutators/simple-chunk-replace.py     |  64 ++
 utils/custom_mutators/simple_example.c            |  74 +++
 utils/custom_mutators/wrapper_afl_min.py          | 118 ++++
 utils/defork/Makefile                             |  64 ++
 utils/defork/README.md                            |  11 +
 utils/defork/defork.c                             |  50 ++
 utils/defork/forking_target.c                     |  49 ++
 utils/distributed_fuzzing/sync_script.sh          |  97 +++
 utils/libpng_no_checksum/libpng-nocrc.patch       |  15 +
 utils/persistent_mode/Makefile                    |  10 +
 utils/persistent_mode/persistent_demo.c           | 112 ++++
 utils/persistent_mode/persistent_demo_new.c       | 117 ++++
 utils/persistent_mode/test-instr.c                |  69 ++
 utils/qemu_persistent_hook/Makefile               |   6 +
 utils/qemu_persistent_hook/README.md              |  19 +
 utils/qemu_persistent_hook/read_into_rdi.c        |  34 +
 utils/qemu_persistent_hook/test.c                 |  35 +
 utils/socket_fuzzing/Makefile                     |  61 ++
 utils/socket_fuzzing/README.md                    |  11 +
 utils/socket_fuzzing/socketfuzz.c                 | 110 ++++
 156 files changed, 7496 insertions(+), 7494 deletions(-)
 delete mode 100644 examples/README.md
 delete mode 100644 examples/afl_frida/GNUmakefile
 delete mode 100644 examples/afl_frida/Makefile
 delete mode 100644 examples/afl_frida/README.md
 delete mode 100644 examples/afl_frida/afl-frida.c
 delete mode 100644 examples/afl_frida/afl-frida.h
 delete mode 100644 examples/afl_frida/libtestinstr.c
 delete mode 100644 examples/afl_network_proxy/GNUmakefile
 delete mode 100644 examples/afl_network_proxy/Makefile
 delete mode 100644 examples/afl_network_proxy/README.md
 delete mode 100644 examples/afl_network_proxy/afl-network-client.c
 delete mode 100644 examples/afl_network_proxy/afl-network-server.c
 delete mode 100644 examples/afl_proxy/Makefile
 delete mode 100644 examples/afl_proxy/README.md
 delete mode 100644 examples/afl_proxy/afl-proxy.c
 delete mode 100644 examples/afl_untracer/Makefile
 delete mode 100644 examples/afl_untracer/README.md
 delete mode 100644 examples/afl_untracer/TODO
 delete mode 100644 examples/afl_untracer/afl-untracer.c
 delete mode 100644 examples/afl_untracer/ghidra_get_patchpoints.java
 delete mode 100644 examples/afl_untracer/ida_get_patchpoints.py
 delete mode 100644 examples/afl_untracer/libtestinstr.c
 delete mode 100755 examples/afl_untracer/libtestinstr.so
 delete mode 100644 examples/afl_untracer/patches.txt
 delete mode 100644 examples/aflpp_driver/GNUmakefile
 delete mode 100644 examples/aflpp_driver/Makefile
 delete mode 100644 examples/aflpp_driver/aflpp_driver.c
 delete mode 100644 examples/aflpp_driver/aflpp_driver_test.c
 delete mode 100644 examples/aflpp_driver/aflpp_qemu_driver.c
 delete mode 100644 examples/aflpp_driver/aflpp_qemu_driver_hook.c
 delete mode 100755 examples/analysis_scripts/queue2csv.sh
 delete mode 100644 examples/argv_fuzzing/Makefile
 delete mode 100644 examples/argv_fuzzing/README.md
 delete mode 100644 examples/argv_fuzzing/argv-fuzz-inl.h
 delete mode 100644 examples/argv_fuzzing/argvfuzz.c
 delete mode 100755 examples/asan_cgroups/limit_memory.sh
 delete mode 100644 examples/bash_shellshock/shellshock-fuzz.diff
 delete mode 100644 examples/canvas_harness/canvas_harness.html
 delete mode 100755 examples/clang_asm_normalize/as
 delete mode 100755 examples/crash_triage/triage_crashes.sh
 delete mode 100644 examples/custom_mutators/Makefile
 delete mode 100644 examples/custom_mutators/README.md
 delete mode 100644 examples/custom_mutators/XmlMutatorMin.py
 delete mode 100644 examples/custom_mutators/common.py
 delete mode 100644 examples/custom_mutators/custom_mutator_helpers.h
 delete mode 100644 examples/custom_mutators/example.c
 delete mode 100644 examples/custom_mutators/example.py
 delete mode 100644 examples/custom_mutators/post_library_gif.so.c
 delete mode 100644 examples/custom_mutators/post_library_png.so.c
 delete mode 100644 examples/custom_mutators/simple-chunk-replace.py
 delete mode 100644 examples/custom_mutators/simple_example.c
 delete mode 100644 examples/custom_mutators/wrapper_afl_min.py
 delete mode 100644 examples/defork/Makefile
 delete mode 100644 examples/defork/README.md
 delete mode 100644 examples/defork/defork.c
 delete mode 100644 examples/defork/forking_target.c
 delete mode 100755 examples/distributed_fuzzing/sync_script.sh
 delete mode 100644 examples/libpng_no_checksum/libpng-nocrc.patch
 delete mode 100644 examples/persistent_mode/Makefile
 delete mode 100644 examples/persistent_mode/persistent_demo.c
 delete mode 100644 examples/persistent_mode/persistent_demo_new.c
 delete mode 100644 examples/persistent_mode/test-instr.c
 delete mode 100644 examples/qemu_persistent_hook/Makefile
 delete mode 100644 examples/qemu_persistent_hook/README.md
 delete mode 100644 examples/qemu_persistent_hook/read_into_rdi.c
 delete mode 100644 examples/qemu_persistent_hook/test.c
 delete mode 100644 examples/socket_fuzzing/Makefile
 delete mode 100644 examples/socket_fuzzing/README.md
 delete mode 100644 examples/socket_fuzzing/socketfuzz.c
 create mode 100644 utils/README.md
 create mode 100644 utils/afl_frida/GNUmakefile
 create mode 100644 utils/afl_frida/Makefile
 create mode 100644 utils/afl_frida/README.md
 create mode 100644 utils/afl_frida/afl-frida.c
 create mode 100644 utils/afl_frida/afl-frida.h
 create mode 100644 utils/afl_frida/libtestinstr.c
 create mode 100644 utils/afl_network_proxy/GNUmakefile
 create mode 100644 utils/afl_network_proxy/Makefile
 create mode 100644 utils/afl_network_proxy/README.md
 create mode 100644 utils/afl_network_proxy/afl-network-client.c
 create mode 100644 utils/afl_network_proxy/afl-network-server.c
 create mode 100644 utils/afl_proxy/Makefile
 create mode 100644 utils/afl_proxy/README.md
 create mode 100644 utils/afl_proxy/afl-proxy.c
 create mode 100644 utils/afl_untracer/Makefile
 create mode 100644 utils/afl_untracer/README.md
 create mode 100644 utils/afl_untracer/TODO
 create mode 100644 utils/afl_untracer/afl-untracer.c
 create mode 100644 utils/afl_untracer/ghidra_get_patchpoints.java
 create mode 100644 utils/afl_untracer/ida_get_patchpoints.py
 create mode 100644 utils/afl_untracer/libtestinstr.c
 create mode 100644 utils/afl_untracer/patches.txt
 create mode 100644 utils/aflpp_driver/GNUmakefile
 create mode 100644 utils/aflpp_driver/Makefile
 create mode 100644 utils/aflpp_driver/aflpp_driver.c
 create mode 100644 utils/aflpp_driver/aflpp_driver_test.c
 create mode 100644 utils/aflpp_driver/aflpp_qemu_driver.c
 create mode 100644 utils/aflpp_driver/aflpp_qemu_driver_hook.c
 create mode 100755 utils/analysis_scripts/queue2csv.sh
 create mode 100644 utils/argv_fuzzing/Makefile
 create mode 100644 utils/argv_fuzzing/README.md
 create mode 100644 utils/argv_fuzzing/argv-fuzz-inl.h
 create mode 100644 utils/argv_fuzzing/argvfuzz.c
 create mode 100755 utils/asan_cgroups/limit_memory.sh
 create mode 100644 utils/bash_shellshock/shellshock-fuzz.diff
 create mode 100644 utils/canvas_harness/canvas_harness.html
 create mode 100755 utils/clang_asm_normalize/as
 create mode 100755 utils/crash_triage/triage_crashes.sh
 create mode 100644 utils/custom_mutators/Makefile
 create mode 100644 utils/custom_mutators/README.md
 create mode 100644 utils/custom_mutators/XmlMutatorMin.py
 create mode 100644 utils/custom_mutators/common.py
 create mode 100644 utils/custom_mutators/custom_mutator_helpers.h
 create mode 100644 utils/custom_mutators/example.c
 create mode 100644 utils/custom_mutators/example.py
 create mode 100644 utils/custom_mutators/post_library_gif.so.c
 create mode 100644 utils/custom_mutators/post_library_png.so.c
 create mode 100644 utils/custom_mutators/simple-chunk-replace.py
 create mode 100644 utils/custom_mutators/simple_example.c
 create mode 100644 utils/custom_mutators/wrapper_afl_min.py
 create mode 100644 utils/defork/Makefile
 create mode 100644 utils/defork/README.md
 create mode 100644 utils/defork/defork.c
 create mode 100644 utils/defork/forking_target.c
 create mode 100755 utils/distributed_fuzzing/sync_script.sh
 create mode 100644 utils/libpng_no_checksum/libpng-nocrc.patch
 create mode 100644 utils/persistent_mode/Makefile
 create mode 100644 utils/persistent_mode/persistent_demo.c
 create mode 100644 utils/persistent_mode/persistent_demo_new.c
 create mode 100644 utils/persistent_mode/test-instr.c
 create mode 100644 utils/qemu_persistent_hook/Makefile
 create mode 100644 utils/qemu_persistent_hook/README.md
 create mode 100644 utils/qemu_persistent_hook/read_into_rdi.c
 create mode 100644 utils/qemu_persistent_hook/test.c
 create mode 100644 utils/socket_fuzzing/Makefile
 create mode 100644 utils/socket_fuzzing/README.md
 create mode 100644 utils/socket_fuzzing/socketfuzz.c

(limited to 'examples/aflpp_driver')

diff --git a/GNUmakefile b/GNUmakefile
index 521ab683..309a7d4c 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -500,8 +500,8 @@ code-format:
 	./.custom-format.py -i instrumentation/*.c
 	@#./.custom-format.py -i custom_mutators/*/*.c* # destroys libfuzzer :-(
 	@#./.custom-format.py -i custom_mutators/*/*.h # destroys honggfuzz :-(
-	./.custom-format.py -i examples/*/*.c*
-	./.custom-format.py -i examples/*/*.h
+	./.custom-format.py -i utils/*/*.c*
+	./.custom-format.py -i utils/*/*.h
 	./.custom-format.py -i test/*.c
 	./.custom-format.py -i qemu_mode/libcompcov/*.c
 	./.custom-format.py -i qemu_mode/libcompcov/*.cc
@@ -547,9 +547,9 @@ clean:
 	-$(MAKE) -f GNUmakefile.gcc_plugin clean
 	$(MAKE) -C libdislocator clean
 	$(MAKE) -C libtokencap clean
-	$(MAKE) -C examples/afl_network_proxy clean
-	$(MAKE) -C examples/socket_fuzzing clean
-	$(MAKE) -C examples/argv_fuzzing clean
+	$(MAKE) -C utils/afl_network_proxy clean
+	$(MAKE) -C utils/socket_fuzzing clean
+	$(MAKE) -C utils/argv_fuzzing clean
 	$(MAKE) -C qemu_mode/unsigaction clean
 	$(MAKE) -C qemu_mode/libcompcov clean
 ifeq "$(IN_REPO)" "1"
@@ -572,10 +572,10 @@ distrib: all
 	-$(MAKE) -f GNUmakefile.gcc_plugin
 	$(MAKE) -C libdislocator
 	$(MAKE) -C libtokencap
-	$(MAKE) -C examples/aflpp_driver
-	$(MAKE) -C examples/afl_network_proxy
-	$(MAKE) -C examples/socket_fuzzing
-	$(MAKE) -C examples/argv_fuzzing
+	$(MAKE) -C utils/aflpp_driver
+	$(MAKE) -C utils/afl_network_proxy
+	$(MAKE) -C utils/socket_fuzzing
+	$(MAKE) -C utils/argv_fuzzing
 	-cd qemu_mode && sh ./build_qemu_support.sh
 	-cd unicorn_mode && unset CFLAGS && sh ./build_unicorn_support.sh
 
@@ -583,9 +583,9 @@ distrib: all
 binary-only: all
 	$(MAKE) -C libdislocator
 	$(MAKE) -C libtokencap
-	$(MAKE) -C examples/afl_network_proxy
-	$(MAKE) -C examples/socket_fuzzing
-	$(MAKE) -C examples/argv_fuzzing
+	$(MAKE) -C utils/afl_network_proxy
+	$(MAKE) -C utils/socket_fuzzing
+	$(MAKE) -C utils/argv_fuzzing
 	-cd qemu_mode && sh ./build_qemu_support.sh
 	-cd unicorn_mode && unset CFLAGS && sh ./build_unicorn_support.sh
 
@@ -595,7 +595,7 @@ source-only: all
 	-$(MAKE) -f GNUmakefile.gcc_plugin
 	$(MAKE) -C libdislocator
 	$(MAKE) -C libtokencap
-	$(MAKE) -C examples/aflpp_driver
+	$(MAKE) -C utils/aflpp_driver
 
 %.8:	%
 	@echo .TH $* 8 $(BUILD_DATE) "afl++" > $@
@@ -628,11 +628,11 @@ install: all $(MANPAGES)
 	@if [ -f libtokencap.so ]; then set -e; install -m 755 libtokencap.so $${DESTDIR}$(HELPER_PATH); fi
 	@if [ -f libcompcov.so ]; then set -e; install -m 755 libcompcov.so $${DESTDIR}$(HELPER_PATH); fi
 	@if [ -f afl-fuzz-document ]; then set -e; install -m 755 afl-fuzz-document $${DESTDIR}$(BIN_PATH); fi
-	@if [ -f socketfuzz32.so -o -f socketfuzz64.so ]; then $(MAKE) -C examples/socket_fuzzing install; fi
-	@if [ -f argvfuzz32.so -o -f argvfuzz64.so ]; then $(MAKE) -C examples/argv_fuzzing install; fi
-	@if [ -f examples/afl_network_proxy/afl-network-server ]; then $(MAKE) -C examples/afl_network_proxy install; fi
-	@if [ -f examples/aflpp_driver/libAFLDriver.a ]; then set -e; install -m 644 examples/aflpp_driver/libAFLDriver.a $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f examples/aflpp_driver/libAFLQemuDriver.a ]; then set -e; install -m 644 examples/aflpp_driver/libAFLQemuDriver.a $${DESTDIR}$(HELPER_PATH); fi
+	@if [ -f socketfuzz32.so -o -f socketfuzz64.so ]; then $(MAKE) -C utils/socket_fuzzing install; fi
+	@if [ -f argvfuzz32.so -o -f argvfuzz64.so ]; then $(MAKE) -C utils/argv_fuzzing install; fi
+	@if [ -f utils/afl_network_proxy/afl-network-server ]; then $(MAKE) -C utils/afl_network_proxy install; fi
+	@if [ -f utils/aflpp_driver/libAFLDriver.a ]; then set -e; install -m 644 utils/aflpp_driver/libAFLDriver.a $${DESTDIR}$(HELPER_PATH); fi
+	@if [ -f utils/aflpp_driver/libAFLQemuDriver.a ]; then set -e; install -m 644 utils/aflpp_driver/libAFLQemuDriver.a $${DESTDIR}$(HELPER_PATH); fi
 	-$(MAKE) -f GNUmakefile.llvm install
 	-$(MAKE) -f GNUmakefile.gcc_plugin install
 	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-gcc
diff --git a/README.md b/README.md
index d7cad092..b00e5d00 100644
--- a/README.md
+++ b/README.md
@@ -55,6 +55,7 @@ behaviours and defaults:
     * a caching of testcases can now be performed and can be modified by
       editing config.h for TESTCASE_CACHE or by specifying the env variable
       `AFL_TESTCACHE_SIZE` (in MB). Good values are between 50-500 (default: 50).
+  * utils/ got renamed to utils/
 
 ## Contents
 
@@ -760,10 +761,10 @@ cd unicorn_mode
 
 If the goal is to fuzz a dynamic library then there are two options available.
 For both you need to write a small hardness that loads and calls the library.
-Faster is the frida solution: [examples/afl_frida/README.md](examples/afl_frida/README.md)
+Faster is the frida solution: [utils/afl_frida/README.md](utils/afl_frida/README.md)
 
 Another, less precise and slower option is using ptrace with debugger interrupt
-instrumentation: [examples/afl_untracer/README.md](examples/afl_untracer/README.md)
+instrumentation: [utils/afl_untracer/README.md](utils/afl_untracer/README.md)
 
 ### More
 
@@ -1037,7 +1038,7 @@ Here are some of the most important caveats for AFL:
     wholly wrap the actual data format to be tested.
 
     To work around this, you can comment out the relevant checks (see
-    examples/libpng_no_checksum/ for inspiration); if this is not possible,
+    utils/libpng_no_checksum/ for inspiration); if this is not possible,
     you can also write a postprocessor, one of the hooks of custom mutators.
     See [docs/custom_mutators.md](docs/custom_mutators.md) on how to use
     `AFL_CUSTOM_MUTATOR_LIBRARY`
diff --git a/docs/Changelog.md b/docs/Changelog.md
index 7fa7ff53..fd30c7b0 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -11,6 +11,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
 
 ### Version ++3.00a (develop)
   - llvm_mode/ and gcc_plugin/ moved to instrumentation/
+  - examples/ renamed to utils/
   - all compilers combined to afl-cc which emulates the previous ones
   - afl-llvm/gcc-rt.o merged into afl-compiler-rt.o
   - afl-fuzz
diff --git a/docs/FAQ.md b/docs/FAQ.md
index 064638f4..714d50eb 100644
--- a/docs/FAQ.md
+++ b/docs/FAQ.md
@@ -63,7 +63,7 @@ x10 - that is a x100 difference!).
 If modifying the source is not an option (e.g. because you only have a binary
 and perform binary fuzzing) you can also use a shared library with AFL_PRELOAD
 to emulate the network. This is also much faster than the real network would be.
-See [examples/socket_fuzzing/](../examples/socket_fuzzing/).
+See [utils/socket_fuzzing/](../utils/socket_fuzzing/).
 
 There is an outdated afl++ branch that implements networking if you are
 desperate though: [https://github.com/AFLplusplus/AFLplusplus/tree/networking](https://github.com/AFLplusplus/AFLplusplus/tree/networking) - 
diff --git a/docs/binaryonly_fuzzing.md b/docs/binaryonly_fuzzing.md
index cb1288ef..66734452 100644
--- a/docs/binaryonly_fuzzing.md
+++ b/docs/binaryonly_fuzzing.md
@@ -15,7 +15,7 @@
   high enough. Otherwise try retrowrite, afl-dyninst and if these
   fail too then try standard qemu_mode with AFL_ENTRYPOINT to where you need it.
 
-  If your target is a library use examples/afl_frida/.
+  If your target is a library use utils/afl_frida/.
 
   If your target is non-linux then use unicorn_mode/.
 
@@ -65,14 +65,14 @@
 ## AFL FRIDA
 
    If you want to fuzz a binary-only shared library then you can fuzz it with
-   frida-gum via examples/afl_frida/, you will have to write a harness to
+   frida-gum via utils/afl_frida/, you will have to write a harness to
    call the target function in the library, use afl-frida.c as a template.
 
 
 ## AFL UNTRACER
 
    If you want to fuzz a binary-only shared library then you can fuzz it with
-   examples/afl_untracer/, use afl-untracer.c as a template.
+   utils/afl_untracer/, use afl-untracer.c as a template.
    It is slower than AFL FRIDA (see above).
 
 
diff --git a/docs/custom_mutators.md b/docs/custom_mutators.md
index 53f783fe..6e16ba0f 100644
--- a/docs/custom_mutators.md
+++ b/docs/custom_mutators.md
@@ -268,8 +268,8 @@ afl-fuzz /path/to/program
 
 ## 4) Example
 
-Please see [example.c](../examples/custom_mutators/example.c) and
-[example.py](../examples/custom_mutators/example.py)
+Please see [example.c](../utils/custom_mutators/example.c) and
+[example.py](../utils/custom_mutators/example.py)
 
 ## 5) Other Resources
 
diff --git a/docs/env_variables.md b/docs/env_variables.md
index f7b4c994..ada89257 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -55,7 +55,7 @@ make fairly broad use of environmental variables instead:
     in your `$PATH`.
 
   - `AFL_PATH` can be used to point afl-gcc to an alternate location of afl-as.
-    One possible use of this is examples/clang_asm_normalize/, which lets
+    One possible use of this is utils/clang_asm_normalize/, which lets
     you instrument hand-written assembly when compiling clang code by plugging
     a normalizer into the chain. (There is no equivalent feature for GCC.)
 
diff --git a/docs/life_pro_tips.md b/docs/life_pro_tips.md
index 323f16f1..77845c63 100644
--- a/docs/life_pro_tips.md
+++ b/docs/life_pro_tips.md
@@ -78,10 +78,10 @@ Be sure to check out docs/sister_projects.md before writing your own.
 
 ## Need to fuzz the command-line arguments of a particular program?
 
-You can find a simple solution in examples/argv_fuzzing.
+You can find a simple solution in utils/argv_fuzzing.
 
 ## Attacking a format that uses checksums? 
 
 Remove the checksum-checking code or use a postprocessor!
-See examples/custom_mutators/ for more.
+See utils/custom_mutators/ for more.
 
diff --git a/docs/notes_for_asan.md b/docs/notes_for_asan.md
index 2e18c15f..f08ae3fb 100644
--- a/docs/notes_for_asan.md
+++ b/docs/notes_for_asan.md
@@ -20,7 +20,7 @@ Because of this, fuzzing with ASAN is recommended only in four scenarios:
     - Precisely gauge memory needs using http://jwilk.net/software/recidivm .
 
     - Limit the memory available to process using cgroups on Linux (see
-      examples/asan_cgroups).
+      utils/asan_cgroups).
 
 To compile with ASAN, set AFL_USE_ASAN=1 before calling 'make clean all'. The
 afl-gcc / afl-clang wrappers will pick that up and add the appropriate flags.
@@ -74,7 +74,7 @@ There are also cgroups, but they are Linux-specific, not universally available
 even on Linux systems, and they require root permissions to set up; I'm a bit
 hesitant to make afl-fuzz require root permissions just for that. That said,
 if you are on Linux and want to use cgroups, check out the contributed script
-that ships in examples/asan_cgroups/.
+that ships in utils/asan_cgroups/.
 
 In settings where cgroups aren't available, we have no nice, portable way to
 avoid counting the ASAN allocation toward the limit. On 32-bit systems, or for
diff --git a/docs/parallel_fuzzing.md b/docs/parallel_fuzzing.md
index bf57ace8..8f2afe1b 100644
--- a/docs/parallel_fuzzing.md
+++ b/docs/parallel_fuzzing.md
@@ -152,7 +152,7 @@ write a simple script that performs two actions:
     done
     ```
 
-There is an example of such a script in examples/distributed_fuzzing/.
+There is an example of such a script in utils/distributed_fuzzing/.
 
 There are other (older) more featured, experimental tools:
   * https://github.com/richo/roving
diff --git a/examples/README.md b/examples/README.md
deleted file mode 100644
index 7dd70d6a..00000000
--- a/examples/README.md
+++ /dev/null
@@ -1,54 +0,0 @@
-# AFL++ Examples
-
-Here's a quick overview of the stuff you can find in this directory:
-
-  - afl_network_proxy    - fuzz a target over the network: afl-fuzz on
-                           a host, target on an embedded system.
-
-  - afl_proxy            - skeleton file example to show how to fuzz
-                           something where you gather coverage data via
-                           different means, e.g. hw debugger
-
-  - afl_untracer         - fuzz binary-only libraries much faster but with
-                           less coverage than qemu_mode
-
-  - argv_fuzzing         - a simple wrapper to allow cmdline to be fuzzed
-                           (e.g., to test setuid programs).
-
-  - asan_cgroups         - a contributed script to simplify fuzzing ASAN
-                           binaries with robust memory limits on Linux.
-
-  - bash_shellshock      - a simple hack used to find a bunch of
-                           post-Shellshock bugs in bash.
-
-  - canvas_harness       - a test harness used to find browser bugs with a
-                           corpus generated using simple image parsing
-                           binaries & afl-fuzz.
-
-  - clang_asm_normalize  - a script that makes it easy to instrument
-                           hand-written assembly, provided that you have clang.
-
-  - crash_triage         - a very rudimentary example of how to annotate crashes
-                           with additional gdb metadata.
-
-  - custom_mutators      - examples for the afl++ custom mutator interface in
-                           C and Python
-
-  - distributed_fuzzing  - a sample script for synchronizing fuzzer instances
-                           across multiple machines (see parallel_fuzzing.md).
-
-  - libpng_no_checksum   - a sample patch for removing CRC checks in libpng.
-
-  - persistent_mode      - an example of how to use the LLVM persistent process
-                           mode to speed up certain fuzzing jobs.
-
-  - socket_fuzzing       - a LD_PRELOAD library 'redirects' a socket to stdin
-                           for fuzzing access with afl++
-
-Note that the minimize_corpus.sh tool has graduated from the examples/
-directory and is now available as ../afl-cmin. The LLVM mode has likewise
-graduated to ../instrumentation/*.
-
-Most of the tools in this directory are meant chiefly as examples that need to
-be tweaked for your specific needs. They come with some basic documentation,
-but are not necessarily production-grade.
diff --git a/examples/afl_frida/GNUmakefile b/examples/afl_frida/GNUmakefile
deleted file mode 100644
index c154f3a4..00000000
--- a/examples/afl_frida/GNUmakefile
+++ /dev/null
@@ -1,23 +0,0 @@
-ifdef DEBUG
-  OPT=-O0 -D_DEBUG=\"1\"
-else
-  OPT=-O3 -funroll-loops
-endif
-
-all:	afl-frida libtestinstr.so
-
-libfrida-gum.a:
-	@echo Download and extract frida-gum-devkit-VERSION-PLATFORM.tar.xz for your platform from https://github.com/frida/frida/releases/latest
-	@exit 1
-	
-afl-frida:	afl-frida.c libfrida-gum.a
-	$(CC) -g $(OPT) -o afl-frida -Wno-format -Wno-pointer-sign -I. -fpermissive -fPIC afl-frida.c ../../afl-llvm-rt.o libfrida-gum.a -ldl -lresolv -pthread
-
-libtestinstr.so:        libtestinstr.c
-	$(CC) -g -O0 -fPIC -o libtestinstr.so -shared libtestinstr.c
-
-clean:
-	rm -f afl-frida *~ core *.o libtestinstr.so
-
-deepclean: clean
-	rm -f libfrida-gum.a frida-gum*
diff --git a/examples/afl_frida/Makefile b/examples/afl_frida/Makefile
deleted file mode 100644
index 0b306dde..00000000
--- a/examples/afl_frida/Makefile
+++ /dev/null
@@ -1,2 +0,0 @@
-all:
-	@echo please use GNU make, thanks!
diff --git a/examples/afl_frida/README.md b/examples/afl_frida/README.md
deleted file mode 100644
index 7743479b..00000000
--- a/examples/afl_frida/README.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# afl-frida - faster fuzzing of binary-only libraries
-
-## Introduction
-
-afl-frida is an example skeleton file which can easily be used to fuzz
-a closed source library.
-
-It requires less memory and is x5-10 faster than qemu_mode but does not
-provide interesting features like compcov or cmplog.
-
-## How-to
-
-### Modify afl-frida.c
-
-Read and modify afl-frida.c then `make`.
-To adapt afl-frida.c to your needs, read the header of the file and then
-search and edit the `STEP 1`, `STEP 2` and `STEP 3` locations.
-
-### Fuzzing
-
-Example (after modifying afl-frida.c to your needs and compile it):
-```
-LD_LIBRARY_PATH=/path/to/the/target/library afl-fuzz -i in -o out -- ./afl-frida
-```
-(or even remote via afl-network-proxy).
-
-# Speed and stability
-
-The speed is very good, about x12 of fork() qemu_mode.
-However the stability is low. Reason is currently unknown.
-
-# Background
-
-This code is copied for a larger part from https://github.com/meme/hotwax
diff --git a/examples/afl_frida/afl-frida.c b/examples/afl_frida/afl-frida.c
deleted file mode 100644
index 31bf8f25..00000000
--- a/examples/afl_frida/afl-frida.c
+++ /dev/null
@@ -1,542 +0,0 @@
-/*
-   american fuzzy lop++ - afl-frida skeleton example
-   -------------------------------------------------
-
-   Copyright 2020 AFLplusplus Project. All rights reserved.
-
-   Written mostly by meme -> https://github.com/meme/hotwax
-
-   Modifications by Marc Heuse <mh@mh-sec.de>
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-   HOW-TO
-   ======
-
-   You only need to change the following:
-
-   1. set the defines and function call parameters.
-   2. dl load the library you want to fuzz, lookup the functions you need
-      and setup the calls to these.
-   3. in the while loop you call the functions in the necessary order -
-      incl the cleanup. the cleanup is important!
-
-   Just look these steps up in the code, look for "// STEP x:"
-
-*/
-
-#include <stdio.h>
-#include <stdint.h>
-#include <unistd.h>
-#include <stdint.h>
-#include <stddef.h>
-#include <sys/shm.h>
-#include <dlfcn.h>
-
-#ifndef __APPLE__
-  #include <sys/wait.h>
-  #include <sys/personality.h>
-#endif
-
-int debug = 0;
-
-// STEP 1:
-
-// The presets are for the example libtestinstr.so:
-
-/* What is the name of the library to fuzz */
-#define TARGET_LIBRARY "libtestinstr.so"
-
-/* What is the name of the function to fuzz */
-#define TARGET_FUNCTION "testinstr"
-
-/* here you need to specify the parameter for the target function */
-static void *(*o_function)(uint8_t *, int);
-
-// END STEP 1
-
-#include "frida-gum.h"
-
-G_BEGIN_DECLS
-
-#define GUM_TYPE_FAKE_EVENT_SINK (gum_fake_event_sink_get_type())
-G_DECLARE_FINAL_TYPE(GumFakeEventSink, gum_fake_event_sink, GUM,
-                     FAKE_EVENT_SINK, GObject)
-
-struct _GumFakeEventSink {
-
-  GObject      parent;
-  GumEventType mask;
-
-};
-
-GumEventSink *gum_fake_event_sink_new(void);
-void          gum_fake_event_sink_reset(GumFakeEventSink *self);
-
-G_END_DECLS
-
-static void         gum_fake_event_sink_iface_init(gpointer g_iface,
-                                                   gpointer iface_data);
-static void         gum_fake_event_sink_finalize(GObject *obj);
-static GumEventType gum_fake_event_sink_query_mask(GumEventSink *sink);
-static void gum_fake_event_sink_process(GumEventSink *sink, const GumEvent *ev);
-void instr_basic_block(GumStalkerIterator *iterator, GumStalkerOutput *output,
-                       gpointer user_data);
-void afl_setup(void);
-void afl_start_forkserver(void);
-int  __afl_persistent_loop(unsigned int max_cnt);
-
-static void gum_fake_event_sink_class_init(GumFakeEventSinkClass *klass) {
-
-  GObjectClass *object_class = G_OBJECT_CLASS(klass);
-  object_class->finalize = gum_fake_event_sink_finalize;
-
-}
-
-static void gum_fake_event_sink_iface_init(gpointer g_iface,
-                                           gpointer iface_data) {
-
-  GumEventSinkInterface *iface = (GumEventSinkInterface *)g_iface;
-  iface->query_mask = gum_fake_event_sink_query_mask;
-  iface->process = gum_fake_event_sink_process;
-
-}
-
-G_DEFINE_TYPE_EXTENDED(GumFakeEventSink, gum_fake_event_sink, G_TYPE_OBJECT, 0,
-                       G_IMPLEMENT_INTERFACE(GUM_TYPE_EVENT_SINK,
-                                             gum_fake_event_sink_iface_init))
-
-#include "../../config.h"
-
-// Shared memory fuzzing.
-int                   __afl_sharedmem_fuzzing = 1;
-extern unsigned int * __afl_fuzz_len;
-extern unsigned char *__afl_fuzz_ptr;
-
-// Notify AFL about persistent mode.
-static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
-int                  __afl_persistent_loop(unsigned int);
-
-// Notify AFL about deferred forkserver.
-static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
-void                 __afl_manual_init();
-
-// Because we do our own logging.
-extern uint8_t *        __afl_area_ptr;
-static __thread guint64 previous_pc;
-
-// Frida stuff below.
-typedef struct {
-
-  GumAddress base_address;
-  guint64    code_start, code_end;
-
-} range_t;
-
-inline static void afl_maybe_log(guint64 current_pc) {
-
-  // fprintf(stderr, "PC: %p ^ %p\n", current_pc, previous_pc);
-
-  current_pc = (current_pc >> 4) ^ (current_pc << 8);
-  current_pc &= MAP_SIZE - 1;
-
-  __afl_area_ptr[current_pc ^ previous_pc]++;
-  previous_pc = current_pc >> 1;
-
-}
-
-static void on_basic_block(GumCpuContext *context, gpointer user_data) {
-
-  afl_maybe_log((guint64)user_data);
-
-}
-
-void instr_basic_block(GumStalkerIterator *iterator, GumStalkerOutput *output,
-                       gpointer user_data) {
-
-  range_t *range = (range_t *)user_data;
-
-  const cs_insn *instr;
-  gboolean       begin = TRUE;
-  while (gum_stalker_iterator_next(iterator, &instr)) {
-
-    if (begin) {
-
-      if (instr->address >= range->code_start &&
-          instr->address <= range->code_end) {
-
-        gum_stalker_iterator_put_callout(iterator, on_basic_block,
-                                         (gpointer)instr->address, NULL);
-        begin = FALSE;
-
-      }
-
-    }
-
-    gum_stalker_iterator_keep(iterator);
-
-  }
-
-}
-
-static void gum_fake_event_sink_init(GumFakeEventSink *self) {
-
-}
-
-static void gum_fake_event_sink_finalize(GObject *obj) {
-
-  G_OBJECT_CLASS(gum_fake_event_sink_parent_class)->finalize(obj);
-
-}
-
-GumEventSink *gum_fake_event_sink_new(void) {
-
-  GumFakeEventSink *sink;
-  sink = (GumFakeEventSink *)g_object_new(GUM_TYPE_FAKE_EVENT_SINK, NULL);
-  return GUM_EVENT_SINK(sink);
-
-}
-
-void gum_fake_event_sink_reset(GumFakeEventSink *self) {
-
-}
-
-static GumEventType gum_fake_event_sink_query_mask(GumEventSink *sink) {
-
-  return 0;
-
-}
-
-typedef struct library_list {
-
-  uint8_t *name;
-  uint64_t addr_start, addr_end;
-
-} library_list_t;
-
-#define MAX_LIB_COUNT 256
-static library_list_t liblist[MAX_LIB_COUNT];
-static u32            liblist_cnt;
-
-void read_library_information() {
-
-#if defined(__linux__)
-  FILE *f;
-  u8    buf[1024], *b, *m, *e, *n;
-
-  if ((f = fopen("/proc/self/maps", "r")) == NULL) {
-
-    fprintf(stderr, "Error: cannot open /proc/self/maps\n");
-    exit(-1);
-
-  }
-
-  if (debug) fprintf(stderr, "Library list:\n");
-  while (fgets(buf, sizeof(buf), f)) {
-
-    if (strstr(buf, " r-x")) {
-
-      if (liblist_cnt >= MAX_LIB_COUNT) {
-
-        fprintf(
-            stderr,
-            "Warning: too many libraries to old, maximum count of %d reached\n",
-            liblist_cnt);
-        return;
-
-      }
-
-      b = buf;
-      m = index(buf, '-');
-      e = index(buf, ' ');
-      if ((n = rindex(buf, '/')) == NULL) n = rindex(buf, ' ');
-      if (n &&
-          ((*n >= '0' && *n <= '9') || *n == '[' || *n == '{' || *n == '('))
-        n = NULL;
-      else
-        n++;
-      if (b && m && e && n && *n) {
-
-        *m++ = 0;
-        *e = 0;
-        if (n[strlen(n) - 1] == '\n') n[strlen(n) - 1] = 0;
-
-        if (rindex(n, '/') != NULL) {
-
-          n = rindex(n, '/');
-          n++;
-
-        }
-
-        liblist[liblist_cnt].name = strdup(n);
-        liblist[liblist_cnt].addr_start = strtoull(b, NULL, 16);
-        liblist[liblist_cnt].addr_end = strtoull(m, NULL, 16);
-        if (debug)
-          fprintf(
-              stderr, "%s:%llx (%llx-%llx)\n", liblist[liblist_cnt].name,
-              liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
-              liblist[liblist_cnt].addr_start,
-              liblist[liblist_cnt].addr_end - 1);
-        liblist_cnt++;
-
-      }
-
-    }
-
-  }
-
-  if (debug) fprintf(stderr, "\n");
-
-#elif defined(__FreeBSD__)
-  int    mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, getpid()};
-  char * buf, *start, *end;
-  size_t miblen = sizeof(mib) / sizeof(mib[0]);
-  size_t len;
-
-  if (debug) fprintf(stderr, "Library list:\n");
-  if (sysctl(mib, miblen, NULL, &len, NULL, 0) == -1) { return; }
-
-  len = len * 4 / 3;
-
-  buf = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
-  if (buf == MAP_FAILED) { return; }
-  if (sysctl(mib, miblen, buf, &len, NULL, 0) == -1) {
-
-    munmap(buf, len);
-    return;
-
-  }
-
-  start = buf;
-  end = buf + len;
-
-  while (start < end) {
-
-    struct kinfo_vmentry *region = (struct kinfo_vmentry *)start;
-    size_t                size = region->kve_structsize;
-
-    if (size == 0) { break; }
-
-    if ((region->kve_protection & KVME_PROT_READ) &&
-        !(region->kve_protection & KVME_PROT_EXEC)) {
-
-      liblist[liblist_cnt].name =
-          region->kve_path[0] != '\0' ? strdup(region->kve_path) : 0;
-      liblist[liblist_cnt].addr_start = region->kve_start;
-      liblist[liblist_cnt].addr_end = region->kve_end;
-
-      if (debug) {
-
-        fprintf(stderr, "%s:%x (%lx-%lx)\n", liblist[liblist_cnt].name,
-                liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
-                liblist[liblist_cnt].addr_start,
-                liblist[liblist_cnt].addr_end - 1);
-
-      }
-
-      liblist_cnt++;
-
-    }
-
-    start += size;
-
-  }
-
-#endif
-
-}
-
-library_list_t *find_library(char *name) {
-
-  char *filename = rindex(name, '/');
-
-  if (filename)
-    filename++;
-  else
-    filename = name;
-
-#if defined(__linux__)
-  u32 i;
-  for (i = 0; i < liblist_cnt; i++)
-    if (strcmp(liblist[i].name, filename) == 0) return &liblist[i];
-#elif defined(__APPLE__) && defined(__LP64__)
-  kern_return_t         err;
-  static library_list_t lib;
-
-  // get the list of all loaded modules from dyld
-  // the task_info mach API will get the address of the dyld all_image_info
-  // struct for the given task from which we can get the names and load
-  // addresses of all modules
-  task_dyld_info_data_t  task_dyld_info;
-  mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
-  err = task_info(mach_task_self(), TASK_DYLD_INFO,
-                  (task_info_t)&task_dyld_info, &count);
-
-  const struct dyld_all_image_infos *all_image_infos =
-      (const struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr;
-  const struct dyld_image_info *image_infos = all_image_infos->infoArray;
-
-  for (size_t i = 0; i < all_image_infos->infoArrayCount; i++) {
-
-    const char *      image_name = image_infos[i].imageFilePath;
-    mach_vm_address_t image_load_address =
-        (mach_vm_address_t)image_infos[i].imageLoadAddress;
-    if (strstr(image_name, name)) {
-
-      lib.name = name;
-      lib.addr_start = (u64)image_load_address;
-      lib.addr_end = 0;
-      return &lib;
-
-    }
-
-  }
-
-#endif
-
-  return NULL;
-
-}
-
-static void gum_fake_event_sink_process(GumEventSink *  sink,
-                                        const GumEvent *ev) {
-
-}
-
-/* Because this CAN be called more than once, it will return the LAST range */
-static int enumerate_ranges(const GumRangeDetails *details,
-                            gpointer               user_data) {
-
-  GumMemoryRange *code_range = (GumMemoryRange *)user_data;
-  memcpy(code_range, details->range, sizeof(*code_range));
-  return 0;
-
-}
-
-int main() {
-
-#ifndef __APPLE__
-  (void)personality(ADDR_NO_RANDOMIZE);  // disable ASLR
-#endif
-
-  // STEP 2: load the library you want to fuzz and lookup the functions,
-  //         inclusive of the cleanup functions.
-  //         If there is just one function, then there is nothing to change
-  //         or add here.
-
-  void *dl = dlopen(TARGET_LIBRARY, RTLD_LAZY);
-  if (!dl) {
-
-    fprintf(stderr, "Could not load %s\n", TARGET_LIBRARY);
-    exit(-1);
-
-  }
-
-  if (!(o_function = dlsym(dl, TARGET_FUNCTION))) {
-
-    fprintf(stderr, "Could not find function %s\n", TARGET_FUNCTION);
-    exit(-1);
-
-  }
-
-  // END STEP 2
-
-  read_library_information();
-  library_list_t *lib = find_library(TARGET_LIBRARY);
-
-  if (lib == NULL) {
-
-    fprintf(stderr, "Could not find target library\n");
-    exit(-1);
-
-  }
-
-  gum_init_embedded();
-  if (!gum_stalker_is_supported()) {
-
-    gum_deinit_embedded();
-    return 1;
-
-  }
-
-  GumStalker *stalker = gum_stalker_new();
-
-  /*
-  This does not work here as we load a shared library. pretty sure this
-  would also be easily solvable with frida gum, but I already have all the
-  code I need from afl-untracer
-
-  GumAddress base_address = gum_module_find_base_address(TARGET_LIBRARY);
-  GumMemoryRange code_range;
-  gum_module_enumerate_ranges(TARGET_LIBRARY, GUM_PAGE_RX, enumerate_ranges,
-                              &code_range);
-  guint64 code_start = code_range.base_address - base_address;
-  guint64 code_end = (code_range.base_address + code_range.size) - base_address;
-  range_t instr_range = {base_address, code_start, code_end};
-  */
-  range_t instr_range = {0, lib->addr_start, lib->addr_end};
-
-  GumStalkerTransformer *transformer =
-      gum_stalker_transformer_make_from_callback(instr_basic_block,
-                                                 &instr_range, NULL);
-
-  GumEventSink *event_sink = gum_fake_event_sink_new();
-
-  // to ensure that the signatures are not optimized out
-  memcpy(__afl_area_ptr, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT) + 1);
-  memcpy(__afl_area_ptr + 32, (void *)AFL_DEFER_FORKSVR,
-         sizeof(AFL_DEFER_FORKSVR) + 1);
-  __afl_manual_init();
-
-  //
-  // any expensive target library initialization that has to be done just once
-  // - put that here
-  //
-
-  gum_stalker_follow_me(stalker, transformer, event_sink);
-
-  while (__afl_persistent_loop(UINT32_MAX) != 0) {
-
-    previous_pc = 0;  // Required!
-
-#ifdef _DEBUG
-    fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
-            hash64(__afl_fuzz_ptr, *__afl_fuzz_len), *__afl_fuzz_len);
-    fprintf(stderr, "RECV:");
-    for (int i = 0; i < *__afl_fuzz_len; i++)
-      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
-    fprintf(stderr, "\n");
-#endif
-
-    // STEP 3: ensure the minimum length is present and setup the target
-    //         function to fuzz.
-
-    if (*__afl_fuzz_len > 0) {
-
-      __afl_fuzz_ptr[*__afl_fuzz_len] = 0;  // if you need to null terminate
-      (*o_function)(__afl_fuzz_ptr, *__afl_fuzz_len);
-
-    }
-
-    // END STEP 3
-
-  }
-
-  gum_stalker_unfollow_me(stalker);
-
-  while (gum_stalker_garbage_collect(stalker))
-    g_usleep(10000);
-
-  g_object_unref(stalker);
-  g_object_unref(transformer);
-  g_object_unref(event_sink);
-  gum_deinit_embedded();
-
-  return 0;
-
-}
-
diff --git a/examples/afl_frida/afl-frida.h b/examples/afl_frida/afl-frida.h
deleted file mode 100644
index efa3440f..00000000
--- a/examples/afl_frida/afl-frida.h
+++ /dev/null
@@ -1,53 +0,0 @@
-extern int is_persistent;
-
-G_BEGIN_DECLS
-
-#define GUM_TYPE_FAKE_EVENT_SINK (gum_fake_event_sink_get_type())
-
-G_DECLARE_FINAL_TYPE(GumFakeEventSink, gum_fake_event_sink, GUM,
-                     FAKE_EVENT_SINK, GObject)
-
-struct _GumFakeEventSink {
-
-  GObject      parent;
-  GumEventType mask;
-
-};
-
-GumEventSink *gum_fake_event_sink_new(void);
-void          gum_fake_event_sink_reset(GumFakeEventSink *self);
-
-G_END_DECLS
-
-typedef struct {
-
-  GumAddress base_address;
-  guint64    code_start, code_end;
-
-} range_t;
-
-void instr_basic_block(GumStalkerIterator *iterator, GumStalkerOutput *output,
-                       gpointer user_data);
-#pragma once
-
-void afl_setup(void);
-void afl_start_forkserver(void);
-int  __afl_persistent_loop(unsigned int max_cnt);
-
-inline static inline void afl_maybe_log(guint64 current_pc) {
-
-  extern unsigned int afl_instr_rms;
-  extern uint8_t *    afl_area_ptr;
-
-  static __thread guint64 previous_pc;
-
-  current_pc = (current_pc >> 4) ^ (current_pc << 8);
-  current_pc &= MAP_SIZE - 1;
-
-  if (current_pc >= afl_instr_rms) return;
-
-  afl_area_ptr[current_pc ^ previous_pc]++;
-  previous_pc = current_pc >> 1;
-
-}
-
diff --git a/examples/afl_frida/libtestinstr.c b/examples/afl_frida/libtestinstr.c
deleted file mode 100644
index 96b1cf21..00000000
--- a/examples/afl_frida/libtestinstr.c
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
-   american fuzzy lop++ - a trivial program to test the build
-   --------------------------------------------------------
-   Originally written by Michal Zalewski
-   Copyright 2014 Google Inc. All rights reserved.
-   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-     http://www.apache.org/licenses/LICENSE-2.0
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-
-void testinstr(char *buf, int len) {
-
-  if (len < 1) return;
-  buf[len] = 0;
-
-  // we support three input cases
-  if (buf[0] == '0')
-    printf("Looks like a zero to me!\n");
-  else if (buf[0] == '1')
-    printf("Pretty sure that is a one!\n");
-  else
-    printf("Neither one or zero? How quaint!\n");
-
-}
-
diff --git a/examples/afl_network_proxy/GNUmakefile b/examples/afl_network_proxy/GNUmakefile
deleted file mode 100644
index 25a3df82..00000000
--- a/examples/afl_network_proxy/GNUmakefile
+++ /dev/null
@@ -1,43 +0,0 @@
-PREFIX   ?= /usr/local
-BIN_PATH  = $(PREFIX)/bin
-DOC_PATH  = $(PREFIX)/share/doc/afl
-
-PROGRAMS = afl-network-client afl-network-server
-
-HASH=\#
-
-CFLAGS += -Wno-pointer-sign
-
-ifdef STATIC
-  CFLAGS += -static
-endif
-
-ifeq "$(shell echo '$(HASH)include <libdeflate.h>@int main() { struct libdeflate_compressor *d = libdeflate_alloc_compressor(1); return 0;}' | tr @ '\n' | $(CC) $(CFLAGS) -x c - -o .test2 -ldeflate 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
- CFLAGS += -DUSE_DEFLATE=1
- LDFLAGS += -ldeflate 
- $(info libdeflate-dev was detected, using compression)
-else
- $(warn did not find libdeflate-dev, cannot use compression)
-endif
-
-all:	$(PROGRAMS)
-
-help:
-	@echo make options:
-	@echo STATIC - build as static binaries
-	@echo COMPRESS_TESTCASES - compress test cases
-
-afl-network-client:	afl-network-client.c
-	$(CC) $(CFLAGS) -I../../include -o afl-network-client afl-network-client.c $(LDFLAGS)
-
-afl-network-server:	afl-network-server.c
-	$(CC) $(CFLAGS) -I../../include -o afl-network-server afl-network-server.c ../../src/afl-forkserver.c ../../src/afl-sharedmem.c ../../src/afl-common.c -DBIN_PATH=\"$(BIN_PATH)\" $(LDFLAGS)
-
-clean:
-	rm -f $(PROGRAMS) *~ core
-
-install: all
-	install -d -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(DOC_PATH)
-	install -m 755 $(PROGRAMS) $${DESTDIR}$(BIN_PATH)
-	install -T -m 644 README.md $${DESTDIR}$(DOC_PATH)/README.network_proxy.md
-
diff --git a/examples/afl_network_proxy/Makefile b/examples/afl_network_proxy/Makefile
deleted file mode 100644
index 0b306dde..00000000
--- a/examples/afl_network_proxy/Makefile
+++ /dev/null
@@ -1,2 +0,0 @@
-all:
-	@echo please use GNU make, thanks!
diff --git a/examples/afl_network_proxy/README.md b/examples/afl_network_proxy/README.md
deleted file mode 100644
index a5ac3578..00000000
--- a/examples/afl_network_proxy/README.md
+++ /dev/null
@@ -1,61 +0,0 @@
-# afl-network-proxy
-
-If you want to run afl-fuzz over the network than this is what you need :)
-Note that the impact on fuzzing speed will be huge, expect a loss of 90%.
-
-## When to use this
-
-1. when you have to fuzz a target that has to run on a system that cannot
-   contain the fuzzing output (e.g. /tmp too small and file system is read-only)
-2. when the target instantly reboots on crashes
-3. ... any other reason you would need this
-
-## how to get it running
-
-### Compiling
-
-Just type `make` and let the autodetection do everything for you.
-
-Note that you will get a 40-50% performance increase if you have libdeflate-dev
-installed. The GNUmakefile will autodetect it if present.
-
-If your target has large test cases (10+kb) that are ascii only or large chunks
-of zero blocks then set `CFLAGS=-DCOMPRESS_TESTCASES=1` to compress them.
-For most targets this hurts performance though so it is disabled by default.
-
-### on the target
-
-Run `afl-network-server` with your target with the -m and -t values you need.
-Important is the -i parameter which is the TCP port to listen on.
-e.g.:
-```
-afl-network-server -i 1111 -m 25M -t 1000 -- /bin/target -f @@
-```
-
-### on the (afl-fuzz) master
-
-Just run afl-fuzz with your normal options, however the target should be
-`afl-network-client` with the IP and PORT of the `afl-network-server` and
-increase the -t value:
-```
-afl-fuzz -i in -o out -t 2000+ -- afl-network-client TARGET-IP 1111
-```
-Note the '+' on the -t parameter value. The afl-network-server will take
-care of proper timeouts hence afl-fuzz should not. The '+' increases the
-timeout and the value itself should be 500-1000 higher than the one on 
-afl-network-server.
-
-### networking
-
-The TARGET can be an IPv4 or IPv6 address, or a host name that resolves to
-either. Note that also the outgoing interface can be specified with a '%' for
-`afl-network-client`, e.g. `fe80::1234%eth0`.
-
-Also make sure your default TCP window size is larger than your MAP_SIZE
-(130kb is a good value).
-On Linux that is the middle value of `/proc/sys/net/ipv4/tcp_rmem` 
-
-## how to compile and install
-
-`make && sudo make install`
-
diff --git a/examples/afl_network_proxy/afl-network-client.c b/examples/afl_network_proxy/afl-network-client.c
deleted file mode 100644
index a2451fdc..00000000
--- a/examples/afl_network_proxy/afl-network-client.c
+++ /dev/null
@@ -1,415 +0,0 @@
-/*
-   american fuzzy lop++ - afl-network-client
-   ---------------------------------------
-
-   Written by Marc Heuse <mh@mh-sec.de>
-
-   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-*/
-
-#ifdef __ANDROID__
-  #include "android-ashmem.h"
-#endif
-#include "config.h"
-#include "types.h"
-#include "debug.h"
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <signal.h>
-#include <unistd.h>
-#include <string.h>
-#include <assert.h>
-#include <stdint.h>
-#include <errno.h>
-
-#include <netinet/in.h>
-#include <netinet/ip6.h>
-#include <arpa/inet.h>
-#include <sys/mman.h>
-#ifndef USEMMAP
-  #include <sys/shm.h>
-#endif
-#include <sys/wait.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netdb.h>
-#include <fcntl.h>
-
-#ifdef USE_DEFLATE
-  #include <libdeflate.h>
-#endif
-
-u8 *__afl_area_ptr;
-
-#ifdef __ANDROID__
-u32 __afl_map_size = MAP_SIZE;
-#else
-__thread u32 __afl_map_size = MAP_SIZE;
-#endif
-
-/* Error reporting to forkserver controller */
-
-void send_forkserver_error(int error) {
-
-  u32 status;
-  if (!error || error > 0xffff) return;
-  status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
-  if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
-
-}
-
-/* SHM setup. */
-
-static void __afl_map_shm(void) {
-
-  char *id_str = getenv(SHM_ENV_VAR);
-  char *ptr;
-
-  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
-
-    u32 val = atoi(ptr);
-    if (val > 0) __afl_map_size = val;
-
-  }
-
-  if (__afl_map_size > MAP_SIZE) {
-
-    if (__afl_map_size > FS_OPT_MAX_MAPSIZE) {
-
-      fprintf(stderr,
-              "Error: AFL++ tools *require* to set AFL_MAP_SIZE to %u to "
-              "be able to run this instrumented program!\n",
-              __afl_map_size);
-      if (id_str) {
-
-        send_forkserver_error(FS_ERROR_MAP_SIZE);
-        exit(-1);
-
-      }
-
-    } else {
-
-      fprintf(stderr,
-              "Warning: AFL++ tools will need to set AFL_MAP_SIZE to %u to "
-              "be able to run this instrumented program!\n",
-              __afl_map_size);
-
-    }
-
-  }
-
-  if (id_str) {
-
-#ifdef USEMMAP
-    const char *   shm_file_path = id_str;
-    int            shm_fd = -1;
-    unsigned char *shm_base = NULL;
-
-    /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
-    if (shm_fd == -1) {
-
-      fprintf(stderr, "shm_open() failed\n");
-      send_forkserver_error(FS_ERROR_SHM_OPEN);
-      exit(1);
-
-    }
-
-    /* map the shared memory segment to the address space of the process */
-    shm_base =
-        mmap(0, __afl_map_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
-
-    if (shm_base == MAP_FAILED) {
-
-      close(shm_fd);
-      shm_fd = -1;
-
-      fprintf(stderr, "mmap() failed\n");
-      send_forkserver_error(FS_ERROR_MMAP);
-      exit(2);
-
-    }
-
-    __afl_area_ptr = shm_base;
-#else
-    u32 shm_id = atoi(id_str);
-
-    __afl_area_ptr = shmat(shm_id, 0, 0);
-
-#endif
-
-    if (__afl_area_ptr == (void *)-1) {
-
-      send_forkserver_error(FS_ERROR_SHMAT);
-      exit(1);
-
-    }
-
-    /* Write something into the bitmap so that the parent doesn't give up */
-
-    __afl_area_ptr[0] = 1;
-
-  }
-
-}
-
-/* Fork server logic. */
-
-static void __afl_start_forkserver(void) {
-
-  u8  tmp[4] = {0, 0, 0, 0};
-  u32 status = 0;
-
-  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
-    status |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
-  if (status) status |= (FS_OPT_ENABLED);
-  memcpy(tmp, &status, 4);
-
-  /* Phone home and tell the parent that we're OK. */
-
-  if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
-
-}
-
-static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
-
-  s32 status, res = 0x0fffffff;  // res is a dummy pid
-
-  /* Wait for parent by reading from the pipe. Abort if read fails. */
-  if (read(FORKSRV_FD, &status, 4) != 4) return 0;
-
-  /* we have a testcase - read it */
-  status = read(0, buf, max_len);
-
-  /* report that we are starting the target */
-  if (write(FORKSRV_FD + 1, &res, 4) != 4) return 0;
-
-  if (status < 1)
-    return 0;
-  else
-    return status;
-
-}
-
-static void __afl_end_testcase(int status) {
-
-  if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
-
-}
-
-/* you just need to modify the while() loop in this main() */
-
-int main(int argc, char *argv[]) {
-
-  u8 *            interface, *buf, *ptr;
-  s32             s = -1;
-  struct addrinfo hints, *hres, *aip;
-  u32 *           lenptr, max_len = 65536;
-#ifdef USE_DEFLATE
-  u8 *   buf2;
-  u32 *  lenptr1, *lenptr2, buf2_len, compress_len;
-  size_t decompress_len;
-#endif
-
-  if (argc < 3 || argc > 4) {
-
-    printf("Syntax: %s host port [max-input-size]\n\n", argv[0]);
-    printf("Requires host and port of the remote afl-proxy-server instance.\n");
-    printf(
-        "IPv4 and IPv6 are supported, also binding to an interface with "
-        "\"%%\"\n");
-    printf("The max-input-size default is %u.\n", max_len);
-    printf(
-        "The default map size is %u and can be changed with setting "
-        "AFL_MAP_SIZE.\n",
-        __afl_map_size);
-    exit(-1);
-
-  }
-
-  if ((interface = strchr(argv[1], '%')) != NULL) *interface++ = 0;
-
-  if (argc > 3)
-    if ((max_len = atoi(argv[3])) < 0)
-      FATAL("max-input-size may not be negative or larger than 2GB: %s",
-            argv[3]);
-
-  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL)
-    if ((__afl_map_size = atoi(ptr)) < 8)
-      FATAL("illegal map size, may not be < 8 or >= 2^30: %s", ptr);
-
-  if ((buf = malloc(max_len + 4)) == NULL)
-    PFATAL("can not allocate %u memory", max_len + 4);
-  lenptr = (u32 *)buf;
-
-#ifdef USE_DEFLATE
-  buf2_len = (max_len > __afl_map_size ? max_len : __afl_map_size);
-  if ((buf2 = malloc(buf2_len + 8)) == NULL)
-    PFATAL("can not allocate %u memory", buf2_len + 8);
-  lenptr1 = (u32 *)buf2;
-  lenptr2 = (u32 *)(buf2 + 4);
-#endif
-
-  memset(&hints, 0, sizeof(hints));
-  hints.ai_socktype = SOCK_STREAM;
-  hints.ai_family = PF_UNSPEC;
-
-  if (getaddrinfo(argv[1], argv[2], &hints, &hres) != 0)
-    PFATAL("could not resolve target %s", argv[1]);
-
-  for (aip = hres; aip != NULL && s == -1; aip = aip->ai_next) {
-
-    if ((s = socket(aip->ai_family, aip->ai_socktype, aip->ai_protocol)) >= 0) {
-
-#ifdef SO_BINDTODEVICE
-      if (interface != NULL)
-        if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, interface,
-                       strlen(interface) + 1) < 0)
-          fprintf(stderr, "Warning: could not bind to device %s\n", interface);
-#else
-      fprintf(stderr,
-              "Warning: binding to interface is not supported for your OS\n");
-#endif
-
-#ifdef SO_PRIORITY
-      int priority = 7;
-      if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
-          0) {
-
-        priority = 6;
-        if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority,
-                       sizeof(priority)) < 0)
-          WARNF("could not set priority on socket");
-
-      }
-
-#endif
-
-      if (connect(s, aip->ai_addr, aip->ai_addrlen) == -1) s = -1;
-
-    }
-
-  }
-
-#ifdef USE_DEFLATE
-  struct libdeflate_compressor *compressor;
-  compressor = libdeflate_alloc_compressor(1);
-  struct libdeflate_decompressor *decompressor;
-  decompressor = libdeflate_alloc_decompressor();
-  fprintf(stderr, "Compiled with compression support\n");
-#endif
-
-  if (s == -1)
-    FATAL("could not connect to target tcp://%s:%s", argv[1], argv[2]);
-  else
-    fprintf(stderr, "Connected to target tcp://%s:%s\n", argv[1], argv[2]);
-
-  /* we initialize the shared memory map and start the forkserver */
-  __afl_map_shm();
-  __afl_start_forkserver();
-
-  int i = 1, j, status, ret, received;
-
-  // fprintf(stderr, "Waiting for first testcase\n");
-  while ((*lenptr = __afl_next_testcase(buf + 4, max_len)) > 0) {
-
-    // fprintf(stderr, "Sending testcase with len %u\n", *lenptr);
-#ifdef USE_DEFLATE
-  #ifdef COMPRESS_TESTCASES
-    // we only compress the testcase if it does not fit in the TCP packet
-    if (*lenptr > 1500 - 20 - 32 - 4) {
-
-      // set highest byte to signify compression
-      *lenptr1 = (*lenptr | 0xff000000);
-      *lenptr2 = (u32)libdeflate_deflate_compress(compressor, buf + 4, *lenptr,
-                                                  buf2 + 8, buf2_len);
-      if (send(s, buf2, *lenptr2 + 8, 0) != *lenptr2 + 8)
-        PFATAL("sending test data failed");
-      // fprintf(stderr, "COMPRESS (%u->%u):\n", *lenptr, *lenptr2);
-      // for (u32 i = 0; i < *lenptr; i++)
-      //  fprintf(stderr, "%02x", buf[i + 4]);
-      // fprintf(stderr, "\n");
-      // for (u32 i = 0; i < *lenptr2; i++)
-      //  fprintf(stderr, "%02x", buf2[i + 8]);
-      // fprintf(stderr, "\n");
-
-    } else {
-
-  #endif
-#endif
-      if (send(s, buf, *lenptr + 4, 0) != *lenptr + 4)
-        PFATAL("sending test data failed");
-#ifdef USE_DEFLATE
-  #ifdef COMPRESS_TESTCASES
-      // fprintf(stderr, "unCOMPRESS (%u)\n", *lenptr);
-
-    }
-
-  #endif
-#endif
-
-    received = 0;
-    while (received < 4 &&
-           (ret = recv(s, &status + received, 4 - received, 0)) > 0)
-      received += ret;
-    if (received != 4)
-      FATAL("did not receive waitpid data (%d, %d)", received, ret);
-    // fprintf(stderr, "Received status\n");
-
-    received = 0;
-#ifdef USE_DEFLATE
-    while (received < 4 &&
-           (ret = recv(s, &compress_len + received, 4 - received, 0)) > 0)
-      received += ret;
-    if (received != 4)
-      FATAL("did not receive compress_len (%d, %d)", received, ret);
-    // fprintf(stderr, "Received status\n");
-
-    received = 0;
-    while (received < compress_len &&
-           (ret = recv(s, buf2 + received, buf2_len - received, 0)) > 0)
-      received += ret;
-    if (received != compress_len)
-      FATAL("did not receive coverage data (%d, %d)", received, ret);
-
-    if (libdeflate_deflate_decompress(decompressor, buf2, compress_len,
-                                      __afl_area_ptr, __afl_map_size,
-                                      &decompress_len) != LIBDEFLATE_SUCCESS ||
-        decompress_len != __afl_map_size)
-      FATAL("decompression failed");
-      // fprintf(stderr, "DECOMPRESS (%u->%u): ", compress_len, decompress_len);
-      // for (u32 i = 0; i < __afl_map_size; i++) fprintf(stderr, "%02x",
-      // __afl_area_ptr[i]); fprintf(stderr, "\n");
-#else
-    while (received < __afl_map_size &&
-           (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received,
-                       0)) > 0)
-      received += ret;
-    if (received != __afl_map_size)
-      FATAL("did not receive coverage data (%d, %d)", received, ret);
-#endif
-    // fprintf(stderr, "Received coverage\n");
-
-    /* report the test case is done and wait for the next */
-    __afl_end_testcase(status);
-    // fprintf(stderr, "Waiting for next testcase %d\n", ++i);
-
-  }
-
-#ifdef USE_DEFLATE
-  libdeflate_free_compressor(compressor);
-  libdeflate_free_decompressor(decompressor);
-#endif
-
-  return 0;
-
-}
-
diff --git a/examples/afl_network_proxy/afl-network-server.c b/examples/afl_network_proxy/afl-network-server.c
deleted file mode 100644
index 513dc8f2..00000000
--- a/examples/afl_network_proxy/afl-network-server.c
+++ /dev/null
@@ -1,720 +0,0 @@
-/*
-   american fuzzy lop++ - network proxy server
-   -------------------------------------------
-
-   Originally written by Michal Zalewski
-
-   Forkserver design by Jann Horn <jannhorn@googlemail.com>
-
-   Now maintained by Marc Heuse <mh@mh-sec.de>,
-                        Heiko Eißfeldt <heiko.eissfeldt@hexco.de> and
-                        Andrea Fioraldi <andreafioraldi@gmail.com> and
-                        Dominik Maier <mail@dmnk.co>
-
-   Copyright 2016, 2017 Google Inc. All rights reserved.
-   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- */
-
-#define AFL_MAIN
-
-#ifdef __ANDROID__
-  #include "android-ashmem.h"
-#endif
-
-#include "config.h"
-#include "types.h"
-#include "debug.h"
-#include "alloc-inl.h"
-#include "hash.h"
-#include "forkserver.h"
-#include "sharedmem.h"
-#include "common.h"
-
-#include <stdio.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-#include <errno.h>
-#include <signal.h>
-#include <dirent.h>
-#include <fcntl.h>
-
-#include <sys/wait.h>
-#include <sys/time.h>
-#include <sys/shm.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <sys/resource.h>
-#include <netinet/in.h>
-#include <netinet/ip6.h>
-#include <arpa/inet.h>
-#include <sys/mman.h>
-#include <sys/shm.h>
-#include <sys/socket.h>
-#include <netdb.h>
-
-#ifdef USE_DEFLATE
-  #include <libdeflate.h>
-struct libdeflate_compressor *  compressor;
-struct libdeflate_decompressor *decompressor;
-#endif
-
-static u8 *in_file,                    /* Minimizer input test case         */
-    *out_file;
-
-static u8 *in_data;                    /* Input data for trimming           */
-static u8 *buf2;
-
-static s32 in_len;
-static s32 buf2_len;
-static u32 map_size = MAP_SIZE;
-
-static volatile u8 stop_soon;          /* Ctrl-C pressed?                   */
-
-/* See if any bytes are set in the bitmap. */
-
-static inline u8 anything_set(afl_forkserver_t *fsrv) {
-
-  u32 *ptr = (u32 *)fsrv->trace_bits;
-  u32  i = (map_size >> 2);
-
-  while (i--) {
-
-    if (*(ptr++)) { return 1; }
-
-  }
-
-  return 0;
-
-}
-
-static void at_exit_handler(void) {
-
-  afl_fsrv_killall();
-
-}
-
-/* Write output file. */
-
-static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
-
-  s32 ret;
-
-  unlink(path);                                            /* Ignore errors */
-
-  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
-
-  if (ret < 0) { PFATAL("Unable to create '%s'", path); }
-
-  ck_write(ret, mem, len, path);
-
-  lseek(ret, 0, SEEK_SET);
-
-  return ret;
-
-}
-
-/* Execute target application. Returns 0 if the changes are a dud, or
-   1 if they should be kept. */
-
-static u8 run_target(afl_forkserver_t *fsrv, char **argv, u8 *mem, u32 len,
-                     u8 first_run) {
-
-  afl_fsrv_write_to_testcase(fsrv, mem, len);
-
-  fsrv_run_result_t ret =
-      afl_fsrv_run_target(fsrv, fsrv->exec_tmout, &stop_soon);
-
-  if (ret == FSRV_RUN_ERROR) { FATAL("Couldn't run child"); }
-
-  if (stop_soon) {
-
-    SAYF(cRST cLRD "\n+++ aborted by user +++\n" cRST);
-    exit(1);
-
-  }
-
-  return ret;
-
-}
-
-/* Handle Ctrl-C and the like. */
-
-static void handle_stop_sig(int sig) {
-
-  stop_soon = 1;
-  afl_fsrv_killall();
-
-}
-
-/* Do basic preparations - persistent fds, filenames, etc. */
-
-static void set_up_environment(afl_forkserver_t *fsrv) {
-
-  u8 *x;
-
-  fsrv->dev_null_fd = open("/dev/null", O_RDWR);
-  if (fsrv->dev_null_fd < 0) { PFATAL("Unable to open /dev/null"); }
-
-  if (!out_file) {
-
-    u8 *use_dir = ".";
-
-    if (access(use_dir, R_OK | W_OK | X_OK)) {
-
-      use_dir = get_afl_env("TMPDIR");
-      if (!use_dir) { use_dir = "/tmp"; }
-
-    }
-
-    out_file = alloc_printf("%s/.afl-input-temp-%u", use_dir, getpid());
-
-  }
-
-  unlink(out_file);
-
-  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
-
-  if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
-
-  /* Set sane defaults... */
-
-  x = get_afl_env("ASAN_OPTIONS");
-
-  if (x) {
-
-    if (!strstr(x, "abort_on_error=1")) {
-
-      FATAL("Custom ASAN_OPTIONS set without abort_on_error=1 - please fix!");
-
-    }
-
-    if (!strstr(x, "symbolize=0")) {
-
-      FATAL("Custom ASAN_OPTIONS set without symbolize=0 - please fix!");
-
-    }
-
-  }
-
-  x = get_afl_env("MSAN_OPTIONS");
-
-  if (x) {
-
-    if (!strstr(x, "exit_code=" STRINGIFY(MSAN_ERROR))) {
-
-      FATAL("Custom MSAN_OPTIONS set without exit_code=" STRINGIFY(
-          MSAN_ERROR) " - please fix!");
-
-    }
-
-    if (!strstr(x, "symbolize=0")) {
-
-      FATAL("Custom MSAN_OPTIONS set without symbolize=0 - please fix!");
-
-    }
-
-  }
-
-  setenv("ASAN_OPTIONS",
-         "abort_on_error=1:"
-         "detect_leaks=0:"
-         "symbolize=0:"
-         "allocator_may_return_null=1",
-         0);
-
-  setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
-                         "symbolize=0:"
-                         "abort_on_error=1:"
-                         "allocator_may_return_null=1:"
-                         "msan_track_origins=0", 0);
-
-  if (get_afl_env("AFL_PRELOAD")) {
-
-    if (fsrv->qemu_mode) {
-
-      u8 *qemu_preload = getenv("QEMU_SET_ENV");
-      u8 *afl_preload = getenv("AFL_PRELOAD");
-      u8 *buf;
-
-      s32 i, afl_preload_size = strlen(afl_preload);
-      for (i = 0; i < afl_preload_size; ++i) {
-
-        if (afl_preload[i] == ',') {
-
-          PFATAL(
-              "Comma (',') is not allowed in AFL_PRELOAD when -Q is "
-              "specified!");
-
-        }
-
-      }
-
-      if (qemu_preload) {
-
-        buf = alloc_printf("%s,LD_PRELOAD=%s,DYLD_INSERT_LIBRARIES=%s",
-                           qemu_preload, afl_preload, afl_preload);
-
-      } else {
-
-        buf = alloc_printf("LD_PRELOAD=%s,DYLD_INSERT_LIBRARIES=%s",
-                           afl_preload, afl_preload);
-
-      }
-
-      setenv("QEMU_SET_ENV", buf, 1);
-
-      afl_free(buf);
-
-    } else {
-
-      setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
-      setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
-
-    }
-
-  }
-
-}
-
-/* Setup signal handlers, duh. */
-
-static void setup_signal_handlers(void) {
-
-  struct sigaction sa;
-
-  sa.sa_handler = NULL;
-  sa.sa_flags = SA_RESTART;
-  sa.sa_sigaction = NULL;
-
-  sigemptyset(&sa.sa_mask);
-
-  /* Various ways of saying "stop". */
-
-  sa.sa_handler = handle_stop_sig;
-  sigaction(SIGHUP, &sa, NULL);
-  sigaction(SIGINT, &sa, NULL);
-  sigaction(SIGTERM, &sa, NULL);
-
-}
-
-/* Display usage hints. */
-
-static void usage(u8 *argv0) {
-
-  SAYF(
-      "\n%s [ options ] -- /path/to/target_app [ ... ]\n\n"
-
-      "Required parameters:\n"
-
-      "  -i port       - the port to listen for the client to connect to\n\n"
-
-      "Execution control settings:\n"
-
-      "  -f file       - input file read by the tested program (stdin)\n"
-      "  -t msec       - timeout for each run (%d ms)\n"
-      "  -m megs       - memory limit for child process (%d MB)\n"
-      "  -Q            - use binary-only instrumentation (QEMU mode)\n"
-      "  -U            - use unicorn-based instrumentation (Unicorn mode)\n"
-      "  -W            - use qemu-based instrumentation with Wine (Wine "
-      "mode)\n\n"
-
-      "Environment variables used:\n"
-      "TMPDIR: directory to use for temporary input files\n"
-      "ASAN_OPTIONS: custom settings for ASAN\n"
-      "              (must contain abort_on_error=1 and symbolize=0)\n"
-      "MSAN_OPTIONS: custom settings for MSAN\n"
-      "              (must contain exitcode="STRINGIFY(MSAN_ERROR)" and symbolize=0)\n"
-      "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
-      "              the target was compiled for\n"
-      "AFL_PRELOAD:  LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
-
-      , argv0, EXEC_TIMEOUT, MEM_LIMIT);
-
-  exit(1);
-
-}
-
-int recv_testcase(int s, void **buf) {
-
-  u32    size;
-  s32    ret;
-  size_t received;
-
-  received = 0;
-  while (received < 4 && (ret = recv(s, &size + received, 4 - received, 0)) > 0)
-    received += ret;
-  if (received != 4) FATAL("did not receive size information");
-  if (size == 0) FATAL("did not receive valid size information");
-  // fprintf(stderr, "received size information of %d\n", size);
-
-  if ((size & 0xff000000) != 0xff000000) {
-
-    *buf = afl_realloc(buf, size);
-    if (unlikely(!*buf)) { PFATAL("Alloc"); }
-    received = 0;
-    // fprintf(stderr, "unCOMPRESS (%u)\n", size);
-    while (received < size &&
-           (ret = recv(s, ((char *)*buf) + received, size - received, 0)) > 0)
-      received += ret;
-
-  } else {
-
-#ifdef USE_DEFLATE
-    u32 clen;
-    size -= 0xff000000;
-    *buf = afl_realloc(buf, size);
-    if (unlikely(!*buf)) { PFATAL("Alloc"); }
-    received = 0;
-    while (received < 4 &&
-           (ret = recv(s, &clen + received, 4 - received, 0)) > 0)
-      received += ret;
-    if (received != 4) FATAL("did not receive clen1 information");
-    // fprintf(stderr, "received clen information of %d\n", clen);
-    if (clen < 1)
-      FATAL("did not receive valid compressed len information: %u", clen);
-    buf2 = afl_realloc((void **)&buf2, clen);
-    buf2_len = clen;
-    if (unlikely(!buf2)) { PFATAL("Alloc"); }
-    received = 0;
-    while (received < clen &&
-           (ret = recv(s, buf2 + received, clen - received, 0)) > 0)
-      received += ret;
-    if (received != clen) FATAL("did not receive compressed information");
-    if (libdeflate_deflate_decompress(decompressor, buf2, clen, (char *)*buf,
-                                      size, &received) != LIBDEFLATE_SUCCESS)
-      FATAL("decompression failed");
-      // fprintf(stderr, "DECOMPRESS (%u->%u):\n", clen, received);
-      // for (u32 i = 0; i < clen; i++) fprintf(stderr, "%02x", buf2[i]);
-      // fprintf(stderr, "\n");
-      // for (u32 i = 0; i < received; i++) fprintf(stderr, "%02x",
-      // ((u8*)(*buf))[i]); fprintf(stderr, "\n");
-#else
-    FATAL("Received compressed data but not compiled with compression support");
-#endif
-
-  }
-
-  // fprintf(stderr, "receiving testcase %p %p max %u\n", buf, *buf, *max_len);
-  if (received != size)
-    FATAL("did not receive testcase data %lu != %u, %d", received, size, ret);
-  // fprintf(stderr, "received testcase\n");
-  return size;
-
-}
-
-/* Main entry point */
-
-int main(int argc, char **argv_orig, char **envp) {
-
-  s32    opt, s, sock, on = 1, port = -1;
-  u8     mem_limit_given = 0, timeout_given = 0, unicorn_mode = 0, use_wine = 0;
-  char **use_argv;
-  struct sockaddr_in6 serveraddr, clientaddr;
-  int                 addrlen = sizeof(clientaddr);
-  char                str[INET6_ADDRSTRLEN];
-  char **             argv = argv_cpy_dup(argc, argv_orig);
-  u8 *                send_buf;
-#ifdef USE_DEFLATE
-  u32 *lenptr;
-#endif
-
-  afl_forkserver_t  fsrv_var = {0};
-  afl_forkserver_t *fsrv = &fsrv_var;
-  afl_fsrv_init(fsrv);
-  map_size = get_map_size();
-  fsrv->map_size = map_size;
-
-  if ((send_buf = malloc(map_size + 4)) == NULL) PFATAL("malloc");
-
-  while ((opt = getopt(argc, argv, "+i:f:m:t:QUWh")) > 0) {
-
-    switch (opt) {
-
-      case 'i':
-
-        if (port > 0) { FATAL("Multiple -i options not supported"); }
-        port = atoi(optarg);
-        if (port < 1 || port > 65535)
-          FATAL("invalid port definition, must be between 1-65535: %s", optarg);
-        break;
-
-      case 'f':
-
-        if (out_file) { FATAL("Multiple -f options not supported"); }
-        fsrv->use_stdin = 0;
-        out_file = optarg;
-        break;
-
-      case 'm': {
-
-        u8 suffix = 'M';
-
-        if (mem_limit_given) { FATAL("Multiple -m options not supported"); }
-        mem_limit_given = 1;
-
-        if (!optarg) { FATAL("Wrong usage of -m"); }
-
-        if (!strcmp(optarg, "none")) {
-
-          fsrv->mem_limit = 0;
-          break;
-
-        }
-
-        if (sscanf(optarg, "%llu%c", &fsrv->mem_limit, &suffix) < 1 ||
-            optarg[0] == '-') {
-
-          FATAL("Bad syntax used for -m");
-
-        }
-
-        switch (suffix) {
-
-          case 'T':
-            fsrv->mem_limit *= 1024 * 1024;
-            break;
-          case 'G':
-            fsrv->mem_limit *= 1024;
-            break;
-          case 'k':
-            fsrv->mem_limit /= 1024;
-            break;
-          case 'M':
-            break;
-
-          default:
-            FATAL("Unsupported suffix or bad syntax for -m");
-
-        }
-
-        if (fsrv->mem_limit < 5) { FATAL("Dangerously low value of -m"); }
-
-        if (sizeof(rlim_t) == 4 && fsrv->mem_limit > 2000) {
-
-          FATAL("Value of -m out of range on 32-bit systems");
-
-        }
-
-      }
-
-      break;
-
-      case 't':
-
-        if (timeout_given) { FATAL("Multiple -t options not supported"); }
-        timeout_given = 1;
-
-        if (!optarg) { FATAL("Wrong usage of -t"); }
-
-        fsrv->exec_tmout = atoi(optarg);
-
-        if (fsrv->exec_tmout < 10 || optarg[0] == '-') {
-
-          FATAL("Dangerously low value of -t");
-
-        }
-
-        break;
-
-      case 'Q':
-
-        if (fsrv->qemu_mode) { FATAL("Multiple -Q options not supported"); }
-        if (!mem_limit_given) { fsrv->mem_limit = MEM_LIMIT_QEMU; }
-
-        fsrv->qemu_mode = 1;
-        break;
-
-      case 'U':
-
-        if (unicorn_mode) { FATAL("Multiple -Q options not supported"); }
-        if (!mem_limit_given) { fsrv->mem_limit = MEM_LIMIT_UNICORN; }
-
-        unicorn_mode = 1;
-        break;
-
-      case 'W':                                           /* Wine+QEMU mode */
-
-        if (use_wine) { FATAL("Multiple -W options not supported"); }
-        fsrv->qemu_mode = 1;
-        use_wine = 1;
-
-        if (!mem_limit_given) { fsrv->mem_limit = 0; }
-
-        break;
-
-      case 'h':
-        usage(argv[0]);
-        return -1;
-        break;
-
-      default:
-        usage(argv[0]);
-
-    }
-
-  }
-
-  if (optind == argc || port < 1) { usage(argv[0]); }
-
-  check_environment_vars(envp);
-
-  sharedmem_t shm = {0};
-  fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
-
-  in_data = afl_realloc((void **)&in_data, 65536);
-  if (unlikely(!in_data)) { PFATAL("Alloc"); }
-
-  atexit(at_exit_handler);
-  setup_signal_handlers();
-
-  set_up_environment(fsrv);
-
-  fsrv->target_path = find_binary(argv[optind]);
-  detect_file_args(argv + optind, out_file, &fsrv->use_stdin);
-
-  if (fsrv->qemu_mode) {
-
-    if (use_wine) {
-
-      use_argv = get_wine_argv(argv[0], &fsrv->target_path, argc - optind,
-                               argv + optind);
-
-    } else {
-
-      use_argv = get_qemu_argv(argv[0], &fsrv->target_path, argc - optind,
-                               argv + optind);
-
-    }
-
-  } else {
-
-    use_argv = argv + optind;
-
-  }
-
-  if ((sock = socket(AF_INET6, SOCK_STREAM, 0)) < 0) PFATAL("socket() failed");
-
-#ifdef SO_REUSEADDR
-  if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (char *)&on, sizeof(on)) < 0) {
-
-    WARNF("setsockopt(SO_REUSEADDR) failed");
-
-  }
-
-#endif
-
-#ifdef SO_PRIORITY
-  int priority = 7;
-  if (setsockopt(sock, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
-      0) {
-
-    priority = 6;
-    if (setsockopt(sock, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
-        0)
-      WARNF("could not set priority on socket");
-
-  }
-
-#endif
-
-  memset(&serveraddr, 0, sizeof(serveraddr));
-  serveraddr.sin6_family = AF_INET6;
-  serveraddr.sin6_port = htons(port);
-  serveraddr.sin6_addr = in6addr_any;
-
-  if (bind(sock, (struct sockaddr *)&serveraddr, sizeof(serveraddr)) < 0)
-    PFATAL("bind() failed");
-
-  if (listen(sock, 1) < 0) { PFATAL("listen() failed"); }
-
-  afl_fsrv_start(
-      fsrv, use_argv, &stop_soon,
-      (get_afl_env("AFL_DEBUG_CHILD") || get_afl_env("AFL_DEBUG_CHILD_OUTPUT"))
-          ? 1
-          : 0);
-
-#ifdef USE_DEFLATE
-  compressor = libdeflate_alloc_compressor(1);
-  decompressor = libdeflate_alloc_decompressor();
-  buf2 = afl_realloc((void **)&buf2, map_size + 16);
-  buf2_len = map_size + 16;
-  if (unlikely(!buf2)) { PFATAL("alloc"); }
-  lenptr = (u32 *)(buf2 + 4);
-  fprintf(stderr, "Compiled with compression support\n");
-#endif
-
-  fprintf(stderr,
-          "Waiting for incoming connection from afl-network-client on port %d "
-          "...\n",
-          port);
-
-  if ((s = accept(sock, NULL, NULL)) < 0) { PFATAL("accept() failed"); }
-  fprintf(stderr, "Received connection, starting ...\n");
-
-#ifdef SO_PRIORITY
-  priority = 7;
-  if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) < 0) {
-
-    priority = 6;
-    if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) < 0)
-      WARNF("could not set priority on socket");
-
-  }
-
-#endif
-
-  while ((in_len = recv_testcase(s, (void **)&in_data)) > 0) {
-
-    // fprintf(stderr, "received %u\n", in_len);
-    (void)run_target(fsrv, use_argv, in_data, in_len, 1);
-
-    memcpy(send_buf + 4, fsrv->trace_bits, fsrv->map_size);
-
-#ifdef USE_DEFLATE
-    memcpy(buf2, &fsrv->child_status, 4);
-    *lenptr = (u32)libdeflate_deflate_compress(
-        compressor, send_buf + 4, fsrv->map_size, buf2 + 8, buf2_len - 8);
-    // fprintf(stderr, "COMPRESS (%u->%u): ", fsrv->map_size, *lenptr);
-    // for (u32 i = 0; i < fsrv->map_size; i++) fprintf(stderr, "%02x",
-    // fsrv->trace_bits[i]); fprintf(stderr, "\n");
-    if (send(s, buf2, *lenptr + 8, 0) != 8 + *lenptr)
-      FATAL("could not send data");
-#else
-    memcpy(send_buf, &fsrv->child_status, 4);
-    if (send(s, send_buf, fsrv->map_size + 4, 0) != 4 + fsrv->map_size)
-      FATAL("could not send data");
-#endif
-
-    // fprintf(stderr, "sent result\n");
-
-  }
-
-  unlink(out_file);
-  if (out_file) { ck_free(out_file); }
-  out_file = NULL;
-
-  afl_shm_deinit(&shm);
-  afl_fsrv_deinit(fsrv);
-  if (fsrv->target_path) { ck_free(fsrv->target_path); }
-  afl_free(in_data);
-#if USE_DEFLATE
-  afl_free(buf2);
-  libdeflate_free_compressor(compressor);
-  libdeflate_free_decompressor(decompressor);
-#endif
-
-  argv_cpy_free(argv);
-
-  exit(0);
-
-}
-
diff --git a/examples/afl_proxy/Makefile b/examples/afl_proxy/Makefile
deleted file mode 100644
index 4b368f8d..00000000
--- a/examples/afl_proxy/Makefile
+++ /dev/null
@@ -1,7 +0,0 @@
-all:	afl-proxy
-
-afl-proxy:	afl-proxy.c
-	$(CC) -I../../include -o afl-proxy afl-proxy.c
-
-clean:
-	rm -f afl-proxy *~ core
diff --git a/examples/afl_proxy/README.md b/examples/afl_proxy/README.md
deleted file mode 100644
index 3c768a19..00000000
--- a/examples/afl_proxy/README.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# afl-proxy
-
-afl-proxy is an example skeleton file which can easily be used to fuzz
-and instrument non-standard things.
-
-You only need to change the while() loop of the main() to send the
-data of buf[] with length len to the target and write the coverage
-information to __afl_area_ptr[__afl_map_size]
-
diff --git a/examples/afl_proxy/afl-proxy.c b/examples/afl_proxy/afl-proxy.c
deleted file mode 100644
index f2dfeac1..00000000
--- a/examples/afl_proxy/afl-proxy.c
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
-   american fuzzy lop++ - afl-proxy skeleton example
-   ---------------------------------------------------
-
-   Written by Marc Heuse <mh@mh-sec.de>
-
-   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-
-   HOW-TO
-   ======
-
-   You only need to change the while() loop of the main() to send the
-   data of buf[] with length len to the target and write the coverage
-   information to __afl_area_ptr[__afl_map_size]
-
-
-*/
-
-#ifdef __ANDROID__
-  #include "android-ashmem.h"
-#endif
-#include "config.h"
-#include "types.h"
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <signal.h>
-#include <unistd.h>
-#include <string.h>
-#include <assert.h>
-#include <stdint.h>
-#include <errno.h>
-
-#include <sys/mman.h>
-#include <sys/shm.h>
-#include <sys/wait.h>
-#include <sys/types.h>
-#include <fcntl.h>
-
-u8 *__afl_area_ptr;
-
-#ifdef __ANDROID__
-u32 __afl_map_size = MAP_SIZE;
-#else
-__thread u32 __afl_map_size = MAP_SIZE;
-#endif
-
-/* Error reporting to forkserver controller */
-
-void send_forkserver_error(int error) {
-
-  u32 status;
-  if (!error || error > 0xffff) return;
-  status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
-  if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
-
-}
-
-/* SHM setup. */
-
-static void __afl_map_shm(void) {
-
-  char *id_str = getenv(SHM_ENV_VAR);
-  char *ptr;
-
-  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
-
-    u32 val = atoi(ptr);
-    if (val > 0) __afl_map_size = val;
-
-  }
-
-  if (__afl_map_size > MAP_SIZE) {
-
-    if (__afl_map_size > FS_OPT_MAX_MAPSIZE) {
-
-      fprintf(stderr,
-              "Error: AFL++ tools *require* to set AFL_MAP_SIZE to %u to "
-              "be able to run this instrumented program!\n",
-              __afl_map_size);
-      if (id_str) {
-
-        send_forkserver_error(FS_ERROR_MAP_SIZE);
-        exit(-1);
-
-      }
-
-    } else {
-
-      fprintf(stderr,
-              "Warning: AFL++ tools will need to set AFL_MAP_SIZE to %u to "
-              "be able to run this instrumented program!\n",
-              __afl_map_size);
-
-    }
-
-  }
-
-  if (id_str) {
-
-#ifdef USEMMAP
-    const char *   shm_file_path = id_str;
-    int            shm_fd = -1;
-    unsigned char *shm_base = NULL;
-
-    /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
-    if (shm_fd == -1) {
-
-      fprintf(stderr, "shm_open() failed\n");
-      send_forkserver_error(FS_ERROR_SHM_OPEN);
-      exit(1);
-
-    }
-
-    /* map the shared memory segment to the address space of the process */
-    shm_base =
-        mmap(0, __afl_map_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
-
-    if (shm_base == MAP_FAILED) {
-
-      close(shm_fd);
-      shm_fd = -1;
-
-      fprintf(stderr, "mmap() failed\n");
-      send_forkserver_error(FS_ERROR_MMAP);
-      exit(2);
-
-    }
-
-    __afl_area_ptr = shm_base;
-#else
-    u32 shm_id = atoi(id_str);
-
-    __afl_area_ptr = shmat(shm_id, 0, 0);
-
-#endif
-
-    if (__afl_area_ptr == (void *)-1) {
-
-      send_forkserver_error(FS_ERROR_SHMAT);
-      exit(1);
-
-    }
-
-    /* Write something into the bitmap so that the parent doesn't give up */
-
-    __afl_area_ptr[0] = 1;
-
-  }
-
-}
-
-/* Fork server logic. */
-
-static void __afl_start_forkserver(void) {
-
-  u8  tmp[4] = {0, 0, 0, 0};
-  u32 status = 0;
-
-  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
-    status |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
-  if (status) status |= (FS_OPT_ENABLED);
-  memcpy(tmp, &status, 4);
-
-  /* Phone home and tell the parent that we're OK. */
-
-  if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
-
-}
-
-static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
-
-  s32 status, res = 0xffffff;
-
-  /* Wait for parent by reading from the pipe. Abort if read fails. */
-  if (read(FORKSRV_FD, &status, 4) != 4) return 0;
-
-  /* we have a testcase - read it */
-  status = read(0, buf, max_len);
-
-  /* report that we are starting the target */
-  if (write(FORKSRV_FD + 1, &res, 4) != 4) return 0;
-
-  if (status < 1)
-    return 0;
-  else
-    return status;
-
-}
-
-static void __afl_end_testcase(void) {
-
-  int status = 0xffffff;
-
-  if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
-
-}
-
-/* you just need to modify the while() loop in this main() */
-
-int main(int argc, char *argv[]) {
-
-  /* This is were the testcase data is written into */
-  u8  buf[1024];  // this is the maximum size for a test case! set it!
-  u32 len;
-
-  /* here you specify the map size you need that you are reporting to
-     afl-fuzz. */
-  __afl_map_size = MAP_SIZE;  // default is 65536
-
-  /* then we initialize the shared memory map and start the forkserver */
-  __afl_map_shm();
-  __afl_start_forkserver();
-
-  while ((len = __afl_next_testcase(buf, sizeof(buf))) > 0) {
-
-    /* here you have to create the magic that feeds the buf/len to the
-       target and write the coverage to __afl_area_ptr */
-
-    // ... the magic ...
-
-    /* report the test case is done and wait for the next */
-    __afl_end_testcase();
-
-  }
-
-  return 0;
-
-}
-
diff --git a/examples/afl_untracer/Makefile b/examples/afl_untracer/Makefile
deleted file mode 100644
index 14a09b41..00000000
--- a/examples/afl_untracer/Makefile
+++ /dev/null
@@ -1,16 +0,0 @@
-ifdef DEBUG
-  OPT=-O0
-else
-  OPT=-O3
-endif
-
-all:	afl-untracer libtestinstr.so
-
-afl-untracer:	afl-untracer.c
-	$(CC) $(OPT) -I../../include -g -o afl-untracer afl-untracer.c -ldl
-
-libtestinstr.so:	libtestinstr.c
-	$(CC) -g -O0 -fPIC -o libtestinstr.so -shared libtestinstr.c
-
-clean:
-	rm -f afl-untracer libtestinstr.so *~ core
diff --git a/examples/afl_untracer/README.md b/examples/afl_untracer/README.md
deleted file mode 100644
index ada0c916..00000000
--- a/examples/afl_untracer/README.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# afl-untracer - fast fuzzing of binary-only libraries
-
-## Introduction
-
-afl-untracer is an example skeleton file which can easily be used to fuzz
-a closed source library.
-
-It requires less memory and is x3-5 faster than qemu_mode however it is way
-more course grained and does not provide interesting features like compcov
-or cmplog.
-
-Supported is so far Intel (i386/x86_64) and AARCH64.
-
-## How-to
-
-### Modify afl-untracer.c
-
-Read and modify afl-untracer.c then `make`.
-To adapt afl-untracer.c to your needs, read the header of the file and then
-search and edit the `STEP 1`, `STEP 2` and `STEP 3` locations.
-
-### Generate patches.txt file
-
-To generate the `patches.txt` file for your target library use the
-`ida_get_patchpoints.py` script for IDA Pro or
-`ghidra_get_patchpoints.java` for Ghidra.
-
-The patches.txt file has to be pointed to by `AFL_UNTRACER_FILE`.
-
-To easily run the scripts without needing to run the GUI with Ghidra:
-```
-/opt/ghidra/support/analyzeHeadless /tmp/ tmp$$ -import libtestinstr.so -postscript ./ghidra_get_patchpoints.java
-rm -rf /tmp/tmp$$
-```
-The file is created at `~/Desktop/patches.txt`
-
-### Fuzzing
-
-Example (after modifying afl-untracer.c to your needs, compiling and creating
-patches.txt):
-```
-LD_LIBRARY_PATH=/path/to/target/library AFL_UNTRACER_FILE=./patches.txt afl-fuzz -i in -o out -- ./afl-untracer
-```
-(or even remote via afl-network-proxy).
-
-### Testing and debugging
-
-For testing/debugging you can try:
-```
-make DEBUG=1
-AFL_UNTRACER_FILE=./patches.txt AFL_DEBUG=1 gdb ./afl-untracer
-```
-and then you can easily set breakpoints to "breakpoint" and "fuzz".
-
-# Background
-
-This idea is based on [UnTracer](https://github.com/FoRTE-Research/UnTracer-AFL)
-and modified by [Trapfuzz](https://github.com/googleprojectzero/p0tools/tree/master/TrapFuzz).
-This implementation is slower because the traps are not patched out with each
-run, but on the other hand gives much better coverage information.
diff --git a/examples/afl_untracer/TODO b/examples/afl_untracer/TODO
deleted file mode 100644
index fffffacf..00000000
--- a/examples/afl_untracer/TODO
+++ /dev/null
@@ -1,2 +0,0 @@
- * add shmem fuzzing
- * add snapshot feature?
diff --git a/examples/afl_untracer/afl-untracer.c b/examples/afl_untracer/afl-untracer.c
deleted file mode 100644
index cb6f948c..00000000
--- a/examples/afl_untracer/afl-untracer.c
+++ /dev/null
@@ -1,768 +0,0 @@
-/*
-   american fuzzy lop++ - afl-untracer skeleton example
-   ---------------------------------------------------
-
-   Written by Marc Heuse <mh@mh-sec.de>
-
-   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-
-   HOW-TO
-   ======
-
-   You only need to change the following:
-
-   1. decide if you want to receive data from stdin [DEFAULT] or file(name)
-      -> use_stdin = 0 if via file, and what the maximum input size is
-   2. dl load the library you want to fuzz, lookup the functions you need
-      and setup the calls to these
-   3. in the while loop you call the functions in the necessary order -
-      incl the cleanup. the cleanup is important!
-
-   Just look these steps up in the code, look for "// STEP x:"
-
-
-*/
-
-#define __USE_GNU
-#define _GNU_SOURCE
-
-#ifdef __ANDROID__
-  #include "android-ashmem.h"
-#endif
-#include "config.h"
-#include "types.h"
-#include "debug.h"
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <signal.h>
-#include <unistd.h>
-#include <string.h>
-#include <assert.h>
-#include <stdint.h>
-#include <errno.h>
-#include <dlfcn.h>
-#include <fcntl.h>
-#include <pthread.h>
-
-#include <sys/mman.h>
-#include <sys/shm.h>
-#include <sys/wait.h>
-#include <sys/types.h>
-#include <sys/personality.h>
-
-#if defined(__linux__)
-  #include <sys/ucontext.h>
-#elif defined(__APPLE__) && defined(__LP64__)
-  #include <mach-o/dyld_images.h>
-#elif defined(__FreeBSD__)
-  #include <sys/sysctl.h>
-  #include <sys/user.h>
-#else
-  #error "Unsupported platform"
-#endif
-
-#define MEMORY_MAP_DECREMENT 0x200000000000
-#define MAX_LIB_COUNT 128
-
-// STEP 1:
-
-/* here you need to specify the parameter for the target function */
-static void *(*o_function)(u8 *buf, int len);
-
-/* use stdin (1) or a file on the commandline (0) */
-static u32 use_stdin = 1;
-
-/* This is were the testcase data is written into */
-static u8 buf[10000];  // this is the maximum size for a test case! set it!
-
-/* If you want to have debug output set this to 1, can also be set with
-   AFL_DEBUG  */
-static u32 debug = 0;
-
-// END STEP 1
-
-typedef struct library_list {
-
-  u8 *name;
-  u64 addr_start, addr_end;
-
-} library_list_t;
-
-#ifdef __ANDROID__
-u32 __afl_map_size = MAP_SIZE;
-u32 do_exit;
-#else
-__thread u32 __afl_map_size = MAP_SIZE;
-__thread u32 do_exit;
-#endif
-
-static pid_t     pid = 65537;
-static pthread_t __afl_thread;
-static u8        __afl_dummy[MAP_SIZE];
-static u8 *      __afl_area_ptr = __afl_dummy;
-static u8 *      inputfile;  // this will point to argv[1]
-static u32       len;
-
-static library_list_t liblist[MAX_LIB_COUNT];
-static u32            liblist_cnt;
-
-static void sigtrap_handler(int signum, siginfo_t *si, void *context);
-static void fuzz(void);
-
-/* read the library information */
-void read_library_information(void) {
-
-#if defined(__linux__)
-  FILE *f;
-  u8    buf[1024], *b, *m, *e, *n;
-
-  if ((f = fopen("/proc/self/maps", "r")) == NULL)
-    FATAL("cannot open /proc/self/maps");
-
-  if (debug) fprintf(stderr, "Library list:\n");
-  while (fgets(buf, sizeof(buf), f)) {
-
-    if (strstr(buf, " r-x")) {
-
-      if (liblist_cnt >= MAX_LIB_COUNT) {
-
-        WARNF("too many libraries to old, maximum count of %d reached",
-              liblist_cnt);
-        return;
-
-      }
-
-      b = buf;
-      m = index(buf, '-');
-      e = index(buf, ' ');
-      if ((n = rindex(buf, '/')) == NULL) n = rindex(buf, ' ');
-      if (n &&
-          ((*n >= '0' && *n <= '9') || *n == '[' || *n == '{' || *n == '('))
-        n = NULL;
-      else
-        n++;
-      if (b && m && e && n && *n) {
-
-        *m++ = 0;
-        *e = 0;
-        if (n[strlen(n) - 1] == '\n') n[strlen(n) - 1] = 0;
-
-        liblist[liblist_cnt].name = strdup(n);
-        liblist[liblist_cnt].addr_start = strtoull(b, NULL, 16);
-        liblist[liblist_cnt].addr_end = strtoull(m, NULL, 16);
-        if (debug)
-          fprintf(
-              stderr, "%s:%llx (%llx-%llx)\n", liblist[liblist_cnt].name,
-              liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
-              liblist[liblist_cnt].addr_start,
-              liblist[liblist_cnt].addr_end - 1);
-        liblist_cnt++;
-
-      }
-
-    }
-
-  }
-
-  if (debug) fprintf(stderr, "\n");
-
-#elif defined(__FreeBSD__)
-  int    mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, getpid()};
-  char * buf, *start, *end;
-  size_t miblen = sizeof(mib) / sizeof(mib[0]);
-  size_t len;
-
-  if (debug) fprintf(stderr, "Library list:\n");
-  if (sysctl(mib, miblen, NULL, &len, NULL, 0) == -1) { return; }
-
-  len = len * 4 / 3;
-
-  buf = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
-  if (buf == MAP_FAILED) { return; }
-
-  if (sysctl(mib, miblen, buf, &len, NULL, 0) == -1) {
-
-    munmap(buf, len);
-    return;
-
-  }
-
-  start = buf;
-  end = buf + len;
-
-  while (start < end) {
-
-    struct kinfo_vmentry *region = (struct kinfo_vmentry *)start;
-    size_t                size = region->kve_structsize;
-
-    if (size == 0) { break; }
-
-    if ((region->kve_protection & KVME_PROT_READ) &&
-        !(region->kve_protection & KVME_PROT_EXEC)) {
-
-      liblist[liblist_cnt].name =
-          region->kve_path[0] != '\0' ? strdup(region->kve_path) : 0;
-      liblist[liblist_cnt].addr_start = region->kve_start;
-      liblist[liblist_cnt].addr_end = region->kve_end;
-
-      if (debug) {
-
-        fprintf(stderr, "%s:%x (%lx-%lx)\n", liblist[liblist_cnt].name,
-                liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
-                liblist[liblist_cnt].addr_start,
-                liblist[liblist_cnt].addr_end - 1);
-
-      }
-
-      liblist_cnt++;
-
-    }
-
-    start += size;
-
-  }
-
-#endif
-
-}
-
-library_list_t *find_library(char *name) {
-
-#if defined(__linux__)
-  u32 i;
-
-  for (i = 0; i < liblist_cnt; i++)
-    if (strncmp(liblist[i].name, name, strlen(name)) == 0) return &liblist[i];
-#elif defined(__APPLE__) && defined(__LP64__)
-  kern_return_t         err;
-  static library_list_t lib;
-
-  // get the list of all loaded modules from dyld
-  // the task_info mach API will get the address of the dyld all_image_info
-  // struct for the given task from which we can get the names and load
-  // addresses of all modules
-  task_dyld_info_data_t  task_dyld_info;
-  mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
-  err = task_info(mach_task_self(), TASK_DYLD_INFO,
-                  (task_info_t)&task_dyld_info, &count);
-
-  const struct dyld_all_image_infos *all_image_infos =
-      (const struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr;
-  const struct dyld_image_info *image_infos = all_image_infos->infoArray;
-
-  for (size_t i = 0; i < all_image_infos->infoArrayCount; i++) {
-
-    const char *      image_name = image_infos[i].imageFilePath;
-    mach_vm_address_t image_load_address =
-        (mach_vm_address_t)image_infos[i].imageLoadAddress;
-    if (strstr(image_name, name)) {
-
-      lib.name = name;
-      lib.addr_start = (u64)image_load_address;
-      lib.addr_end = 0;
-      return &lib;
-
-    }
-
-  }
-
-#endif
-
-  return NULL;
-
-}
-
-/* for having an easy breakpoint location after loading the shared library */
-// this seems to work for clang too. nice :) requires gcc 4.4+
-#pragma GCC push_options
-#pragma GCC optimize("O0")
-void        breakpoint(void) {
-
-  if (debug) fprintf(stderr, "Breakpoint function \"breakpoint\" reached.\n");
-
-}
-
-#pragma GCC pop_options
-
-/* Error reporting to forkserver controller */
-
-void send_forkserver_error(int error) {
-
-  u32 status;
-  if (!error || error > 0xffff) return;
-  status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
-  if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
-
-}
-
-/* SHM setup. */
-
-static void __afl_map_shm(void) {
-
-  char *id_str = getenv(SHM_ENV_VAR);
-  char *ptr;
-
-  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
-
-    u32 val = atoi(ptr);
-    if (val > 0) __afl_map_size = val;
-
-  }
-
-  if (__afl_map_size > MAP_SIZE) {
-
-    if (__afl_map_size > FS_OPT_MAX_MAPSIZE) {
-
-      fprintf(stderr,
-              "Error: AFL++ tools *require* to set AFL_MAP_SIZE to %u to "
-              "be able to run this instrumented program!\n",
-              __afl_map_size);
-      if (id_str) {
-
-        send_forkserver_error(FS_ERROR_MAP_SIZE);
-        exit(-1);
-
-      }
-
-    } else {
-
-      fprintf(stderr,
-              "Warning: AFL++ tools will need to set AFL_MAP_SIZE to %u to "
-              "be able to run this instrumented program!\n",
-              __afl_map_size);
-
-    }
-
-  }
-
-  if (id_str) {
-
-#ifdef USEMMAP
-    const char *   shm_file_path = id_str;
-    int            shm_fd = -1;
-    unsigned char *shm_base = NULL;
-
-    /* create the shared memory segment as if it was a file */
-    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
-    if (shm_fd == -1) {
-
-      fprintf(stderr, "shm_open() failed\n");
-      send_forkserver_error(FS_ERROR_SHM_OPEN);
-      exit(1);
-
-    }
-
-    /* map the shared memory segment to the address space of the process */
-    shm_base =
-        mmap(0, __afl_map_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
-
-    if (shm_base == MAP_FAILED) {
-
-      close(shm_fd);
-      shm_fd = -1;
-
-      fprintf(stderr, "mmap() failed\n");
-      send_forkserver_error(FS_ERROR_MMAP);
-      exit(2);
-
-    }
-
-    __afl_area_ptr = shm_base;
-#else
-    u32 shm_id = atoi(id_str);
-
-    __afl_area_ptr = shmat(shm_id, 0, 0);
-
-#endif
-
-    if (__afl_area_ptr == (void *)-1) {
-
-      send_forkserver_error(FS_ERROR_SHMAT);
-      exit(1);
-
-    }
-
-    /* Write something into the bitmap so that the parent doesn't give up */
-
-    __afl_area_ptr[0] = 1;
-
-  }
-
-}
-
-/* Fork server logic. */
-inline static void __afl_start_forkserver(void) {
-
-  u8  tmp[4] = {0, 0, 0, 0};
-  u32 status = 0;
-
-  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
-    status |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
-  if (status) status |= (FS_OPT_ENABLED);
-  memcpy(tmp, &status, 4);
-
-  /* Phone home and tell the parent that we're OK. */
-  if (write(FORKSRV_FD + 1, tmp, 4) != 4) do_exit = 1;
-  // fprintf(stderr, "write0 %d\n", do_exit);
-
-}
-
-inline static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
-
-  s32 status;
-
-  /* Wait for parent by reading from the pipe. Abort if read fails. */
-  if (read(FORKSRV_FD, &status, 4) != 4) do_exit = 1;
-  // fprintf(stderr, "read %d\n", do_exit);
-
-  /* we have a testcase - read it if we read from stdin */
-  if (use_stdin) {
-
-    if ((status = read(0, buf, max_len)) <= 0) exit(-1);
-
-  } else
-
-    status = 1;
-  // fprintf(stderr, "stdin: %d %d\n", use_stdin, status);
-
-  /* report that we are starting the target */
-  if (write(FORKSRV_FD + 1, &pid, 4) != 4) do_exit = 1;
-  // fprintf(stderr, "write1 %d\n", do_exit);
-
-  __afl_area_ptr[0] = 1;  // put something in the map
-
-  return status;
-
-}
-
-inline static void __afl_end_testcase(int status) {
-
-  if (write(FORKSRV_FD + 1, &status, 4) != 4) do_exit = 1;
-  // fprintf(stderr, "write2 %d\n", do_exit);
-  if (do_exit) exit(0);
-
-}
-
-#ifdef __aarch64__
-  #define SHADOW(addr)                                     \
-    ((uint64_t *)(((uintptr_t)addr & 0xfffffffffffffff8) - \
-                  MEMORY_MAP_DECREMENT -                   \
-                  ((uintptr_t)addr & 0x7) * 0x10000000000))
-#else
-  #define SHADOW(addr)                                     \
-    ((uint32_t *)(((uintptr_t)addr & 0xfffffffffffffffc) - \
-                  MEMORY_MAP_DECREMENT -                   \
-                  ((uintptr_t)addr & 0x3) * 0x10000000000))
-#endif
-
-void setup_trap_instrumentation(void) {
-
-  library_list_t *lib_base = NULL;
-  size_t          lib_size = 0;
-  u8 *            lib_addr;
-  char *          line = NULL;
-  size_t          nread, len = 0;
-  char *          filename = getenv("AFL_UNTRACER_FILE");
-  if (!filename) filename = getenv("TRAPFUZZ_FILE");
-  if (!filename) FATAL("AFL_UNTRACER_FILE environment variable not set");
-
-  FILE *patches = fopen(filename, "r");
-  if (!patches) FATAL("Couldn't open AFL_UNTRACER_FILE file %s", filename);
-
-    // Index into the coverage bitmap for the current trap instruction.
-#ifdef __aarch64__
-  uint64_t bitmap_index = 0;
-#else
-  uint32_t bitmap_index = 0;
-#endif
-
-  while ((nread = getline(&line, &len, patches)) != -1) {
-
-    char *end = line + len;
-
-    char *col = strchr(line, ':');
-    if (col) {
-
-      // It's a library:size pair
-      *col++ = 0;
-
-      lib_base = find_library(line);
-      if (!lib_base) FATAL("Library %s does not appear to be loaded", line);
-
-      // we ignore the defined lib_size
-      lib_size = strtoul(col, NULL, 16);
-#if (__linux__)
-      if (lib_size < lib_base->addr_end - lib_base->addr_start)
-        lib_size = lib_base->addr_end - lib_base->addr_start;
-#endif
-      if (lib_size % 0x1000 != 0)
-        WARNF("Invalid library size 0x%zx. Must be multiple of 0x1000",
-              lib_size);
-
-      lib_addr = (u8 *)lib_base->addr_start;
-
-      // Make library code writable.
-      if (mprotect((void *)lib_addr, lib_size,
-                   PROT_READ | PROT_WRITE | PROT_EXEC) != 0)
-        FATAL("Failed to mprotect library %s writable", line);
-
-        // Create shadow memory.
-#ifdef __aarch64__
-      for (int i = 0; i < 8; i++) {
-
-#else
-      for (int i = 0; i < 4; i++) {
-
-#endif
-
-        void *shadow_addr = SHADOW(lib_addr + i);
-        void *shadow = mmap(shadow_addr, lib_size, PROT_READ | PROT_WRITE,
-                            MAP_PRIVATE | MAP_ANON | MAP_FIXED, 0, 0);
-        if (debug)
-          fprintf(stderr, "Shadow: %s %d = %p-%p for %p\n", line, i, shadow,
-                  shadow + lib_size - 1, lib_addr);
-        if (shadow == MAP_FAILED) FATAL("Failed to mmap shadow memory");
-
-      }
-
-      // Done, continue with next line.
-      continue;
-
-    }
-
-    // It's an offset, parse it and do the patching.
-    unsigned long offset = strtoul(line, NULL, 16);
-
-    if (offset > lib_size)
-      FATAL("Invalid offset: 0x%lx. Current library is 0x%zx bytes large",
-            offset, lib_size);
-
-    if (bitmap_index >= __afl_map_size)
-      FATAL("Too many basic blocks to instrument");
-
-#ifdef __arch64__
-    uint64_t
-#else
-    uint32_t
-#endif
-        *shadow = SHADOW(lib_addr + offset);
-    if (*shadow != 0) continue;  // skip duplicates
-
-      // Make lookup entry in shadow memory.
-
-#if ((defined(__APPLE__) && defined(__LP64__)) || defined(__x86_64__) || \
-     defined(__i386__))
-
-    // this is for Intel x64
-
-    uint8_t orig_byte = lib_addr[offset];
-    *shadow = (bitmap_index << 8) | orig_byte;
-    lib_addr[offset] = 0xcc;  // replace instruction with debug trap
-    if (debug)
-      fprintf(stderr,
-              "Patch entry: %p[%x] = %p = %02x -> SHADOW(%p) #%d -> %08x\n",
-              lib_addr, offset, lib_addr + offset, orig_byte, shadow,
-              bitmap_index, *shadow);
-
-#elif defined(__aarch64__)
-
-    // this is for aarch64
-
-    uint32_t *patch_bytes = (uint32_t *)(lib_addr + offset);
-    uint32_t  orig_bytes = *patch_bytes;
-    *shadow = (bitmap_index << 32) | orig_bytes;
-    *patch_bytes = 0xd4200000;  // replace instruction with debug trap
-    if (debug)
-      fprintf(stderr,
-              "Patch entry: %p[%x] = %p = %02x -> SHADOW(%p) #%d -> %016x\n",
-              lib_addr, offset, lib_addr + offset, orig_bytes, shadow,
-              bitmap_index, *shadow);
-
-#else
-    // this will be ARM and AARCH64
-    // for ARM we will need to identify if the code is in thumb or ARM
-  #error "non x86_64/aarch64 not supported yet"
-    //__arm__:
-    // linux thumb: 0xde01
-    // linux arm: 0xe7f001f0
-    //__aarch64__:
-    // linux aarch64: 0xd4200000
-#endif
-
-    bitmap_index++;
-
-  }
-
-  free(line);
-  fclose(patches);
-
-  // Install signal handler for SIGTRAP.
-  struct sigaction s;
-  s.sa_flags = SA_SIGINFO;
-  s.sa_sigaction = sigtrap_handler;
-  sigemptyset(&s.sa_mask);
-  sigaction(SIGTRAP, &s, 0);
-
-  if (debug) fprintf(stderr, "Patched %u locations.\n", bitmap_index);
-  __afl_map_size = bitmap_index;
-  if (__afl_map_size % 8) __afl_map_size = (((__afl_map_size + 7) >> 3) << 3);
-
-}
-
-/* the signal handler for the traps / debugging interrupts
-   No debug output here because this would cost speed      */
-static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
-
-  uint64_t addr;
-  // Must re-execute the instruction, so decrement PC by one instruction.
-  ucontext_t *ctx = (ucontext_t *)context;
-#if defined(__APPLE__) && defined(__LP64__)
-  ctx->uc_mcontext->__ss.__rip -= 1;
-  addr = ctx->uc_mcontext->__ss.__rip;
-#elif defined(__linux__)
-  #if defined(__x86_64__) || defined(__i386__)
-  ctx->uc_mcontext.gregs[REG_RIP] -= 1;
-  addr = ctx->uc_mcontext.gregs[REG_RIP];
-  #elif defined(__aarch64__)
-  ctx->uc_mcontext.pc -= 4;
-  addr = ctx->uc_mcontext.pc;
-  #else
-    #error "Unsupported processor"
-  #endif
-#elif defined(__FreeBSD__) && defined(__LP64__)
-  ctx->uc_mcontext.mc_rip -= 1;
-  addr = ctx->uc_mcontext.mc_rip;
-#else
-  #error "Unsupported platform"
-#endif
-
-  // fprintf(stderr, "TRAP at context addr = %lx, fault addr = %lx\n", addr,
-  // si->si_addr);
-
-  // If the trap didn't come from our instrumentation, then we probably will
-  // just segfault here
-  uint8_t *faultaddr;
-  if (unlikely(si->si_addr))
-    faultaddr = (u8 *)si->si_addr - 1;
-  else
-    faultaddr = (u8 *)addr;
-  // if (debug) fprintf(stderr, "Shadow location: %p\n", SHADOW(faultaddr));
-  uint32_t shadow = *SHADOW(faultaddr);
-  uint8_t  orig_byte = shadow & 0xff;
-  uint32_t index = shadow >> 8;
-
-  // if (debug) fprintf(stderr, "shadow data: %x, orig_byte %02x, index %d\n",
-  // shadow, orig_byte, index);
-
-  // Index zero is invalid so that it is still possible to catch actual trap
-  // instructions in instrumented libraries.
-  if (unlikely(index == 0)) abort();
-
-  // Restore original instruction
-  *faultaddr = orig_byte;
-
-  __afl_area_ptr[index] = 128;
-
-}
-
-/* the MAIN function */
-int main(int argc, char *argv[]) {
-
-  (void)personality(ADDR_NO_RANDOMIZE);  // disable ASLR
-
-  pid = getpid();
-  if (getenv("AFL_DEBUG")) debug = 1;
-
-  /* by default we use stdin, but also a filename can be passed, in this
-     case the input is argv[1] and we have to disable stdin */
-  if (argc > 1) {
-
-    use_stdin = 0;
-    inputfile = argv[1];
-
-  }
-
-  // STEP 2: load the library you want to fuzz and lookup the functions,
-  //         inclusive of the cleanup functions
-  //         NOTE: above the main() you have to define the functions!
-
-  void *dl = dlopen("./libtestinstr.so", RTLD_LAZY);
-  if (!dl) FATAL("could not find target library");
-  o_function = dlsym(dl, "testinstr");
-  if (!o_function) FATAL("could not resolve target function from library");
-  if (debug) fprintf(stderr, "Function address: %p\n", o_function);
-
-  // END STEP 2
-
-  /* setup instrumentation, shared memory and forkserver */
-  breakpoint();
-  read_library_information();
-  setup_trap_instrumentation();
-  __afl_map_shm();
-  __afl_start_forkserver();
-
-  while (1) {
-
-    // instead of fork() we could also use the snapshot lkm or do our own mini
-    // snapshot feature like in https://github.com/marcinguy/fuzzer
-    // -> snapshot.c
-    if ((pid = fork()) == -1) PFATAL("fork failed");
-
-    if (pid) {
-
-      u32 status;
-      if (waitpid(pid, &status, 0) < 0) exit(1);
-      /* report the test case is done and wait for the next */
-      __afl_end_testcase(status);
-
-    } else {
-
-      pid = getpid();
-      while ((len = __afl_next_testcase(buf, sizeof(buf))) > 0) {
-
-        // in this function the fuzz magic happens, this is STEP 3
-        fuzz();
-
-        // we can use _exit which is faster because our target library
-        // was loaded via dlopen and therefore cannot have deconstructors
-        // registered.
-        _exit(0);
-
-      }
-
-    }
-
-  }
-
-  return 0;
-
-}
-
-#ifndef _DEBUG
-inline
-#endif
-    static void
-    fuzz(void) {
-
-  // STEP 3: call the function to fuzz, also the functions you might
-  //         need to call to prepare the function and - important! -
-  //         to clean everything up
-
-  // in this example we use the input file, not stdin!
-  (*o_function)(buf, len);
-
-  // normally you also need to cleanup
-  //(*o_LibFree)(foo);
-
-  // END STEP 3
-
-}
-
diff --git a/examples/afl_untracer/ghidra_get_patchpoints.java b/examples/afl_untracer/ghidra_get_patchpoints.java
deleted file mode 100644
index d341bea4..00000000
--- a/examples/afl_untracer/ghidra_get_patchpoints.java
+++ /dev/null
@@ -1,84 +0,0 @@
-/* ###
- * IP: GHIDRA
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- * 
- *      http://www.apache.org/licenses/LICENSE-2.0
- * 
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-// Find patch points for untracer tools (e.g. afl++ examples/afl_untracer)
-//
-//   Copy to ..../Ghidra/Features/Search/ghidra_scripts/
-//   Writes the results to ~/Desktop/patches.txt
-//
-//   This is my very first Ghidra script. I am sure this could be done better.
-//
-//@category Search
-
-import ghidra.app.script.GhidraScript;
-import ghidra.program.model.address.*;
-import ghidra.program.model.block.*;
-import ghidra.program.model.listing.*;
-import ghidra.program.model.symbol.*;
-import ghidra.program.model.mem.*;
-
-import java.io.*;
-
-public class ghidra_get_patchpoints extends GhidraScript {
-
-	@Override
-	public void run() throws Exception {
-
-		long segment_start = 0;
-		Memory memory = currentProgram.getMemory();
-		MultEntSubModel model = new MultEntSubModel(currentProgram);
-		CodeBlockIterator subIter = model.getCodeBlocks(monitor);
-		BufferedWriter out = new BufferedWriter(new FileWriter(System.getProperty("user.home") + File.separator + "Desktop" + File.separator + "patches.txt"));
-
-		while (subIter.hasNext()) {
-
-			CodeBlock multiEntryBlock = subIter.next();
-			SimpleBlockModel basicBlockModel = new SimpleBlockModel(currentProgram);
-			CodeBlockIterator bbIter = basicBlockModel.getCodeBlocksContaining(multiEntryBlock, monitor);
-
-			while (bbIter.hasNext()) {
-
-				CodeBlock basicBlock = bbIter.next();
-
-				if (segment_start == 0) {
-
-					Address firstAddr = basicBlock.getFirstStartAddress();
-					long firstBlockAddr = firstAddr.getAddressableWordOffset();
-					MemoryBlock mb = memory.getBlock(firstAddr);
-					Address startAddr = mb.getStart();
-					Address endAddr = mb.getEnd();
-					segment_start = startAddr.getAddressableWordOffset();
-					if ((firstBlockAddr - segment_start) >= 0x1000)
-					  segment_start += 0x1000;
-					long segment_end = endAddr.getAddressableWordOffset();
-					long segment_size = segment_end - segment_start;
-					if ((segment_size % 0x1000) > 0)
-					  segment_size = (((segment_size / 0x1000) + 1) * 0x1000);
-					out.write(currentProgram.getName() + ":0x" + Long.toHexString(segment_size) + "\n"); 
-					//println("Start: " + Long.toHexString(segment_start));
-					//println("End: " + Long.toHexString(segment_end));
-
-				}
- 	   		        
- 	   		        if (basicBlock.getFirstStartAddress().getAddressableWordOffset() - segment_start > 0)
- 	   		        	out.write("0x" + Long.toHexString(basicBlock.getFirstStartAddress().getAddressableWordOffset() - segment_start) + "\n");
-
-			}
-		}
-
-		out.close();
-
-	}
-}
diff --git a/examples/afl_untracer/ida_get_patchpoints.py b/examples/afl_untracer/ida_get_patchpoints.py
deleted file mode 100644
index 43cf6d89..00000000
--- a/examples/afl_untracer/ida_get_patchpoints.py
+++ /dev/null
@@ -1,62 +0,0 @@
-#
-# IDAPython script for IDA Pro
-# Slightly modified from https://github.com/googleprojectzero/p0tools/blob/master/TrapFuzz/findPatchPoints.py
-#
-
-import idautils
-import idaapi
-import ida_nalt
-import idc
-
-# See https://www.hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml
-
-from os.path import expanduser
-home = expanduser("~")
-
-patchpoints = set()
-
-max_offset = 0
-for seg_ea in idautils.Segments():
-    name = idc.get_segm_name(seg_ea)
-    #print("Segment: " + name)
-    if name != "__text" and name != ".text":
-        continue
-
-    start = idc.get_segm_start(seg_ea)
-    end = idc.get_segm_end(seg_ea)
-    first = 0
-    subtract_addr = 0
-    #print("Start: " + hex(start) + " End: " + hex(end))
-    for func_ea in idautils.Functions(start, end):
-        f = idaapi.get_func(func_ea)
-        if not f:
-            continue
-        for block in idaapi.FlowChart(f):
-            if start <= block.start_ea < end:
-                if first == 0:
-                    if block.start_ea >= 0x1000:
-                        subtract_addr = 0x1000
-                        first = 1
-                        
-                max_offset = max(max_offset, block.start_ea)
-                patchpoints.add(block.start_ea - subtract_addr)
-            #else:
-            #    print("Warning: broken CFG?")
-
-# Round up max_offset to page size
-size = max_offset
-rem = size % 0x1000
-if rem != 0:
-    size += 0x1000 - rem
-
-print("Writing to " + home + "/Desktop/patches.txt")
-
-with open(home + "/Desktop/patches.txt", "w") as f:
-    f.write(ida_nalt.get_root_filename() + ':' + hex(size) + '\n')
-    f.write('\n'.join(map(hex, sorted(patchpoints))))
-    f.write('\n')
-
-print("Done, found {} patchpoints".format(len(patchpoints)))
-
-# For headless script running remove the comment from the next line
-#ida_pro.qexit()
diff --git a/examples/afl_untracer/libtestinstr.c b/examples/afl_untracer/libtestinstr.c
deleted file mode 100644
index 96b1cf21..00000000
--- a/examples/afl_untracer/libtestinstr.c
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
-   american fuzzy lop++ - a trivial program to test the build
-   --------------------------------------------------------
-   Originally written by Michal Zalewski
-   Copyright 2014 Google Inc. All rights reserved.
-   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-     http://www.apache.org/licenses/LICENSE-2.0
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-
-void testinstr(char *buf, int len) {
-
-  if (len < 1) return;
-  buf[len] = 0;
-
-  // we support three input cases
-  if (buf[0] == '0')
-    printf("Looks like a zero to me!\n");
-  else if (buf[0] == '1')
-    printf("Pretty sure that is a one!\n");
-  else
-    printf("Neither one or zero? How quaint!\n");
-
-}
-
diff --git a/examples/afl_untracer/libtestinstr.so b/examples/afl_untracer/libtestinstr.so
deleted file mode 100755
index 389a946c..00000000
Binary files a/examples/afl_untracer/libtestinstr.so and /dev/null differ
diff --git a/examples/afl_untracer/patches.txt b/examples/afl_untracer/patches.txt
deleted file mode 100644
index 7e964249..00000000
--- a/examples/afl_untracer/patches.txt
+++ /dev/null
@@ -1,34 +0,0 @@
-libtestinstr.so:0x1000
-0x10
-0x12
-0x20
-0x36
-0x30
-0x40
-0x50
-0x63
-0x6f
-0x78
-0x80
-0xa4
-0xb0
-0xb8
-0x100
-0xc0
-0xc9
-0xd7
-0xe3
-0xe8
-0xf8
-0x105
-0x11a
-0x135
-0x141
-0x143
-0x14e
-0x15a
-0x15c
-0x168
-0x16a
-0x16b
-0x170
diff --git a/examples/aflpp_driver/GNUmakefile b/examples/aflpp_driver/GNUmakefile
deleted file mode 100644
index c1a087d7..00000000
--- a/examples/aflpp_driver/GNUmakefile
+++ /dev/null
@@ -1,46 +0,0 @@
-ifeq "" "$(LLVM_CONFIG)"
-  LLVM_CONFIG=llvm-config
-endif
-
-LLVM_BINDIR = $(shell $(LLVM_CONFIG) --bindir 2>/dev/null)
-ifneq "" "$(LLVM_BINDIR)"
-  LLVM_BINDIR := $(LLVM_BINDIR)/
-endif
-
-CFLAGS := -O3 -funroll-loops -g
-
-all:	libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
-
-aflpp_driver.o:	aflpp_driver.c
-	-$(LLVM_BINDIR)clang -I. -I../../include $(CFLAGS) -c aflpp_driver.c
-
-libAFLDriver.a:	aflpp_driver.o
-	ar ru libAFLDriver.a aflpp_driver.o
-	cp -vf libAFLDriver.a ../../
-
-debug:
-	$(LLVM_BINDIR)clang -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
-	$(LLVM_BINDIR)clang -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
-	#$(LLVM_BINDIR)clang -S -emit-llvm -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c
-	#$(LLVM_BINDIR)clang -S -emit-llvm -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
-	ar ru libAFLDriver.a afl-performance.o aflpp_driver.o
-
-aflpp_qemu_driver.o:	aflpp_qemu_driver.c
-	$(LLVM_BINDIR)clang $(CFLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
-
-libAFLQemuDriver.a:	aflpp_qemu_driver.o
-	ar ru libAFLQemuDriver.a aflpp_qemu_driver.o
-	cp -vf libAFLQemuDriver.a ../../
-
-aflpp_qemu_driver_hook.so:	aflpp_qemu_driver_hook.o
-	$(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so
-
-aflpp_qemu_driver_hook.o:	aflpp_qemu_driver_hook.c
-	$(LLVM_BINDIR)clang -fPIC $(CFLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
-
-test:	debug
-	#clang -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test.ll aflpp_driver_test.c
-	afl-clang-fast -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test aflpp_driver_test.c libAFLDriver.a afl-performance.o
-
-clean:
-	rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test
diff --git a/examples/aflpp_driver/Makefile b/examples/aflpp_driver/Makefile
deleted file mode 100644
index 3666a74d..00000000
--- a/examples/aflpp_driver/Makefile
+++ /dev/null
@@ -1,2 +0,0 @@
-all:
-	@gmake all || echo please install GNUmake
diff --git a/examples/aflpp_driver/aflpp_driver.c b/examples/aflpp_driver/aflpp_driver.c
deleted file mode 100644
index 017aa72b..00000000
--- a/examples/aflpp_driver/aflpp_driver.c
+++ /dev/null
@@ -1,326 +0,0 @@
-//===- afl_driver.cpp - a glue between AFL and libFuzzer --------*- C++ -* ===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//===----------------------------------------------------------------------===//
-
-/* This file allows to fuzz libFuzzer-style target functions
- (LLVMFuzzerTestOneInput) with AFL using AFL's persistent (in-process) mode.
-
-Usage:
-################################################################################
-cat << EOF > test_fuzzer.cc
-#include <stddef.h>
-#include <stdint.h>
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-
-  if (size > 0 && data[0] == 'H')
-    if (size > 1 && data[1] == 'I')
-       if (size > 2 && data[2] == '!')
-       __builtin_trap();
-  return 0;
-
-}
-
-EOF
-# Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang.
-clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c
-# Build afl-llvm-rt.o.c from the AFL distribution.
-clang -c -w $AFL_HOME/instrumentation/afl-llvm-rt.o.c
-# Build this file, link it with afl-llvm-rt.o.o and the target code.
-clang++ afl_driver.cpp test_fuzzer.o afl-llvm-rt.o.o
-# Run AFL:
-rm -rf IN OUT; mkdir IN OUT; echo z > IN/z;
-$AFL_HOME/afl-fuzz -i IN -o OUT ./a.out
-################################################################################
-AFL_DRIVER_STDERR_DUPLICATE_FILENAME: Setting this *appends* stderr to the file
-specified. If the file does not exist, it is created. This is useful for getting
-stack traces (when using ASAN for example) or original error messages on hard
-to reproduce bugs. Note that any content written to stderr will be written to
-this file instead of stderr's usual location.
-
-AFL_DRIVER_CLOSE_FD_MASK: Similar to libFuzzer's -close_fd_mask behavior option.
-If 1, close stdout at startup. If 2 close stderr; if 3 close both.
-
-*/
-#include <assert.h>
-#include <errno.h>
-#include <stdarg.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <limits.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <sys/mman.h>
-
-#include "config.h"
-#include "cmplog.h"
-
-#ifdef _DEBUG
-  #include "hash.h"
-#endif
-
-#ifndef MAP_FIXED_NOREPLACE
-  #define MAP_FIXED_NOREPLACE 0x100000
-#endif
-
-#define MAX_DUMMY_SIZE 256000
-
-// Platform detection. Copied from FuzzerInternal.h
-#ifdef __linux__
-  #define LIBFUZZER_LINUX 1
-  #define LIBFUZZER_APPLE 0
-  #define LIBFUZZER_NETBSD 0
-  #define LIBFUZZER_FREEBSD 0
-  #define LIBFUZZER_OPENBSD 0
-#elif __APPLE__
-  #define LIBFUZZER_LINUX 0
-  #define LIBFUZZER_APPLE 1
-  #define LIBFUZZER_NETBSD 0
-  #define LIBFUZZER_FREEBSD 0
-  #define LIBFUZZER_OPENBSD 0
-#elif __NetBSD__
-  #define LIBFUZZER_LINUX 0
-  #define LIBFUZZER_APPLE 0
-  #define LIBFUZZER_NETBSD 1
-  #define LIBFUZZER_FREEBSD 0
-  #define LIBFUZZER_OPENBSD 0
-#elif __FreeBSD__
-  #define LIBFUZZER_LINUX 0
-  #define LIBFUZZER_APPLE 0
-  #define LIBFUZZER_NETBSD 0
-  #define LIBFUZZER_FREEBSD 1
-  #define LIBFUZZER_OPENBSD 0
-#elif __OpenBSD__
-  #define LIBFUZZER_LINUX 0
-  #define LIBFUZZER_APPLE 0
-  #define LIBFUZZER_NETBSD 0
-  #define LIBFUZZER_FREEBSD 0
-  #define LIBFUZZER_OPENBSD 1
-#else
-  #error "Support for your platform has not been implemented"
-#endif
-
-int                   __afl_sharedmem_fuzzing = 1;
-extern unsigned int * __afl_fuzz_len;
-extern unsigned char *__afl_fuzz_ptr;
-
-// libFuzzer interface is thin, so we don't include any libFuzzer headers.
-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
-__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
-
-// Notify AFL about persistent mode.
-static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
-int                  __afl_persistent_loop(unsigned int);
-
-// Notify AFL about deferred forkserver.
-static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
-void                 __afl_manual_init();
-
-// Use this optionally defined function to output sanitizer messages even if
-// user asks to close stderr.
-__attribute__((weak)) void __sanitizer_set_report_fd(void *);
-
-// Keep track of where stderr content is being written to, so that
-// dup_and_close_stderr can use the correct one.
-static FILE *output_file;
-
-// Experimental feature to use afl_driver without AFL's deferred mode.
-// Needs to run before __afl_auto_init.
-__attribute__((constructor(0))) static void __decide_deferred_forkserver(void) {
-
-  if (getenv("AFL_DRIVER_DONT_DEFER")) {
-
-    if (unsetenv("__AFL_DEFER_FORKSRV")) {
-
-      perror("Failed to unset __AFL_DEFER_FORKSRV");
-      abort();
-
-    }
-
-  }
-
-}
-
-// If the user asks us to duplicate stderr, then do it.
-static void maybe_duplicate_stderr() {
-
-  char *stderr_duplicate_filename =
-      getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
-
-  if (!stderr_duplicate_filename) return;
-
-  FILE *stderr_duplicate_stream =
-      freopen(stderr_duplicate_filename, "a+", stderr);
-
-  if (!stderr_duplicate_stream) {
-
-    fprintf(
-        stderr,
-        "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
-    abort();
-
-  }
-
-  output_file = stderr_duplicate_stream;
-
-}
-
-// Most of these I/O functions were inspired by/copied from libFuzzer's code.
-static void discard_output(int fd) {
-
-  FILE *temp = fopen("/dev/null", "w");
-  if (!temp) abort();
-  dup2(fileno(temp), fd);
-  fclose(temp);
-
-}
-
-static void close_stdout() {
-
-  discard_output(STDOUT_FILENO);
-
-}
-
-// Prevent the targeted code from writing to "stderr" but allow sanitizers and
-// this driver to do so.
-static void dup_and_close_stderr() {
-
-  int output_fileno = fileno(output_file);
-  int output_fd = dup(output_fileno);
-  if (output_fd <= 0) abort();
-  FILE *new_output_file = fdopen(output_fd, "w");
-  if (!new_output_file) abort();
-  if (!__sanitizer_set_report_fd) return;
-  __sanitizer_set_report_fd((void *)(long int)output_fd);
-  discard_output(output_fileno);
-
-}
-
-// Close stdout and/or stderr if user asks for it.
-static void maybe_close_fd_mask() {
-
-  char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
-  if (!fd_mask_str) return;
-  int fd_mask = atoi(fd_mask_str);
-  if (fd_mask & 2) dup_and_close_stderr();
-  if (fd_mask & 1) close_stdout();
-
-}
-
-// Define LLVMFuzzerMutate to avoid link failures for targets that use it
-// with libFuzzer's LLVMFuzzerCustomMutator.
-size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
-
-  // assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
-  return 0;
-
-}
-
-// Execute any files provided as parameters.
-static int ExecuteFilesOnyByOne(int argc, char **argv) {
-
-  unsigned char *buf = malloc(MAX_FILE);
-  for (int i = 1; i < argc; i++) {
-
-    int fd = open(argv[i], O_RDONLY);
-    if (fd == -1) continue;
-    ssize_t length = read(fd, buf, MAX_FILE);
-    if (length > 0) {
-
-      printf("Reading %zu bytes from %s\n", length, argv[i]);
-      LLVMFuzzerTestOneInput(buf, length);
-      printf("Execution successful.\n");
-
-    }
-
-  }
-
-  free(buf);
-  return 0;
-
-}
-
-int main(int argc, char **argv) {
-
-  printf(
-      "======================= INFO =========================\n"
-      "This binary is built for afl++.\n"
-      "To run the target function on individual input(s) execute this:\n"
-      "  %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
-      "To fuzz with afl-fuzz execute this:\n"
-      "  afl-fuzz [afl-flags] -- %s [-N]\n"
-      "afl-fuzz will run N iterations before re-spawning the process (default: "
-      "1000)\n"
-      "======================================================\n",
-      argv[0], argv[0]);
-
-  output_file = stderr;
-  maybe_duplicate_stderr();
-  maybe_close_fd_mask();
-  if (LLVMFuzzerInitialize) {
-
-    fprintf(stderr, "Running LLVMFuzzerInitialize ...\n");
-    LLVMFuzzerInitialize(&argc, &argv);
-    fprintf(stderr, "continue...\n");
-
-  }
-
-  // Do any other expensive one-time initialization here.
-
-  uint8_t dummy_input[64] = {0};
-  memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
-  memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
-         sizeof(AFL_DEFER_FORKSVR));
-  int N = INT_MAX;
-  if (argc == 2 && argv[1][0] == '-')
-    N = atoi(argv[1] + 1);
-  else if (argc == 2 && (N = atoi(argv[1])) > 0)
-    printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
-  else if (argc > 1) {
-
-    __afl_sharedmem_fuzzing = 0;
-    __afl_manual_init();
-    return ExecuteFilesOnyByOne(argc, argv);
-
-  }
-
-  assert(N > 0);
-
-  //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
-  __afl_manual_init();
-
-  // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
-  // on the first execution of LLVMFuzzerTestOneInput is ignored.
-  LLVMFuzzerTestOneInput(dummy_input, 1);
-
-  int num_runs = 0;
-  while (__afl_persistent_loop(N)) {
-
-#ifdef _DEBUG
-    fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
-            hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705),
-            *__afl_fuzz_len);
-    fprintf(stderr, "RECV:");
-    for (int i = 0; i < *__afl_fuzz_len; i++)
-      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
-    fprintf(stderr, "\n");
-#endif
-    if (*__afl_fuzz_len) {
-
-      num_runs++;
-      LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
-
-    }
-
-  }
-
-  printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
-
-}
-
diff --git a/examples/aflpp_driver/aflpp_driver_test.c b/examples/aflpp_driver/aflpp_driver_test.c
deleted file mode 100644
index b4ff6bc6..00000000
--- a/examples/aflpp_driver/aflpp_driver_test.c
+++ /dev/null
@@ -1,32 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-
-#include "hash.h"
-
-void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
-
-  if (Size < 5) return;
-
-  if (Data[0] == 'F')
-    if (Data[1] == 'A')
-      if (Data[2] == '$')
-        if (Data[3] == '$')
-          if (Data[4] == '$') abort();
-
-}
-
-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
-
-  if (Size)
-    fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
-            hash64((u8 *)Data, (unsigned int)Size,
-                   (unsigned long long int)0xa5b35705),
-            Size);
-
-  crashme(Data, Size);
-
-  return 0;
-
-}
-
diff --git a/examples/aflpp_driver/aflpp_qemu_driver.c b/examples/aflpp_driver/aflpp_qemu_driver.c
deleted file mode 100644
index 4f3e5f71..00000000
--- a/examples/aflpp_driver/aflpp_qemu_driver.c
+++ /dev/null
@@ -1,38 +0,0 @@
-#include <stdint.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-// libFuzzer interface is thin, so we don't include any libFuzzer headers.
-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
-__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
-
-static const size_t kMaxAflInputSize = 1 * 1024 * 1024;
-static uint8_t      AflInputBuf[kMaxAflInputSize];
-
-void __attribute__((noinline)) afl_qemu_driver_stdin_input(void) {
-
-  size_t l = read(0, AflInputBuf, kMaxAflInputSize);
-  LLVMFuzzerTestOneInput(AflInputBuf, l);
-
-}
-
-int main(int argc, char **argv) {
-
-  if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv);
-  // Do any other expensive one-time initialization here.
-
-  if (getenv("AFL_QEMU_DRIVER_NO_HOOK")) {
-
-    afl_qemu_driver_stdin_input();
-
-  } else {
-
-    uint8_t dummy_input[1024000] = {0};
-    LLVMFuzzerTestOneInput(dummy_input, 1);
-
-  }
-
-  return 0;
-
-}
-
diff --git a/examples/aflpp_driver/aflpp_qemu_driver_hook.c b/examples/aflpp_driver/aflpp_qemu_driver_hook.c
deleted file mode 100644
index 823cc42d..00000000
--- a/examples/aflpp_driver/aflpp_qemu_driver_hook.c
+++ /dev/null
@@ -1,22 +0,0 @@
-#include <stdint.h>
-#include <string.h>
-
-#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
-
-#define REGS_RDI 7
-#define REGS_RSI 6
-
-void afl_persistent_hook(uint64_t *regs, uint64_t guest_base,
-                         uint8_t *input_buf, uint32_t input_len) {
-
-  memcpy(g2h(regs[REGS_RDI]), input_buf, input_len);
-  regs[REGS_RSI] = input_len;
-
-}
-
-int afl_persistent_hook_init(void) {
-
-  return 1;
-
-}
-
diff --git a/examples/analysis_scripts/queue2csv.sh b/examples/analysis_scripts/queue2csv.sh
deleted file mode 100755
index 2528b438..00000000
--- a/examples/analysis_scripts/queue2csv.sh
+++ /dev/null
@@ -1,122 +0,0 @@
-#!/bin/bash
-
-test -z "$1" -o -z "$2" -o "$1" = "-h" -o "$1" = "-hh" -o "$1" = "--help" -o '!' -d "$1" && {
-  echo "Syntax: [-n]  $0 out-directory file.csv [\"tools/target --opt @@\"]"
-  echo Option -n will suppress the CSV header.
-  echo If the target execution command is supplied then also edge coverage is gathered.
-  exit 1
-}
-
-function getval() {
-  VAL=""
-  if [ "$file" != "${file/$1/}" ]; then
-    TMP="${file/*$1:/}"
-    VAL="${TMP/,*/}"
-  fi
-}
-
-SKIP=
-if [ "$1" = "-n" ]; then
-  SKIP=1
-  shift
-fi
-
-test -n "$4" && { echo "Error: too many commandline options. Target command and options including @@ have to be passed within \"\"!"; exit 1; }
-
-test -d "$1"/queue && OUT="$1/queue" || OUT="$1"
-
-OK=`ls $OUT/id:000000,time:0,orig:* 2> /dev/null`
-if [ -n "$OK" ]; then
-  LISTCMD="ls $OUT/id:"*
-else
-  LISTCMD="ls -tr $OUT/"
-fi
-
-ID=;SRC=;TIME=;OP=;POS=;REP=;EDGES=;EDGES_TOTAL=;
-DIR="$OUT/../stats"
-rm -rf "$DIR"
-> "$2" || exit 1
-mkdir "$DIR" || exit 1
-> "$DIR/../edges.txt" || exit 1
-
-{
-
-  if [ -z "$SKIP" ]; then
-    echo "time;\"filename\";id;src;new_cov;edges;total_edges;\"op\";pos;rep;unique_edges"
-  fi
-
-  $LISTCMD | grep -v ,sync: | sed 's/.*id:/id:/g' | while read file; do
-
-    if [ -n "$3" ]; then
-
-      TMP=${3/@@/$OUT/$file}
-      
-      if [ "$TMP" = "$3" ]; then
-    
-        cat "$OUT/$file" | afl-showmap -o "$DIR/$file" -q -- $3 >/dev/null 2>&1
-        
-      else
-      
-        afl-showmap -o "$DIR/$file" -q -- $TMP >/dev/null 2>&1
-      
-      fi
-    
-      { cat "$DIR/$file" | sed 's/:.*//' ; cat "$DIR/../edges.txt" ; } | sort -nu > $DIR/../edges.txt.tmp
-      mv $DIR/../edges.txt.tmp $DIR/../edges.txt
-      EDGES=$(cat "$DIR/$file" | wc -l)
-      EDGES_TOTAL=$(cat "$DIR/../edges.txt" | wc -l)
-
-    fi
-
-    getval id; ID="$VAL"
-    getval src; SRC="$VAL"
-    getval time; TIME="$VAL"
-    getval op; OP="$VAL"
-    getval pos; POS="$VAL"
-    getval rep; REP="$VAL"
-    if [ "$file" != "${file/+cov/}" ]; then
-      COV=1
-    else
-      COV=""
-    fi
-
-    if [ -n "$3" -a -s "$DIR/../edges.txt" ]; then
-      echo "$TIME;\"$file\";$ID;$SRC;$COV;$EDGES;$EDGES_TOTAL;\"$OP\";$POS;$REP;UNIQUE$file"
-    else
-      echo "$TIME;\"$file\";$ID;$SRC;$COV;;;\"$OP\";$POS;$REP;"
-    fi
-
-  done
-
-} | tee "$DIR/../queue.csv" > "$2" || exit 1
-
-if [ -n "$3" -a -s "$DIR/../edges.txt" ]; then
-
-  cat "$DIR/"* | sed 's/:.*//' | sort -n | uniq -c | egrep '^[ \t]*1 ' | awk '{print$2}' > $DIR/../unique.txt
-
-  if [ -s "$DIR/../unique.txt" ]; then
-
-    ls "$DIR/id:"* | grep -v ",sync:" |sed 's/.*\/id:/id:/g' | while read file; do
-
-      CNT=$(sed 's/:.*//' "$DIR/$file" | tee "$DIR/../tmp.txt" | wc -l)
-      DIFF=$(diff -u "$DIR/../tmp.txt" "$DIR/../unique.txt" | egrep '^-[0-9]' | wc -l)
-      UNIQUE=$(($CNT - $DIFF))
-      sed -i "s/;UNIQUE$file/;$UNIQUE/" "$DIR/../queue.csv" "$2"
-
-    done
-    
-    rm -f "$DIR/../tmp.txt"
-
-  else
-    
-    sed -i 's/;UNIQUE.*/;/' "$DIR/../queue.csv" "$2"
-  
-  fi  
-
-fi
-
-mv "$DIR/../queue.csv" "$DIR/queue.csv"
-if [ -e "$DIR/../edges.txt" ]; then mv "$DIR/../edges.txt" "$DIR/edges.txt"; fi
-if [ -e "$DIR/../unique.txt" ]; then mv "$DIR/../unique.txt" "$DIR/unique.txt"; fi
-
-echo "Created $2"
diff --git a/examples/argv_fuzzing/Makefile b/examples/argv_fuzzing/Makefile
deleted file mode 100644
index 5a0ac6e6..00000000
--- a/examples/argv_fuzzing/Makefile
+++ /dev/null
@@ -1,58 +0,0 @@
-#
-# american fuzzy lop++ - argvfuzz
-# --------------------------------
-#
-# Copyright 2019-2020 Kjell Braden <afflux@pentabarf.de>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-
-.PHONY: all install clean
-
-PREFIX     ?= /usr/local
-BIN_PATH    = $(PREFIX)/bin
-HELPER_PATH = $(PREFIX)/lib/afl
-
-CFLAGS = -fPIC -Wall -Wextra
-LDFLAGS = -shared
-
-UNAME_SAYS_LINUX=$(shell uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?)
-UNAME_SAYS_LINUX:sh=uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?
-
-_LDFLAGS_ADD=$(UNAME_SAYS_LINUX:1=)
-LDFLAGS_ADD=$(_LDFLAGS_ADD:0=-ldl)
-LDFLAGS  += $(LDFLAGS_ADD)
-
-# on gcc for arm there is no -m32, but -mbe32
-M32FLAG = -m32
-M64FLAG = -m64
-
-CC_IS_GCC=$(shell $(CC) --version 2>/dev/null | grep -q gcc; echo $$?)
-CC_IS_GCC:sh=$(CC) --version 2>/dev/null | grep -q gcc; echo $$?
-CC_IS_ARMCOMPILER=$(shell $(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?)
-CC_IS_ARMCOMPILER:sh=$(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?
-
-_M32FLAG=$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)
-__M32FLAG=$(_M32FLAG:00=-mbe32)
-___M32FLAG=$(__M32FLAG:$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)=-m32)
-M32FLAG=$(___M32FLAG)
-
-all: argvfuzz32.so argvfuzz64.so
-
-argvfuzz32.so: argvfuzz.c
-	-@$(CC) $(M32FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "argvfuzz32 build failure (that's fine)"
-
-argvfuzz64.so: argvfuzz.c
-	-@$(CC) $(M64FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "argvfuzz64 build failure (that's fine)"
-
-install: argvfuzz32.so argvfuzz64.so
-	install -d -m 755 $(DESTDIR)$(HELPER_PATH)/
-	if [ -f argvfuzz32.so ]; then set -e; install -m 755 argvfuzz32.so $(DESTDIR)$(HELPER_PATH)/; fi
-	if [ -f argvfuzz64.so ]; then set -e; install -m 755 argvfuzz64.so $(DESTDIR)$(HELPER_PATH)/; fi
-
-clean:
-	rm -f argvfuzz32.so argvfuzz64.so
diff --git a/examples/argv_fuzzing/README.md b/examples/argv_fuzzing/README.md
deleted file mode 100644
index fa8cad80..00000000
--- a/examples/argv_fuzzing/README.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# argvfuzz
-
-afl supports fuzzing file inputs or stdin. When source is available,
-`argv-fuzz-inl.h` can be used to change `main()` to build argv from stdin.
-
-`argvfuzz` tries to provide the same functionality for binaries. When loaded
-using `LD_PRELOAD`, it will hook the call to `__libc_start_main` and replace
-argv using the same logic of `argv-fuzz-inl.h`.
-
-A few conditions need to be fulfilled for this mechanism to work correctly:
-
-1. As it relies on hooking the loader, it cannot work on static binaries.
-2. If the target binary does not use the default libc's `_start` implementation
-   (crt1.o), the hook may not run.
-3. The hook will replace argv with pointers to `.data` of `argvfuzz.so`. If the
-   target binary expects argv to be living on the stack, things may go wrong.
diff --git a/examples/argv_fuzzing/argv-fuzz-inl.h b/examples/argv_fuzzing/argv-fuzz-inl.h
deleted file mode 100644
index c15c0271..00000000
--- a/examples/argv_fuzzing/argv-fuzz-inl.h
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
-   american fuzzy lop++ - sample argv fuzzing wrapper
-   ------------------------------------------------
-
-   Originally written by Michal Zalewski
-
-   Copyright 2015 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   This file shows a simple way to fuzz command-line parameters with stock
-   afl-fuzz. To use, add:
-
-   #include "/path/to/argv-fuzz-inl.h"
-
-   ...to the file containing main(), ideally placing it after all the
-   standard includes. Next, put AFL_INIT_ARGV(); near the very beginning of
-   main().
-
-   This will cause the program to read NUL-delimited input from stdin and
-   put it in argv[]. Two subsequent NULs terminate the array. Empty
-   params are encoded as a lone 0x02. Lone 0x02 can't be generated, but
-   that shouldn't matter in real life.
-
-   If you would like to always preserve argv[0], use this instead:
-   AFL_INIT_SET0("prog_name");
-
-*/
-
-#ifndef _HAVE_ARGV_FUZZ_INL
-#define _HAVE_ARGV_FUZZ_INL
-
-#include <unistd.h>
-
-#define AFL_INIT_ARGV()          \
-  do {                           \
-                                 \
-    argv = afl_init_argv(&argc); \
-                                 \
-  } while (0)
-
-#define AFL_INIT_SET0(_p)        \
-  do {                           \
-                                 \
-    argv = afl_init_argv(&argc); \
-    argv[0] = (_p);              \
-    if (!argc) argc = 1;         \
-                                 \
-  } while (0)
-
-#define MAX_CMDLINE_LEN 100000
-#define MAX_CMDLINE_PAR 50000
-
-static char **afl_init_argv(int *argc) {
-
-  static char  in_buf[MAX_CMDLINE_LEN];
-  static char *ret[MAX_CMDLINE_PAR];
-
-  char *ptr = in_buf;
-  int   rc = 0;
-
-  if (read(0, in_buf, MAX_CMDLINE_LEN - 2) < 0) {}
-
-  while (*ptr && rc < MAX_CMDLINE_PAR) {
-
-    ret[rc] = ptr;
-    if (ret[rc][0] == 0x02 && !ret[rc][1]) ret[rc]++;
-    rc++;
-
-    while (*ptr)
-      ptr++;
-    ptr++;
-
-  }
-
-  *argc = rc;
-
-  return ret;
-
-}
-
-#undef MAX_CMDLINE_LEN
-#undef MAX_CMDLINE_PAR
-
-#endif                                              /* !_HAVE_ARGV_FUZZ_INL */
-
diff --git a/examples/argv_fuzzing/argvfuzz.c b/examples/argv_fuzzing/argvfuzz.c
deleted file mode 100644
index 4251ca4c..00000000
--- a/examples/argv_fuzzing/argvfuzz.c
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
-   american fuzzy lop++ - LD_PRELOAD for fuzzing argv in binaries
-   ------------------------------------------------------------
-
-   Copyright 2019-2020 Kjell Braden <afflux@pentabarf.de>
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
- */
-
-#define _GNU_SOURCE                                        /* for RTLD_NEXT */
-#include <dlfcn.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <unistd.h>
-#include "argv-fuzz-inl.h"
-
-int __libc_start_main(int (*main)(int, char **, char **), int argc, char **argv,
-                      void (*init)(void), void (*fini)(void),
-                      void (*rtld_fini)(void), void *stack_end) {
-
-  int (*orig)(int (*main)(int, char **, char **), int argc, char **argv,
-              void (*init)(void), void (*fini)(void), void (*rtld_fini)(void),
-              void *stack_end);
-  int    sub_argc;
-  char **sub_argv;
-
-  (void)argc;
-  (void)argv;
-
-  orig = dlsym(RTLD_NEXT, __func__);
-
-  if (!orig) {
-
-    fprintf(stderr, "hook did not find original %s: %s\n", __func__, dlerror());
-    exit(EXIT_FAILURE);
-
-  }
-
-  sub_argv = afl_init_argv(&sub_argc);
-
-  return orig(main, sub_argc, sub_argv, init, fini, rtld_fini, stack_end);
-
-}
-
diff --git a/examples/asan_cgroups/limit_memory.sh b/examples/asan_cgroups/limit_memory.sh
deleted file mode 100755
index 1f0f04ad..00000000
--- a/examples/asan_cgroups/limit_memory.sh
+++ /dev/null
@@ -1,157 +0,0 @@
-#!/usr/bin/env bash
-#
-# american fuzzy lop++ - limit memory using cgroups
-# -----------------------------------------------
-#
-# Written by Samir Khakimov <samir.hakim@nyu.edu> and
-#            David A. Wheeler <dwheeler@ida.org>
-#
-# Edits to bring the script in line with afl-cmin and other companion scripts
-# by Michal Zalewski. All bugs are my fault.
-#
-# Copyright 2015 Institute for Defense Analyses.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# This tool allows the amount of actual memory allocated to a program
-# to be limited on Linux systems using cgroups, instead of the traditional
-# setrlimit() API. This helps avoid the address space problems discussed in
-# docs/notes_for_asan.md.
-#
-# Important: the limit covers *both* afl-fuzz and the fuzzed binary. In some
-# hopefully rare circumstances, afl-fuzz could be killed before the fuzzed
-# task.
-#
-
-echo "cgroup tool for afl-fuzz by <samir.hakim@nyu.edu> and <dwheeler@ida.org>"
-echo
-
-unset NEW_USER
-MEM_LIMIT="50"
-
-while getopts "+u:m:" opt; do
-
-  case "$opt" in
-
-    "u")
-         NEW_USER="$OPTARG"
-         ;;
-
-    "m")
-         MEM_LIMIT="$[OPTARG]"
-         ;;
-
-    "?")
-         exit 1
-         ;;
-
-   esac
-
-done
-
-if [ "$MEM_LIMIT" -lt "5" ]; then
-  echo "[-] Error: malformed or dangerously low value of -m." 1>&2
-  exit 1
-fi
-
-shift $((OPTIND-1))
-
-TARGET_BIN="$1"
-
-if [ "$TARGET_BIN" = "" -o "$NEW_USER" = "" ]; then
-
-  cat 1>&2 <<_EOF_
-Usage: $0 [ options ] -- /path/to/afl-fuzz [ ...afl options... ]
-
-Required parameters:
-
-  -u user   - run the fuzzer as a specific user after setting up limits
-
-Optional parameters:
-
-  -m megs   - set memory limit to a specified value ($MEM_LIMIT MB)
-
-This tool configures cgroups-based memory limits for a fuzzing job to simplify
-the task of fuzzing ASAN or MSAN binaries. You would normally want to use it in
-conjunction with '-m none' passed to the afl-fuzz binary itself, say:
-
-  $0 -u joe ./afl-fuzz -i input -o output -m none /path/to/target
-
-_EOF_
-
-  exit 1
-
-fi
-
-# Basic sanity checks
-
-if [ ! "`uname -s`" = "Linux" ]; then
- echo "[-] Error: this tool does not support non-Linux systems." 1>&2
- exit 1
-fi
-
-if [ ! "`id -u`" = "0" ]; then
- echo "[-] Error: you need to run this script as root (sorry!)." 1>&2
- exit 1
-fi
-
-if ! type cgcreate 2>/dev/null 1>&2; then
-
-  echo "[-] Error: you need to install cgroup tools first." 1>&2
-
-  if type apt-get 2>/dev/null 1>&2; then
-    echo "    (Perhaps 'apt-get install cgroup-bin' will work.)" 1>&2
-  elif type yum 2>/dev/null 1>&2; then
-    echo "    (Perhaps 'yum install libcgroup-tools' will work.)" 1>&2
-  fi
-
-  exit 1
-
-fi
-
-if ! id -u "$NEW_USER" 2>/dev/null 1>&2; then
-  echo "[-] Error: user '$NEW_USER' does not seem to exist." 1>&2
-  exit 1
-fi
-
-# Create a new cgroup path if necessary... We used PID-keyed groups to keep
-# parallel afl-fuzz tasks separate from each other.
-
-CID="afl-$NEW_USER-$$"
-
-CPATH="/sys/fs/cgroup/memory/$CID"
-
-if [ ! -d "$CPATH" ]; then
-
-  cgcreate -a "$NEW_USER" -g memory:"$CID" || exit 1
-
-fi
-
-# Set the appropriate limit...
-
-if [ -f "$CPATH/memory.memsw.limit_in_bytes" ]; then
-
-  echo "${MEM_LIMIT}M" > "$CPATH/memory.limit_in_bytes" 2>/dev/null
-  echo "${MEM_LIMIT}M" > "$CPATH/memory.memsw.limit_in_bytes" || exit 1
-  echo "${MEM_LIMIT}M" > "$CPATH/memory.limit_in_bytes" || exit 1
-
-elif grep -qE 'partition|file' /proc/swaps; then
-
-  echo "[-] Error: your system requires swap to be disabled first (swapoff -a)." 1>&2
-  exit 1
-
-else
-
-  echo "${MEM_LIMIT}M" > "$CPATH/memory.limit_in_bytes" || exit 1
-
-fi
-
-# All right. At this point, we can just run the command.
-
-cgexec -g "memory:$CID" su -c "$*" "$NEW_USER"
-
-cgdelete -g "memory:$CID"
diff --git a/examples/bash_shellshock/shellshock-fuzz.diff b/examples/bash_shellshock/shellshock-fuzz.diff
deleted file mode 100644
index 3fa05bf8..00000000
--- a/examples/bash_shellshock/shellshock-fuzz.diff
+++ /dev/null
@@ -1,59 +0,0 @@
-This patch shows a very simple way to find post-Shellshock bugs in bash, as
-discussed here:
-
-  http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html
-
-In essence, it shows a way to fuzz environmental variables. Instructions:
-
-1) Download bash 4.3, apply this patch, compile with:
-
-   CC=/path/to/afl-gcc ./configure
-   make clean all
-
-   Note that the harness puts the fuzzed output in $TEST_VARIABLE. With
-   Florian's Shellshock patch (bash43-028), this is no longer passed down
-   to the parser.
-
-2) Create and cd to an empty directory, put the compiled bash binary in
-   there, and run these commands:
-
-   mkdir in_dir
-   echo -n '() { a() { a; }; : >b; }' >in_dir/script.txt
-
-3) Run the fuzzer with:
-
-   /path/to/afl-fuzz -d -i in_dir -o out_dir ./bash -c :
-
-   The -d parameter is advisable only if the tested shell is fairly slow
-   or if you are in a hurry; will cover more ground faster, but
-   less systematically.
-
-4) Watch for crashes in out_dir/crashes/. Also watch for any new files
-   created in cwd if you're interested in non-crash RCEs (files will be
-   created whenever the shell executes "foo>bar" or something like
-   that). You can correlate their creation date with new entries in
-   out_dir/queue/.
-
-   You can also modify the bash binary to directly check for more subtle
-   fault conditions, or use the synthesized entries in out_dir/queue/
-   as a seed for other, possibly slower or more involved testing regimes.
-
-   Expect several hours to get decent coverage.
-
---- bash-4.3/shell.c.orig	2014-01-14 14:04:32.000000000 +0100
-+++ bash-4.3/shell.c	2015-04-30 05:56:46.000000000 +0200
-@@ -371,6 +371,14 @@
-   env = environ;
- #endif /* __OPENNT */
- 
-+  {
-+
-+    static char val[1024 * 16];
-+    read(0, val, sizeof(val) - 1);
-+    setenv("TEST_VARIABLE", val, 1);
-+
-+  }
-+
-   USE_VAR(argc);
-   USE_VAR(argv);
-   USE_VAR(env);
diff --git a/examples/canvas_harness/canvas_harness.html b/examples/canvas_harness/canvas_harness.html
deleted file mode 100644
index a37b6937..00000000
--- a/examples/canvas_harness/canvas_harness.html
+++ /dev/null
@@ -1,170 +0,0 @@
-<html>
-<!--
-
-  american fuzzy lop++ - <canvas> harness
-  -------------------------------------
- 
-  Originally written by Michal Zalewski
- 
-  Copyright 2013, 2014 Google Inc. All rights reserved.
- 
-  Licensed under the Apache License, Version 2.0 (the "License");
-  you may not use this file except in compliance with the License.
-  You may obtain a copy of the License at:
- 
-    http://www.apache.org/licenses/LICENSE-2.0
- 
-  A simple harness for going through afl-generated test cases, rendering them in
-  the browser environment, and discovering the use of uninitialized memory and
-  similar bugs. This code led to the discovery of a fair number of library and
-  browser security bugs!
-
-  The url_list[] array is a placeholder; for this to work properly, it needs to
-  be initialized with web-reachable paths to individual test cases. This can
-  be done manually or with a simple script.
-
--->
-
-<body onload="set_images()">
-
-<div id="status"></div>
-
-<div id="image_div"></div>
-
-<canvas height=64 width=64 id=cvs></canvas>
-
-<h2>Results</h2>
-
-<ul id="output"></ul>
-
-<script>
-
-var c = document.getElementById('cvs');
-var ctx = c.getContext('2d');
-
-var url_list = [
-  "images/id:000000,[...].jpg",
-  "images/id:000001,[...].jpg",
-  /* ... */
-  null
-];
-
-var USE_IMAGES = 50;
-var cur_image = 0;
-
-if (location.hash) cur_image = parseInt(location.hash.substr(1));
-
-var loaded = 0;
-var image_obj = [];
-
-var msie_cleanup;
-
-function check_results() {
-
-  var uniques = [];
-
-  clearTimeout(msie_cleanup);
-
-  ctx.clearRect(0, 0, 64, 64);
-
-  uniques.push(image_obj[0].imgdata);
-
-  for (var i = 1; i < USE_IMAGES; i++) {
-
-    if (!image_obj[i].imgdata) continue;
-
-    if (image_obj[0].imgdata != image_obj[i].imgdata) {
-
-      for (var j = 1; j < uniques.length; j++)
-        if (uniques[j] == image_obj[i].imgdata) break;
-
-      if (j == uniques.length) uniques.push(image_obj[i].imgdata);
-
-
-    }
-
-  }
-
-  if (uniques.length > 1) {
-
-    var str = '<li> Image ' + url_list[cur_image] + ' has ' + uniques.length + ' variants: ';
-
-    for (var i = 0; i < uniques.length; i++)
-      str += '<img src="' + uniques[i] + '">';
-
-    document.getElementById('output').innerHTML += str;
-
-  }
-
-  cur_image++;
-  set_images();
-}
-
-
-function count_image() {
-
-  if (!this.complete || this.counted) return;
-
-  this.counted = true;
-
-  loaded++;
-
-  ctx.clearRect(0, 0, 64, 64);
-
-  try {
-    ctx.drawImage(this, 0, 0, 64, 64);
-  } catch (e) { }
-
-  this.imgdata = c.toDataURL();
-
-  if (loaded == USE_IMAGES) check_results();
-}
-
-
-function set_images() {
-
-  loaded = 0;
-
-  document.getElementById('status').innerHTML = 'Now processing ' + cur_image + '...';
-  location.hash = '#' + cur_image;
-
-  if (url_list[cur_image] == null) {
-    alert('Done!');
-    return;
-  }
-
-  restart_images();
-
-  msie_cleanup = setTimeout(check_results, 5000);
-
-  for (var i = 0; i < USE_IMAGES; i++)
-    image_obj[i].src = url_list[cur_image] + '?' + Math.random();
-
-}
-
-
-function restart_images() {
-
-  for (var i = 0; i < USE_IMAGES; i++) 
-    if (image_obj[i]) image_obj[i].counted = true;
-
-  document.getElementById('image_div').innerHTML = '';
-  image_obj = [];
-
-  for (var i = 0; i < USE_IMAGES; i++) {
-
-    image_obj[i] = new Image();
-    image_obj[i].height = 64;
-    image_obj[i].width = 64;
-    image_obj[i].onerror = count_image;
-    image_obj[i].onload = count_image;
-
-    document.getElementById('image_div').appendChild(image_obj[i]);
-
-  }
-
-}
-
-</script>
-
-<iframe src='http://www.cnn.com/'></iframe>
diff --git a/examples/clang_asm_normalize/as b/examples/clang_asm_normalize/as
deleted file mode 100755
index 45537cae..00000000
--- a/examples/clang_asm_normalize/as
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/bin/sh
-#
-# american fuzzy lop++ - clang assembly normalizer
-# ----------------------------------------------
-#
-# Originally written by Michal Zalewski
-# The idea for this wrapper comes from Ryan Govostes.
-#
-# Copyright 2013, 2014 Google Inc. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# This 'as' wrapper should allow you to instrument unruly, hand-written
-# assembly with afl-as.
-#
-# Usage:
-#
-# export AFL_REAL_PATH=/path/to/directory/with/afl-as/
-# AFL_PATH=/path/to/this/directory/ make clean all
-
-if [ "$#" -lt "2" ]; then
-  echo "[-] Error: this utility can't be called directly." 1>&2
-  exit 1
-fi
-
-if [ "$AFL_REAL_PATH" = "" ]; then
-  echo "[-] Error: AFL_REAL_PATH not set!" 1>&2
-  exit 1
-fi
-
-if [ ! -x "$AFL_REAL_PATH/afl-as" ]; then
-  echo "[-] Error: AFL_REAL_PATH does not contain the 'afl-as' binary." 1>&2
-  exit 1
-fi
-
-unset __AFL_AS_CMDLINE __AFL_FNAME
-
-while [ ! "$#" = "0" ]; do
-
-  if [ "$#" = "1" ]; then
-    __AFL_FNAME="$1"
-  else
-    __AFL_AS_CMDLINE="${__AFL_AS_CMDLINE} $1"
-  fi
-
-  shift
-
-done
-
-test "$TMPDIR" = "" && TMPDIR=/tmp
-
-TMPFILE=`mktemp $TMPDIR/.afl-XXXXXXXXXX.s`
-
-test "$TMPFILE" = "" && exit 1
-
-clang -cc1as -filetype asm -output-asm-variant 0 "${__AFL_FNAME}" >"$TMPFILE"
-
-ERR="$?"
-
-if [ ! "$ERR" = "0" ]; then
-  rm -f "$TMPFILE"
-  exit $ERR
-fi
-
-"$AFL_REAL_PATH/afl-as" ${__AFL_AS_CMDLINE} "$TMPFILE"
-
-ERR="$?"
-
-rm -f "$TMPFILE"
-
-exit "$ERR"
diff --git a/examples/crash_triage/triage_crashes.sh b/examples/crash_triage/triage_crashes.sh
deleted file mode 100755
index bf763cba..00000000
--- a/examples/crash_triage/triage_crashes.sh
+++ /dev/null
@@ -1,115 +0,0 @@
-#!/bin/sh
-#
-# american fuzzy lop++ - crash triage utility
-# -----------------------------------------
-#
-# Originally written by Michal Zalewski
-#
-# Copyright 2013, 2014, 2017 Google Inc. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Note that this assumes that the targeted application reads from stdin
-# and requires no other cmdline parameters. Modify as needed if this is
-# not the case.
-#
-# Note that on OpenBSD, you may need to install a newer version of gdb
-# (e.g., from ports). You can set GDB=/some/path to point to it if
-# necessary.
-#
-
-echo "crash triage utility for afl-fuzz by Michal Zalewski"
-echo
-
-ulimit -v 100000 2>/dev/null
-ulimit -d 100000 2>/dev/null
-
-if [ "$#" -lt "2" ]; then
-  echo "Usage: $0 /path/to/afl_output_dir /path/to/tested_binary [...target params...]" 1>&2
-  echo 1>&2
-  exit 1
-fi
-
-DIR="$1"
-BIN="$2"
-shift
-shift
-
-if [ "$AFL_ALLOW_TMP" = "" ]; then
-
-  echo "$DIR" | grep -qE '^(/var)?/tmp/'
-  T1="$?"
-
-  echo "$BIN" | grep -qE '^(/var)?/tmp/'
-  T2="$?"
-
-  if [ "$T1" = "0" -o "$T2" = "0" ]; then
-    echo "[-] Error: do not use shared /tmp or /var/tmp directories with this script." 1>&2
-    exit 1
-  fi
-
-fi
-
-if
- [ "$GDB" = "" ]; then
-  GDB=gdb
-fi
-
-if [ ! -f "$BIN" -o ! -x "$BIN" ]; then
-  echo "[-] Error: binary '$2' not found or is not executable." 1>&2
-  exit 1
-fi
-
-if [ ! -d "$DIR/queue" ]; then
-  echo "[-] Error: directory '$1' not found or not created by afl-fuzz." 1>&2
-  exit 1
-fi
-
-CCOUNT=$((`ls -- "$DIR/crashes" 2>/dev/null | wc -l`))
-
-if [ "$CCOUNT" = "0" ]; then
-  echo "No crashes recorded in the target directory - nothing to be done."
-  exit 0
-fi
-
-echo
-
-for crash in $DIR/crashes/id:*; do
-
-  id=`basename -- "$crash" | cut -d, -f1 | cut -d: -f2`
-  sig=`basename -- "$crash" | cut -d, -f2 | cut -d: -f2`
-
-  # Grab the args, converting @@ to $crash
-
-  use_args=""
-  use_stdio=1
-
-  for a in $@; do
-
-    if [ "$a" = "@@" ] ; then
-      use_args="$use_args $crash"
-      unset use_stdio
-    else
-      use_args="$use_args $a"
-    fi
-
-  done
-
-  # Strip the trailing space
-  use_args="${use_args# }"
-
-  echo "+++ ID $id, SIGNAL $sig +++"
-  echo
-
-  if [ "$use_stdio" = "1" ]; then  
-    $GDB --batch -q --ex "r $use_args <$crash" --ex 'back' --ex 'disass $pc, $pc+16' --ex 'info reg' --ex 'quit' "$BIN" 0</dev/null
-  else
-    $GDB --batch -q --ex "r $use_args" --ex 'back' --ex 'disass $pc, $pc+16' --ex 'info reg' --ex 'quit' "$BIN" 0</dev/null
-  fi
-  echo
-
-done
diff --git a/examples/custom_mutators/Makefile b/examples/custom_mutators/Makefile
deleted file mode 100644
index 9849f3f4..00000000
--- a/examples/custom_mutators/Makefile
+++ /dev/null
@@ -1,7 +0,0 @@
-all: libexamplemutator.so
-
-libexamplemutator.so:
-	$(CC) $(CFLAGS) -D_FORTIFY_SOURCE=2 -O3 -fPIC -shared -g -I ../../include example.c -o libexamplemutator.so
-
-clean:
-	rm -rf libexamplemutator.so
diff --git a/examples/custom_mutators/README.md b/examples/custom_mutators/README.md
deleted file mode 100644
index 655f7a5e..00000000
--- a/examples/custom_mutators/README.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Examples for the custom mutator
-
-These are example and helper files for the custom mutator feature.
-See [docs/custom_mutators.md](../../docs/custom_mutators.md) for more information
-
-Note that if you compile with python3.7 you must use python3 scripts, and if
-you use python2.7 to compile python2 scripts!
-
-simple_example.c - most simplest example. generates a random sized buffer
-          filled with 'A'
-
-example.c - this is a simple example written in C and should be compiled to a
-          shared library. Use make to compile it and produce libexamplemutator.so
-
-example.py - this is the template you can use, the functions are there but they
-           are empty
-
-post_library_gif.so.c - fix a fuzz input to ensure it is valid for GIF
-
-post_library_png.so.c - fix a fuzz input to ensure it is valid for PNG
-
-simple-chunk-replace.py - this is a simple example where chunks are replaced
-
-common.py - this can be used for common functions and helpers.
-          the examples do not use this though. But you can :)
-
-wrapper_afl_min.py - mutation of XML documents, loads XmlMutatorMin.py
-
-XmlMutatorMin.py - module for XML mutation
-
-custom_mutator_helpers.h is an header that defines some helper routines
-like surgical_havoc_mutate() that allow to perform a randomly chosen
-mutation from a subset of the havoc mutations.
-If you do so, you have to specify -I /path/to/AFLplusplus/include when
-compiling.
diff --git a/examples/custom_mutators/XmlMutatorMin.py b/examples/custom_mutators/XmlMutatorMin.py
deleted file mode 100644
index 4c80a2ba..00000000
--- a/examples/custom_mutators/XmlMutatorMin.py
+++ /dev/null
@@ -1,332 +0,0 @@
-#!/usr/bin/python
-
-""" Mutation of XML documents, should be called from one of its wrappers (CLI, AFL, ...) """
-
-from __future__ import print_function
-from copy import deepcopy
-from lxml import etree as ET
-import random, re, io
-
-
-###########################
-# The XmlMutatorMin class #
-###########################
-
-class XmlMutatorMin:
-
-    """
-        Optionals parameters:
-            seed        Seed used by the PRNG (default: "RANDOM")
-            verbose     Verbosity (default: False)
-    """
-
-    def __init__(self, seed="RANDOM", verbose=False):
-
-        """ Initialize seed, database and mutators """
-
-        # Verbosity
-        self.verbose = verbose
-
-        # Initialize PRNG
-        self.seed = str(seed)
-        if self.seed == "RANDOM":
-            random.seed()
-        else:
-            if self.verbose:
-                print("Static seed '%s'" % self.seed)
-            random.seed(self.seed)
-
-        # Initialize input and output documents
-        self.input_tree = None
-        self.tree = None
-
-        # High-level mutators (no database needed)
-        hl_mutators_delete = ["del_node_and_children", "del_node_but_children", "del_attribute", "del_content"]  # Delete items
-        hl_mutators_fuzz = ["fuzz_attribute"]  # Randomly change attribute values
-
-        # Exposed mutators
-        self.hl_mutators_all = hl_mutators_fuzz + hl_mutators_delete
-
-    def __parse_xml(self, xml):
-
-        """ Parse an XML string. Basic wrapper around lxml.parse() """
-
-        try:
-            # Function parse() takes care of comments / DTD / processing instructions / ...
-            tree = ET.parse(io.BytesIO(xml))
-        except ET.ParseError:
-            raise RuntimeError("XML isn't well-formed!")
-        except LookupError as e:
-            raise RuntimeError(e)
-
-        # Return a document wrapper
-        return tree
-
-    def __exec_among(self, module, functions, min_times, max_times):
-
-        """ Randomly execute $functions between $min and $max times """
-
-        for i in xrange(random.randint(min_times, max_times)):
-            # Function names are mangled because they are "private"
-            getattr(module, "_XmlMutatorMin__" + random.choice(functions))()
-
-    def __serialize_xml(self, tree):
-
-        """ Serialize a XML document. Basic wrapper around lxml.tostring() """
-
-        return ET.tostring(tree, with_tail=False, xml_declaration=True, encoding=tree.docinfo.encoding)
-
-    def __ver(self, version):
-
-        """ Helper for displaying lxml version numbers """
-
-        return ".".join(map(str, version))
-
-    def reset(self):
-
-        """ Reset the mutator """
-
-        self.tree = deepcopy(self.input_tree)
-
-    def init_from_string(self, input_string):
-
-        """ Initialize the mutator from a XML string """
-
-        # Get a pointer to the top-element
-        self.input_tree = self.__parse_xml(input_string)
-
-        # Get a working copy
-        self.tree = deepcopy(self.input_tree)
-
-    def save_to_string(self):
-
-        """ Return the current XML document as UTF-8 string """
-
-        # Return a text version of the tree
-        return self.__serialize_xml(self.tree)
-
-    def __pick_element(self, exclude_root_node=False):
-
-        """ Pick a random element from the current document """
-
-        # Get a list of all elements, but nodes like PI and comments
-        elems = list(self.tree.getroot().iter(tag=ET.Element))
-
-        # Is the root node excluded?
-        if exclude_root_node:
-            start = 1
-        else:
-            start = 0
-
-        # Pick a random element
-        try:
-            elem_id = random.randint(start, len(elems) - 1)
-            elem = elems[elem_id]
-        except ValueError:
-            # Should only occurs if "exclude_root_node = True"
-            return (None, None)
-
-        return (elem_id, elem)
-
-    def __fuzz_attribute(self):
-
-        """ Fuzz (part of) an attribute value """
-
-        # Select a node to modify
-        (rand_elem_id, rand_elem) = self.__pick_element()
-
-        # Get all the attributes
-        attribs = rand_elem.keys()
-
-        # Is there attributes?
-        if len(attribs) < 1:
-            if self.verbose:
-                print("No attribute: can't replace!")
-            return
-
-        # Pick a random attribute
-        rand_attrib_id = random.randint(0, len(attribs) - 1)
-        rand_attrib = attribs[rand_attrib_id]
-
-        # We have the attribute to modify
-        # Get its value
-        attrib_value = rand_elem.get(rand_attrib)
-        # print("- Value: " + attrib_value)
-
-        # Should we work on the whole value?
-        func_call = "(?P<func>[a-zA-Z:\-]+)\((?P<args>.*?)\)"
-        p = re.compile(func_call)
-        l = p.findall(attrib_value)
-        if random.choice((True, False)) and l:
-            # Randomly pick one the function calls
-            (func, args) = random.choice(l)
-            # Split by "," and randomly pick one of the arguments
-            value = random.choice(args.split(','))
-            # Remove superfluous characters
-            unclean_value = value
-            value = value.strip(" ").strip("'")
-            # print("Selected argument: [%s]" % value)
-        else:
-            value = attrib_value
-
-        # For each type, define some possible replacement values
-        choices_number =    ( \
-                                "0", \
-                                "11111", \
-                                "-128", \
-                                "2", \
-                                "-1", \
-                                "1/3", \
-                                "42/0", \
-                                "1094861636 idiv 1.0", \
-                                "-1123329771506872 idiv 3.8", \
-                                "17=$numericRTF", \
-                                str(3 + random.randrange(0, 100)), \
-                            )
-
-        choices_letter =    ( \
-                                "P" * (25 * random.randrange(1, 100)), \
-                                "%s%s%s%s%s%s", \
-                                "foobar", \
-                            )
-
-        choices_alnum =     ( \
-                                "Abc123", \
-                                "020F0302020204030204", \
-                                "020F0302020204030204" * (random.randrange(5, 20)), \
-                            )
-
-        # Fuzz the value
-        if random.choice((True,False)) and value == "":
-
-            # Empty
-            new_value = value
-
-        elif random.choice((True,False)) and value.isdigit():
-
-            # Numbers
-            new_value = random.choice(choices_number)
-
-        elif random.choice((True,False)) and value.isalpha():
-
-            # Letters
-            new_value = random.choice(choices_letter)
-
-        elif random.choice((True,False)) and value.isalnum():
-
-            # Alphanumeric
-            new_value = random.choice(choices_alnum)
-
-        else:
-
-            # Default type
-            new_value = random.choice(choices_alnum + choices_letter + choices_number)
-
-        # If we worked on a substring, apply changes to the whole string
-        if value != attrib_value:
-            # No ' around empty values
-            if new_value != "" and value != "":
-                new_value = "'" + new_value + "'"
-            # Apply changes
-            new_value = attrib_value.replace(unclean_value, new_value)
-
-        # Log something
-        if self.verbose:
-            print("Fuzzing attribute #%i '%s' of tag #%i '%s'" % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag))
-
-        # Modify the attribute
-        rand_elem.set(rand_attrib, new_value.decode("utf-8"))
-
-    def __del_node_and_children(self):
-
-        """ High-level minimizing mutator
-            Delete a random node and its children (i.e. delete a random tree) """
-
-        self.__del_node(True)
-
-    def __del_node_but_children(self):
-
-        """ High-level minimizing mutator
-            Delete a random node but its children (i.e. link them to the parent of the deleted node) """
-
-        self.__del_node(False)
-
-    def __del_node(self, delete_children):
-
-        """ Called by the __del_node_* mutators """
-
-        # Select a node to modify (but the root one)
-        (rand_elem_id, rand_elem) = self.__pick_element(exclude_root_node=True)
-
-        # If the document includes only a top-level element
-        # Then we can't pick a element (given that "exclude_root_node = True")
-
-        # Is the document deep enough?
-        if rand_elem is None:
-            if self.verbose:
-                print("Can't delete a node: document not deep enough!")
-            return
-
-        # Log something
-        if self.verbose:
-            but_or_and = "and" if delete_children else "but"
-            print("Deleting tag #%i '%s' %s its children" % (rand_elem_id, rand_elem.tag, but_or_and))
-
-        if delete_children is False:
-            # Link children of the random (soon to be deleted) node to its parent
-            for child in rand_elem:
-                rand_elem.getparent().append(child)
-
-        # Remove the node
-        rand_elem.getparent().remove(rand_elem)
-
-    def __del_content(self):
-
-        """ High-level minimizing mutator
-            Delete the attributes and children of a random node """
-
-        # Select a node to modify
-        (rand_elem_id, rand_elem) = self.__pick_element()
-
-        # Log something
-        if self.verbose:
-            print("Reseting tag #%i '%s'" % (rand_elem_id, rand_elem.tag))
-
-        # Reset the node
-        rand_elem.clear()
-
-    def __del_attribute(self):
-
-        """ High-level minimizing mutator
-            Delete a random attribute from a random node """
-
-        # Select a node to modify
-        (rand_elem_id, rand_elem) = self.__pick_element()
-
-        # Get all the attributes
-        attribs = rand_elem.keys()
-
-        # Is there attributes?
-        if len(attribs) < 1:
-            if self.verbose:
-                print("No attribute: can't delete!")
-            return
-
-        # Pick a random attribute
-        rand_attrib_id = random.randint(0, len(attribs) - 1)
-        rand_attrib = attribs[rand_attrib_id]
-
-        # Log something
-        if self.verbose:
-            print("Deleting attribute #%i '%s' of tag #%i '%s'" % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag))
-
-        # Delete the attribute
-        rand_elem.attrib.pop(rand_attrib)
-
-    def mutate(self, min=1, max=5):
-
-        """ Execute some high-level mutators between $min and $max times, then some medium-level ones """
-
-        # High-level mutation
-        self.__exec_among(self, self.hl_mutators_all, min, max)
-
diff --git a/examples/custom_mutators/common.py b/examples/custom_mutators/common.py
deleted file mode 100644
index 9a1ef0a3..00000000
--- a/examples/custom_mutators/common.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env python
-# encoding: utf-8
-'''
-Module containing functions shared between multiple AFL modules
-
-@author:     Christian Holler (:decoder)
-
-@license:
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-@contact:    choller@mozilla.com
-'''
-
-from __future__ import print_function
-import random
-import os
-import re
-
-
-def randel(l):
-    if not l:
-        return None
-    return l[random.randint(0, len(l)-1)]
-
-
-def randel_pop(l):
-    if not l:
-        return None
-    return l.pop(random.randint(0, len(l)-1))
-
-
-def write_exc_example(data, exc):
-    exc_name = re.sub(r'[^a-zA-Z0-9]', '_', repr(exc))
-
-    if not os.path.exists(exc_name):
-        with open(exc_name, 'w') as f:
-            f.write(data)
diff --git a/examples/custom_mutators/custom_mutator_helpers.h b/examples/custom_mutators/custom_mutator_helpers.h
deleted file mode 100644
index 62e6efba..00000000
--- a/examples/custom_mutators/custom_mutator_helpers.h
+++ /dev/null
@@ -1,342 +0,0 @@
-#ifndef CUSTOM_MUTATOR_HELPERS
-#define CUSTOM_MUTATOR_HELPERS
-
-#include "config.h"
-#include "types.h"
-#include <stdlib.h>
-
-#define INITIAL_GROWTH_SIZE (64)
-
-#define RAND_BELOW(limit) (rand() % (limit))
-
-/* Use in a struct: creates a name_buf and a name_size variable. */
-#define BUF_VAR(type, name) \
-  type * name##_buf;        \
-  size_t name##_size;
-/* this fills in `&structptr->something_buf, &structptr->something_size`. */
-#define BUF_PARAMS(struct, name) \
-  (void **)&struct->name##_buf, &struct->name##_size
-
-typedef struct {
-
-} afl_t;
-
-static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
-
-  static s8  interesting_8[] = {INTERESTING_8};
-  static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16};
-  static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32};
-
-  switch (RAND_BELOW(12)) {
-
-    case 0: {
-
-      /* Flip a single bit somewhere. Spooky! */
-
-      s32 bit_idx = ((RAND_BELOW(end - begin) + begin) << 3) + RAND_BELOW(8);
-
-      out_buf[bit_idx >> 3] ^= 128 >> (bit_idx & 7);
-
-      break;
-
-    }
-
-    case 1: {
-
-      /* Set byte to interesting value. */
-
-      u8 val = interesting_8[RAND_BELOW(sizeof(interesting_8))];
-      out_buf[(RAND_BELOW(end - begin) + begin)] = val;
-
-      break;
-
-    }
-
-    case 2: {
-
-      /* Set word to interesting value, randomly choosing endian. */
-
-      if (end - begin < 2) break;
-
-      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
-
-      if (byte_idx >= end - 1) break;
-
-      switch (RAND_BELOW(2)) {
-
-        case 0:
-          *(u16 *)(out_buf + byte_idx) =
-              interesting_16[RAND_BELOW(sizeof(interesting_16) >> 1)];
-          break;
-        case 1:
-          *(u16 *)(out_buf + byte_idx) =
-              SWAP16(interesting_16[RAND_BELOW(sizeof(interesting_16) >> 1)]);
-          break;
-
-      }
-
-      break;
-
-    }
-
-    case 3: {
-
-      /* Set dword to interesting value, randomly choosing endian. */
-
-      if (end - begin < 4) break;
-
-      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
-
-      if (byte_idx >= end - 3) break;
-
-      switch (RAND_BELOW(2)) {
-
-        case 0:
-          *(u32 *)(out_buf + byte_idx) =
-              interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
-          break;
-        case 1:
-          *(u32 *)(out_buf + byte_idx) =
-              SWAP32(interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
-          break;
-
-      }
-
-      break;
-
-    }
-
-    case 4: {
-
-      /* Set qword to interesting value, randomly choosing endian. */
-
-      if (end - begin < 8) break;
-
-      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
-
-      if (byte_idx >= end - 7) break;
-
-      switch (RAND_BELOW(2)) {
-
-        case 0:
-          *(u64 *)(out_buf + byte_idx) =
-              (s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
-          break;
-        case 1:
-          *(u64 *)(out_buf + byte_idx) = SWAP64(
-              (s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
-          break;
-
-      }
-
-      break;
-
-    }
-
-    case 5: {
-
-      /* Randomly subtract from byte. */
-
-      out_buf[(RAND_BELOW(end - begin) + begin)] -= 1 + RAND_BELOW(ARITH_MAX);
-
-      break;
-
-    }
-
-    case 6: {
-
-      /* Randomly add to byte. */
-
-      out_buf[(RAND_BELOW(end - begin) + begin)] += 1 + RAND_BELOW(ARITH_MAX);
-
-      break;
-
-    }
-
-    case 7: {
-
-      /* Randomly subtract from word, random endian. */
-
-      if (end - begin < 2) break;
-
-      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
-
-      if (byte_idx >= end - 1) break;
-
-      if (RAND_BELOW(2)) {
-
-        *(u16 *)(out_buf + byte_idx) -= 1 + RAND_BELOW(ARITH_MAX);
-
-      } else {
-
-        u16 num = 1 + RAND_BELOW(ARITH_MAX);
-
-        *(u16 *)(out_buf + byte_idx) =
-            SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) - num);
-
-      }
-
-      break;
-
-    }
-
-    case 8: {
-
-      /* Randomly add to word, random endian. */
-
-      if (end - begin < 2) break;
-
-      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
-
-      if (byte_idx >= end - 1) break;
-
-      if (RAND_BELOW(2)) {
-
-        *(u16 *)(out_buf + byte_idx) += 1 + RAND_BELOW(ARITH_MAX);
-
-      } else {
-
-        u16 num = 1 + RAND_BELOW(ARITH_MAX);
-
-        *(u16 *)(out_buf + byte_idx) =
-            SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) + num);
-
-      }
-
-      break;
-
-    }
-
-    case 9: {
-
-      /* Randomly subtract from dword, random endian. */
-
-      if (end - begin < 4) break;
-
-      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
-
-      if (byte_idx >= end - 3) break;
-
-      if (RAND_BELOW(2)) {
-
-        *(u32 *)(out_buf + byte_idx) -= 1 + RAND_BELOW(ARITH_MAX);
-
-      } else {
-
-        u32 num = 1 + RAND_BELOW(ARITH_MAX);
-
-        *(u32 *)(out_buf + byte_idx) =
-            SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) - num);
-
-      }
-
-      break;
-
-    }
-
-    case 10: {
-
-      /* Randomly add to dword, random endian. */
-
-      if (end - begin < 4) break;
-
-      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
-
-      if (byte_idx >= end - 3) break;
-
-      if (RAND_BELOW(2)) {
-
-        *(u32 *)(out_buf + byte_idx) += 1 + RAND_BELOW(ARITH_MAX);
-
-      } else {
-
-        u32 num = 1 + RAND_BELOW(ARITH_MAX);
-
-        *(u32 *)(out_buf + byte_idx) =
-            SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) + num);
-
-      }
-
-      break;
-
-    }
-
-    case 11: {
-
-      /* Just set a random byte to a random value. Because,
-         why not. We use XOR with 1-255 to eliminate the
-         possibility of a no-op. */
-
-      out_buf[(RAND_BELOW(end - begin) + begin)] ^= 1 + RAND_BELOW(255);
-
-      break;
-
-    }
-
-  }
-
-}
-
-/* This function calculates the next power of 2 greater or equal its argument.
- @return The rounded up power of 2 (if no overflow) or 0 on overflow.
-*/
-static inline size_t next_pow2(size_t in) {
-
-  if (in == 0 || in > (size_t)-1)
-    return 0;                  /* avoid undefined behaviour under-/overflow */
-  size_t out = in - 1;
-  out |= out >> 1;
-  out |= out >> 2;
-  out |= out >> 4;
-  out |= out >> 8;
-  out |= out >> 16;
-  return out + 1;
-
-}
-
-/* This function makes sure *size is > size_needed after call.
- It will realloc *buf otherwise.
- *size will grow exponentially as per:
- https://blog.mozilla.org/nnethercote/2014/11/04/please-grow-your-buffers-exponentially/
- Will return NULL and free *buf if size_needed is <1 or realloc failed.
- @return For convenience, this function returns *buf.
- */
-static inline void *maybe_grow(void **buf, size_t *size, size_t size_needed) {
-
-  /* No need to realloc */
-  if (likely(size_needed && *size >= size_needed)) return *buf;
-
-  /* No initial size was set */
-  if (size_needed < INITIAL_GROWTH_SIZE) size_needed = INITIAL_GROWTH_SIZE;
-
-  /* grow exponentially */
-  size_t next_size = next_pow2(size_needed);
-
-  /* handle overflow */
-  if (!next_size) { next_size = size_needed; }
-
-  /* alloc */
-  *buf = realloc(*buf, next_size);
-  *size = *buf ? next_size : 0;
-
-  return *buf;
-
-}
-
-/* Swaps buf1 ptr and buf2 ptr, as well as their sizes */
-static inline void afl_swap_bufs(void **buf1, size_t *size1, void **buf2,
-                                 size_t *size2) {
-
-  void * scratch_buf = *buf1;
-  size_t scratch_size = *size1;
-  *buf1 = *buf2;
-  *size1 = *size2;
-  *buf2 = scratch_buf;
-  *size2 = scratch_size;
-
-}
-
-#undef INITIAL_GROWTH_SIZE
-
-#endif
-
diff --git a/examples/custom_mutators/example.c b/examples/custom_mutators/example.c
deleted file mode 100644
index 23add128..00000000
--- a/examples/custom_mutators/example.c
+++ /dev/null
@@ -1,376 +0,0 @@
-/*
-  New Custom Mutator for AFL++
-  Written by Khaled Yakdan <yakdan@code-intelligence.de>
-             Andrea Fioraldi <andreafioraldi@gmail.com>
-             Shengtuo Hu <h1994st@gmail.com>
-             Dominik Maier <mail@dmnk.co>
-*/
-
-// You need to use -I /path/to/AFLplusplus/include
-#include "custom_mutator_helpers.h"
-
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-
-#define DATA_SIZE (100)
-
-static const char *commands[] = {
-
-    "GET",
-    "PUT",
-    "DEL",
-
-};
-
-typedef struct my_mutator {
-
-  afl_t *afl;
-
-  // any additional data here!
-  size_t trim_size_current;
-  int    trimmming_steps;
-  int    cur_step;
-
-  // Reused buffers:
-  BUF_VAR(u8, fuzz);
-  BUF_VAR(u8, data);
-  BUF_VAR(u8, havoc);
-  BUF_VAR(u8, trim);
-  BUF_VAR(u8, post_process);
-
-} my_mutator_t;
-
-/**
- * Initialize this custom mutator
- *
- * @param[in] afl a pointer to the internal state object. Can be ignored for
- * now.
- * @param[in] seed A seed for this mutator - the same seed should always mutate
- * in the same way.
- * @return Pointer to the data object this custom mutator instance should use.
- *         There may be multiple instances of this mutator in one afl-fuzz run!
- *         Return NULL on error.
- */
-my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) {
-
-  srand(seed);  // needed also by surgical_havoc_mutate()
-
-  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  data->afl = afl;
-
-  return data;
-
-}
-
-/**
- * Perform custom mutations on a given input
- *
- * (Optional for now. Required in the future)
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @param[in] buf Pointer to input data to be mutated
- * @param[in] buf_size Size of input data
- * @param[out] out_buf the buffer we will work on. we can reuse *buf. NULL on
- * error.
- * @param[in] add_buf Buffer containing the additional test case
- * @param[in] add_buf_size Size of the additional test case
- * @param[in] max_size Maximum size of the mutated output. The mutation must not
- *     produce data larger than max_size.
- * @return Size of the mutated output.
- */
-size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
-                       u8 **out_buf, uint8_t *add_buf,
-                       size_t add_buf_size,  // add_buf can be NULL
-                       size_t max_size) {
-
-  // Make sure that the packet size does not exceed the maximum size expected by
-  // the fuzzer
-  size_t mutated_size = DATA_SIZE <= max_size ? DATA_SIZE : max_size;
-
-  // maybe_grow is optimized to be quick for reused buffers.
-  u8 *mutated_out = maybe_grow(BUF_PARAMS(data, fuzz), mutated_size);
-  if (!mutated_out) {
-
-    *out_buf = NULL;
-    perror("custom mutator allocation (maybe_grow)");
-    return 0;            /* afl-fuzz will very likely error out after this. */
-
-  }
-
-  // Randomly select a command string to add as a header to the packet
-  memcpy(mutated_out, commands[rand() % 3], 3);
-
-  // Mutate the payload of the packet
-  int i;
-  for (i = 0; i < 8; ++i) {
-
-    // Randomly perform one of the (no len modification) havoc mutations
-    surgical_havoc_mutate(mutated_out, 3, mutated_size);
-
-  }
-
-  *out_buf = mutated_out;
-  return mutated_size;
-
-}
-
-/**
- * A post-processing function to use right before AFL writes the test case to
- * disk in order to execute the target.
- *
- * (Optional) If this functionality is not needed, simply don't define this
- * function.
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @param[in] buf Buffer containing the test case to be executed
- * @param[in] buf_size Size of the test case
- * @param[out] out_buf Pointer to the buffer containing the test case after
- *     processing. External library should allocate memory for out_buf.
- *     The buf pointer may be reused (up to the given buf_size);
- * @return Size of the output buffer after processing or the needed amount.
- *     A return of 0 indicates an error.
- */
-size_t afl_custom_post_process(my_mutator_t *data, uint8_t *buf,
-                               size_t buf_size, uint8_t **out_buf) {
-
-  uint8_t *post_process_buf =
-      maybe_grow(BUF_PARAMS(data, post_process), buf_size + 5);
-  if (!post_process_buf) {
-
-    perror("custom mutator realloc failed.");
-    *out_buf = NULL;
-    return 0;
-
-  }
-
-  memcpy(post_process_buf + 5, buf, buf_size);
-  post_process_buf[0] = 'A';
-  post_process_buf[1] = 'F';
-  post_process_buf[2] = 'L';
-  post_process_buf[3] = '+';
-  post_process_buf[4] = '+';
-
-  *out_buf = post_process_buf;
-
-  return buf_size + 5;
-
-}
-
-/**
- * This method is called at the start of each trimming operation and receives
- * the initial buffer. It should return the amount of iteration steps possible
- * on this input (e.g. if your input has n elements and you want to remove
- * them one by one, return n, if you do a binary search, return log(n),
- * and so on...).
- *
- * If your trimming algorithm doesn't allow you to determine the amount of
- * (remaining) steps easily (esp. while running), then you can alternatively
- * return 1 here and always return 0 in post_trim until you are finished and
- * no steps remain. In that case, returning 1 in post_trim will end the
- * trimming routine. The whole current index/max iterations stuff is only used
- * to show progress.
- *
- * (Optional)
- *
- * @param data pointer returned in afl_custom_init for this fuzz case
- * @param buf Buffer containing the test case
- * @param buf_size Size of the test case
- * @return The amount of possible iteration steps to trim the input.
- *        negative on error.
- */
-int32_t afl_custom_init_trim(my_mutator_t *data, uint8_t *buf,
-                             size_t buf_size) {
-
-  // We simply trim once
-  data->trimmming_steps = 1;
-
-  data->cur_step = 0;
-
-  if (!maybe_grow(BUF_PARAMS(data, trim), buf_size)) {
-
-    perror("init_trim grow");
-    return -1;
-
-  }
-
-  memcpy(data->trim_buf, buf, buf_size);
-
-  data->trim_size_current = buf_size;
-
-  return data->trimmming_steps;
-
-}
-
-/**
- * This method is called for each trimming operation. It doesn't have any
- * arguments because we already have the initial buffer from init_trim and we
- * can memorize the current state in *data. This can also save
- * reparsing steps for each iteration. It should return the trimmed input
- * buffer, where the returned data must not exceed the initial input data in
- * length. Returning anything that is larger than the original data (passed
- * to init_trim) will result in a fatal abort of AFLFuzz.
- *
- * (Optional)
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @param[out] out_buf Pointer to the buffer containing the trimmed test case.
- *     External library should allocate memory for out_buf.
- *     AFL++ will not release the memory after saving the test case.
- *     Keep a ref in *data.
- *     *out_buf = NULL is treated as error.
- * @return Pointer to the size of the trimmed test case
- */
-size_t afl_custom_trim(my_mutator_t *data, uint8_t **out_buf) {
-
-  *out_buf = data->trim_buf;
-
-  // Remove the last byte of the trimming input
-  return data->trim_size_current - 1;
-
-}
-
-/**
- * This method is called after each trim operation to inform you if your
- * trimming step was successful or not (in terms of coverage). If you receive
- * a failure here, you should reset your input to the last known good state.
- *
- * (Optional)
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @param success Indicates if the last trim operation was successful.
- * @return The next trim iteration index (from 0 to the maximum amount of
- *     steps returned in init_trim). negative ret on failure.
- */
-int32_t afl_custom_post_trim(my_mutator_t *data, int success) {
-
-  if (success) {
-
-    ++data->cur_step;
-    return data->cur_step;
-
-  }
-
-  return data->trimmming_steps;
-
-}
-
-/**
- * Perform a single custom mutation on a given input.
- * This mutation is stacked with the other muatations in havoc.
- *
- * (Optional)
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @param[in] buf Pointer to the input data to be mutated and the mutated
- *     output
- * @param[in] buf_size Size of input data
- * @param[out] out_buf The output buffer. buf can be reused, if the content
- * fits. *out_buf = NULL is treated as error.
- * @param[in] max_size Maximum size of the mutated output. The mutation must
- *     not produce data larger than max_size.
- * @return Size of the mutated output.
- */
-size_t afl_custom_havoc_mutation(my_mutator_t *data, u8 *buf, size_t buf_size,
-                                 u8 **out_buf, size_t max_size) {
-
-  if (buf_size == 0) {
-
-    *out_buf = maybe_grow(BUF_PARAMS(data, havoc), 1);
-    if (!*out_buf) {
-
-      perror("custom havoc: maybe_grow");
-      return 0;
-
-    }
-
-    **out_buf = rand() % 256;
-    buf_size = 1;
-
-  } else {
-
-    // We reuse buf here. It's legal and faster.
-    *out_buf = buf;
-
-  }
-
-  size_t victim = rand() % buf_size;
-  (*out_buf)[victim] += rand() % 10;
-
-  return buf_size;
-
-}
-
-/**
- * Return the probability (in percentage) that afl_custom_havoc_mutation
- * is called in havoc. By default it is 6 %.
- *
- * (Optional)
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @return The probability (0-100).
- */
-uint8_t afl_custom_havoc_mutation_probability(my_mutator_t *data) {
-
-  return 5;  // 5 %
-
-}
-
-/**
- * Determine whether the fuzzer should fuzz the queue entry or not.
- *
- * (Optional)
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @param filename File name of the test case in the queue entry
- * @return Return True(1) if the fuzzer will fuzz the queue entry, and
- *     False(0) otherwise.
- */
-uint8_t afl_custom_queue_get(my_mutator_t *data, const uint8_t *filename) {
-
-  return 1;
-
-}
-
-/**
- * Allow for additional analysis (e.g. calling a different tool that does a
- * different kind of coverage and saves this for the custom mutator).
- *
- * (Optional)
- *
- * @param data pointer returned in afl_custom_init for this fuzz case
- * @param filename_new_queue File name of the new queue entry
- * @param filename_orig_queue File name of the original queue entry
- */
-void afl_custom_queue_new_entry(my_mutator_t * data,
-                                const uint8_t *filename_new_queue,
-                                const uint8_t *filename_orig_queue) {
-
-  /* Additional analysis on the original or new test case */
-
-}
-
-/**
- * Deinitialize everything
- *
- * @param data The data ptr from afl_custom_init
- */
-void afl_custom_deinit(my_mutator_t *data) {
-
-  free(data->post_process_buf);
-  free(data->havoc_buf);
-  free(data->data_buf);
-  free(data->fuzz_buf);
-  free(data->trim_buf);
-  free(data);
-
-}
-
diff --git a/examples/custom_mutators/example.py b/examples/custom_mutators/example.py
deleted file mode 100644
index cf659e5a..00000000
--- a/examples/custom_mutators/example.py
+++ /dev/null
@@ -1,186 +0,0 @@
-#!/usr/bin/env python
-# encoding: utf-8
-'''
-Example Python Module for AFLFuzz
-
-@author:     Christian Holler (:decoder)
-
-@license:
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-@contact:    choller@mozilla.com
-'''
-
-import random
-
-
-COMMANDS = [
-    b"GET",
-    b"PUT",
-    b"DEL",
-    b"AAAAAAAAAAAAAAAAA",
-]
-
-
-def init(seed):
-    '''
-    Called once when AFLFuzz starts up. Used to seed our RNG.
-
-    @type seed: int
-    @param seed: A 32-bit random value
-    '''
-    random.seed(seed)
-
-
-def deinit():
-    pass
-
-
-def fuzz(buf, add_buf, max_size):
-    '''
-    Called per fuzzing iteration.
-
-    @type buf: bytearray
-    @param buf: The buffer that should be mutated.
-
-    @type add_buf: bytearray
-    @param add_buf: A second buffer that can be used as mutation source.
-
-    @type max_size: int
-    @param max_size: Maximum size of the mutated output. The mutation must not
-        produce data larger than max_size.
-
-    @rtype: bytearray
-    @return: A new bytearray containing the mutated data
-    '''
-    ret = bytearray(100)
-
-    ret[:3] = random.choice(COMMANDS)
-
-    return ret
-
-# Uncomment and implement the following methods if you want to use a custom
-# trimming algorithm. See also the documentation for a better API description.
-
-# def init_trim(buf):
-#     '''
-#     Called per trimming iteration.
-#
-#     @type buf: bytearray
-#     @param buf: The buffer that should be trimmed.
-#
-#     @rtype: int
-#     @return: The maximum number of trimming steps.
-#     '''
-#     global ...
-#
-#     # Initialize global variables
-#
-#     # Figure out how many trimming steps are possible.
-#     # If this is not possible for your trimming, you can
-#     # return 1 instead and always return 0 in post_trim
-#     # until you are done (then you return 1).
-#
-#     return steps
-#
-# def trim():
-#     '''
-#     Called per trimming iteration.
-#
-#     @rtype: bytearray
-#     @return: A new bytearray containing the trimmed data.
-#     '''
-#     global ...
-#
-#     # Implement the actual trimming here
-#
-#     return bytearray(...)
-#
-# def post_trim(success):
-#     '''
-#     Called after each trimming operation.
-#
-#     @type success: bool
-#     @param success: Indicates if the last trim operation was successful.
-#
-#     @rtype: int
-#     @return: The next trim index (0 to max number of steps) where max
-#              number of steps indicates the trimming is done.
-#     '''
-#     global ...
-#
-#     if not success:
-#         # Restore last known successful input, determine next index
-#     else:
-#         # Just determine the next index, based on what was successfully
-#         # removed in the last step
-#
-#     return next_index
-#
-# def post_process(buf):
-#     '''
-#     Called just before the execution to write the test case in the format
-#     expected by the target
-#
-#     @type buf: bytearray
-#     @param buf: The buffer containing the test case to be executed
-#
-#     @rtype: bytearray
-#     @return: The buffer containing the test case after
-#     '''
-#     return buf
-#
-# def havoc_mutation(buf, max_size):
-#     '''
-#     Perform a single custom mutation on a given input.
-#
-#     @type buf: bytearray
-#     @param buf: The buffer that should be mutated.
-#
-#     @type max_size: int
-#     @param max_size: Maximum size of the mutated output. The mutation must not
-#         produce data larger than max_size.
-#
-#     @rtype: bytearray
-#     @return: A new bytearray containing the mutated data
-#     '''
-#     return mutated_buf
-#
-# def havoc_mutation_probability():
-#     '''
-#     Called for each `havoc_mutation`. Return the probability (in percentage)
-#     that `havoc_mutation` is called in havoc. Be default it is 6%.
-#
-#     @rtype: int
-#     @return: The probability (0-100)
-#     '''
-#     return prob
-#
-# def queue_get(filename):
-#     '''
-#     Called at the beginning of each fuzz iteration to determine whether the
-#     test case should be fuzzed
-#
-#     @type filename: str
-#     @param filename: File name of the test case in the current queue entry
-#
-#     @rtype: bool
-#     @return: Return True if the custom mutator decides to fuzz the test case,
-#         and False otherwise
-#     '''
-#     return True
-#
-# def queue_new_entry(filename_new_queue, filename_orig_queue):
-#     '''
-#     Called after adding a new test case to the queue
-#
-#     @type filename_new_queue: str
-#     @param filename_new_queue: File name of the new queue entry
-#
-#     @type filename_orig_queue: str
-#     @param filename_orig_queue: File name of the original queue entry
-#     '''
-#     pass
diff --git a/examples/custom_mutators/post_library_gif.so.c b/examples/custom_mutators/post_library_gif.so.c
deleted file mode 100644
index ac10f409..00000000
--- a/examples/custom_mutators/post_library_gif.so.c
+++ /dev/null
@@ -1,165 +0,0 @@
-/*
-   american fuzzy lop++ - postprocessor library example
-   --------------------------------------------------
-
-   Originally written by Michal Zalewski
-   Edited by Dominik Maier, 2020
-
-   Copyright 2015 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   Postprocessor libraries can be passed to afl-fuzz to perform final cleanup
-   of any mutated test cases - for example, to fix up checksums in PNG files.
-
-   Please heed the following warnings:
-
-   1) In almost all cases, it is more productive to comment out checksum logic
-      in the targeted binary (as shown in ../libpng_no_checksum/). One possible
-      exception is the process of fuzzing binary-only software in QEMU mode.
-
-   2) The use of postprocessors for anything other than checksums is
-   questionable and may cause more harm than good. AFL is normally pretty good
-   about dealing with length fields, magic values, etc.
-
-   3) Postprocessors that do anything non-trivial must be extremely robust to
-      gracefully handle malformed data and other error conditions - otherwise,
-      they will crash and take afl-fuzz down with them. Be wary of reading past
-      *len and of integer overflows when calculating file offsets.
-
-   In other words, THIS IS PROBABLY NOT WHAT YOU WANT - unless you really,
-   honestly know what you're doing =)
-
-   With that out of the way: the postprocessor library is passed to afl-fuzz
-   via AFL_POST_LIBRARY. The library must be compiled with:
-
-     gcc -shared -Wall -O3 post_library.so.c -o post_library.so
-
-   AFL will call the afl_custom_post_process() function for every mutated output
-   buffer. From there, you have three choices:
-
-   1) If you don't want to modify the test case, simply set `*out_buf = in_buf`
-      and return the original `len`.
-
-   2) If you want to skip this test case altogether and have AFL generate a
-      new one, return 0 or set `*out_buf = NULL`.
-      Use this sparingly - it's faster than running the target program
-      with patently useless inputs, but still wastes CPU time.
-
-   3) If you want to modify the test case, allocate an appropriately-sized
-      buffer, move the data into that buffer, make the necessary changes, and
-      then return the new pointer as out_buf. Return an appropriate len
-   afterwards.
-
-      Note that the buffer will *not* be freed for you. To avoid memory leaks,
-      you need to free it or reuse it on subsequent calls (as shown below).
-
-      *** Feel free to reuse the original 'in_buf' BUFFER and return it. ***
-
-    Aight. The example below shows a simple postprocessor that tries to make
-    sure that all input files start with "GIF89a".
-
-    PS. If you don't like C, you can try out the unix-based wrapper from
-    Ben Nagy instead: https://github.com/bnagy/aflfix
-
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-/* Header that must be present at the beginning of every test case: */
-
-#define HEADER "GIF89a"
-
-typedef struct post_state {
-
-  unsigned char *buf;
-  size_t         size;
-
-} post_state_t;
-
-void *afl_custom_init(void *afl) {
-
-  post_state_t *state = malloc(sizeof(post_state_t));
-  if (!state) {
-
-    perror("malloc");
-    return NULL;
-
-  }
-
-  state->buf = calloc(sizeof(unsigned char), 4096);
-  if (!state->buf) {
-
-    free(state);
-    perror("calloc");
-    return NULL;
-
-  }
-
-  return state;
-
-}
-
-/* The actual postprocessor routine called by afl-fuzz: */
-
-size_t afl_custom_post_process(post_state_t *data, unsigned char *in_buf,
-                               unsigned int len, unsigned char **out_buf) {
-
-  /* Skip execution altogether for buffers shorter than 6 bytes (just to
-     show how it's done). We can trust len to be sane. */
-
-  if (len < strlen(HEADER)) return 0;
-
-  /* Do nothing for buffers that already start with the expected header. */
-
-  if (!memcmp(in_buf, HEADER, strlen(HEADER))) {
-
-    *out_buf = in_buf;
-    return len;
-
-  }
-
-  /* Allocate memory for new buffer, reusing previous allocation if
-     possible. */
-
-  *out_buf = realloc(data->buf, len);
-
-  /* If we're out of memory, the most graceful thing to do is to return the
-     original buffer and give up on modifying it. Let AFL handle OOM on its
-     own later on. */
-
-  if (!*out_buf) {
-
-    *out_buf = in_buf;
-    return len;
-
-  }
-
-  /* Copy the original data to the new location. */
-
-  memcpy(*out_buf, in_buf, len);
-
-  /* Insert the new header. */
-
-  memcpy(*out_buf, HEADER, strlen(HEADER));
-
-  /* Return the new len. It hasn't changed, so it's just len. */
-
-  return len;
-
-}
-
-/* Gets called afterwards */
-void afl_custom_deinit(post_state_t *data) {
-
-  free(data->buf);
-  free(data);
-
-}
-
diff --git a/examples/custom_mutators/post_library_png.so.c b/examples/custom_mutators/post_library_png.so.c
deleted file mode 100644
index 941f7e55..00000000
--- a/examples/custom_mutators/post_library_png.so.c
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
-   american fuzzy lop++ - postprocessor for PNG
-   ------------------------------------------
-
-   Originally written by Michal Zalewski
-
-   Copyright 2015 Google Inc. All rights reserved.
-   Adapted to the new API, 2020 by Dominik Maier
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   See post_library.so.c for a general discussion of how to implement
-   postprocessors. This specific postprocessor attempts to fix up PNG
-   checksums, providing a slightly more complicated example than found
-   in post_library.so.c.
-
-   Compile with:
-
-     gcc -shared -Wall -O3 post_library_png.so.c -o post_library_png.so -lz
-
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <string.h>
-#include <zlib.h>
-
-#include <arpa/inet.h>
-
-/* A macro to round an integer up to 4 kB. */
-
-#define UP4K(_i) ((((_i) >> 12) + 1) << 12)
-
-typedef struct post_state {
-
-  unsigned char *buf;
-  size_t         size;
-
-} post_state_t;
-
-void *afl_custom_init(void *afl) {
-
-  post_state_t *state = malloc(sizeof(post_state_t));
-  if (!state) {
-
-    perror("malloc");
-    return NULL;
-
-  }
-
-  state->buf = calloc(sizeof(unsigned char), 4096);
-  if (!state->buf) {
-
-    free(state);
-    perror("calloc");
-    return NULL;
-
-  }
-
-  return state;
-
-}
-
-size_t afl_custom_post_process(post_state_t *data, const unsigned char *in_buf,
-                               unsigned int          len,
-                               const unsigned char **out_buf) {
-
-  unsigned char *new_buf = (unsigned char *)in_buf;
-  unsigned int   pos = 8;
-
-  /* Don't do anything if there's not enough room for the PNG header
-     (8 bytes). */
-
-  if (len < 8) {
-
-    *out_buf = in_buf;
-    return len;
-
-  }
-
-  /* Minimum size of a zero-length PNG chunk is 12 bytes; if we
-     don't have that, we can bail out. */
-
-  while (pos + 12 <= len) {
-
-    unsigned int chunk_len, real_cksum, file_cksum;
-
-    /* Chunk length is the first big-endian dword in the chunk. */
-
-    chunk_len = ntohl(*(uint32_t *)(in_buf + pos));
-
-    /* Bail out if chunk size is too big or goes past EOF. */
-
-    if (chunk_len > 1024 * 1024 || pos + 12 + chunk_len > len) break;
-
-    /* Chunk checksum is calculated for chunk ID (dword) and the actual
-       payload. */
-
-    real_cksum = htonl(crc32(0, in_buf + pos + 4, chunk_len + 4));
-
-    /* The in-file checksum is the last dword past the chunk data. */
-
-    file_cksum = *(uint32_t *)(in_buf + pos + 8 + chunk_len);
-
-    /* If the checksums do not match, we need to fix the file. */
-
-    if (real_cksum != file_cksum) {
-
-      /* First modification? Make a copy of the input buffer. Round size
-         up to 4 kB to minimize the number of reallocs needed. */
-
-      if (new_buf == in_buf) {
-
-        if (len <= data->size) {
-
-          new_buf = data->buf;
-
-        } else {
-
-          new_buf = realloc(data->buf, UP4K(len));
-          if (!new_buf) {
-
-            *out_buf = in_buf;
-            return len;
-
-          }
-
-          data->buf = new_buf;
-          data->size = UP4K(len);
-          memcpy(new_buf, in_buf, len);
-
-        }
-
-      }
-
-      *(uint32_t *)(new_buf + pos + 8 + chunk_len) = real_cksum;
-
-    }
-
-    /* Skip the entire chunk and move to the next one. */
-
-    pos += 12 + chunk_len;
-
-  }
-
-  *out_buf = new_buf;
-  return len;
-
-}
-
-/* Gets called afterwards */
-void afl_custom_deinit(post_state_t *data) {
-
-  free(data->buf);
-  free(data);
-
-}
-
diff --git a/examples/custom_mutators/simple-chunk-replace.py b/examples/custom_mutators/simple-chunk-replace.py
deleted file mode 100644
index df2f4ca7..00000000
--- a/examples/custom_mutators/simple-chunk-replace.py
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/usr/bin/env python
-# encoding: utf-8
-'''
-Simple Chunk Cross-Over Replacement Module for AFLFuzz
-
-@author:     Christian Holler (:decoder)
-
-@license:
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0. If a copy of the MPL was not distributed with this
-file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-@contact:    choller@mozilla.com
-'''
-
-import random
-
-
-def init(seed):
-    '''
-    Called once when AFLFuzz starts up. Used to seed our RNG.
-
-    @type seed: int
-    @param seed: A 32-bit random value
-    '''
-    # Seed our RNG
-    random.seed(seed)
-
-
-def fuzz(buf, add_buf, max_size):
-    '''
-    Called per fuzzing iteration.
-
-    @type buf: bytearray
-    @param buf: The buffer that should be mutated.
-
-    @type add_buf: bytearray
-    @param add_buf: A second buffer that can be used as mutation source.
-
-    @type max_size: int
-    @param max_size: Maximum size of the mutated output. The mutation must not
-        produce data larger than max_size.
-
-    @rtype: bytearray
-    @return: A new bytearray containing the mutated data
-    '''
-    # Make a copy of our input buffer for returning
-    ret = bytearray(buf)
-
-    # Take a random fragment length between 2 and 32 (or less if add_buf is shorter)
-    fragment_len = random.randint(1, min(len(add_buf), 32))
-
-    # Determine a random source index where to take the data chunk from
-    rand_src_idx = random.randint(0, len(add_buf) - fragment_len)
-
-    # Determine a random destination index where to put the data chunk
-    rand_dst_idx = random.randint(0, len(buf))
-
-    # Make the chunk replacement
-    ret[rand_dst_idx:rand_dst_idx + fragment_len] = add_buf[rand_src_idx:rand_src_idx + fragment_len]
-
-    # Return data
-    return ret
diff --git a/examples/custom_mutators/simple_example.c b/examples/custom_mutators/simple_example.c
deleted file mode 100644
index d888ec1f..00000000
--- a/examples/custom_mutators/simple_example.c
+++ /dev/null
@@ -1,74 +0,0 @@
-// This simple example just creates random buffer <= 100 filled with 'A'
-// needs -I /path/to/AFLplusplus/include
-#include "custom_mutator_helpers.h"
-
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-
-#ifndef _FIXED_CHAR
-  #define _FIXED_CHAR 0x41
-#endif
-
-typedef struct my_mutator {
-
-  afl_t *afl;
-
-  // Reused buffers:
-  BUF_VAR(u8, fuzz);
-
-} my_mutator_t;
-
-my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) {
-
-  srand(seed);
-  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  data->afl = afl;
-
-  return data;
-
-}
-
-size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
-                       u8 **out_buf, uint8_t *add_buf,
-                       size_t add_buf_size,  // add_buf can be NULL
-                       size_t max_size) {
-
-  int size = (rand() % 100) + 1;
-  if (size > max_size) size = max_size;
-  u8 *mutated_out = maybe_grow(BUF_PARAMS(data, fuzz), size);
-  if (!mutated_out) {
-
-    *out_buf = NULL;
-    perror("custom mutator allocation (maybe_grow)");
-    return 0;            /* afl-fuzz will very likely error out after this. */
-
-  }
-
-  memset(mutated_out, _FIXED_CHAR, size);
-
-  *out_buf = mutated_out;
-  return size;
-
-}
-
-/**
- * Deinitialize everything
- *
- * @param data The data ptr from afl_custom_init
- */
-void afl_custom_deinit(my_mutator_t *data) {
-
-  free(data->fuzz_buf);
-  free(data);
-
-}
-
diff --git a/examples/custom_mutators/wrapper_afl_min.py b/examples/custom_mutators/wrapper_afl_min.py
deleted file mode 100644
index ecb03b55..00000000
--- a/examples/custom_mutators/wrapper_afl_min.py
+++ /dev/null
@@ -1,118 +0,0 @@
-#!/usr/bin/env python
-
-from XmlMutatorMin import XmlMutatorMin
-
-# Default settings (production mode)
-
-__mutator__ = None
-__seed__ = "RANDOM"
-__log__ = False
-__log_file__ = "wrapper.log"
-
-
-# AFL functions
-def log(text):
-    """
-    Logger
-    """
-
-    global __seed__
-    global __log__
-    global __log_file__
-
-    if __log__:
-        with open(__log_file__, "a") as logf:
-            logf.write("[%s] %s\n" % (__seed__, text))
-
-
-def init(seed):
-    """
-          Called once when AFL starts up. Seed is used to identify the AFL instance in log files
-    """
-
-    global __mutator__
-    global __seed__
-
-    # Get the seed
-    __seed__ = seed
-
-    # Create a global mutation class
-    try:
-        __mutator__ = XmlMutatorMin(__seed__, verbose=__log__)
-        log("init(): Mutator created")
-    except RuntimeError as e:
-        log("init(): Can't create mutator: %s" % e.message)
-
-
-def fuzz(buf, add_buf, max_size):
-    """
-    Called for each fuzzing iteration.
-    """
-
-    global __mutator__
-
-    # Do we have a working mutator object?
-    if __mutator__ is None:
-        log("fuzz(): Can't fuzz, no mutator available")
-        return buf
-
-    # Try to use the AFL buffer
-    via_buffer = True
-
-    # Interpret the AFL buffer (an array of bytes) as a string
-    if via_buffer:
-        try:
-            buf_str = str(buf)
-            log("fuzz(): AFL buffer converted to a string")
-        except Exception:
-            via_buffer = False
-            log("fuzz(): Can't convert AFL buffer to a string")
-
-    # Load XML from the AFL string
-    if via_buffer:
-        try:
-            __mutator__.init_from_string(buf_str)
-            log("fuzz(): Mutator successfully initialized with AFL buffer (%d bytes)" % len(buf_str))
-        except Exception:
-            via_buffer = False
-            log("fuzz(): Can't initialize mutator with AFL buffer")
-
-    # If init from AFL buffer wasn't succesful
-    if not via_buffer:
-        log("fuzz(): Returning unmodified AFL buffer")
-        return buf
-
-    # Sucessful initialization -> mutate
-    try:
-        __mutator__.mutate(max=5)
-        log("fuzz(): Input mutated")
-    except Exception:
-        log("fuzz(): Can't mutate input => returning buf")
-        return buf
-
-    # Convert mutated data to a array of bytes
-    try:
-        data = bytearray(__mutator__.save_to_string())
-        log("fuzz(): Mutated data converted as bytes")
-    except Exception:
-        log("fuzz(): Can't convert mutated data to bytes => returning buf")
-        return buf
-
-    # Everything went fine, returning mutated content
-    log("fuzz(): Returning %d bytes" % len(data))
-    return data
-
-
-# Main (for debug)
-if __name__ == '__main__':
-
-    __log__ = True
-    __log_file__ = "/dev/stdout"
-    __seed__ = "RANDOM"
-
-    init(__seed__)
-
-    in_1 = bytearray("<foo ddd='eeee'>ffff<a b='c' d='456' eee='ffffff'>zzzzzzzzzzzz</a><b yyy='YYY' zzz='ZZZ'></b></foo>")
-    in_2 = bytearray("<abc abc123='456' abcCBA='ppppppppppppppppppppppppppppp'/>")
-    out = fuzz(in_1, in_2)
-    print(out)
diff --git a/examples/defork/Makefile b/examples/defork/Makefile
deleted file mode 100644
index e8240dba..00000000
--- a/examples/defork/Makefile
+++ /dev/null
@@ -1,64 +0,0 @@
-#
-# american fuzzy lop++ - defork
-# ----------------------------------
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-
-.PHONY: all install clean
-
-PREFIX     ?= /usr/local
-BIN_PATH    = $(PREFIX)/bin
-HELPER_PATH = $(PREFIX)/lib/afl
-
-CFLAGS = -fPIC -Wall -Wextra
-LDFLAGS = -shared
-
-UNAME_SAYS_LINUX=$(shell uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?)
-UNAME_SAYS_LINUX:sh=uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?
-
-_LDFLAGS_ADD=$(UNAME_SAYS_LINUX:1=)
-LDFLAGS_ADD=$(_LDFLAGS_ADD:0=-ldl)
-LDFLAGS  += $(LDFLAGS_ADD)
-
-# on gcc for arm there is no -m32, but -mbe32
-M32FLAG = -m32
-M64FLAG = -m64
-
-CC_IS_GCC=$(shell $(CC) --version 2>/dev/null | grep -q gcc; echo $$?)
-CC_IS_GCC:sh=$(CC) --version 2>/dev/null | grep -q gcc; echo $$?
-CC_IS_ARMCOMPILER=$(shell $(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?)
-CC_IS_ARMCOMPILER:sh=$(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?
-
-_M32FLAG=$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)
-__M32FLAG=$(_M32FLAG:00=-mbe32)
-___M32FLAG=$(__M32FLAG:$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)=-m32)
-M32FLAG=$(___M32FLAG)
-#ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" ""
-# ifneq (,$(findstring arm, "$(shell $(CC) -v 2>&1 >/dev/null)"))
-#  M32FLAG = -mbe32
-# endif
-#endif
-
-all: defork32.so defork64.so
-
-defork32.so: defork.c
-	-@$(CC) $(M32FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "defork32 build failure (that's fine)"
-
-defork64.so: defork.c
-	-@$(CC) $(M64FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "defork64 build failure (that's fine)"
-
-install: defork32.so defork64.so
-	install -d -m 755 $(DESTDIR)$(HELPER_PATH)/
-	if [ -f defork32.so ]; then set -e; install -m 755 defork32.so $(DESTDIR)$(HELPER_PATH)/; fi
-	if [ -f defork64.so ]; then set -e; install -m 755 defork64.so $(DESTDIR)$(HELPER_PATH)/; fi
-
-target:
-	../../afl-clang forking_target.c -o forking_target -Wall -Wextra -Werror
-
-clean:
-	rm -f defork32.so defork64.so forking_target
diff --git a/examples/defork/README.md b/examples/defork/README.md
deleted file mode 100644
index 7e950323..00000000
--- a/examples/defork/README.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# defork
-
-when the target forks, this breaks all normal fuzzing runs.
-Sometimes, though, it is enough to just run the child process.
-If this is the case, then this LD_PRELOAD library will always return 0 on fork,
-the target will belive it is running as the child, post-fork.
-
-This is defork.c from the amazing preeny project
-https://github.com/zardus/preeny
-
-It is altered for afl++ to work with its fork-server: the initial fork will go through, the second fork will be blocked.
diff --git a/examples/defork/defork.c b/examples/defork/defork.c
deleted file mode 100644
index f71d1124..00000000
--- a/examples/defork/defork.c
+++ /dev/null
@@ -1,50 +0,0 @@
-#define __GNU_SOURCE
-#include <dlfcn.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <stdbool.h>
-
-#include "../../include/config.h"
-
-/* we want to fork once (for the afl++ forkserver),
-   then immediately return as child on subsequent forks. */
-static bool forked = 0;
-
-pid_t (*original_fork)(void);
-
-/* In case we are not running in afl, we use a dummy original_fork */
-static pid_t nop(void) {
-
-  return 0;
-
-}
-
-__attribute__((constructor)) void preeny_fork_orig() {
-
-  if (getenv(SHM_ENV_VAR)) {
-
-    printf("defork: running in AFL++. Allowing forkserver.\n");
-    original_fork = dlsym(RTLD_NEXT, "socket");
-
-  } else {
-
-    printf("defork: no AFL++ detected. Disabling fork from the start.\n");
-    original_fork = &nop;
-
-  }
-
-}
-
-pid_t fork(void) {
-
-  /* If we forked before, or if we're in the child (pid==0),
-    we don't want to fork anymore, else, we are still in the forkserver.
-    The forkserver parent needs to fork infinite times, each child should never
-    fork again. This can be written without branches and I hate myself for it.
-  */
-  pid_t ret = !forked && original_fork();
-  forked = !ret;
-  return ret;
-
-}
-
diff --git a/examples/defork/forking_target.c b/examples/defork/forking_target.c
deleted file mode 100644
index 628d23c9..00000000
--- a/examples/defork/forking_target.c
+++ /dev/null
@@ -1,49 +0,0 @@
-#include <stdio.h>
-#include <unistd.h>
-#include <stdint.h>
-#include <sys/types.h>
-
-/* This is an example target for defork.c - fuzz using
-```
-mkdir in; echo a > ./in/a
-AFL_PRELOAD=./defork64.so ../../afl-fuzz -i in -o out -- ./forking_target @@
-```
-*/
-
-int main(int argc, char **argv) {
-
-  if (argc < 2) {
-
-    printf("Example tool to test defork.\nUsage ./forking_target <input>\n");
-    return -1;
-
-  }
-
-  pid_t pid = fork();
-  if (pid == 0) {
-
-    printf("We're in the child.\n");
-    FILE *f = fopen(argv[1], "r");
-    char  buf[4096];
-    fread(buf, 1, 4096, f);
-    fclose(f);
-    uint32_t offset = buf[100] + (buf[101] << 8);
-    char     test_val = buf[offset];
-    return test_val < 100;
-
-  } else if (pid < 0) {
-
-    perror("fork");
-    return -1;
-
-  } else {
-
-    printf("We are in the parent - defork didn't work! :( (pid=%d)\n",
-           (int)pid);
-
-  }
-
-  return 0;
-
-}
-
diff --git a/examples/distributed_fuzzing/sync_script.sh b/examples/distributed_fuzzing/sync_script.sh
deleted file mode 100755
index b28ff6cd..00000000
--- a/examples/distributed_fuzzing/sync_script.sh
+++ /dev/null
@@ -1,97 +0,0 @@
-#!/bin/sh
-#
-# american fuzzy lop++ - fuzzer synchronization tool
-# --------------------------------------------------
-#
-# Originally written by Michal Zalewski
-#
-# Copyright 2014 Google Inc. All rights reserved.
-# Copyright 2019-2020 AFLplusplus Project. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# To make this script work:
-#
-# - Edit FUZZ_HOSTS, FUZZ_DOMAIN, FUZZ_USER, and SYNC_DIR to reflect your
-#   environment.
-#
-# - Make sure that the system you are running this on can log into FUZZ_HOSTS
-#   without a password (authorized_keys or otherwise).
-#
-# - Make sure that every fuzzer is running with -o pointing to SYNC_DIR and -S
-#   that consists of its local host name, followed by an underscore, and then
-#   by some host-local fuzzer ID.
-#
-
-# Hosts to synchronize the data across.
-FUZZ_HOSTS='host1 host2 host3 host4'
-
-# Domain for all hosts
-FUZZ_DOMAIN='example.com'
-
-# Remote user for SSH
-FUZZ_USER=bob
-
-# Directory to synchronize
-SYNC_DIR='/home/bob/sync_dir'
-
-# We only capture -M main nodes, set the name to your chosen naming scheme
-MAIN_NAME='main'
-
-# Interval (seconds) between sync attempts (eg one hour)
-SYNC_INTERVAL=$((60 * 60))
-
-if [ "$AFL_ALLOW_TMP" = "" ]; then
-
-  if [ "$PWD" = "/tmp" -o "$PWD" = "/var/tmp" ]; then
-    echo "[-] Error: do not use shared /tmp or /var/tmp directories with this script." 1>&2
-    exit 1
-  fi
-
-fi
-
-rm -rf .sync_tmp 2>/dev/null
-mkdir .sync_tmp || exit 1
-
-while :; do
-
-  # Pull data in...
-
-  for host in $FUZZ_HOSTS; do
-
-    echo "[*] Retrieving data from ${host}.${FUZZ_DOMAIN}..."
-
-    ssh -o 'passwordauthentication no' ${FUZZ_USER}@${host}.$FUZZ_DOMAIN \
-      "cd '$SYNC_DIR' && tar -czf - ${host}_${MAIN_NAME}*/" > ".sync_tmp/${host}.tgz"
-
-  done
-
-  # Distribute data. For large fleets, see tips in the docs/ directory.
-
-  for dst_host in $FUZZ_HOSTS; do
-
-    echo "[*] Distributing data to ${dst_host}.${FUZZ_DOMAIN}..."
-
-    for src_host in $FUZZ_HOSTS; do
-
-      test "$src_host" = "$dst_host" && continue
-
-      echo "    Sending fuzzer data from ${src_host}.${FUZZ_DOMAIN}..."
-
-      ssh -o 'passwordauthentication no' ${FUZZ_USER}@$dst_host \
-        "cd '$SYNC_DIR' && tar -xkzf - " < ".sync_tmp/${src_host}.tgz"
-
-    done
-
-  done
-
-  echo "[+] Done. Sleeping for $SYNC_INTERVAL seconds (Ctrl-C to quit)."
-
-  sleep $SYNC_INTERVAL
-
-done
-
diff --git a/examples/libpng_no_checksum/libpng-nocrc.patch b/examples/libpng_no_checksum/libpng-nocrc.patch
deleted file mode 100644
index 0a3793a0..00000000
--- a/examples/libpng_no_checksum/libpng-nocrc.patch
+++ /dev/null
@@ -1,15 +0,0 @@
---- pngrutil.c.orig	2014-06-12 03:35:16.000000000 +0200
-+++ pngrutil.c	2014-07-01 05:08:31.000000000 +0200
-@@ -268,7 +268,11 @@
-    if (need_crc != 0)
-    {
-       crc = png_get_uint_32(crc_bytes);
--      return ((int)(crc != png_ptr->crc));
-+
-+      if (crc != png_ptr->crc)
-+        fprintf(stderr, "NOTE: CRC in the file is 0x%08x, change to 0x%08x\n", crc, png_ptr->crc);
-+
-+      return ((int)(1 != 1));
-    }
- 
-    else
diff --git a/examples/persistent_mode/Makefile b/examples/persistent_mode/Makefile
deleted file mode 100644
index 6fa1c30e..00000000
--- a/examples/persistent_mode/Makefile
+++ /dev/null
@@ -1,10 +0,0 @@
-all:
-	afl-clang-fast -o persistent_demo persistent_demo.c
-	afl-clang-fast -o persistent_demo_new persistent_demo_new.c
-	AFL_DONT_OPTIMIZE=1 afl-clang-fast -o test-instr test-instr.c
-
-document:
-	AFL_DONT_OPTIMIZE=1 afl-clang-fast -D_AFL_DOCUMENT_MUTATIONS -o test-instr test-instr.c
-
-clean:
-	rm -f persistent_demo persistent_demo_new test-instr
diff --git a/examples/persistent_mode/persistent_demo.c b/examples/persistent_mode/persistent_demo.c
deleted file mode 100644
index 4cedc32c..00000000
--- a/examples/persistent_mode/persistent_demo.c
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
-   american fuzzy lop++ - persistent mode example
-   --------------------------------------------
-
-   Originally written by Michal Zalewski
-
-   Copyright 2015 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   This file demonstrates the high-performance "persistent mode" that may be
-   suitable for fuzzing certain fast and well-behaved libraries, provided that
-   they are stateless or that their internal state can be easily reset
-   across runs.
-
-   To make this work, the library and this shim need to be compiled in LLVM
-   mode using afl-clang-fast (other compiler wrappers will *not* work).
-
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <signal.h>
-#include <string.h>
-
-/* Main entry point. */
-
-int main(int argc, char **argv) {
-
-  ssize_t len;                               /* how much input did we read? */
-  char buf[100]; /* Example-only buffer, you'd replace it with other global or
-                    local variables appropriate for your use case. */
-
-  /* The number passed to __AFL_LOOP() controls the maximum number of
-     iterations before the loop exits and the program is allowed to
-     terminate normally. This limits the impact of accidental memory leaks
-     and similar hiccups. */
-
-  __AFL_INIT();
-  while (__AFL_LOOP(1000)) {
-
-    /*** PLACEHOLDER CODE ***/
-
-    /* STEP 1: Fully re-initialize all critical variables. In our example, this
-               involves zeroing buf[], our input buffer. */
-
-    memset(buf, 0, 100);
-
-    /* STEP 2: Read input data. When reading from stdin, no special preparation
-               is required. When reading from a named file, you need to close
-               the old descriptor and reopen the file first!
-
-               Beware of reading from buffered FILE* objects such as stdin. Use
-               raw file descriptors or call fopen() / fdopen() in every pass. */
-
-    len = read(0, buf, 100);
-
-    /* STEP 3: This is where we'd call the tested library on the read data.
-               We just have some trivial inline code that faults on 'foo!'. */
-
-    /* do we have enough data? */
-    if (len < 8) continue;
-
-    if (buf[0] == 'f') {
-
-      printf("one\n");
-      if (buf[1] == 'o') {
-
-        printf("two\n");
-        if (buf[2] == 'o') {
-
-          printf("three\n");
-          if (buf[3] == '!') {
-
-            printf("four\n");
-            if (buf[4] == '!') {
-
-              printf("five\n");
-              if (buf[5] == '!') {
-
-                printf("six\n");
-                abort();
-
-              }
-
-            }
-
-          }
-
-        }
-
-      }
-
-    }
-
-    /*** END PLACEHOLDER CODE ***/
-
-  }
-
-  /* Once the loop is exited, terminate normally - AFL will restart the process
-     when this happens, with a clean slate when it comes to allocated memory,
-     leftover file descriptors, etc. */
-
-  return 0;
-
-}
-
diff --git a/examples/persistent_mode/persistent_demo_new.c b/examples/persistent_mode/persistent_demo_new.c
deleted file mode 100644
index a29792ff..00000000
--- a/examples/persistent_mode/persistent_demo_new.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
-   american fuzzy lop++ - persistent mode example
-   --------------------------------------------
-
-   Originally written by Michal Zalewski
-
-   Copyright 2015 Google Inc. All rights reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   This file demonstrates the high-performance "persistent mode" that may be
-   suitable for fuzzing certain fast and well-behaved libraries, provided that
-   they are stateless or that their internal state can be easily reset
-   across runs.
-
-   To make this work, the library and this shim need to be compiled in LLVM
-   mode using afl-clang-fast (other compiler wrappers will *not* work).
-
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <signal.h>
-#include <string.h>
-
-/* this lets the source compile without afl-clang-fast/lto */
-#ifndef __AFL_FUZZ_TESTCASE_LEN
-
-ssize_t       fuzz_len;
-unsigned char fuzz_buf[1024000];
-
-  #define __AFL_FUZZ_TESTCASE_LEN fuzz_len
-  #define __AFL_FUZZ_TESTCASE_BUF fuzz_buf
-  #define __AFL_FUZZ_INIT() void sync(void);
-  #define __AFL_LOOP(x) \
-    ((fuzz_len = read(0, fuzz_buf, sizeof(fuzz_buf))) > 0 ? 1 : 0)
-  #define __AFL_INIT() sync()
-
-#endif
-
-__AFL_FUZZ_INIT();
-
-/* Main entry point. */
-
-int main(int argc, char **argv) {
-
-  ssize_t        len;                        /* how much input did we read? */
-  unsigned char *buf;                        /* test case buffer pointer    */
-
-  /* The number passed to __AFL_LOOP() controls the maximum number of
-     iterations before the loop exits and the program is allowed to
-     terminate normally. This limits the impact of accidental memory leaks
-     and similar hiccups. */
-
-  __AFL_INIT();
-  buf = __AFL_FUZZ_TESTCASE_BUF;  // this must be assigned before __AFL_LOOP!
-
-  while (__AFL_LOOP(1000)) {  // increase if you have good stability
-
-    len = __AFL_FUZZ_TESTCASE_LEN;  // do not use the macro directly in a call!
-
-    fprintf(stderr, "input: %zd \"%s\"\n", len, buf);
-
-    /* do we have enough data? */
-    if (len < 8) continue;
-
-    if (strcmp((char *)buf, "thisisateststring") == 0) printf("teststring\n");
-
-    if (buf[0] == 'f') {
-
-      printf("one\n");
-      if (buf[1] == 'o') {
-
-        printf("two\n");
-        if (buf[2] == 'o') {
-
-          printf("three\n");
-          if (buf[3] == '!') {
-
-            printf("four\n");
-            if (buf[4] == '!') {
-
-              printf("five\n");
-              if (buf[6] == '!') {
-
-                printf("six\n");
-                abort();
-
-              }
-
-            }
-
-          }
-
-        }
-
-      }
-
-    }
-
-    /*** END PLACEHOLDER CODE ***/
-
-  }
-
-  /* Once the loop is exited, terminate normally - AFL will restart the process
-     when this happens, with a clean slate when it comes to allocated memory,
-     leftover file descriptors, etc. */
-
-  return 0;
-
-}
-
diff --git a/examples/persistent_mode/test-instr.c b/examples/persistent_mode/test-instr.c
deleted file mode 100644
index a6188b22..00000000
--- a/examples/persistent_mode/test-instr.c
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
-   american fuzzy lop++ - a trivial program to test the build
-   --------------------------------------------------------
-   Originally written by Michal Zalewski
-   Copyright 2014 Google Inc. All rights reserved.
-   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at:
-     http://www.apache.org/licenses/LICENSE-2.0
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-
-__AFL_FUZZ_INIT();
-
-int main(int argc, char **argv) {
-
-  __AFL_INIT();
-  unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
-
-  while (__AFL_LOOP(2147483647)) {  // MAX_INT if you have 100% stability
-
-    unsigned int len = __AFL_FUZZ_TESTCASE_LEN;
-
-#ifdef _AFL_DOCUMENT_MUTATIONS
-    static unsigned int counter = 0;
-    char                fn[32];
-    sprintf(fn, "%09u:test-instr", counter);
-    int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
-    if (fd_doc >= 0) {
-
-      if (write(fd_doc, buf, len) != __afl_fuzz_len) {
-
-        fprintf(stderr, "write of mutation file failed: %s\n", fn);
-        unlink(fn);
-
-      }
-
-      close(fd_doc);
-
-    }
-
-    counter++;
-#endif
-
-    // fprintf(stderr, "len: %u\n", len);
-
-    if (!len) continue;
-
-    if (buf[0] == '0')
-      printf("Looks like a zero to me!\n");
-    else if (buf[0] == '1')
-      printf("Pretty sure that is a one!\n");
-    else
-      printf("Neither one or zero? How quaint!\n");
-
-  }
-
-  return 0;
-
-}
-
diff --git a/examples/qemu_persistent_hook/Makefile b/examples/qemu_persistent_hook/Makefile
deleted file mode 100644
index 85db1b46..00000000
--- a/examples/qemu_persistent_hook/Makefile
+++ /dev/null
@@ -1,6 +0,0 @@
-all:
-	$(CC) -no-pie test.c -o test
-	$(CC) -fPIC -shared read_into_rdi.c -o read_into_rdi.so
-
-clean:
-	rm -rf in out test read_into_rdi.so
diff --git a/examples/qemu_persistent_hook/README.md b/examples/qemu_persistent_hook/README.md
deleted file mode 100644
index 3f908c22..00000000
--- a/examples/qemu_persistent_hook/README.md
+++ /dev/null
@@ -1,19 +0,0 @@
-# QEMU persistent hook example
-
-Compile the test binary and the library:
-
-```
-make
-```
-
-Fuzz with:
-
-```
-export AFL_QEMU_PERSISTENT_ADDR=0x$(nm test | grep "T target_func" | awk '{print $1}')
-export AFL_QEMU_PERSISTENT_HOOK=./read_into_rdi.so
-
-mkdir in
-echo 0000 > in/in
-
-../../afl-fuzz -Q -i in -o out -- ./test
-```
diff --git a/examples/qemu_persistent_hook/read_into_rdi.c b/examples/qemu_persistent_hook/read_into_rdi.c
deleted file mode 100644
index f4a8ae59..00000000
--- a/examples/qemu_persistent_hook/read_into_rdi.c
+++ /dev/null
@@ -1,34 +0,0 @@
-#include "../../qemu_mode/qemuafl/qemuafl/api.h"
-
-#include <stdio.h>
-#include <string.h>
-
-void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
-                         uint8_t *input_buf, uint32_t input_buf_len) {
-\
-#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
-#define h2g(x) ((uint64_t)(x)-guest_base)
-
-  // In this example the register RDI is pointing to the memory location
-  // of the target buffer, and the length of the input is in RSI.
-  // This can be seen with a debugger, e.g. gdb (and "disass main")
-
-  printf("Placing input into 0x%lx\n", regs->rdi);
-
-  if (input_buf_len > 1024) input_buf_len = 1024;
-  memcpy(g2h(regs->rdi), input_buf, input_buf_len);
-  regs->rsi = input_buf_len;
-
-#undef g2h
-#undef h2g
-
-}
-
-int afl_persistent_hook_init(void) {
-
-  // 1 for shared memory input (faster), 0 for normal input (you have to use
-  // read(), input_buf will be NULL)
-  return 1;
-
-}
-
diff --git a/examples/qemu_persistent_hook/test.c b/examples/qemu_persistent_hook/test.c
deleted file mode 100644
index afeff202..00000000
--- a/examples/qemu_persistent_hook/test.c
+++ /dev/null
@@ -1,35 +0,0 @@
-#include <stdio.h>
-
-int target_func(unsigned char *buf, int size) {
-
-  printf("buffer:%p, size:%p\n", buf, size);
-  switch (buf[0]) {
-
-    case 1:
-      if (buf[1] == '\x44') { puts("a"); }
-      break;
-    case 0xff:
-      if (buf[2] == '\xff') {
-
-        if (buf[1] == '\x44') { puts("b"); }
-
-      }
-
-      break;
-    default:
-      break;
-
-  }
-
-  return 1;
-
-}
-
-char data[1024];
-
-int main() {
-
-  target_func(data, 1024);
-
-}
-
diff --git a/examples/socket_fuzzing/Makefile b/examples/socket_fuzzing/Makefile
deleted file mode 100644
index 9476e2d5..00000000
--- a/examples/socket_fuzzing/Makefile
+++ /dev/null
@@ -1,61 +0,0 @@
-#
-# american fuzzy lop++ - socket_fuzz
-# ----------------------------------
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-
-.PHONY: all install clean
-
-PREFIX     ?= /usr/local
-BIN_PATH    = $(PREFIX)/bin
-HELPER_PATH = $(PREFIX)/lib/afl
-
-CFLAGS = -fPIC -Wall -Wextra
-LDFLAGS = -shared
-
-UNAME_SAYS_LINUX=$(shell uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?)
-UNAME_SAYS_LINUX:sh=uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?
-
-_LDFLAGS_ADD=$(UNAME_SAYS_LINUX:1=)
-LDFLAGS_ADD=$(_LDFLAGS_ADD:0=-ldl)
-LDFLAGS  += $(LDFLAGS_ADD)
-
-# on gcc for arm there is no -m32, but -mbe32
-M32FLAG = -m32
-M64FLAG = -m64
-
-CC_IS_GCC=$(shell $(CC) --version 2>/dev/null | grep -q gcc; echo $$?)
-CC_IS_GCC:sh=$(CC) --version 2>/dev/null | grep -q gcc; echo $$?
-CC_IS_ARMCOMPILER=$(shell $(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?)
-CC_IS_ARMCOMPILER:sh=$(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?
-
-_M32FLAG=$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)
-__M32FLAG=$(_M32FLAG:00=-mbe32)
-___M32FLAG=$(__M32FLAG:$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)=-m32)
-M32FLAG=$(___M32FLAG)
-#ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" ""
-# ifneq (,$(findstring arm, "$(shell $(CC) -v 2>&1 >/dev/null)"))
-#  M32FLAG = -mbe32
-# endif
-#endif
-
-all: socketfuzz32.so socketfuzz64.so
-
-socketfuzz32.so: socketfuzz.c
-	-@$(CC) $(M32FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "socketfuzz32 build failure (that's fine)"
-
-socketfuzz64.so: socketfuzz.c
-	-@$(CC) $(M64FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "socketfuzz64 build failure (that's fine)"
-
-install: socketfuzz32.so socketfuzz64.so
-	install -d -m 755 $(DESTDIR)$(HELPER_PATH)/
-	if [ -f socketfuzz32.so ]; then set -e; install -m 755 socketfuzz32.so $(DESTDIR)$(HELPER_PATH)/; fi
-	if [ -f socketfuzz64.so ]; then set -e; install -m 755 socketfuzz64.so $(DESTDIR)$(HELPER_PATH)/; fi
-
-clean:
-	rm -f socketfuzz32.so socketfuzz64.so
diff --git a/examples/socket_fuzzing/README.md b/examples/socket_fuzzing/README.md
deleted file mode 100644
index 79f28bea..00000000
--- a/examples/socket_fuzzing/README.md
+++ /dev/null
@@ -1,11 +0,0 @@
-# socketfuzz
-
-when you want to fuzz a network service and you can not/do not want to modify
-the source (or just have a binary), then this LD_PRELOAD library will allow
-for sending input to stdin which the target binary will think is coming from
-a network socket.
-
-This is desock_dup.c from the amazing preeny project
-https://github.com/zardus/preeny
-
-It is packaged in afl++ to have it at hand if needed
diff --git a/examples/socket_fuzzing/socketfuzz.c b/examples/socket_fuzzing/socketfuzz.c
deleted file mode 100644
index 3ec8383b..00000000
--- a/examples/socket_fuzzing/socketfuzz.c
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * This is desock_dup.c from the amazing preeny project
- * https://github.com/zardus/preeny
- *
- * It is packaged in afl++ to have it at hand if needed
- *
- */
-
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <sys/types.h>   //
-#include <sys/socket.h>  //
-#include <sys/stat.h>    //
-#include <fcntl.h>       //
-#include <netinet/in.h>
-#include <pthread.h>
-#include <signal.h>
-#include <dlfcn.h>
-#include <errno.h>
-#include <stdio.h>
-#include <poll.h>
-//#include "logging.h" // switche from preeny_info() to fprintf(stderr, "Info: "
-
-//
-// originals
-//
-int (*original_close)(int);
-int (*original_dup2)(int, int);
-__attribute__((constructor)) void preeny_desock_dup_orig() {
-
-  original_close = dlsym(RTLD_NEXT, "close");
-  original_dup2 = dlsym(RTLD_NEXT, "dup2");
-
-}
-
-int close(int sockfd) {
-
-  if (sockfd <= 2) {
-
-    fprintf(stderr, "Info: Disabling close on %d\n", sockfd);
-    return 0;
-
-  } else {
-
-    return original_close(sockfd);
-
-  }
-
-}
-
-int dup2(int old, int new) {
-
-  if (new <= 2) {
-
-    fprintf(stderr, "Info: Disabling dup from %d to %d\n", old, new);
-    return 0;
-
-  } else {
-
-    return original_dup2(old, new);
-
-  }
-
-}
-
-int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen) {
-
-  (void)sockfd;
-  (void)addr;
-  (void)addrlen;
-  fprintf(stderr, "Info: Emulating accept on %d\n", sockfd);
-  return 0;
-
-}
-
-int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen) {
-
-  (void)sockfd;
-  (void)addr;
-  (void)addrlen;
-  fprintf(stderr, "Info: Emulating bind on port %d\n",
-          ntohs(((struct sockaddr_in *)addr)->sin_port));
-  return 0;
-
-}
-
-int listen(int sockfd, int backlog) {
-
-  (void)sockfd;
-  (void)backlog;
-  return 0;
-
-}
-
-int setsockopt(int sockfd, int level, int optid, const void *optdata,
-               socklen_t optdatalen) {
-
-  (void)sockfd;
-  (void)level;
-  (void)optid;
-  (void)optdata;
-  (void)optdatalen;
-  return 0;
-
-}
-
diff --git a/instrumentation/README.gcc_plugin.md b/instrumentation/README.gcc_plugin.md
index 6ccb5fd3..12449efd 100644
--- a/instrumentation/README.gcc_plugin.md
+++ b/instrumentation/README.gcc_plugin.md
@@ -147,7 +147,7 @@ The numerical value specified within the loop controls the maximum number
 of iterations before AFL will restart the process from scratch. This minimizes
 the impact of memory leaks and similar glitches; 1000 is a good starting point.
 
-A more detailed template is shown in ../examples/persistent_mode/.
+A more detailed template is shown in ../utils/persistent_mode/.
 Similarly to the previous mode, the feature works only with afl-gcc-fast or
 afl-clang-fast; #ifdef guards can be used to suppress it when using other
 compilers.
diff --git a/instrumentation/README.persistent_mode.md b/instrumentation/README.persistent_mode.md
index 49f5ee8b..2cf76adf 100644
--- a/instrumentation/README.persistent_mode.md
+++ b/instrumentation/README.persistent_mode.md
@@ -11,7 +11,7 @@ and that its state can be resetted so that multiple calls can be performed
 without resource leaks and former runs having no impact on following runs
 (this can be seen by the `stability` indicator in the `afl-fuzz` UI).
 
-Examples can be found in [examples/persistent_mode](../examples/persistent_mode).
+Examples can be found in [utils/persistent_mode](../utils/persistent_mode).
 
 ## 2) TLDR;
 
@@ -150,7 +150,7 @@ the impact of memory leaks and similar glitches; 1000 is a good starting point,
 and going much higher increases the likelihood of hiccups without giving you
 any real performance benefits.
 
-A more detailed template is shown in ../examples/persistent_mode/.
+A more detailed template is shown in ../utils/persistent_mode/.
 Similarly to the previous mode, the feature works only with afl-clang-fast; #ifdef
 guards can be used to suppress it when using other compilers.
 
diff --git a/qemu_mode/README.md b/qemu_mode/README.md
index 1c5d240c..58e48e91 100644
--- a/qemu_mode/README.md
+++ b/qemu_mode/README.md
@@ -179,7 +179,7 @@ match.
 ## 12) Gotchas, feedback, bugs
 
 If you need to fix up checksums or do other cleanup on mutated test cases, see
-examples/custom_mutators/ for a viable solution.
+utils/custom_mutators/ for a viable solution.
 
 Do not mix QEMU mode with ASAN, MSAN, or the likes; QEMU doesn't appreciate
 the "shadow VM" trick employed by the sanitizers and will probably just
diff --git a/qemu_mode/README.persistent.md b/qemu_mode/README.persistent.md
index d9e7e1cc..2ca5c873 100644
--- a/qemu_mode/README.persistent.md
+++ b/qemu_mode/README.persistent.md
@@ -172,4 +172,4 @@ and so the input_buf variables of the hook becomes meaningful. Otherwise,
 you have to read the input from a file like stdin.
 
 An example that you can use with little modification for your target can
-be found here: [examples/qemu_persistent_hook](../examples/qemu_persistent_hook)
+be found here: [utils/qemu_persistent_hook](../utils/qemu_persistent_hook)
diff --git a/src/afl-as.c b/src/afl-as.c
index 7d70bfcd..3d6f7d5e 100644
--- a/src/afl-as.c
+++ b/src/afl-as.c
@@ -27,7 +27,7 @@
    utility has right now is to be able to skip them gracefully and allow the
    compilation process to continue.
 
-   That said, see examples/clang_asm_normalize/ for a solution that may
+   That said, see utils/clang_asm_normalize/ for a solution that may
    allow clang users to make things work even with hand-crafted assembly. Just
    note that there is no equivalent for GCC.
 
diff --git a/test/test-custom-mutators.sh b/test/test-custom-mutators.sh
index d4d21048..24c95ac7 100755
--- a/test/test-custom-mutators.sh
+++ b/test/test-custom-mutators.sh
@@ -5,7 +5,7 @@
 $ECHO "$BLUE[*] Testing: custom mutator"
 test "1" = "`../afl-fuzz | grep -i 'without python' >/dev/null; echo $?`" && {
   # normalize path
-  CUSTOM_MUTATOR_PATH=$(cd $(pwd)/../examples/custom_mutators;pwd)
+  CUSTOM_MUTATOR_PATH=$(cd $(pwd)/../utils/custom_mutators;pwd)
   test -e test-custom-mutator.c -a -e ${CUSTOM_MUTATOR_PATH}/example.c -a -e ${CUSTOM_MUTATOR_PATH}/example.py && {
     unset AFL_CC
     # Compile the vulnerable program for single mutator
@@ -29,8 +29,8 @@ test "1" = "`../afl-fuzz | grep -i 'without python' >/dev/null; echo $?`" && {
       }
     }
     # Compile the custom mutator
-    cc -D_FIXED_CHAR=0x41 -g -fPIC -shared -I../include ../examples/custom_mutators/simple_example.c -o libexamplemutator.so > /dev/null 2>&1
-    cc -D_FIXED_CHAR=0x42 -g -fPIC -shared -I../include ../examples/custom_mutators/simple_example.c -o libexamplemutator2.so > /dev/null 2>&1
+    cc -D_FIXED_CHAR=0x41 -g -fPIC -shared -I../include ../utils/custom_mutators/simple_example.c -o libexamplemutator.so > /dev/null 2>&1
+    cc -D_FIXED_CHAR=0x42 -g -fPIC -shared -I../include ../utils/custom_mutators/simple_example.c -o libexamplemutator2.so > /dev/null 2>&1
     test -e test-custom-mutator -a -e ./libexamplemutator.so && {
       # Create input directory
       mkdir -p in
@@ -109,7 +109,7 @@ test "1" = "`../afl-fuzz | grep -i 'without python' >/dev/null; echo $?`" && {
 
     #test "$CODE" = 1 && { $ECHO "$YELLOW[!] custom mutator tests currently will not fail travis" ; CODE=0 ; }
 
-    make -C ../examples/custom_mutators clean > /dev/null 2>&1
+    make -C ../utils/custom_mutators clean > /dev/null 2>&1
     rm -f test-custom-mutator
     rm -f test-custom-mutators
   } || {
diff --git a/test/test-gcc-plugin.sh b/test/test-gcc-plugin.sh
index af8674c9..71d86364 100755
--- a/test/test-gcc-plugin.sh
+++ b/test/test-gcc-plugin.sh
@@ -94,7 +94,7 @@ test -e ../afl-gcc-fast -a -e ../afl-compiler-rt.o && {
     CODE=1
   }
   rm -f test-compcov test.out instrumentlist.txt
-  ../afl-gcc-fast -o test-persistent ../examples/persistent_mode/persistent_demo.c > /dev/null 2>&1
+  ../afl-gcc-fast -o test-persistent ../utils/persistent_mode/persistent_demo.c > /dev/null 2>&1
   test -e test-persistent && {
     echo foo | ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -q -r ./test-persistent && {
       $ECHO "$GREEN[+] gcc_plugin persistent mode feature works correctly"
diff --git a/test/test-llvm-lto.sh b/test/test-llvm-lto.sh
index bdb08559..e10f4cf7 100755
--- a/test/test-llvm-lto.sh
+++ b/test/test-llvm-lto.sh
@@ -57,7 +57,7 @@ test -e ../afl-clang-lto -a -e ../afl-llvm-lto-instrumentation.so && {
     CODE=1
   }
   rm -f test-compcov test.out instrumentlist.txt
-  ../afl-clang-lto -o test-persistent ../examples/persistent_mode/persistent_mode.c > /dev/null 2>&1
+  ../afl-clang-lto -o test-persistent ../utils/persistent_mode/persistent_mode.c > /dev/null 2>&1
   test -e test-persistent && {
     echo foo | ../afl-showmap -m none -o /dev/null -q -r ./test-persistent && {
       $ECHO "$GREEN[+] llvm_mode LTO persistent mode feature works correctly"
diff --git a/test/test-llvm.sh b/test/test-llvm.sh
index 14778e1c..4fcaf367 100755
--- a/test/test-llvm.sh
+++ b/test/test-llvm.sh
@@ -209,7 +209,7 @@ test -e ../afl-clang-fast -a -e ../split-switches-pass.so && {
     INCOMPLETE=1
   }
   rm -rf errors test-cmplog in core.*
-  ../afl-clang-fast -o test-persistent ../examples/persistent_mode/persistent_demo.c > /dev/null 2>&1
+  ../afl-clang-fast -o test-persistent ../utils/persistent_mode/persistent_demo.c > /dev/null 2>&1
   test -e test-persistent && {
     echo foo | ../afl-showmap -m ${MEM_LIMIT} -o /dev/null -q -r ./test-persistent && {
       $ECHO "$GREEN[+] llvm_mode persistent mode feature works correctly"
diff --git a/utils/README.md b/utils/README.md
new file mode 100644
index 00000000..336b6b6c
--- /dev/null
+++ b/utils/README.md
@@ -0,0 +1,54 @@
+# AFL++ Examples
+
+Here's a quick overview of the stuff you can find in this directory:
+
+  - afl_network_proxy    - fuzz a target over the network: afl-fuzz on
+                           a host, target on an embedded system.
+
+  - afl_proxy            - skeleton file example to show how to fuzz
+                           something where you gather coverage data via
+                           different means, e.g. hw debugger
+
+  - afl_untracer         - fuzz binary-only libraries much faster but with
+                           less coverage than qemu_mode
+
+  - argv_fuzzing         - a simple wrapper to allow cmdline to be fuzzed
+                           (e.g., to test setuid programs).
+
+  - asan_cgroups         - a contributed script to simplify fuzzing ASAN
+                           binaries with robust memory limits on Linux.
+
+  - bash_shellshock      - a simple hack used to find a bunch of
+                           post-Shellshock bugs in bash.
+
+  - canvas_harness       - a test harness used to find browser bugs with a
+                           corpus generated using simple image parsing
+                           binaries & afl-fuzz.
+
+  - clang_asm_normalize  - a script that makes it easy to instrument
+                           hand-written assembly, provided that you have clang.
+
+  - crash_triage         - a very rudimentary example of how to annotate crashes
+                           with additional gdb metadata.
+
+  - custom_mutators      - examples for the afl++ custom mutator interface in
+                           C and Python
+
+  - distributed_fuzzing  - a sample script for synchronizing fuzzer instances
+                           across multiple machines (see parallel_fuzzing.md).
+
+  - libpng_no_checksum   - a sample patch for removing CRC checks in libpng.
+
+  - persistent_mode      - an example of how to use the LLVM persistent process
+                           mode to speed up certain fuzzing jobs.
+
+  - socket_fuzzing       - a LD_PRELOAD library 'redirects' a socket to stdin
+                           for fuzzing access with afl++
+
+Note that the minimize_corpus.sh tool has graduated from the utils/
+directory and is now available as ../afl-cmin. The LLVM mode has likewise
+graduated to ../instrumentation/*.
+
+Most of the tools in this directory are meant chiefly as examples that need to
+be tweaked for your specific needs. They come with some basic documentation,
+but are not necessarily production-grade.
diff --git a/utils/afl_frida/GNUmakefile b/utils/afl_frida/GNUmakefile
new file mode 100644
index 00000000..c154f3a4
--- /dev/null
+++ b/utils/afl_frida/GNUmakefile
@@ -0,0 +1,23 @@
+ifdef DEBUG
+  OPT=-O0 -D_DEBUG=\"1\"
+else
+  OPT=-O3 -funroll-loops
+endif
+
+all:	afl-frida libtestinstr.so
+
+libfrida-gum.a:
+	@echo Download and extract frida-gum-devkit-VERSION-PLATFORM.tar.xz for your platform from https://github.com/frida/frida/releases/latest
+	@exit 1
+	
+afl-frida:	afl-frida.c libfrida-gum.a
+	$(CC) -g $(OPT) -o afl-frida -Wno-format -Wno-pointer-sign -I. -fpermissive -fPIC afl-frida.c ../../afl-llvm-rt.o libfrida-gum.a -ldl -lresolv -pthread
+
+libtestinstr.so:        libtestinstr.c
+	$(CC) -g -O0 -fPIC -o libtestinstr.so -shared libtestinstr.c
+
+clean:
+	rm -f afl-frida *~ core *.o libtestinstr.so
+
+deepclean: clean
+	rm -f libfrida-gum.a frida-gum*
diff --git a/utils/afl_frida/Makefile b/utils/afl_frida/Makefile
new file mode 100644
index 00000000..0b306dde
--- /dev/null
+++ b/utils/afl_frida/Makefile
@@ -0,0 +1,2 @@
+all:
+	@echo please use GNU make, thanks!
diff --git a/utils/afl_frida/README.md b/utils/afl_frida/README.md
new file mode 100644
index 00000000..7743479b
--- /dev/null
+++ b/utils/afl_frida/README.md
@@ -0,0 +1,34 @@
+# afl-frida - faster fuzzing of binary-only libraries
+
+## Introduction
+
+afl-frida is an example skeleton file which can easily be used to fuzz
+a closed source library.
+
+It requires less memory and is x5-10 faster than qemu_mode but does not
+provide interesting features like compcov or cmplog.
+
+## How-to
+
+### Modify afl-frida.c
+
+Read and modify afl-frida.c then `make`.
+To adapt afl-frida.c to your needs, read the header of the file and then
+search and edit the `STEP 1`, `STEP 2` and `STEP 3` locations.
+
+### Fuzzing
+
+Example (after modifying afl-frida.c to your needs and compile it):
+```
+LD_LIBRARY_PATH=/path/to/the/target/library afl-fuzz -i in -o out -- ./afl-frida
+```
+(or even remote via afl-network-proxy).
+
+# Speed and stability
+
+The speed is very good, about x12 of fork() qemu_mode.
+However the stability is low. Reason is currently unknown.
+
+# Background
+
+This code is copied for a larger part from https://github.com/meme/hotwax
diff --git a/utils/afl_frida/afl-frida.c b/utils/afl_frida/afl-frida.c
new file mode 100644
index 00000000..31bf8f25
--- /dev/null
+++ b/utils/afl_frida/afl-frida.c
@@ -0,0 +1,542 @@
+/*
+   american fuzzy lop++ - afl-frida skeleton example
+   -------------------------------------------------
+
+   Copyright 2020 AFLplusplus Project. All rights reserved.
+
+   Written mostly by meme -> https://github.com/meme/hotwax
+
+   Modifications by Marc Heuse <mh@mh-sec.de>
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+   HOW-TO
+   ======
+
+   You only need to change the following:
+
+   1. set the defines and function call parameters.
+   2. dl load the library you want to fuzz, lookup the functions you need
+      and setup the calls to these.
+   3. in the while loop you call the functions in the necessary order -
+      incl the cleanup. the cleanup is important!
+
+   Just look these steps up in the code, look for "// STEP x:"
+
+*/
+
+#include <stdio.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <stddef.h>
+#include <sys/shm.h>
+#include <dlfcn.h>
+
+#ifndef __APPLE__
+  #include <sys/wait.h>
+  #include <sys/personality.h>
+#endif
+
+int debug = 0;
+
+// STEP 1:
+
+// The presets are for the example libtestinstr.so:
+
+/* What is the name of the library to fuzz */
+#define TARGET_LIBRARY "libtestinstr.so"
+
+/* What is the name of the function to fuzz */
+#define TARGET_FUNCTION "testinstr"
+
+/* here you need to specify the parameter for the target function */
+static void *(*o_function)(uint8_t *, int);
+
+// END STEP 1
+
+#include "frida-gum.h"
+
+G_BEGIN_DECLS
+
+#define GUM_TYPE_FAKE_EVENT_SINK (gum_fake_event_sink_get_type())
+G_DECLARE_FINAL_TYPE(GumFakeEventSink, gum_fake_event_sink, GUM,
+                     FAKE_EVENT_SINK, GObject)
+
+struct _GumFakeEventSink {
+
+  GObject      parent;
+  GumEventType mask;
+
+};
+
+GumEventSink *gum_fake_event_sink_new(void);
+void          gum_fake_event_sink_reset(GumFakeEventSink *self);
+
+G_END_DECLS
+
+static void         gum_fake_event_sink_iface_init(gpointer g_iface,
+                                                   gpointer iface_data);
+static void         gum_fake_event_sink_finalize(GObject *obj);
+static GumEventType gum_fake_event_sink_query_mask(GumEventSink *sink);
+static void gum_fake_event_sink_process(GumEventSink *sink, const GumEvent *ev);
+void instr_basic_block(GumStalkerIterator *iterator, GumStalkerOutput *output,
+                       gpointer user_data);
+void afl_setup(void);
+void afl_start_forkserver(void);
+int  __afl_persistent_loop(unsigned int max_cnt);
+
+static void gum_fake_event_sink_class_init(GumFakeEventSinkClass *klass) {
+
+  GObjectClass *object_class = G_OBJECT_CLASS(klass);
+  object_class->finalize = gum_fake_event_sink_finalize;
+
+}
+
+static void gum_fake_event_sink_iface_init(gpointer g_iface,
+                                           gpointer iface_data) {
+
+  GumEventSinkInterface *iface = (GumEventSinkInterface *)g_iface;
+  iface->query_mask = gum_fake_event_sink_query_mask;
+  iface->process = gum_fake_event_sink_process;
+
+}
+
+G_DEFINE_TYPE_EXTENDED(GumFakeEventSink, gum_fake_event_sink, G_TYPE_OBJECT, 0,
+                       G_IMPLEMENT_INTERFACE(GUM_TYPE_EVENT_SINK,
+                                             gum_fake_event_sink_iface_init))
+
+#include "../../config.h"
+
+// Shared memory fuzzing.
+int                   __afl_sharedmem_fuzzing = 1;
+extern unsigned int * __afl_fuzz_len;
+extern unsigned char *__afl_fuzz_ptr;
+
+// Notify AFL about persistent mode.
+static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
+int                  __afl_persistent_loop(unsigned int);
+
+// Notify AFL about deferred forkserver.
+static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
+void                 __afl_manual_init();
+
+// Because we do our own logging.
+extern uint8_t *        __afl_area_ptr;
+static __thread guint64 previous_pc;
+
+// Frida stuff below.
+typedef struct {
+
+  GumAddress base_address;
+  guint64    code_start, code_end;
+
+} range_t;
+
+inline static void afl_maybe_log(guint64 current_pc) {
+
+  // fprintf(stderr, "PC: %p ^ %p\n", current_pc, previous_pc);
+
+  current_pc = (current_pc >> 4) ^ (current_pc << 8);
+  current_pc &= MAP_SIZE - 1;
+
+  __afl_area_ptr[current_pc ^ previous_pc]++;
+  previous_pc = current_pc >> 1;
+
+}
+
+static void on_basic_block(GumCpuContext *context, gpointer user_data) {
+
+  afl_maybe_log((guint64)user_data);
+
+}
+
+void instr_basic_block(GumStalkerIterator *iterator, GumStalkerOutput *output,
+                       gpointer user_data) {
+
+  range_t *range = (range_t *)user_data;
+
+  const cs_insn *instr;
+  gboolean       begin = TRUE;
+  while (gum_stalker_iterator_next(iterator, &instr)) {
+
+    if (begin) {
+
+      if (instr->address >= range->code_start &&
+          instr->address <= range->code_end) {
+
+        gum_stalker_iterator_put_callout(iterator, on_basic_block,
+                                         (gpointer)instr->address, NULL);
+        begin = FALSE;
+
+      }
+
+    }
+
+    gum_stalker_iterator_keep(iterator);
+
+  }
+
+}
+
+static void gum_fake_event_sink_init(GumFakeEventSink *self) {
+
+}
+
+static void gum_fake_event_sink_finalize(GObject *obj) {
+
+  G_OBJECT_CLASS(gum_fake_event_sink_parent_class)->finalize(obj);
+
+}
+
+GumEventSink *gum_fake_event_sink_new(void) {
+
+  GumFakeEventSink *sink;
+  sink = (GumFakeEventSink *)g_object_new(GUM_TYPE_FAKE_EVENT_SINK, NULL);
+  return GUM_EVENT_SINK(sink);
+
+}
+
+void gum_fake_event_sink_reset(GumFakeEventSink *self) {
+
+}
+
+static GumEventType gum_fake_event_sink_query_mask(GumEventSink *sink) {
+
+  return 0;
+
+}
+
+typedef struct library_list {
+
+  uint8_t *name;
+  uint64_t addr_start, addr_end;
+
+} library_list_t;
+
+#define MAX_LIB_COUNT 256
+static library_list_t liblist[MAX_LIB_COUNT];
+static u32            liblist_cnt;
+
+void read_library_information() {
+
+#if defined(__linux__)
+  FILE *f;
+  u8    buf[1024], *b, *m, *e, *n;
+
+  if ((f = fopen("/proc/self/maps", "r")) == NULL) {
+
+    fprintf(stderr, "Error: cannot open /proc/self/maps\n");
+    exit(-1);
+
+  }
+
+  if (debug) fprintf(stderr, "Library list:\n");
+  while (fgets(buf, sizeof(buf), f)) {
+
+    if (strstr(buf, " r-x")) {
+
+      if (liblist_cnt >= MAX_LIB_COUNT) {
+
+        fprintf(
+            stderr,
+            "Warning: too many libraries to old, maximum count of %d reached\n",
+            liblist_cnt);
+        return;
+
+      }
+
+      b = buf;
+      m = index(buf, '-');
+      e = index(buf, ' ');
+      if ((n = rindex(buf, '/')) == NULL) n = rindex(buf, ' ');
+      if (n &&
+          ((*n >= '0' && *n <= '9') || *n == '[' || *n == '{' || *n == '('))
+        n = NULL;
+      else
+        n++;
+      if (b && m && e && n && *n) {
+
+        *m++ = 0;
+        *e = 0;
+        if (n[strlen(n) - 1] == '\n') n[strlen(n) - 1] = 0;
+
+        if (rindex(n, '/') != NULL) {
+
+          n = rindex(n, '/');
+          n++;
+
+        }
+
+        liblist[liblist_cnt].name = strdup(n);
+        liblist[liblist_cnt].addr_start = strtoull(b, NULL, 16);
+        liblist[liblist_cnt].addr_end = strtoull(m, NULL, 16);
+        if (debug)
+          fprintf(
+              stderr, "%s:%llx (%llx-%llx)\n", liblist[liblist_cnt].name,
+              liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
+              liblist[liblist_cnt].addr_start,
+              liblist[liblist_cnt].addr_end - 1);
+        liblist_cnt++;
+
+      }
+
+    }
+
+  }
+
+  if (debug) fprintf(stderr, "\n");
+
+#elif defined(__FreeBSD__)
+  int    mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, getpid()};
+  char * buf, *start, *end;
+  size_t miblen = sizeof(mib) / sizeof(mib[0]);
+  size_t len;
+
+  if (debug) fprintf(stderr, "Library list:\n");
+  if (sysctl(mib, miblen, NULL, &len, NULL, 0) == -1) { return; }
+
+  len = len * 4 / 3;
+
+  buf = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
+  if (buf == MAP_FAILED) { return; }
+  if (sysctl(mib, miblen, buf, &len, NULL, 0) == -1) {
+
+    munmap(buf, len);
+    return;
+
+  }
+
+  start = buf;
+  end = buf + len;
+
+  while (start < end) {
+
+    struct kinfo_vmentry *region = (struct kinfo_vmentry *)start;
+    size_t                size = region->kve_structsize;
+
+    if (size == 0) { break; }
+
+    if ((region->kve_protection & KVME_PROT_READ) &&
+        !(region->kve_protection & KVME_PROT_EXEC)) {
+
+      liblist[liblist_cnt].name =
+          region->kve_path[0] != '\0' ? strdup(region->kve_path) : 0;
+      liblist[liblist_cnt].addr_start = region->kve_start;
+      liblist[liblist_cnt].addr_end = region->kve_end;
+
+      if (debug) {
+
+        fprintf(stderr, "%s:%x (%lx-%lx)\n", liblist[liblist_cnt].name,
+                liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
+                liblist[liblist_cnt].addr_start,
+                liblist[liblist_cnt].addr_end - 1);
+
+      }
+
+      liblist_cnt++;
+
+    }
+
+    start += size;
+
+  }
+
+#endif
+
+}
+
+library_list_t *find_library(char *name) {
+
+  char *filename = rindex(name, '/');
+
+  if (filename)
+    filename++;
+  else
+    filename = name;
+
+#if defined(__linux__)
+  u32 i;
+  for (i = 0; i < liblist_cnt; i++)
+    if (strcmp(liblist[i].name, filename) == 0) return &liblist[i];
+#elif defined(__APPLE__) && defined(__LP64__)
+  kern_return_t         err;
+  static library_list_t lib;
+
+  // get the list of all loaded modules from dyld
+  // the task_info mach API will get the address of the dyld all_image_info
+  // struct for the given task from which we can get the names and load
+  // addresses of all modules
+  task_dyld_info_data_t  task_dyld_info;
+  mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
+  err = task_info(mach_task_self(), TASK_DYLD_INFO,
+                  (task_info_t)&task_dyld_info, &count);
+
+  const struct dyld_all_image_infos *all_image_infos =
+      (const struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr;
+  const struct dyld_image_info *image_infos = all_image_infos->infoArray;
+
+  for (size_t i = 0; i < all_image_infos->infoArrayCount; i++) {
+
+    const char *      image_name = image_infos[i].imageFilePath;
+    mach_vm_address_t image_load_address =
+        (mach_vm_address_t)image_infos[i].imageLoadAddress;
+    if (strstr(image_name, name)) {
+
+      lib.name = name;
+      lib.addr_start = (u64)image_load_address;
+      lib.addr_end = 0;
+      return &lib;
+
+    }
+
+  }
+
+#endif
+
+  return NULL;
+
+}
+
+static void gum_fake_event_sink_process(GumEventSink *  sink,
+                                        const GumEvent *ev) {
+
+}
+
+/* Because this CAN be called more than once, it will return the LAST range */
+static int enumerate_ranges(const GumRangeDetails *details,
+                            gpointer               user_data) {
+
+  GumMemoryRange *code_range = (GumMemoryRange *)user_data;
+  memcpy(code_range, details->range, sizeof(*code_range));
+  return 0;
+
+}
+
+int main() {
+
+#ifndef __APPLE__
+  (void)personality(ADDR_NO_RANDOMIZE);  // disable ASLR
+#endif
+
+  // STEP 2: load the library you want to fuzz and lookup the functions,
+  //         inclusive of the cleanup functions.
+  //         If there is just one function, then there is nothing to change
+  //         or add here.
+
+  void *dl = dlopen(TARGET_LIBRARY, RTLD_LAZY);
+  if (!dl) {
+
+    fprintf(stderr, "Could not load %s\n", TARGET_LIBRARY);
+    exit(-1);
+
+  }
+
+  if (!(o_function = dlsym(dl, TARGET_FUNCTION))) {
+
+    fprintf(stderr, "Could not find function %s\n", TARGET_FUNCTION);
+    exit(-1);
+
+  }
+
+  // END STEP 2
+
+  read_library_information();
+  library_list_t *lib = find_library(TARGET_LIBRARY);
+
+  if (lib == NULL) {
+
+    fprintf(stderr, "Could not find target library\n");
+    exit(-1);
+
+  }
+
+  gum_init_embedded();
+  if (!gum_stalker_is_supported()) {
+
+    gum_deinit_embedded();
+    return 1;
+
+  }
+
+  GumStalker *stalker = gum_stalker_new();
+
+  /*
+  This does not work here as we load a shared library. pretty sure this
+  would also be easily solvable with frida gum, but I already have all the
+  code I need from afl-untracer
+
+  GumAddress base_address = gum_module_find_base_address(TARGET_LIBRARY);
+  GumMemoryRange code_range;
+  gum_module_enumerate_ranges(TARGET_LIBRARY, GUM_PAGE_RX, enumerate_ranges,
+                              &code_range);
+  guint64 code_start = code_range.base_address - base_address;
+  guint64 code_end = (code_range.base_address + code_range.size) - base_address;
+  range_t instr_range = {base_address, code_start, code_end};
+  */
+  range_t instr_range = {0, lib->addr_start, lib->addr_end};
+
+  GumStalkerTransformer *transformer =
+      gum_stalker_transformer_make_from_callback(instr_basic_block,
+                                                 &instr_range, NULL);
+
+  GumEventSink *event_sink = gum_fake_event_sink_new();
+
+  // to ensure that the signatures are not optimized out
+  memcpy(__afl_area_ptr, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT) + 1);
+  memcpy(__afl_area_ptr + 32, (void *)AFL_DEFER_FORKSVR,
+         sizeof(AFL_DEFER_FORKSVR) + 1);
+  __afl_manual_init();
+
+  //
+  // any expensive target library initialization that has to be done just once
+  // - put that here
+  //
+
+  gum_stalker_follow_me(stalker, transformer, event_sink);
+
+  while (__afl_persistent_loop(UINT32_MAX) != 0) {
+
+    previous_pc = 0;  // Required!
+
+#ifdef _DEBUG
+    fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
+            hash64(__afl_fuzz_ptr, *__afl_fuzz_len), *__afl_fuzz_len);
+    fprintf(stderr, "RECV:");
+    for (int i = 0; i < *__afl_fuzz_len; i++)
+      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
+    fprintf(stderr, "\n");
+#endif
+
+    // STEP 3: ensure the minimum length is present and setup the target
+    //         function to fuzz.
+
+    if (*__afl_fuzz_len > 0) {
+
+      __afl_fuzz_ptr[*__afl_fuzz_len] = 0;  // if you need to null terminate
+      (*o_function)(__afl_fuzz_ptr, *__afl_fuzz_len);
+
+    }
+
+    // END STEP 3
+
+  }
+
+  gum_stalker_unfollow_me(stalker);
+
+  while (gum_stalker_garbage_collect(stalker))
+    g_usleep(10000);
+
+  g_object_unref(stalker);
+  g_object_unref(transformer);
+  g_object_unref(event_sink);
+  gum_deinit_embedded();
+
+  return 0;
+
+}
+
diff --git a/utils/afl_frida/afl-frida.h b/utils/afl_frida/afl-frida.h
new file mode 100644
index 00000000..efa3440f
--- /dev/null
+++ b/utils/afl_frida/afl-frida.h
@@ -0,0 +1,53 @@
+extern int is_persistent;
+
+G_BEGIN_DECLS
+
+#define GUM_TYPE_FAKE_EVENT_SINK (gum_fake_event_sink_get_type())
+
+G_DECLARE_FINAL_TYPE(GumFakeEventSink, gum_fake_event_sink, GUM,
+                     FAKE_EVENT_SINK, GObject)
+
+struct _GumFakeEventSink {
+
+  GObject      parent;
+  GumEventType mask;
+
+};
+
+GumEventSink *gum_fake_event_sink_new(void);
+void          gum_fake_event_sink_reset(GumFakeEventSink *self);
+
+G_END_DECLS
+
+typedef struct {
+
+  GumAddress base_address;
+  guint64    code_start, code_end;
+
+} range_t;
+
+void instr_basic_block(GumStalkerIterator *iterator, GumStalkerOutput *output,
+                       gpointer user_data);
+#pragma once
+
+void afl_setup(void);
+void afl_start_forkserver(void);
+int  __afl_persistent_loop(unsigned int max_cnt);
+
+inline static inline void afl_maybe_log(guint64 current_pc) {
+
+  extern unsigned int afl_instr_rms;
+  extern uint8_t *    afl_area_ptr;
+
+  static __thread guint64 previous_pc;
+
+  current_pc = (current_pc >> 4) ^ (current_pc << 8);
+  current_pc &= MAP_SIZE - 1;
+
+  if (current_pc >= afl_instr_rms) return;
+
+  afl_area_ptr[current_pc ^ previous_pc]++;
+  previous_pc = current_pc >> 1;
+
+}
+
diff --git a/utils/afl_frida/libtestinstr.c b/utils/afl_frida/libtestinstr.c
new file mode 100644
index 00000000..96b1cf21
--- /dev/null
+++ b/utils/afl_frida/libtestinstr.c
@@ -0,0 +1,35 @@
+/*
+   american fuzzy lop++ - a trivial program to test the build
+   --------------------------------------------------------
+   Originally written by Michal Zalewski
+   Copyright 2014 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+     http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+void testinstr(char *buf, int len) {
+
+  if (len < 1) return;
+  buf[len] = 0;
+
+  // we support three input cases
+  if (buf[0] == '0')
+    printf("Looks like a zero to me!\n");
+  else if (buf[0] == '1')
+    printf("Pretty sure that is a one!\n");
+  else
+    printf("Neither one or zero? How quaint!\n");
+
+}
+
diff --git a/utils/afl_network_proxy/GNUmakefile b/utils/afl_network_proxy/GNUmakefile
new file mode 100644
index 00000000..25a3df82
--- /dev/null
+++ b/utils/afl_network_proxy/GNUmakefile
@@ -0,0 +1,43 @@
+PREFIX   ?= /usr/local
+BIN_PATH  = $(PREFIX)/bin
+DOC_PATH  = $(PREFIX)/share/doc/afl
+
+PROGRAMS = afl-network-client afl-network-server
+
+HASH=\#
+
+CFLAGS += -Wno-pointer-sign
+
+ifdef STATIC
+  CFLAGS += -static
+endif
+
+ifeq "$(shell echo '$(HASH)include <libdeflate.h>@int main() { struct libdeflate_compressor *d = libdeflate_alloc_compressor(1); return 0;}' | tr @ '\n' | $(CC) $(CFLAGS) -x c - -o .test2 -ldeflate 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
+ CFLAGS += -DUSE_DEFLATE=1
+ LDFLAGS += -ldeflate 
+ $(info libdeflate-dev was detected, using compression)
+else
+ $(warn did not find libdeflate-dev, cannot use compression)
+endif
+
+all:	$(PROGRAMS)
+
+help:
+	@echo make options:
+	@echo STATIC - build as static binaries
+	@echo COMPRESS_TESTCASES - compress test cases
+
+afl-network-client:	afl-network-client.c
+	$(CC) $(CFLAGS) -I../../include -o afl-network-client afl-network-client.c $(LDFLAGS)
+
+afl-network-server:	afl-network-server.c
+	$(CC) $(CFLAGS) -I../../include -o afl-network-server afl-network-server.c ../../src/afl-forkserver.c ../../src/afl-sharedmem.c ../../src/afl-common.c -DBIN_PATH=\"$(BIN_PATH)\" $(LDFLAGS)
+
+clean:
+	rm -f $(PROGRAMS) *~ core
+
+install: all
+	install -d -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(DOC_PATH)
+	install -m 755 $(PROGRAMS) $${DESTDIR}$(BIN_PATH)
+	install -T -m 644 README.md $${DESTDIR}$(DOC_PATH)/README.network_proxy.md
+
diff --git a/utils/afl_network_proxy/Makefile b/utils/afl_network_proxy/Makefile
new file mode 100644
index 00000000..0b306dde
--- /dev/null
+++ b/utils/afl_network_proxy/Makefile
@@ -0,0 +1,2 @@
+all:
+	@echo please use GNU make, thanks!
diff --git a/utils/afl_network_proxy/README.md b/utils/afl_network_proxy/README.md
new file mode 100644
index 00000000..a5ac3578
--- /dev/null
+++ b/utils/afl_network_proxy/README.md
@@ -0,0 +1,61 @@
+# afl-network-proxy
+
+If you want to run afl-fuzz over the network than this is what you need :)
+Note that the impact on fuzzing speed will be huge, expect a loss of 90%.
+
+## When to use this
+
+1. when you have to fuzz a target that has to run on a system that cannot
+   contain the fuzzing output (e.g. /tmp too small and file system is read-only)
+2. when the target instantly reboots on crashes
+3. ... any other reason you would need this
+
+## how to get it running
+
+### Compiling
+
+Just type `make` and let the autodetection do everything for you.
+
+Note that you will get a 40-50% performance increase if you have libdeflate-dev
+installed. The GNUmakefile will autodetect it if present.
+
+If your target has large test cases (10+kb) that are ascii only or large chunks
+of zero blocks then set `CFLAGS=-DCOMPRESS_TESTCASES=1` to compress them.
+For most targets this hurts performance though so it is disabled by default.
+
+### on the target
+
+Run `afl-network-server` with your target with the -m and -t values you need.
+Important is the -i parameter which is the TCP port to listen on.
+e.g.:
+```
+afl-network-server -i 1111 -m 25M -t 1000 -- /bin/target -f @@
+```
+
+### on the (afl-fuzz) master
+
+Just run afl-fuzz with your normal options, however the target should be
+`afl-network-client` with the IP and PORT of the `afl-network-server` and
+increase the -t value:
+```
+afl-fuzz -i in -o out -t 2000+ -- afl-network-client TARGET-IP 1111
+```
+Note the '+' on the -t parameter value. The afl-network-server will take
+care of proper timeouts hence afl-fuzz should not. The '+' increases the
+timeout and the value itself should be 500-1000 higher than the one on 
+afl-network-server.
+
+### networking
+
+The TARGET can be an IPv4 or IPv6 address, or a host name that resolves to
+either. Note that also the outgoing interface can be specified with a '%' for
+`afl-network-client`, e.g. `fe80::1234%eth0`.
+
+Also make sure your default TCP window size is larger than your MAP_SIZE
+(130kb is a good value).
+On Linux that is the middle value of `/proc/sys/net/ipv4/tcp_rmem` 
+
+## how to compile and install
+
+`make && sudo make install`
+
diff --git a/utils/afl_network_proxy/afl-network-client.c b/utils/afl_network_proxy/afl-network-client.c
new file mode 100644
index 00000000..a2451fdc
--- /dev/null
+++ b/utils/afl_network_proxy/afl-network-client.c
@@ -0,0 +1,415 @@
+/*
+   american fuzzy lop++ - afl-network-client
+   ---------------------------------------
+
+   Written by Marc Heuse <mh@mh-sec.de>
+
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+*/
+
+#ifdef __ANDROID__
+  #include "android-ashmem.h"
+#endif
+#include "config.h"
+#include "types.h"
+#include "debug.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <unistd.h>
+#include <string.h>
+#include <assert.h>
+#include <stdint.h>
+#include <errno.h>
+
+#include <netinet/in.h>
+#include <netinet/ip6.h>
+#include <arpa/inet.h>
+#include <sys/mman.h>
+#ifndef USEMMAP
+  #include <sys/shm.h>
+#endif
+#include <sys/wait.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netdb.h>
+#include <fcntl.h>
+
+#ifdef USE_DEFLATE
+  #include <libdeflate.h>
+#endif
+
+u8 *__afl_area_ptr;
+
+#ifdef __ANDROID__
+u32 __afl_map_size = MAP_SIZE;
+#else
+__thread u32 __afl_map_size = MAP_SIZE;
+#endif
+
+/* Error reporting to forkserver controller */
+
+void send_forkserver_error(int error) {
+
+  u32 status;
+  if (!error || error > 0xffff) return;
+  status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
+  if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
+
+}
+
+/* SHM setup. */
+
+static void __afl_map_shm(void) {
+
+  char *id_str = getenv(SHM_ENV_VAR);
+  char *ptr;
+
+  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
+
+    u32 val = atoi(ptr);
+    if (val > 0) __afl_map_size = val;
+
+  }
+
+  if (__afl_map_size > MAP_SIZE) {
+
+    if (__afl_map_size > FS_OPT_MAX_MAPSIZE) {
+
+      fprintf(stderr,
+              "Error: AFL++ tools *require* to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+      if (id_str) {
+
+        send_forkserver_error(FS_ERROR_MAP_SIZE);
+        exit(-1);
+
+      }
+
+    } else {
+
+      fprintf(stderr,
+              "Warning: AFL++ tools will need to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+
+    }
+
+  }
+
+  if (id_str) {
+
+#ifdef USEMMAP
+    const char *   shm_file_path = id_str;
+    int            shm_fd = -1;
+    unsigned char *shm_base = NULL;
+
+    /* create the shared memory segment as if it was a file */
+    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    if (shm_fd == -1) {
+
+      fprintf(stderr, "shm_open() failed\n");
+      send_forkserver_error(FS_ERROR_SHM_OPEN);
+      exit(1);
+
+    }
+
+    /* map the shared memory segment to the address space of the process */
+    shm_base =
+        mmap(0, __afl_map_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
+
+    if (shm_base == MAP_FAILED) {
+
+      close(shm_fd);
+      shm_fd = -1;
+
+      fprintf(stderr, "mmap() failed\n");
+      send_forkserver_error(FS_ERROR_MMAP);
+      exit(2);
+
+    }
+
+    __afl_area_ptr = shm_base;
+#else
+    u32 shm_id = atoi(id_str);
+
+    __afl_area_ptr = shmat(shm_id, 0, 0);
+
+#endif
+
+    if (__afl_area_ptr == (void *)-1) {
+
+      send_forkserver_error(FS_ERROR_SHMAT);
+      exit(1);
+
+    }
+
+    /* Write something into the bitmap so that the parent doesn't give up */
+
+    __afl_area_ptr[0] = 1;
+
+  }
+
+}
+
+/* Fork server logic. */
+
+static void __afl_start_forkserver(void) {
+
+  u8  tmp[4] = {0, 0, 0, 0};
+  u32 status = 0;
+
+  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
+    status |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
+  if (status) status |= (FS_OPT_ENABLED);
+  memcpy(tmp, &status, 4);
+
+  /* Phone home and tell the parent that we're OK. */
+
+  if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
+
+}
+
+static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
+
+  s32 status, res = 0x0fffffff;  // res is a dummy pid
+
+  /* Wait for parent by reading from the pipe. Abort if read fails. */
+  if (read(FORKSRV_FD, &status, 4) != 4) return 0;
+
+  /* we have a testcase - read it */
+  status = read(0, buf, max_len);
+
+  /* report that we are starting the target */
+  if (write(FORKSRV_FD + 1, &res, 4) != 4) return 0;
+
+  if (status < 1)
+    return 0;
+  else
+    return status;
+
+}
+
+static void __afl_end_testcase(int status) {
+
+  if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
+
+}
+
+/* you just need to modify the while() loop in this main() */
+
+int main(int argc, char *argv[]) {
+
+  u8 *            interface, *buf, *ptr;
+  s32             s = -1;
+  struct addrinfo hints, *hres, *aip;
+  u32 *           lenptr, max_len = 65536;
+#ifdef USE_DEFLATE
+  u8 *   buf2;
+  u32 *  lenptr1, *lenptr2, buf2_len, compress_len;
+  size_t decompress_len;
+#endif
+
+  if (argc < 3 || argc > 4) {
+
+    printf("Syntax: %s host port [max-input-size]\n\n", argv[0]);
+    printf("Requires host and port of the remote afl-proxy-server instance.\n");
+    printf(
+        "IPv4 and IPv6 are supported, also binding to an interface with "
+        "\"%%\"\n");
+    printf("The max-input-size default is %u.\n", max_len);
+    printf(
+        "The default map size is %u and can be changed with setting "
+        "AFL_MAP_SIZE.\n",
+        __afl_map_size);
+    exit(-1);
+
+  }
+
+  if ((interface = strchr(argv[1], '%')) != NULL) *interface++ = 0;
+
+  if (argc > 3)
+    if ((max_len = atoi(argv[3])) < 0)
+      FATAL("max-input-size may not be negative or larger than 2GB: %s",
+            argv[3]);
+
+  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL)
+    if ((__afl_map_size = atoi(ptr)) < 8)
+      FATAL("illegal map size, may not be < 8 or >= 2^30: %s", ptr);
+
+  if ((buf = malloc(max_len + 4)) == NULL)
+    PFATAL("can not allocate %u memory", max_len + 4);
+  lenptr = (u32 *)buf;
+
+#ifdef USE_DEFLATE
+  buf2_len = (max_len > __afl_map_size ? max_len : __afl_map_size);
+  if ((buf2 = malloc(buf2_len + 8)) == NULL)
+    PFATAL("can not allocate %u memory", buf2_len + 8);
+  lenptr1 = (u32 *)buf2;
+  lenptr2 = (u32 *)(buf2 + 4);
+#endif
+
+  memset(&hints, 0, sizeof(hints));
+  hints.ai_socktype = SOCK_STREAM;
+  hints.ai_family = PF_UNSPEC;
+
+  if (getaddrinfo(argv[1], argv[2], &hints, &hres) != 0)
+    PFATAL("could not resolve target %s", argv[1]);
+
+  for (aip = hres; aip != NULL && s == -1; aip = aip->ai_next) {
+
+    if ((s = socket(aip->ai_family, aip->ai_socktype, aip->ai_protocol)) >= 0) {
+
+#ifdef SO_BINDTODEVICE
+      if (interface != NULL)
+        if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, interface,
+                       strlen(interface) + 1) < 0)
+          fprintf(stderr, "Warning: could not bind to device %s\n", interface);
+#else
+      fprintf(stderr,
+              "Warning: binding to interface is not supported for your OS\n");
+#endif
+
+#ifdef SO_PRIORITY
+      int priority = 7;
+      if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
+          0) {
+
+        priority = 6;
+        if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority,
+                       sizeof(priority)) < 0)
+          WARNF("could not set priority on socket");
+
+      }
+
+#endif
+
+      if (connect(s, aip->ai_addr, aip->ai_addrlen) == -1) s = -1;
+
+    }
+
+  }
+
+#ifdef USE_DEFLATE
+  struct libdeflate_compressor *compressor;
+  compressor = libdeflate_alloc_compressor(1);
+  struct libdeflate_decompressor *decompressor;
+  decompressor = libdeflate_alloc_decompressor();
+  fprintf(stderr, "Compiled with compression support\n");
+#endif
+
+  if (s == -1)
+    FATAL("could not connect to target tcp://%s:%s", argv[1], argv[2]);
+  else
+    fprintf(stderr, "Connected to target tcp://%s:%s\n", argv[1], argv[2]);
+
+  /* we initialize the shared memory map and start the forkserver */
+  __afl_map_shm();
+  __afl_start_forkserver();
+
+  int i = 1, j, status, ret, received;
+
+  // fprintf(stderr, "Waiting for first testcase\n");
+  while ((*lenptr = __afl_next_testcase(buf + 4, max_len)) > 0) {
+
+    // fprintf(stderr, "Sending testcase with len %u\n", *lenptr);
+#ifdef USE_DEFLATE
+  #ifdef COMPRESS_TESTCASES
+    // we only compress the testcase if it does not fit in the TCP packet
+    if (*lenptr > 1500 - 20 - 32 - 4) {
+
+      // set highest byte to signify compression
+      *lenptr1 = (*lenptr | 0xff000000);
+      *lenptr2 = (u32)libdeflate_deflate_compress(compressor, buf + 4, *lenptr,
+                                                  buf2 + 8, buf2_len);
+      if (send(s, buf2, *lenptr2 + 8, 0) != *lenptr2 + 8)
+        PFATAL("sending test data failed");
+      // fprintf(stderr, "COMPRESS (%u->%u):\n", *lenptr, *lenptr2);
+      // for (u32 i = 0; i < *lenptr; i++)
+      //  fprintf(stderr, "%02x", buf[i + 4]);
+      // fprintf(stderr, "\n");
+      // for (u32 i = 0; i < *lenptr2; i++)
+      //  fprintf(stderr, "%02x", buf2[i + 8]);
+      // fprintf(stderr, "\n");
+
+    } else {
+
+  #endif
+#endif
+      if (send(s, buf, *lenptr + 4, 0) != *lenptr + 4)
+        PFATAL("sending test data failed");
+#ifdef USE_DEFLATE
+  #ifdef COMPRESS_TESTCASES
+      // fprintf(stderr, "unCOMPRESS (%u)\n", *lenptr);
+
+    }
+
+  #endif
+#endif
+
+    received = 0;
+    while (received < 4 &&
+           (ret = recv(s, &status + received, 4 - received, 0)) > 0)
+      received += ret;
+    if (received != 4)
+      FATAL("did not receive waitpid data (%d, %d)", received, ret);
+    // fprintf(stderr, "Received status\n");
+
+    received = 0;
+#ifdef USE_DEFLATE
+    while (received < 4 &&
+           (ret = recv(s, &compress_len + received, 4 - received, 0)) > 0)
+      received += ret;
+    if (received != 4)
+      FATAL("did not receive compress_len (%d, %d)", received, ret);
+    // fprintf(stderr, "Received status\n");
+
+    received = 0;
+    while (received < compress_len &&
+           (ret = recv(s, buf2 + received, buf2_len - received, 0)) > 0)
+      received += ret;
+    if (received != compress_len)
+      FATAL("did not receive coverage data (%d, %d)", received, ret);
+
+    if (libdeflate_deflate_decompress(decompressor, buf2, compress_len,
+                                      __afl_area_ptr, __afl_map_size,
+                                      &decompress_len) != LIBDEFLATE_SUCCESS ||
+        decompress_len != __afl_map_size)
+      FATAL("decompression failed");
+      // fprintf(stderr, "DECOMPRESS (%u->%u): ", compress_len, decompress_len);
+      // for (u32 i = 0; i < __afl_map_size; i++) fprintf(stderr, "%02x",
+      // __afl_area_ptr[i]); fprintf(stderr, "\n");
+#else
+    while (received < __afl_map_size &&
+           (ret = recv(s, __afl_area_ptr + received, __afl_map_size - received,
+                       0)) > 0)
+      received += ret;
+    if (received != __afl_map_size)
+      FATAL("did not receive coverage data (%d, %d)", received, ret);
+#endif
+    // fprintf(stderr, "Received coverage\n");
+
+    /* report the test case is done and wait for the next */
+    __afl_end_testcase(status);
+    // fprintf(stderr, "Waiting for next testcase %d\n", ++i);
+
+  }
+
+#ifdef USE_DEFLATE
+  libdeflate_free_compressor(compressor);
+  libdeflate_free_decompressor(decompressor);
+#endif
+
+  return 0;
+
+}
+
diff --git a/utils/afl_network_proxy/afl-network-server.c b/utils/afl_network_proxy/afl-network-server.c
new file mode 100644
index 00000000..513dc8f2
--- /dev/null
+++ b/utils/afl_network_proxy/afl-network-server.c
@@ -0,0 +1,720 @@
+/*
+   american fuzzy lop++ - network proxy server
+   -------------------------------------------
+
+   Originally written by Michal Zalewski
+
+   Forkserver design by Jann Horn <jannhorn@googlemail.com>
+
+   Now maintained by Marc Heuse <mh@mh-sec.de>,
+                        Heiko Eißfeldt <heiko.eissfeldt@hexco.de> and
+                        Andrea Fioraldi <andreafioraldi@gmail.com> and
+                        Dominik Maier <mail@dmnk.co>
+
+   Copyright 2016, 2017 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ */
+
+#define AFL_MAIN
+
+#ifdef __ANDROID__
+  #include "android-ashmem.h"
+#endif
+
+#include "config.h"
+#include "types.h"
+#include "debug.h"
+#include "alloc-inl.h"
+#include "hash.h"
+#include "forkserver.h"
+#include "sharedmem.h"
+#include "common.h"
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <errno.h>
+#include <signal.h>
+#include <dirent.h>
+#include <fcntl.h>
+
+#include <sys/wait.h>
+#include <sys/time.h>
+#include <sys/shm.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/resource.h>
+#include <netinet/in.h>
+#include <netinet/ip6.h>
+#include <arpa/inet.h>
+#include <sys/mman.h>
+#include <sys/shm.h>
+#include <sys/socket.h>
+#include <netdb.h>
+
+#ifdef USE_DEFLATE
+  #include <libdeflate.h>
+struct libdeflate_compressor *  compressor;
+struct libdeflate_decompressor *decompressor;
+#endif
+
+static u8 *in_file,                    /* Minimizer input test case         */
+    *out_file;
+
+static u8 *in_data;                    /* Input data for trimming           */
+static u8 *buf2;
+
+static s32 in_len;
+static s32 buf2_len;
+static u32 map_size = MAP_SIZE;
+
+static volatile u8 stop_soon;          /* Ctrl-C pressed?                   */
+
+/* See if any bytes are set in the bitmap. */
+
+static inline u8 anything_set(afl_forkserver_t *fsrv) {
+
+  u32 *ptr = (u32 *)fsrv->trace_bits;
+  u32  i = (map_size >> 2);
+
+  while (i--) {
+
+    if (*(ptr++)) { return 1; }
+
+  }
+
+  return 0;
+
+}
+
+static void at_exit_handler(void) {
+
+  afl_fsrv_killall();
+
+}
+
+/* Write output file. */
+
+static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
+
+  s32 ret;
+
+  unlink(path);                                            /* Ignore errors */
+
+  ret = open(path, O_RDWR | O_CREAT | O_EXCL, 0600);
+
+  if (ret < 0) { PFATAL("Unable to create '%s'", path); }
+
+  ck_write(ret, mem, len, path);
+
+  lseek(ret, 0, SEEK_SET);
+
+  return ret;
+
+}
+
+/* Execute target application. Returns 0 if the changes are a dud, or
+   1 if they should be kept. */
+
+static u8 run_target(afl_forkserver_t *fsrv, char **argv, u8 *mem, u32 len,
+                     u8 first_run) {
+
+  afl_fsrv_write_to_testcase(fsrv, mem, len);
+
+  fsrv_run_result_t ret =
+      afl_fsrv_run_target(fsrv, fsrv->exec_tmout, &stop_soon);
+
+  if (ret == FSRV_RUN_ERROR) { FATAL("Couldn't run child"); }
+
+  if (stop_soon) {
+
+    SAYF(cRST cLRD "\n+++ aborted by user +++\n" cRST);
+    exit(1);
+
+  }
+
+  return ret;
+
+}
+
+/* Handle Ctrl-C and the like. */
+
+static void handle_stop_sig(int sig) {
+
+  stop_soon = 1;
+  afl_fsrv_killall();
+
+}
+
+/* Do basic preparations - persistent fds, filenames, etc. */
+
+static void set_up_environment(afl_forkserver_t *fsrv) {
+
+  u8 *x;
+
+  fsrv->dev_null_fd = open("/dev/null", O_RDWR);
+  if (fsrv->dev_null_fd < 0) { PFATAL("Unable to open /dev/null"); }
+
+  if (!out_file) {
+
+    u8 *use_dir = ".";
+
+    if (access(use_dir, R_OK | W_OK | X_OK)) {
+
+      use_dir = get_afl_env("TMPDIR");
+      if (!use_dir) { use_dir = "/tmp"; }
+
+    }
+
+    out_file = alloc_printf("%s/.afl-input-temp-%u", use_dir, getpid());
+
+  }
+
+  unlink(out_file);
+
+  fsrv->out_fd = open(out_file, O_RDWR | O_CREAT | O_EXCL, 0600);
+
+  if (fsrv->out_fd < 0) { PFATAL("Unable to create '%s'", out_file); }
+
+  /* Set sane defaults... */
+
+  x = get_afl_env("ASAN_OPTIONS");
+
+  if (x) {
+
+    if (!strstr(x, "abort_on_error=1")) {
+
+      FATAL("Custom ASAN_OPTIONS set without abort_on_error=1 - please fix!");
+
+    }
+
+    if (!strstr(x, "symbolize=0")) {
+
+      FATAL("Custom ASAN_OPTIONS set without symbolize=0 - please fix!");
+
+    }
+
+  }
+
+  x = get_afl_env("MSAN_OPTIONS");
+
+  if (x) {
+
+    if (!strstr(x, "exit_code=" STRINGIFY(MSAN_ERROR))) {
+
+      FATAL("Custom MSAN_OPTIONS set without exit_code=" STRINGIFY(
+          MSAN_ERROR) " - please fix!");
+
+    }
+
+    if (!strstr(x, "symbolize=0")) {
+
+      FATAL("Custom MSAN_OPTIONS set without symbolize=0 - please fix!");
+
+    }
+
+  }
+
+  setenv("ASAN_OPTIONS",
+         "abort_on_error=1:"
+         "detect_leaks=0:"
+         "symbolize=0:"
+         "allocator_may_return_null=1",
+         0);
+
+  setenv("MSAN_OPTIONS", "exit_code=" STRINGIFY(MSAN_ERROR) ":"
+                         "symbolize=0:"
+                         "abort_on_error=1:"
+                         "allocator_may_return_null=1:"
+                         "msan_track_origins=0", 0);
+
+  if (get_afl_env("AFL_PRELOAD")) {
+
+    if (fsrv->qemu_mode) {
+
+      u8 *qemu_preload = getenv("QEMU_SET_ENV");
+      u8 *afl_preload = getenv("AFL_PRELOAD");
+      u8 *buf;
+
+      s32 i, afl_preload_size = strlen(afl_preload);
+      for (i = 0; i < afl_preload_size; ++i) {
+
+        if (afl_preload[i] == ',') {
+
+          PFATAL(
+              "Comma (',') is not allowed in AFL_PRELOAD when -Q is "
+              "specified!");
+
+        }
+
+      }
+
+      if (qemu_preload) {
+
+        buf = alloc_printf("%s,LD_PRELOAD=%s,DYLD_INSERT_LIBRARIES=%s",
+                           qemu_preload, afl_preload, afl_preload);
+
+      } else {
+
+        buf = alloc_printf("LD_PRELOAD=%s,DYLD_INSERT_LIBRARIES=%s",
+                           afl_preload, afl_preload);
+
+      }
+
+      setenv("QEMU_SET_ENV", buf, 1);
+
+      afl_free(buf);
+
+    } else {
+
+      setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
+      setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
+
+    }
+
+  }
+
+}
+
+/* Setup signal handlers, duh. */
+
+static void setup_signal_handlers(void) {
+
+  struct sigaction sa;
+
+  sa.sa_handler = NULL;
+  sa.sa_flags = SA_RESTART;
+  sa.sa_sigaction = NULL;
+
+  sigemptyset(&sa.sa_mask);
+
+  /* Various ways of saying "stop". */
+
+  sa.sa_handler = handle_stop_sig;
+  sigaction(SIGHUP, &sa, NULL);
+  sigaction(SIGINT, &sa, NULL);
+  sigaction(SIGTERM, &sa, NULL);
+
+}
+
+/* Display usage hints. */
+
+static void usage(u8 *argv0) {
+
+  SAYF(
+      "\n%s [ options ] -- /path/to/target_app [ ... ]\n\n"
+
+      "Required parameters:\n"
+
+      "  -i port       - the port to listen for the client to connect to\n\n"
+
+      "Execution control settings:\n"
+
+      "  -f file       - input file read by the tested program (stdin)\n"
+      "  -t msec       - timeout for each run (%d ms)\n"
+      "  -m megs       - memory limit for child process (%d MB)\n"
+      "  -Q            - use binary-only instrumentation (QEMU mode)\n"
+      "  -U            - use unicorn-based instrumentation (Unicorn mode)\n"
+      "  -W            - use qemu-based instrumentation with Wine (Wine "
+      "mode)\n\n"
+
+      "Environment variables used:\n"
+      "TMPDIR: directory to use for temporary input files\n"
+      "ASAN_OPTIONS: custom settings for ASAN\n"
+      "              (must contain abort_on_error=1 and symbolize=0)\n"
+      "MSAN_OPTIONS: custom settings for MSAN\n"
+      "              (must contain exitcode="STRINGIFY(MSAN_ERROR)" and symbolize=0)\n"
+      "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
+      "              the target was compiled for\n"
+      "AFL_PRELOAD:  LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
+
+      , argv0, EXEC_TIMEOUT, MEM_LIMIT);
+
+  exit(1);
+
+}
+
+int recv_testcase(int s, void **buf) {
+
+  u32    size;
+  s32    ret;
+  size_t received;
+
+  received = 0;
+  while (received < 4 && (ret = recv(s, &size + received, 4 - received, 0)) > 0)
+    received += ret;
+  if (received != 4) FATAL("did not receive size information");
+  if (size == 0) FATAL("did not receive valid size information");
+  // fprintf(stderr, "received size information of %d\n", size);
+
+  if ((size & 0xff000000) != 0xff000000) {
+
+    *buf = afl_realloc(buf, size);
+    if (unlikely(!*buf)) { PFATAL("Alloc"); }
+    received = 0;
+    // fprintf(stderr, "unCOMPRESS (%u)\n", size);
+    while (received < size &&
+           (ret = recv(s, ((char *)*buf) + received, size - received, 0)) > 0)
+      received += ret;
+
+  } else {
+
+#ifdef USE_DEFLATE
+    u32 clen;
+    size -= 0xff000000;
+    *buf = afl_realloc(buf, size);
+    if (unlikely(!*buf)) { PFATAL("Alloc"); }
+    received = 0;
+    while (received < 4 &&
+           (ret = recv(s, &clen + received, 4 - received, 0)) > 0)
+      received += ret;
+    if (received != 4) FATAL("did not receive clen1 information");
+    // fprintf(stderr, "received clen information of %d\n", clen);
+    if (clen < 1)
+      FATAL("did not receive valid compressed len information: %u", clen);
+    buf2 = afl_realloc((void **)&buf2, clen);
+    buf2_len = clen;
+    if (unlikely(!buf2)) { PFATAL("Alloc"); }
+    received = 0;
+    while (received < clen &&
+           (ret = recv(s, buf2 + received, clen - received, 0)) > 0)
+      received += ret;
+    if (received != clen) FATAL("did not receive compressed information");
+    if (libdeflate_deflate_decompress(decompressor, buf2, clen, (char *)*buf,
+                                      size, &received) != LIBDEFLATE_SUCCESS)
+      FATAL("decompression failed");
+      // fprintf(stderr, "DECOMPRESS (%u->%u):\n", clen, received);
+      // for (u32 i = 0; i < clen; i++) fprintf(stderr, "%02x", buf2[i]);
+      // fprintf(stderr, "\n");
+      // for (u32 i = 0; i < received; i++) fprintf(stderr, "%02x",
+      // ((u8*)(*buf))[i]); fprintf(stderr, "\n");
+#else
+    FATAL("Received compressed data but not compiled with compression support");
+#endif
+
+  }
+
+  // fprintf(stderr, "receiving testcase %p %p max %u\n", buf, *buf, *max_len);
+  if (received != size)
+    FATAL("did not receive testcase data %lu != %u, %d", received, size, ret);
+  // fprintf(stderr, "received testcase\n");
+  return size;
+
+}
+
+/* Main entry point */
+
+int main(int argc, char **argv_orig, char **envp) {
+
+  s32    opt, s, sock, on = 1, port = -1;
+  u8     mem_limit_given = 0, timeout_given = 0, unicorn_mode = 0, use_wine = 0;
+  char **use_argv;
+  struct sockaddr_in6 serveraddr, clientaddr;
+  int                 addrlen = sizeof(clientaddr);
+  char                str[INET6_ADDRSTRLEN];
+  char **             argv = argv_cpy_dup(argc, argv_orig);
+  u8 *                send_buf;
+#ifdef USE_DEFLATE
+  u32 *lenptr;
+#endif
+
+  afl_forkserver_t  fsrv_var = {0};
+  afl_forkserver_t *fsrv = &fsrv_var;
+  afl_fsrv_init(fsrv);
+  map_size = get_map_size();
+  fsrv->map_size = map_size;
+
+  if ((send_buf = malloc(map_size + 4)) == NULL) PFATAL("malloc");
+
+  while ((opt = getopt(argc, argv, "+i:f:m:t:QUWh")) > 0) {
+
+    switch (opt) {
+
+      case 'i':
+
+        if (port > 0) { FATAL("Multiple -i options not supported"); }
+        port = atoi(optarg);
+        if (port < 1 || port > 65535)
+          FATAL("invalid port definition, must be between 1-65535: %s", optarg);
+        break;
+
+      case 'f':
+
+        if (out_file) { FATAL("Multiple -f options not supported"); }
+        fsrv->use_stdin = 0;
+        out_file = optarg;
+        break;
+
+      case 'm': {
+
+        u8 suffix = 'M';
+
+        if (mem_limit_given) { FATAL("Multiple -m options not supported"); }
+        mem_limit_given = 1;
+
+        if (!optarg) { FATAL("Wrong usage of -m"); }
+
+        if (!strcmp(optarg, "none")) {
+
+          fsrv->mem_limit = 0;
+          break;
+
+        }
+
+        if (sscanf(optarg, "%llu%c", &fsrv->mem_limit, &suffix) < 1 ||
+            optarg[0] == '-') {
+
+          FATAL("Bad syntax used for -m");
+
+        }
+
+        switch (suffix) {
+
+          case 'T':
+            fsrv->mem_limit *= 1024 * 1024;
+            break;
+          case 'G':
+            fsrv->mem_limit *= 1024;
+            break;
+          case 'k':
+            fsrv->mem_limit /= 1024;
+            break;
+          case 'M':
+            break;
+
+          default:
+            FATAL("Unsupported suffix or bad syntax for -m");
+
+        }
+
+        if (fsrv->mem_limit < 5) { FATAL("Dangerously low value of -m"); }
+
+        if (sizeof(rlim_t) == 4 && fsrv->mem_limit > 2000) {
+
+          FATAL("Value of -m out of range on 32-bit systems");
+
+        }
+
+      }
+
+      break;
+
+      case 't':
+
+        if (timeout_given) { FATAL("Multiple -t options not supported"); }
+        timeout_given = 1;
+
+        if (!optarg) { FATAL("Wrong usage of -t"); }
+
+        fsrv->exec_tmout = atoi(optarg);
+
+        if (fsrv->exec_tmout < 10 || optarg[0] == '-') {
+
+          FATAL("Dangerously low value of -t");
+
+        }
+
+        break;
+
+      case 'Q':
+
+        if (fsrv->qemu_mode) { FATAL("Multiple -Q options not supported"); }
+        if (!mem_limit_given) { fsrv->mem_limit = MEM_LIMIT_QEMU; }
+
+        fsrv->qemu_mode = 1;
+        break;
+
+      case 'U':
+
+        if (unicorn_mode) { FATAL("Multiple -Q options not supported"); }
+        if (!mem_limit_given) { fsrv->mem_limit = MEM_LIMIT_UNICORN; }
+
+        unicorn_mode = 1;
+        break;
+
+      case 'W':                                           /* Wine+QEMU mode */
+
+        if (use_wine) { FATAL("Multiple -W options not supported"); }
+        fsrv->qemu_mode = 1;
+        use_wine = 1;
+
+        if (!mem_limit_given) { fsrv->mem_limit = 0; }
+
+        break;
+
+      case 'h':
+        usage(argv[0]);
+        return -1;
+        break;
+
+      default:
+        usage(argv[0]);
+
+    }
+
+  }
+
+  if (optind == argc || port < 1) { usage(argv[0]); }
+
+  check_environment_vars(envp);
+
+  sharedmem_t shm = {0};
+  fsrv->trace_bits = afl_shm_init(&shm, map_size, 0);
+
+  in_data = afl_realloc((void **)&in_data, 65536);
+  if (unlikely(!in_data)) { PFATAL("Alloc"); }
+
+  atexit(at_exit_handler);
+  setup_signal_handlers();
+
+  set_up_environment(fsrv);
+
+  fsrv->target_path = find_binary(argv[optind]);
+  detect_file_args(argv + optind, out_file, &fsrv->use_stdin);
+
+  if (fsrv->qemu_mode) {
+
+    if (use_wine) {
+
+      use_argv = get_wine_argv(argv[0], &fsrv->target_path, argc - optind,
+                               argv + optind);
+
+    } else {
+
+      use_argv = get_qemu_argv(argv[0], &fsrv->target_path, argc - optind,
+                               argv + optind);
+
+    }
+
+  } else {
+
+    use_argv = argv + optind;
+
+  }
+
+  if ((sock = socket(AF_INET6, SOCK_STREAM, 0)) < 0) PFATAL("socket() failed");
+
+#ifdef SO_REUSEADDR
+  if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (char *)&on, sizeof(on)) < 0) {
+
+    WARNF("setsockopt(SO_REUSEADDR) failed");
+
+  }
+
+#endif
+
+#ifdef SO_PRIORITY
+  int priority = 7;
+  if (setsockopt(sock, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
+      0) {
+
+    priority = 6;
+    if (setsockopt(sock, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) <
+        0)
+      WARNF("could not set priority on socket");
+
+  }
+
+#endif
+
+  memset(&serveraddr, 0, sizeof(serveraddr));
+  serveraddr.sin6_family = AF_INET6;
+  serveraddr.sin6_port = htons(port);
+  serveraddr.sin6_addr = in6addr_any;
+
+  if (bind(sock, (struct sockaddr *)&serveraddr, sizeof(serveraddr)) < 0)
+    PFATAL("bind() failed");
+
+  if (listen(sock, 1) < 0) { PFATAL("listen() failed"); }
+
+  afl_fsrv_start(
+      fsrv, use_argv, &stop_soon,
+      (get_afl_env("AFL_DEBUG_CHILD") || get_afl_env("AFL_DEBUG_CHILD_OUTPUT"))
+          ? 1
+          : 0);
+
+#ifdef USE_DEFLATE
+  compressor = libdeflate_alloc_compressor(1);
+  decompressor = libdeflate_alloc_decompressor();
+  buf2 = afl_realloc((void **)&buf2, map_size + 16);
+  buf2_len = map_size + 16;
+  if (unlikely(!buf2)) { PFATAL("alloc"); }
+  lenptr = (u32 *)(buf2 + 4);
+  fprintf(stderr, "Compiled with compression support\n");
+#endif
+
+  fprintf(stderr,
+          "Waiting for incoming connection from afl-network-client on port %d "
+          "...\n",
+          port);
+
+  if ((s = accept(sock, NULL, NULL)) < 0) { PFATAL("accept() failed"); }
+  fprintf(stderr, "Received connection, starting ...\n");
+
+#ifdef SO_PRIORITY
+  priority = 7;
+  if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) < 0) {
+
+    priority = 6;
+    if (setsockopt(s, SOL_SOCKET, SO_PRIORITY, &priority, sizeof(priority)) < 0)
+      WARNF("could not set priority on socket");
+
+  }
+
+#endif
+
+  while ((in_len = recv_testcase(s, (void **)&in_data)) > 0) {
+
+    // fprintf(stderr, "received %u\n", in_len);
+    (void)run_target(fsrv, use_argv, in_data, in_len, 1);
+
+    memcpy(send_buf + 4, fsrv->trace_bits, fsrv->map_size);
+
+#ifdef USE_DEFLATE
+    memcpy(buf2, &fsrv->child_status, 4);
+    *lenptr = (u32)libdeflate_deflate_compress(
+        compressor, send_buf + 4, fsrv->map_size, buf2 + 8, buf2_len - 8);
+    // fprintf(stderr, "COMPRESS (%u->%u): ", fsrv->map_size, *lenptr);
+    // for (u32 i = 0; i < fsrv->map_size; i++) fprintf(stderr, "%02x",
+    // fsrv->trace_bits[i]); fprintf(stderr, "\n");
+    if (send(s, buf2, *lenptr + 8, 0) != 8 + *lenptr)
+      FATAL("could not send data");
+#else
+    memcpy(send_buf, &fsrv->child_status, 4);
+    if (send(s, send_buf, fsrv->map_size + 4, 0) != 4 + fsrv->map_size)
+      FATAL("could not send data");
+#endif
+
+    // fprintf(stderr, "sent result\n");
+
+  }
+
+  unlink(out_file);
+  if (out_file) { ck_free(out_file); }
+  out_file = NULL;
+
+  afl_shm_deinit(&shm);
+  afl_fsrv_deinit(fsrv);
+  if (fsrv->target_path) { ck_free(fsrv->target_path); }
+  afl_free(in_data);
+#if USE_DEFLATE
+  afl_free(buf2);
+  libdeflate_free_compressor(compressor);
+  libdeflate_free_decompressor(decompressor);
+#endif
+
+  argv_cpy_free(argv);
+
+  exit(0);
+
+}
+
diff --git a/utils/afl_proxy/Makefile b/utils/afl_proxy/Makefile
new file mode 100644
index 00000000..4b368f8d
--- /dev/null
+++ b/utils/afl_proxy/Makefile
@@ -0,0 +1,7 @@
+all:	afl-proxy
+
+afl-proxy:	afl-proxy.c
+	$(CC) -I../../include -o afl-proxy afl-proxy.c
+
+clean:
+	rm -f afl-proxy *~ core
diff --git a/utils/afl_proxy/README.md b/utils/afl_proxy/README.md
new file mode 100644
index 00000000..3c768a19
--- /dev/null
+++ b/utils/afl_proxy/README.md
@@ -0,0 +1,9 @@
+# afl-proxy
+
+afl-proxy is an example skeleton file which can easily be used to fuzz
+and instrument non-standard things.
+
+You only need to change the while() loop of the main() to send the
+data of buf[] with length len to the target and write the coverage
+information to __afl_area_ptr[__afl_map_size]
+
diff --git a/utils/afl_proxy/afl-proxy.c b/utils/afl_proxy/afl-proxy.c
new file mode 100644
index 00000000..f2dfeac1
--- /dev/null
+++ b/utils/afl_proxy/afl-proxy.c
@@ -0,0 +1,238 @@
+/*
+   american fuzzy lop++ - afl-proxy skeleton example
+   ---------------------------------------------------
+
+   Written by Marc Heuse <mh@mh-sec.de>
+
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+
+   HOW-TO
+   ======
+
+   You only need to change the while() loop of the main() to send the
+   data of buf[] with length len to the target and write the coverage
+   information to __afl_area_ptr[__afl_map_size]
+
+
+*/
+
+#ifdef __ANDROID__
+  #include "android-ashmem.h"
+#endif
+#include "config.h"
+#include "types.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <unistd.h>
+#include <string.h>
+#include <assert.h>
+#include <stdint.h>
+#include <errno.h>
+
+#include <sys/mman.h>
+#include <sys/shm.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+#include <fcntl.h>
+
+u8 *__afl_area_ptr;
+
+#ifdef __ANDROID__
+u32 __afl_map_size = MAP_SIZE;
+#else
+__thread u32 __afl_map_size = MAP_SIZE;
+#endif
+
+/* Error reporting to forkserver controller */
+
+void send_forkserver_error(int error) {
+
+  u32 status;
+  if (!error || error > 0xffff) return;
+  status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
+  if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
+
+}
+
+/* SHM setup. */
+
+static void __afl_map_shm(void) {
+
+  char *id_str = getenv(SHM_ENV_VAR);
+  char *ptr;
+
+  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
+
+    u32 val = atoi(ptr);
+    if (val > 0) __afl_map_size = val;
+
+  }
+
+  if (__afl_map_size > MAP_SIZE) {
+
+    if (__afl_map_size > FS_OPT_MAX_MAPSIZE) {
+
+      fprintf(stderr,
+              "Error: AFL++ tools *require* to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+      if (id_str) {
+
+        send_forkserver_error(FS_ERROR_MAP_SIZE);
+        exit(-1);
+
+      }
+
+    } else {
+
+      fprintf(stderr,
+              "Warning: AFL++ tools will need to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+
+    }
+
+  }
+
+  if (id_str) {
+
+#ifdef USEMMAP
+    const char *   shm_file_path = id_str;
+    int            shm_fd = -1;
+    unsigned char *shm_base = NULL;
+
+    /* create the shared memory segment as if it was a file */
+    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    if (shm_fd == -1) {
+
+      fprintf(stderr, "shm_open() failed\n");
+      send_forkserver_error(FS_ERROR_SHM_OPEN);
+      exit(1);
+
+    }
+
+    /* map the shared memory segment to the address space of the process */
+    shm_base =
+        mmap(0, __afl_map_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
+
+    if (shm_base == MAP_FAILED) {
+
+      close(shm_fd);
+      shm_fd = -1;
+
+      fprintf(stderr, "mmap() failed\n");
+      send_forkserver_error(FS_ERROR_MMAP);
+      exit(2);
+
+    }
+
+    __afl_area_ptr = shm_base;
+#else
+    u32 shm_id = atoi(id_str);
+
+    __afl_area_ptr = shmat(shm_id, 0, 0);
+
+#endif
+
+    if (__afl_area_ptr == (void *)-1) {
+
+      send_forkserver_error(FS_ERROR_SHMAT);
+      exit(1);
+
+    }
+
+    /* Write something into the bitmap so that the parent doesn't give up */
+
+    __afl_area_ptr[0] = 1;
+
+  }
+
+}
+
+/* Fork server logic. */
+
+static void __afl_start_forkserver(void) {
+
+  u8  tmp[4] = {0, 0, 0, 0};
+  u32 status = 0;
+
+  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
+    status |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
+  if (status) status |= (FS_OPT_ENABLED);
+  memcpy(tmp, &status, 4);
+
+  /* Phone home and tell the parent that we're OK. */
+
+  if (write(FORKSRV_FD + 1, tmp, 4) != 4) return;
+
+}
+
+static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
+
+  s32 status, res = 0xffffff;
+
+  /* Wait for parent by reading from the pipe. Abort if read fails. */
+  if (read(FORKSRV_FD, &status, 4) != 4) return 0;
+
+  /* we have a testcase - read it */
+  status = read(0, buf, max_len);
+
+  /* report that we are starting the target */
+  if (write(FORKSRV_FD + 1, &res, 4) != 4) return 0;
+
+  if (status < 1)
+    return 0;
+  else
+    return status;
+
+}
+
+static void __afl_end_testcase(void) {
+
+  int status = 0xffffff;
+
+  if (write(FORKSRV_FD + 1, &status, 4) != 4) exit(1);
+
+}
+
+/* you just need to modify the while() loop in this main() */
+
+int main(int argc, char *argv[]) {
+
+  /* This is were the testcase data is written into */
+  u8  buf[1024];  // this is the maximum size for a test case! set it!
+  u32 len;
+
+  /* here you specify the map size you need that you are reporting to
+     afl-fuzz. */
+  __afl_map_size = MAP_SIZE;  // default is 65536
+
+  /* then we initialize the shared memory map and start the forkserver */
+  __afl_map_shm();
+  __afl_start_forkserver();
+
+  while ((len = __afl_next_testcase(buf, sizeof(buf))) > 0) {
+
+    /* here you have to create the magic that feeds the buf/len to the
+       target and write the coverage to __afl_area_ptr */
+
+    // ... the magic ...
+
+    /* report the test case is done and wait for the next */
+    __afl_end_testcase();
+
+  }
+
+  return 0;
+
+}
+
diff --git a/utils/afl_untracer/Makefile b/utils/afl_untracer/Makefile
new file mode 100644
index 00000000..14a09b41
--- /dev/null
+++ b/utils/afl_untracer/Makefile
@@ -0,0 +1,16 @@
+ifdef DEBUG
+  OPT=-O0
+else
+  OPT=-O3
+endif
+
+all:	afl-untracer libtestinstr.so
+
+afl-untracer:	afl-untracer.c
+	$(CC) $(OPT) -I../../include -g -o afl-untracer afl-untracer.c -ldl
+
+libtestinstr.so:	libtestinstr.c
+	$(CC) -g -O0 -fPIC -o libtestinstr.so -shared libtestinstr.c
+
+clean:
+	rm -f afl-untracer libtestinstr.so *~ core
diff --git a/utils/afl_untracer/README.md b/utils/afl_untracer/README.md
new file mode 100644
index 00000000..ada0c916
--- /dev/null
+++ b/utils/afl_untracer/README.md
@@ -0,0 +1,60 @@
+# afl-untracer - fast fuzzing of binary-only libraries
+
+## Introduction
+
+afl-untracer is an example skeleton file which can easily be used to fuzz
+a closed source library.
+
+It requires less memory and is x3-5 faster than qemu_mode however it is way
+more course grained and does not provide interesting features like compcov
+or cmplog.
+
+Supported is so far Intel (i386/x86_64) and AARCH64.
+
+## How-to
+
+### Modify afl-untracer.c
+
+Read and modify afl-untracer.c then `make`.
+To adapt afl-untracer.c to your needs, read the header of the file and then
+search and edit the `STEP 1`, `STEP 2` and `STEP 3` locations.
+
+### Generate patches.txt file
+
+To generate the `patches.txt` file for your target library use the
+`ida_get_patchpoints.py` script for IDA Pro or
+`ghidra_get_patchpoints.java` for Ghidra.
+
+The patches.txt file has to be pointed to by `AFL_UNTRACER_FILE`.
+
+To easily run the scripts without needing to run the GUI with Ghidra:
+```
+/opt/ghidra/support/analyzeHeadless /tmp/ tmp$$ -import libtestinstr.so -postscript ./ghidra_get_patchpoints.java
+rm -rf /tmp/tmp$$
+```
+The file is created at `~/Desktop/patches.txt`
+
+### Fuzzing
+
+Example (after modifying afl-untracer.c to your needs, compiling and creating
+patches.txt):
+```
+LD_LIBRARY_PATH=/path/to/target/library AFL_UNTRACER_FILE=./patches.txt afl-fuzz -i in -o out -- ./afl-untracer
+```
+(or even remote via afl-network-proxy).
+
+### Testing and debugging
+
+For testing/debugging you can try:
+```
+make DEBUG=1
+AFL_UNTRACER_FILE=./patches.txt AFL_DEBUG=1 gdb ./afl-untracer
+```
+and then you can easily set breakpoints to "breakpoint" and "fuzz".
+
+# Background
+
+This idea is based on [UnTracer](https://github.com/FoRTE-Research/UnTracer-AFL)
+and modified by [Trapfuzz](https://github.com/googleprojectzero/p0tools/tree/master/TrapFuzz).
+This implementation is slower because the traps are not patched out with each
+run, but on the other hand gives much better coverage information.
diff --git a/utils/afl_untracer/TODO b/utils/afl_untracer/TODO
new file mode 100644
index 00000000..fffffacf
--- /dev/null
+++ b/utils/afl_untracer/TODO
@@ -0,0 +1,2 @@
+ * add shmem fuzzing
+ * add snapshot feature?
diff --git a/utils/afl_untracer/afl-untracer.c b/utils/afl_untracer/afl-untracer.c
new file mode 100644
index 00000000..cb6f948c
--- /dev/null
+++ b/utils/afl_untracer/afl-untracer.c
@@ -0,0 +1,768 @@
+/*
+   american fuzzy lop++ - afl-untracer skeleton example
+   ---------------------------------------------------
+
+   Written by Marc Heuse <mh@mh-sec.de>
+
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+
+   HOW-TO
+   ======
+
+   You only need to change the following:
+
+   1. decide if you want to receive data from stdin [DEFAULT] or file(name)
+      -> use_stdin = 0 if via file, and what the maximum input size is
+   2. dl load the library you want to fuzz, lookup the functions you need
+      and setup the calls to these
+   3. in the while loop you call the functions in the necessary order -
+      incl the cleanup. the cleanup is important!
+
+   Just look these steps up in the code, look for "// STEP x:"
+
+
+*/
+
+#define __USE_GNU
+#define _GNU_SOURCE
+
+#ifdef __ANDROID__
+  #include "android-ashmem.h"
+#endif
+#include "config.h"
+#include "types.h"
+#include "debug.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <unistd.h>
+#include <string.h>
+#include <assert.h>
+#include <stdint.h>
+#include <errno.h>
+#include <dlfcn.h>
+#include <fcntl.h>
+#include <pthread.h>
+
+#include <sys/mman.h>
+#include <sys/shm.h>
+#include <sys/wait.h>
+#include <sys/types.h>
+#include <sys/personality.h>
+
+#if defined(__linux__)
+  #include <sys/ucontext.h>
+#elif defined(__APPLE__) && defined(__LP64__)
+  #include <mach-o/dyld_images.h>
+#elif defined(__FreeBSD__)
+  #include <sys/sysctl.h>
+  #include <sys/user.h>
+#else
+  #error "Unsupported platform"
+#endif
+
+#define MEMORY_MAP_DECREMENT 0x200000000000
+#define MAX_LIB_COUNT 128
+
+// STEP 1:
+
+/* here you need to specify the parameter for the target function */
+static void *(*o_function)(u8 *buf, int len);
+
+/* use stdin (1) or a file on the commandline (0) */
+static u32 use_stdin = 1;
+
+/* This is were the testcase data is written into */
+static u8 buf[10000];  // this is the maximum size for a test case! set it!
+
+/* If you want to have debug output set this to 1, can also be set with
+   AFL_DEBUG  */
+static u32 debug = 0;
+
+// END STEP 1
+
+typedef struct library_list {
+
+  u8 *name;
+  u64 addr_start, addr_end;
+
+} library_list_t;
+
+#ifdef __ANDROID__
+u32 __afl_map_size = MAP_SIZE;
+u32 do_exit;
+#else
+__thread u32 __afl_map_size = MAP_SIZE;
+__thread u32 do_exit;
+#endif
+
+static pid_t     pid = 65537;
+static pthread_t __afl_thread;
+static u8        __afl_dummy[MAP_SIZE];
+static u8 *      __afl_area_ptr = __afl_dummy;
+static u8 *      inputfile;  // this will point to argv[1]
+static u32       len;
+
+static library_list_t liblist[MAX_LIB_COUNT];
+static u32            liblist_cnt;
+
+static void sigtrap_handler(int signum, siginfo_t *si, void *context);
+static void fuzz(void);
+
+/* read the library information */
+void read_library_information(void) {
+
+#if defined(__linux__)
+  FILE *f;
+  u8    buf[1024], *b, *m, *e, *n;
+
+  if ((f = fopen("/proc/self/maps", "r")) == NULL)
+    FATAL("cannot open /proc/self/maps");
+
+  if (debug) fprintf(stderr, "Library list:\n");
+  while (fgets(buf, sizeof(buf), f)) {
+
+    if (strstr(buf, " r-x")) {
+
+      if (liblist_cnt >= MAX_LIB_COUNT) {
+
+        WARNF("too many libraries to old, maximum count of %d reached",
+              liblist_cnt);
+        return;
+
+      }
+
+      b = buf;
+      m = index(buf, '-');
+      e = index(buf, ' ');
+      if ((n = rindex(buf, '/')) == NULL) n = rindex(buf, ' ');
+      if (n &&
+          ((*n >= '0' && *n <= '9') || *n == '[' || *n == '{' || *n == '('))
+        n = NULL;
+      else
+        n++;
+      if (b && m && e && n && *n) {
+
+        *m++ = 0;
+        *e = 0;
+        if (n[strlen(n) - 1] == '\n') n[strlen(n) - 1] = 0;
+
+        liblist[liblist_cnt].name = strdup(n);
+        liblist[liblist_cnt].addr_start = strtoull(b, NULL, 16);
+        liblist[liblist_cnt].addr_end = strtoull(m, NULL, 16);
+        if (debug)
+          fprintf(
+              stderr, "%s:%llx (%llx-%llx)\n", liblist[liblist_cnt].name,
+              liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
+              liblist[liblist_cnt].addr_start,
+              liblist[liblist_cnt].addr_end - 1);
+        liblist_cnt++;
+
+      }
+
+    }
+
+  }
+
+  if (debug) fprintf(stderr, "\n");
+
+#elif defined(__FreeBSD__)
+  int    mib[] = {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, getpid()};
+  char * buf, *start, *end;
+  size_t miblen = sizeof(mib) / sizeof(mib[0]);
+  size_t len;
+
+  if (debug) fprintf(stderr, "Library list:\n");
+  if (sysctl(mib, miblen, NULL, &len, NULL, 0) == -1) { return; }
+
+  len = len * 4 / 3;
+
+  buf = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
+  if (buf == MAP_FAILED) { return; }
+
+  if (sysctl(mib, miblen, buf, &len, NULL, 0) == -1) {
+
+    munmap(buf, len);
+    return;
+
+  }
+
+  start = buf;
+  end = buf + len;
+
+  while (start < end) {
+
+    struct kinfo_vmentry *region = (struct kinfo_vmentry *)start;
+    size_t                size = region->kve_structsize;
+
+    if (size == 0) { break; }
+
+    if ((region->kve_protection & KVME_PROT_READ) &&
+        !(region->kve_protection & KVME_PROT_EXEC)) {
+
+      liblist[liblist_cnt].name =
+          region->kve_path[0] != '\0' ? strdup(region->kve_path) : 0;
+      liblist[liblist_cnt].addr_start = region->kve_start;
+      liblist[liblist_cnt].addr_end = region->kve_end;
+
+      if (debug) {
+
+        fprintf(stderr, "%s:%x (%lx-%lx)\n", liblist[liblist_cnt].name,
+                liblist[liblist_cnt].addr_end - liblist[liblist_cnt].addr_start,
+                liblist[liblist_cnt].addr_start,
+                liblist[liblist_cnt].addr_end - 1);
+
+      }
+
+      liblist_cnt++;
+
+    }
+
+    start += size;
+
+  }
+
+#endif
+
+}
+
+library_list_t *find_library(char *name) {
+
+#if defined(__linux__)
+  u32 i;
+
+  for (i = 0; i < liblist_cnt; i++)
+    if (strncmp(liblist[i].name, name, strlen(name)) == 0) return &liblist[i];
+#elif defined(__APPLE__) && defined(__LP64__)
+  kern_return_t         err;
+  static library_list_t lib;
+
+  // get the list of all loaded modules from dyld
+  // the task_info mach API will get the address of the dyld all_image_info
+  // struct for the given task from which we can get the names and load
+  // addresses of all modules
+  task_dyld_info_data_t  task_dyld_info;
+  mach_msg_type_number_t count = TASK_DYLD_INFO_COUNT;
+  err = task_info(mach_task_self(), TASK_DYLD_INFO,
+                  (task_info_t)&task_dyld_info, &count);
+
+  const struct dyld_all_image_infos *all_image_infos =
+      (const struct dyld_all_image_infos *)task_dyld_info.all_image_info_addr;
+  const struct dyld_image_info *image_infos = all_image_infos->infoArray;
+
+  for (size_t i = 0; i < all_image_infos->infoArrayCount; i++) {
+
+    const char *      image_name = image_infos[i].imageFilePath;
+    mach_vm_address_t image_load_address =
+        (mach_vm_address_t)image_infos[i].imageLoadAddress;
+    if (strstr(image_name, name)) {
+
+      lib.name = name;
+      lib.addr_start = (u64)image_load_address;
+      lib.addr_end = 0;
+      return &lib;
+
+    }
+
+  }
+
+#endif
+
+  return NULL;
+
+}
+
+/* for having an easy breakpoint location after loading the shared library */
+// this seems to work for clang too. nice :) requires gcc 4.4+
+#pragma GCC push_options
+#pragma GCC optimize("O0")
+void        breakpoint(void) {
+
+  if (debug) fprintf(stderr, "Breakpoint function \"breakpoint\" reached.\n");
+
+}
+
+#pragma GCC pop_options
+
+/* Error reporting to forkserver controller */
+
+void send_forkserver_error(int error) {
+
+  u32 status;
+  if (!error || error > 0xffff) return;
+  status = (FS_OPT_ERROR | FS_OPT_SET_ERROR(error));
+  if (write(FORKSRV_FD + 1, (char *)&status, 4) != 4) return;
+
+}
+
+/* SHM setup. */
+
+static void __afl_map_shm(void) {
+
+  char *id_str = getenv(SHM_ENV_VAR);
+  char *ptr;
+
+  if ((ptr = getenv("AFL_MAP_SIZE")) != NULL) {
+
+    u32 val = atoi(ptr);
+    if (val > 0) __afl_map_size = val;
+
+  }
+
+  if (__afl_map_size > MAP_SIZE) {
+
+    if (__afl_map_size > FS_OPT_MAX_MAPSIZE) {
+
+      fprintf(stderr,
+              "Error: AFL++ tools *require* to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+      if (id_str) {
+
+        send_forkserver_error(FS_ERROR_MAP_SIZE);
+        exit(-1);
+
+      }
+
+    } else {
+
+      fprintf(stderr,
+              "Warning: AFL++ tools will need to set AFL_MAP_SIZE to %u to "
+              "be able to run this instrumented program!\n",
+              __afl_map_size);
+
+    }
+
+  }
+
+  if (id_str) {
+
+#ifdef USEMMAP
+    const char *   shm_file_path = id_str;
+    int            shm_fd = -1;
+    unsigned char *shm_base = NULL;
+
+    /* create the shared memory segment as if it was a file */
+    shm_fd = shm_open(shm_file_path, O_RDWR, 0600);
+    if (shm_fd == -1) {
+
+      fprintf(stderr, "shm_open() failed\n");
+      send_forkserver_error(FS_ERROR_SHM_OPEN);
+      exit(1);
+
+    }
+
+    /* map the shared memory segment to the address space of the process */
+    shm_base =
+        mmap(0, __afl_map_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
+
+    if (shm_base == MAP_FAILED) {
+
+      close(shm_fd);
+      shm_fd = -1;
+
+      fprintf(stderr, "mmap() failed\n");
+      send_forkserver_error(FS_ERROR_MMAP);
+      exit(2);
+
+    }
+
+    __afl_area_ptr = shm_base;
+#else
+    u32 shm_id = atoi(id_str);
+
+    __afl_area_ptr = shmat(shm_id, 0, 0);
+
+#endif
+
+    if (__afl_area_ptr == (void *)-1) {
+
+      send_forkserver_error(FS_ERROR_SHMAT);
+      exit(1);
+
+    }
+
+    /* Write something into the bitmap so that the parent doesn't give up */
+
+    __afl_area_ptr[0] = 1;
+
+  }
+
+}
+
+/* Fork server logic. */
+inline static void __afl_start_forkserver(void) {
+
+  u8  tmp[4] = {0, 0, 0, 0};
+  u32 status = 0;
+
+  if (__afl_map_size <= FS_OPT_MAX_MAPSIZE)
+    status |= (FS_OPT_SET_MAPSIZE(__afl_map_size) | FS_OPT_MAPSIZE);
+  if (status) status |= (FS_OPT_ENABLED);
+  memcpy(tmp, &status, 4);
+
+  /* Phone home and tell the parent that we're OK. */
+  if (write(FORKSRV_FD + 1, tmp, 4) != 4) do_exit = 1;
+  // fprintf(stderr, "write0 %d\n", do_exit);
+
+}
+
+inline static u32 __afl_next_testcase(u8 *buf, u32 max_len) {
+
+  s32 status;
+
+  /* Wait for parent by reading from the pipe. Abort if read fails. */
+  if (read(FORKSRV_FD, &status, 4) != 4) do_exit = 1;
+  // fprintf(stderr, "read %d\n", do_exit);
+
+  /* we have a testcase - read it if we read from stdin */
+  if (use_stdin) {
+
+    if ((status = read(0, buf, max_len)) <= 0) exit(-1);
+
+  } else
+
+    status = 1;
+  // fprintf(stderr, "stdin: %d %d\n", use_stdin, status);
+
+  /* report that we are starting the target */
+  if (write(FORKSRV_FD + 1, &pid, 4) != 4) do_exit = 1;
+  // fprintf(stderr, "write1 %d\n", do_exit);
+
+  __afl_area_ptr[0] = 1;  // put something in the map
+
+  return status;
+
+}
+
+inline static void __afl_end_testcase(int status) {
+
+  if (write(FORKSRV_FD + 1, &status, 4) != 4) do_exit = 1;
+  // fprintf(stderr, "write2 %d\n", do_exit);
+  if (do_exit) exit(0);
+
+}
+
+#ifdef __aarch64__
+  #define SHADOW(addr)                                     \
+    ((uint64_t *)(((uintptr_t)addr & 0xfffffffffffffff8) - \
+                  MEMORY_MAP_DECREMENT -                   \
+                  ((uintptr_t)addr & 0x7) * 0x10000000000))
+#else
+  #define SHADOW(addr)                                     \
+    ((uint32_t *)(((uintptr_t)addr & 0xfffffffffffffffc) - \
+                  MEMORY_MAP_DECREMENT -                   \
+                  ((uintptr_t)addr & 0x3) * 0x10000000000))
+#endif
+
+void setup_trap_instrumentation(void) {
+
+  library_list_t *lib_base = NULL;
+  size_t          lib_size = 0;
+  u8 *            lib_addr;
+  char *          line = NULL;
+  size_t          nread, len = 0;
+  char *          filename = getenv("AFL_UNTRACER_FILE");
+  if (!filename) filename = getenv("TRAPFUZZ_FILE");
+  if (!filename) FATAL("AFL_UNTRACER_FILE environment variable not set");
+
+  FILE *patches = fopen(filename, "r");
+  if (!patches) FATAL("Couldn't open AFL_UNTRACER_FILE file %s", filename);
+
+    // Index into the coverage bitmap for the current trap instruction.
+#ifdef __aarch64__
+  uint64_t bitmap_index = 0;
+#else
+  uint32_t bitmap_index = 0;
+#endif
+
+  while ((nread = getline(&line, &len, patches)) != -1) {
+
+    char *end = line + len;
+
+    char *col = strchr(line, ':');
+    if (col) {
+
+      // It's a library:size pair
+      *col++ = 0;
+
+      lib_base = find_library(line);
+      if (!lib_base) FATAL("Library %s does not appear to be loaded", line);
+
+      // we ignore the defined lib_size
+      lib_size = strtoul(col, NULL, 16);
+#if (__linux__)
+      if (lib_size < lib_base->addr_end - lib_base->addr_start)
+        lib_size = lib_base->addr_end - lib_base->addr_start;
+#endif
+      if (lib_size % 0x1000 != 0)
+        WARNF("Invalid library size 0x%zx. Must be multiple of 0x1000",
+              lib_size);
+
+      lib_addr = (u8 *)lib_base->addr_start;
+
+      // Make library code writable.
+      if (mprotect((void *)lib_addr, lib_size,
+                   PROT_READ | PROT_WRITE | PROT_EXEC) != 0)
+        FATAL("Failed to mprotect library %s writable", line);
+
+        // Create shadow memory.
+#ifdef __aarch64__
+      for (int i = 0; i < 8; i++) {
+
+#else
+      for (int i = 0; i < 4; i++) {
+
+#endif
+
+        void *shadow_addr = SHADOW(lib_addr + i);
+        void *shadow = mmap(shadow_addr, lib_size, PROT_READ | PROT_WRITE,
+                            MAP_PRIVATE | MAP_ANON | MAP_FIXED, 0, 0);
+        if (debug)
+          fprintf(stderr, "Shadow: %s %d = %p-%p for %p\n", line, i, shadow,
+                  shadow + lib_size - 1, lib_addr);
+        if (shadow == MAP_FAILED) FATAL("Failed to mmap shadow memory");
+
+      }
+
+      // Done, continue with next line.
+      continue;
+
+    }
+
+    // It's an offset, parse it and do the patching.
+    unsigned long offset = strtoul(line, NULL, 16);
+
+    if (offset > lib_size)
+      FATAL("Invalid offset: 0x%lx. Current library is 0x%zx bytes large",
+            offset, lib_size);
+
+    if (bitmap_index >= __afl_map_size)
+      FATAL("Too many basic blocks to instrument");
+
+#ifdef __arch64__
+    uint64_t
+#else
+    uint32_t
+#endif
+        *shadow = SHADOW(lib_addr + offset);
+    if (*shadow != 0) continue;  // skip duplicates
+
+      // Make lookup entry in shadow memory.
+
+#if ((defined(__APPLE__) && defined(__LP64__)) || defined(__x86_64__) || \
+     defined(__i386__))
+
+    // this is for Intel x64
+
+    uint8_t orig_byte = lib_addr[offset];
+    *shadow = (bitmap_index << 8) | orig_byte;
+    lib_addr[offset] = 0xcc;  // replace instruction with debug trap
+    if (debug)
+      fprintf(stderr,
+              "Patch entry: %p[%x] = %p = %02x -> SHADOW(%p) #%d -> %08x\n",
+              lib_addr, offset, lib_addr + offset, orig_byte, shadow,
+              bitmap_index, *shadow);
+
+#elif defined(__aarch64__)
+
+    // this is for aarch64
+
+    uint32_t *patch_bytes = (uint32_t *)(lib_addr + offset);
+    uint32_t  orig_bytes = *patch_bytes;
+    *shadow = (bitmap_index << 32) | orig_bytes;
+    *patch_bytes = 0xd4200000;  // replace instruction with debug trap
+    if (debug)
+      fprintf(stderr,
+              "Patch entry: %p[%x] = %p = %02x -> SHADOW(%p) #%d -> %016x\n",
+              lib_addr, offset, lib_addr + offset, orig_bytes, shadow,
+              bitmap_index, *shadow);
+
+#else
+    // this will be ARM and AARCH64
+    // for ARM we will need to identify if the code is in thumb or ARM
+  #error "non x86_64/aarch64 not supported yet"
+    //__arm__:
+    // linux thumb: 0xde01
+    // linux arm: 0xe7f001f0
+    //__aarch64__:
+    // linux aarch64: 0xd4200000
+#endif
+
+    bitmap_index++;
+
+  }
+
+  free(line);
+  fclose(patches);
+
+  // Install signal handler for SIGTRAP.
+  struct sigaction s;
+  s.sa_flags = SA_SIGINFO;
+  s.sa_sigaction = sigtrap_handler;
+  sigemptyset(&s.sa_mask);
+  sigaction(SIGTRAP, &s, 0);
+
+  if (debug) fprintf(stderr, "Patched %u locations.\n", bitmap_index);
+  __afl_map_size = bitmap_index;
+  if (__afl_map_size % 8) __afl_map_size = (((__afl_map_size + 7) >> 3) << 3);
+
+}
+
+/* the signal handler for the traps / debugging interrupts
+   No debug output here because this would cost speed      */
+static void sigtrap_handler(int signum, siginfo_t *si, void *context) {
+
+  uint64_t addr;
+  // Must re-execute the instruction, so decrement PC by one instruction.
+  ucontext_t *ctx = (ucontext_t *)context;
+#if defined(__APPLE__) && defined(__LP64__)
+  ctx->uc_mcontext->__ss.__rip -= 1;
+  addr = ctx->uc_mcontext->__ss.__rip;
+#elif defined(__linux__)
+  #if defined(__x86_64__) || defined(__i386__)
+  ctx->uc_mcontext.gregs[REG_RIP] -= 1;
+  addr = ctx->uc_mcontext.gregs[REG_RIP];
+  #elif defined(__aarch64__)
+  ctx->uc_mcontext.pc -= 4;
+  addr = ctx->uc_mcontext.pc;
+  #else
+    #error "Unsupported processor"
+  #endif
+#elif defined(__FreeBSD__) && defined(__LP64__)
+  ctx->uc_mcontext.mc_rip -= 1;
+  addr = ctx->uc_mcontext.mc_rip;
+#else
+  #error "Unsupported platform"
+#endif
+
+  // fprintf(stderr, "TRAP at context addr = %lx, fault addr = %lx\n", addr,
+  // si->si_addr);
+
+  // If the trap didn't come from our instrumentation, then we probably will
+  // just segfault here
+  uint8_t *faultaddr;
+  if (unlikely(si->si_addr))
+    faultaddr = (u8 *)si->si_addr - 1;
+  else
+    faultaddr = (u8 *)addr;
+  // if (debug) fprintf(stderr, "Shadow location: %p\n", SHADOW(faultaddr));
+  uint32_t shadow = *SHADOW(faultaddr);
+  uint8_t  orig_byte = shadow & 0xff;
+  uint32_t index = shadow >> 8;
+
+  // if (debug) fprintf(stderr, "shadow data: %x, orig_byte %02x, index %d\n",
+  // shadow, orig_byte, index);
+
+  // Index zero is invalid so that it is still possible to catch actual trap
+  // instructions in instrumented libraries.
+  if (unlikely(index == 0)) abort();
+
+  // Restore original instruction
+  *faultaddr = orig_byte;
+
+  __afl_area_ptr[index] = 128;
+
+}
+
+/* the MAIN function */
+int main(int argc, char *argv[]) {
+
+  (void)personality(ADDR_NO_RANDOMIZE);  // disable ASLR
+
+  pid = getpid();
+  if (getenv("AFL_DEBUG")) debug = 1;
+
+  /* by default we use stdin, but also a filename can be passed, in this
+     case the input is argv[1] and we have to disable stdin */
+  if (argc > 1) {
+
+    use_stdin = 0;
+    inputfile = argv[1];
+
+  }
+
+  // STEP 2: load the library you want to fuzz and lookup the functions,
+  //         inclusive of the cleanup functions
+  //         NOTE: above the main() you have to define the functions!
+
+  void *dl = dlopen("./libtestinstr.so", RTLD_LAZY);
+  if (!dl) FATAL("could not find target library");
+  o_function = dlsym(dl, "testinstr");
+  if (!o_function) FATAL("could not resolve target function from library");
+  if (debug) fprintf(stderr, "Function address: %p\n", o_function);
+
+  // END STEP 2
+
+  /* setup instrumentation, shared memory and forkserver */
+  breakpoint();
+  read_library_information();
+  setup_trap_instrumentation();
+  __afl_map_shm();
+  __afl_start_forkserver();
+
+  while (1) {
+
+    // instead of fork() we could also use the snapshot lkm or do our own mini
+    // snapshot feature like in https://github.com/marcinguy/fuzzer
+    // -> snapshot.c
+    if ((pid = fork()) == -1) PFATAL("fork failed");
+
+    if (pid) {
+
+      u32 status;
+      if (waitpid(pid, &status, 0) < 0) exit(1);
+      /* report the test case is done and wait for the next */
+      __afl_end_testcase(status);
+
+    } else {
+
+      pid = getpid();
+      while ((len = __afl_next_testcase(buf, sizeof(buf))) > 0) {
+
+        // in this function the fuzz magic happens, this is STEP 3
+        fuzz();
+
+        // we can use _exit which is faster because our target library
+        // was loaded via dlopen and therefore cannot have deconstructors
+        // registered.
+        _exit(0);
+
+      }
+
+    }
+
+  }
+
+  return 0;
+
+}
+
+#ifndef _DEBUG
+inline
+#endif
+    static void
+    fuzz(void) {
+
+  // STEP 3: call the function to fuzz, also the functions you might
+  //         need to call to prepare the function and - important! -
+  //         to clean everything up
+
+  // in this example we use the input file, not stdin!
+  (*o_function)(buf, len);
+
+  // normally you also need to cleanup
+  //(*o_LibFree)(foo);
+
+  // END STEP 3
+
+}
+
diff --git a/utils/afl_untracer/ghidra_get_patchpoints.java b/utils/afl_untracer/ghidra_get_patchpoints.java
new file mode 100644
index 00000000..2a93642b
--- /dev/null
+++ b/utils/afl_untracer/ghidra_get_patchpoints.java
@@ -0,0 +1,84 @@
+/* ###
+ * IP: GHIDRA
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Find patch points for untracer tools (e.g. afl++ utils/afl_untracer)
+//
+//   Copy to ..../Ghidra/Features/Search/ghidra_scripts/
+//   Writes the results to ~/Desktop/patches.txt
+//
+//   This is my very first Ghidra script. I am sure this could be done better.
+//
+//@category Search
+
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.*;
+import ghidra.program.model.block.*;
+import ghidra.program.model.listing.*;
+import ghidra.program.model.symbol.*;
+import ghidra.program.model.mem.*;
+
+import java.io.*;
+
+public class ghidra_get_patchpoints extends GhidraScript {
+
+	@Override
+	public void run() throws Exception {
+
+		long segment_start = 0;
+		Memory memory = currentProgram.getMemory();
+		MultEntSubModel model = new MultEntSubModel(currentProgram);
+		CodeBlockIterator subIter = model.getCodeBlocks(monitor);
+		BufferedWriter out = new BufferedWriter(new FileWriter(System.getProperty("user.home") + File.separator + "Desktop" + File.separator + "patches.txt"));
+
+		while (subIter.hasNext()) {
+
+			CodeBlock multiEntryBlock = subIter.next();
+			SimpleBlockModel basicBlockModel = new SimpleBlockModel(currentProgram);
+			CodeBlockIterator bbIter = basicBlockModel.getCodeBlocksContaining(multiEntryBlock, monitor);
+
+			while (bbIter.hasNext()) {
+
+				CodeBlock basicBlock = bbIter.next();
+
+				if (segment_start == 0) {
+
+					Address firstAddr = basicBlock.getFirstStartAddress();
+					long firstBlockAddr = firstAddr.getAddressableWordOffset();
+					MemoryBlock mb = memory.getBlock(firstAddr);
+					Address startAddr = mb.getStart();
+					Address endAddr = mb.getEnd();
+					segment_start = startAddr.getAddressableWordOffset();
+					if ((firstBlockAddr - segment_start) >= 0x1000)
+					  segment_start += 0x1000;
+					long segment_end = endAddr.getAddressableWordOffset();
+					long segment_size = segment_end - segment_start;
+					if ((segment_size % 0x1000) > 0)
+					  segment_size = (((segment_size / 0x1000) + 1) * 0x1000);
+					out.write(currentProgram.getName() + ":0x" + Long.toHexString(segment_size) + "\n"); 
+					//println("Start: " + Long.toHexString(segment_start));
+					//println("End: " + Long.toHexString(segment_end));
+
+				}
+ 	   		        
+ 	   		        if (basicBlock.getFirstStartAddress().getAddressableWordOffset() - segment_start > 0)
+ 	   		        	out.write("0x" + Long.toHexString(basicBlock.getFirstStartAddress().getAddressableWordOffset() - segment_start) + "\n");
+
+			}
+		}
+
+		out.close();
+
+	}
+}
diff --git a/utils/afl_untracer/ida_get_patchpoints.py b/utils/afl_untracer/ida_get_patchpoints.py
new file mode 100644
index 00000000..43cf6d89
--- /dev/null
+++ b/utils/afl_untracer/ida_get_patchpoints.py
@@ -0,0 +1,62 @@
+#
+# IDAPython script for IDA Pro
+# Slightly modified from https://github.com/googleprojectzero/p0tools/blob/master/TrapFuzz/findPatchPoints.py
+#
+
+import idautils
+import idaapi
+import ida_nalt
+import idc
+
+# See https://www.hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml
+
+from os.path import expanduser
+home = expanduser("~")
+
+patchpoints = set()
+
+max_offset = 0
+for seg_ea in idautils.Segments():
+    name = idc.get_segm_name(seg_ea)
+    #print("Segment: " + name)
+    if name != "__text" and name != ".text":
+        continue
+
+    start = idc.get_segm_start(seg_ea)
+    end = idc.get_segm_end(seg_ea)
+    first = 0
+    subtract_addr = 0
+    #print("Start: " + hex(start) + " End: " + hex(end))
+    for func_ea in idautils.Functions(start, end):
+        f = idaapi.get_func(func_ea)
+        if not f:
+            continue
+        for block in idaapi.FlowChart(f):
+            if start <= block.start_ea < end:
+                if first == 0:
+                    if block.start_ea >= 0x1000:
+                        subtract_addr = 0x1000
+                        first = 1
+                        
+                max_offset = max(max_offset, block.start_ea)
+                patchpoints.add(block.start_ea - subtract_addr)
+            #else:
+            #    print("Warning: broken CFG?")
+
+# Round up max_offset to page size
+size = max_offset
+rem = size % 0x1000
+if rem != 0:
+    size += 0x1000 - rem
+
+print("Writing to " + home + "/Desktop/patches.txt")
+
+with open(home + "/Desktop/patches.txt", "w") as f:
+    f.write(ida_nalt.get_root_filename() + ':' + hex(size) + '\n')
+    f.write('\n'.join(map(hex, sorted(patchpoints))))
+    f.write('\n')
+
+print("Done, found {} patchpoints".format(len(patchpoints)))
+
+# For headless script running remove the comment from the next line
+#ida_pro.qexit()
diff --git a/utils/afl_untracer/libtestinstr.c b/utils/afl_untracer/libtestinstr.c
new file mode 100644
index 00000000..96b1cf21
--- /dev/null
+++ b/utils/afl_untracer/libtestinstr.c
@@ -0,0 +1,35 @@
+/*
+   american fuzzy lop++ - a trivial program to test the build
+   --------------------------------------------------------
+   Originally written by Michal Zalewski
+   Copyright 2014 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+     http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+void testinstr(char *buf, int len) {
+
+  if (len < 1) return;
+  buf[len] = 0;
+
+  // we support three input cases
+  if (buf[0] == '0')
+    printf("Looks like a zero to me!\n");
+  else if (buf[0] == '1')
+    printf("Pretty sure that is a one!\n");
+  else
+    printf("Neither one or zero? How quaint!\n");
+
+}
+
diff --git a/utils/afl_untracer/patches.txt b/utils/afl_untracer/patches.txt
new file mode 100644
index 00000000..7e964249
--- /dev/null
+++ b/utils/afl_untracer/patches.txt
@@ -0,0 +1,34 @@
+libtestinstr.so:0x1000
+0x10
+0x12
+0x20
+0x36
+0x30
+0x40
+0x50
+0x63
+0x6f
+0x78
+0x80
+0xa4
+0xb0
+0xb8
+0x100
+0xc0
+0xc9
+0xd7
+0xe3
+0xe8
+0xf8
+0x105
+0x11a
+0x135
+0x141
+0x143
+0x14e
+0x15a
+0x15c
+0x168
+0x16a
+0x16b
+0x170
diff --git a/utils/aflpp_driver/GNUmakefile b/utils/aflpp_driver/GNUmakefile
new file mode 100644
index 00000000..c1a087d7
--- /dev/null
+++ b/utils/aflpp_driver/GNUmakefile
@@ -0,0 +1,46 @@
+ifeq "" "$(LLVM_CONFIG)"
+  LLVM_CONFIG=llvm-config
+endif
+
+LLVM_BINDIR = $(shell $(LLVM_CONFIG) --bindir 2>/dev/null)
+ifneq "" "$(LLVM_BINDIR)"
+  LLVM_BINDIR := $(LLVM_BINDIR)/
+endif
+
+CFLAGS := -O3 -funroll-loops -g
+
+all:	libAFLDriver.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so
+
+aflpp_driver.o:	aflpp_driver.c
+	-$(LLVM_BINDIR)clang -I. -I../../include $(CFLAGS) -c aflpp_driver.c
+
+libAFLDriver.a:	aflpp_driver.o
+	ar ru libAFLDriver.a aflpp_driver.o
+	cp -vf libAFLDriver.a ../../
+
+debug:
+	$(LLVM_BINDIR)clang -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.o ../../src/afl-performance.c
+	$(LLVM_BINDIR)clang -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
+	#$(LLVM_BINDIR)clang -S -emit-llvm -Wno-deprecated -I../../include $(CFLAGS) -D_DEBUG=\"1\" -c -o afl-performance.ll ../../src/afl-performance.c
+	#$(LLVM_BINDIR)clang -S -emit-llvm -I../../include -D_DEBUG=\"1\" -g -funroll-loops -c aflpp_driver.c
+	ar ru libAFLDriver.a afl-performance.o aflpp_driver.o
+
+aflpp_qemu_driver.o:	aflpp_qemu_driver.c
+	$(LLVM_BINDIR)clang $(CFLAGS) -O0 -funroll-loops -c aflpp_qemu_driver.c
+
+libAFLQemuDriver.a:	aflpp_qemu_driver.o
+	ar ru libAFLQemuDriver.a aflpp_qemu_driver.o
+	cp -vf libAFLQemuDriver.a ../../
+
+aflpp_qemu_driver_hook.so:	aflpp_qemu_driver_hook.o
+	$(LLVM_BINDIR)clang -shared aflpp_qemu_driver_hook.o -o aflpp_qemu_driver_hook.so
+
+aflpp_qemu_driver_hook.o:	aflpp_qemu_driver_hook.c
+	$(LLVM_BINDIR)clang -fPIC $(CFLAGS) -funroll-loops -c aflpp_qemu_driver_hook.c
+
+test:	debug
+	#clang -S -emit-llvm -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test.ll aflpp_driver_test.c
+	afl-clang-fast -D_DEBUG=\"1\" -I../../include -Wl,--allow-multiple-definition -funroll-loops -o aflpp_driver_test aflpp_driver_test.c libAFLDriver.a afl-performance.o
+
+clean:
+	rm -f *.o libAFLDriver*.a libAFLQemuDriver.a aflpp_qemu_driver_hook.so *~ core aflpp_driver_test
diff --git a/utils/aflpp_driver/Makefile b/utils/aflpp_driver/Makefile
new file mode 100644
index 00000000..3666a74d
--- /dev/null
+++ b/utils/aflpp_driver/Makefile
@@ -0,0 +1,2 @@
+all:
+	@gmake all || echo please install GNUmake
diff --git a/utils/aflpp_driver/aflpp_driver.c b/utils/aflpp_driver/aflpp_driver.c
new file mode 100644
index 00000000..017aa72b
--- /dev/null
+++ b/utils/aflpp_driver/aflpp_driver.c
@@ -0,0 +1,326 @@
+//===- afl_driver.cpp - a glue between AFL and libFuzzer --------*- C++ -* ===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//===----------------------------------------------------------------------===//
+
+/* This file allows to fuzz libFuzzer-style target functions
+ (LLVMFuzzerTestOneInput) with AFL using AFL's persistent (in-process) mode.
+
+Usage:
+################################################################################
+cat << EOF > test_fuzzer.cc
+#include <stddef.h>
+#include <stdint.h>
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+
+  if (size > 0 && data[0] == 'H')
+    if (size > 1 && data[1] == 'I')
+       if (size > 2 && data[2] == '!')
+       __builtin_trap();
+  return 0;
+
+}
+
+EOF
+# Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang.
+clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c
+# Build afl-llvm-rt.o.c from the AFL distribution.
+clang -c -w $AFL_HOME/instrumentation/afl-llvm-rt.o.c
+# Build this file, link it with afl-llvm-rt.o.o and the target code.
+clang++ afl_driver.cpp test_fuzzer.o afl-llvm-rt.o.o
+# Run AFL:
+rm -rf IN OUT; mkdir IN OUT; echo z > IN/z;
+$AFL_HOME/afl-fuzz -i IN -o OUT ./a.out
+################################################################################
+AFL_DRIVER_STDERR_DUPLICATE_FILENAME: Setting this *appends* stderr to the file
+specified. If the file does not exist, it is created. This is useful for getting
+stack traces (when using ASAN for example) or original error messages on hard
+to reproduce bugs. Note that any content written to stderr will be written to
+this file instead of stderr's usual location.
+
+AFL_DRIVER_CLOSE_FD_MASK: Similar to libFuzzer's -close_fd_mask behavior option.
+If 1, close stdout at startup. If 2 close stderr; if 3 close both.
+
+*/
+#include <assert.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <limits.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+
+#include "config.h"
+#include "cmplog.h"
+
+#ifdef _DEBUG
+  #include "hash.h"
+#endif
+
+#ifndef MAP_FIXED_NOREPLACE
+  #define MAP_FIXED_NOREPLACE 0x100000
+#endif
+
+#define MAX_DUMMY_SIZE 256000
+
+// Platform detection. Copied from FuzzerInternal.h
+#ifdef __linux__
+  #define LIBFUZZER_LINUX 1
+  #define LIBFUZZER_APPLE 0
+  #define LIBFUZZER_NETBSD 0
+  #define LIBFUZZER_FREEBSD 0
+  #define LIBFUZZER_OPENBSD 0
+#elif __APPLE__
+  #define LIBFUZZER_LINUX 0
+  #define LIBFUZZER_APPLE 1
+  #define LIBFUZZER_NETBSD 0
+  #define LIBFUZZER_FREEBSD 0
+  #define LIBFUZZER_OPENBSD 0
+#elif __NetBSD__
+  #define LIBFUZZER_LINUX 0
+  #define LIBFUZZER_APPLE 0
+  #define LIBFUZZER_NETBSD 1
+  #define LIBFUZZER_FREEBSD 0
+  #define LIBFUZZER_OPENBSD 0
+#elif __FreeBSD__
+  #define LIBFUZZER_LINUX 0
+  #define LIBFUZZER_APPLE 0
+  #define LIBFUZZER_NETBSD 0
+  #define LIBFUZZER_FREEBSD 1
+  #define LIBFUZZER_OPENBSD 0
+#elif __OpenBSD__
+  #define LIBFUZZER_LINUX 0
+  #define LIBFUZZER_APPLE 0
+  #define LIBFUZZER_NETBSD 0
+  #define LIBFUZZER_FREEBSD 0
+  #define LIBFUZZER_OPENBSD 1
+#else
+  #error "Support for your platform has not been implemented"
+#endif
+
+int                   __afl_sharedmem_fuzzing = 1;
+extern unsigned int * __afl_fuzz_len;
+extern unsigned char *__afl_fuzz_ptr;
+
+// libFuzzer interface is thin, so we don't include any libFuzzer headers.
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
+__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
+
+// Notify AFL about persistent mode.
+static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
+int                  __afl_persistent_loop(unsigned int);
+
+// Notify AFL about deferred forkserver.
+static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
+void                 __afl_manual_init();
+
+// Use this optionally defined function to output sanitizer messages even if
+// user asks to close stderr.
+__attribute__((weak)) void __sanitizer_set_report_fd(void *);
+
+// Keep track of where stderr content is being written to, so that
+// dup_and_close_stderr can use the correct one.
+static FILE *output_file;
+
+// Experimental feature to use afl_driver without AFL's deferred mode.
+// Needs to run before __afl_auto_init.
+__attribute__((constructor(0))) static void __decide_deferred_forkserver(void) {
+
+  if (getenv("AFL_DRIVER_DONT_DEFER")) {
+
+    if (unsetenv("__AFL_DEFER_FORKSRV")) {
+
+      perror("Failed to unset __AFL_DEFER_FORKSRV");
+      abort();
+
+    }
+
+  }
+
+}
+
+// If the user asks us to duplicate stderr, then do it.
+static void maybe_duplicate_stderr() {
+
+  char *stderr_duplicate_filename =
+      getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+
+  if (!stderr_duplicate_filename) return;
+
+  FILE *stderr_duplicate_stream =
+      freopen(stderr_duplicate_filename, "a+", stderr);
+
+  if (!stderr_duplicate_stream) {
+
+    fprintf(
+        stderr,
+        "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
+    abort();
+
+  }
+
+  output_file = stderr_duplicate_stream;
+
+}
+
+// Most of these I/O functions were inspired by/copied from libFuzzer's code.
+static void discard_output(int fd) {
+
+  FILE *temp = fopen("/dev/null", "w");
+  if (!temp) abort();
+  dup2(fileno(temp), fd);
+  fclose(temp);
+
+}
+
+static void close_stdout() {
+
+  discard_output(STDOUT_FILENO);
+
+}
+
+// Prevent the targeted code from writing to "stderr" but allow sanitizers and
+// this driver to do so.
+static void dup_and_close_stderr() {
+
+  int output_fileno = fileno(output_file);
+  int output_fd = dup(output_fileno);
+  if (output_fd <= 0) abort();
+  FILE *new_output_file = fdopen(output_fd, "w");
+  if (!new_output_file) abort();
+  if (!__sanitizer_set_report_fd) return;
+  __sanitizer_set_report_fd((void *)(long int)output_fd);
+  discard_output(output_fileno);
+
+}
+
+// Close stdout and/or stderr if user asks for it.
+static void maybe_close_fd_mask() {
+
+  char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
+  if (!fd_mask_str) return;
+  int fd_mask = atoi(fd_mask_str);
+  if (fd_mask & 2) dup_and_close_stderr();
+  if (fd_mask & 1) close_stdout();
+
+}
+
+// Define LLVMFuzzerMutate to avoid link failures for targets that use it
+// with libFuzzer's LLVMFuzzerCustomMutator.
+size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
+
+  // assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
+  return 0;
+
+}
+
+// Execute any files provided as parameters.
+static int ExecuteFilesOnyByOne(int argc, char **argv) {
+
+  unsigned char *buf = malloc(MAX_FILE);
+  for (int i = 1; i < argc; i++) {
+
+    int fd = open(argv[i], O_RDONLY);
+    if (fd == -1) continue;
+    ssize_t length = read(fd, buf, MAX_FILE);
+    if (length > 0) {
+
+      printf("Reading %zu bytes from %s\n", length, argv[i]);
+      LLVMFuzzerTestOneInput(buf, length);
+      printf("Execution successful.\n");
+
+    }
+
+  }
+
+  free(buf);
+  return 0;
+
+}
+
+int main(int argc, char **argv) {
+
+  printf(
+      "======================= INFO =========================\n"
+      "This binary is built for afl++.\n"
+      "To run the target function on individual input(s) execute this:\n"
+      "  %s INPUT_FILE1 [INPUT_FILE2 ... ]\n"
+      "To fuzz with afl-fuzz execute this:\n"
+      "  afl-fuzz [afl-flags] -- %s [-N]\n"
+      "afl-fuzz will run N iterations before re-spawning the process (default: "
+      "1000)\n"
+      "======================================================\n",
+      argv[0], argv[0]);
+
+  output_file = stderr;
+  maybe_duplicate_stderr();
+  maybe_close_fd_mask();
+  if (LLVMFuzzerInitialize) {
+
+    fprintf(stderr, "Running LLVMFuzzerInitialize ...\n");
+    LLVMFuzzerInitialize(&argc, &argv);
+    fprintf(stderr, "continue...\n");
+
+  }
+
+  // Do any other expensive one-time initialization here.
+
+  uint8_t dummy_input[64] = {0};
+  memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
+  memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
+         sizeof(AFL_DEFER_FORKSVR));
+  int N = INT_MAX;
+  if (argc == 2 && argv[1][0] == '-')
+    N = atoi(argv[1] + 1);
+  else if (argc == 2 && (N = atoi(argv[1])) > 0)
+    printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
+  else if (argc > 1) {
+
+    __afl_sharedmem_fuzzing = 0;
+    __afl_manual_init();
+    return ExecuteFilesOnyByOne(argc, argv);
+
+  }
+
+  assert(N > 0);
+
+  //  if (!getenv("AFL_DRIVER_DONT_DEFER"))
+  __afl_manual_init();
+
+  // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
+  // on the first execution of LLVMFuzzerTestOneInput is ignored.
+  LLVMFuzzerTestOneInput(dummy_input, 1);
+
+  int num_runs = 0;
+  while (__afl_persistent_loop(N)) {
+
+#ifdef _DEBUG
+    fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
+            hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705),
+            *__afl_fuzz_len);
+    fprintf(stderr, "RECV:");
+    for (int i = 0; i < *__afl_fuzz_len; i++)
+      fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
+    fprintf(stderr, "\n");
+#endif
+    if (*__afl_fuzz_len) {
+
+      num_runs++;
+      LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+
+    }
+
+  }
+
+  printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
+
+}
+
diff --git a/utils/aflpp_driver/aflpp_driver_test.c b/utils/aflpp_driver/aflpp_driver_test.c
new file mode 100644
index 00000000..b4ff6bc6
--- /dev/null
+++ b/utils/aflpp_driver/aflpp_driver_test.c
@@ -0,0 +1,32 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+
+#include "hash.h"
+
+void __attribute__((noinline)) crashme(const uint8_t *Data, size_t Size) {
+
+  if (Size < 5) return;
+
+  if (Data[0] == 'F')
+    if (Data[1] == 'A')
+      if (Data[2] == '$')
+        if (Data[3] == '$')
+          if (Data[4] == '$') abort();
+
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+
+  if (Size)
+    fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
+            hash64((u8 *)Data, (unsigned int)Size,
+                   (unsigned long long int)0xa5b35705),
+            Size);
+
+  crashme(Data, Size);
+
+  return 0;
+
+}
+
diff --git a/utils/aflpp_driver/aflpp_qemu_driver.c b/utils/aflpp_driver/aflpp_qemu_driver.c
new file mode 100644
index 00000000..4f3e5f71
--- /dev/null
+++ b/utils/aflpp_driver/aflpp_qemu_driver.c
@@ -0,0 +1,38 @@
+#include <stdint.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+// libFuzzer interface is thin, so we don't include any libFuzzer headers.
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
+__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
+
+static const size_t kMaxAflInputSize = 1 * 1024 * 1024;
+static uint8_t      AflInputBuf[kMaxAflInputSize];
+
+void __attribute__((noinline)) afl_qemu_driver_stdin_input(void) {
+
+  size_t l = read(0, AflInputBuf, kMaxAflInputSize);
+  LLVMFuzzerTestOneInput(AflInputBuf, l);
+
+}
+
+int main(int argc, char **argv) {
+
+  if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv);
+  // Do any other expensive one-time initialization here.
+
+  if (getenv("AFL_QEMU_DRIVER_NO_HOOK")) {
+
+    afl_qemu_driver_stdin_input();
+
+  } else {
+
+    uint8_t dummy_input[1024000] = {0};
+    LLVMFuzzerTestOneInput(dummy_input, 1);
+
+  }
+
+  return 0;
+
+}
+
diff --git a/utils/aflpp_driver/aflpp_qemu_driver_hook.c b/utils/aflpp_driver/aflpp_qemu_driver_hook.c
new file mode 100644
index 00000000..823cc42d
--- /dev/null
+++ b/utils/aflpp_driver/aflpp_qemu_driver_hook.c
@@ -0,0 +1,22 @@
+#include <stdint.h>
+#include <string.h>
+
+#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
+
+#define REGS_RDI 7
+#define REGS_RSI 6
+
+void afl_persistent_hook(uint64_t *regs, uint64_t guest_base,
+                         uint8_t *input_buf, uint32_t input_len) {
+
+  memcpy(g2h(regs[REGS_RDI]), input_buf, input_len);
+  regs[REGS_RSI] = input_len;
+
+}
+
+int afl_persistent_hook_init(void) {
+
+  return 1;
+
+}
+
diff --git a/utils/analysis_scripts/queue2csv.sh b/utils/analysis_scripts/queue2csv.sh
new file mode 100755
index 00000000..2528b438
--- /dev/null
+++ b/utils/analysis_scripts/queue2csv.sh
@@ -0,0 +1,122 @@
+#!/bin/bash
+
+test -z "$1" -o -z "$2" -o "$1" = "-h" -o "$1" = "-hh" -o "$1" = "--help" -o '!' -d "$1" && {
+  echo "Syntax: [-n]  $0 out-directory file.csv [\"tools/target --opt @@\"]"
+  echo Option -n will suppress the CSV header.
+  echo If the target execution command is supplied then also edge coverage is gathered.
+  exit 1
+}
+
+function getval() {
+  VAL=""
+  if [ "$file" != "${file/$1/}" ]; then
+    TMP="${file/*$1:/}"
+    VAL="${TMP/,*/}"
+  fi
+}
+
+SKIP=
+if [ "$1" = "-n" ]; then
+  SKIP=1
+  shift
+fi
+
+test -n "$4" && { echo "Error: too many commandline options. Target command and options including @@ have to be passed within \"\"!"; exit 1; }
+
+test -d "$1"/queue && OUT="$1/queue" || OUT="$1"
+
+OK=`ls $OUT/id:000000,time:0,orig:* 2> /dev/null`
+if [ -n "$OK" ]; then
+  LISTCMD="ls $OUT/id:"*
+else
+  LISTCMD="ls -tr $OUT/"
+fi
+
+ID=;SRC=;TIME=;OP=;POS=;REP=;EDGES=;EDGES_TOTAL=;
+DIR="$OUT/../stats"
+rm -rf "$DIR"
+> "$2" || exit 1
+mkdir "$DIR" || exit 1
+> "$DIR/../edges.txt" || exit 1
+
+{
+
+  if [ -z "$SKIP" ]; then
+    echo "time;\"filename\";id;src;new_cov;edges;total_edges;\"op\";pos;rep;unique_edges"
+  fi
+
+  $LISTCMD | grep -v ,sync: | sed 's/.*id:/id:/g' | while read file; do
+
+    if [ -n "$3" ]; then
+
+      TMP=${3/@@/$OUT/$file}
+      
+      if [ "$TMP" = "$3" ]; then
+    
+        cat "$OUT/$file" | afl-showmap -o "$DIR/$file" -q -- $3 >/dev/null 2>&1
+        
+      else
+      
+        afl-showmap -o "$DIR/$file" -q -- $TMP >/dev/null 2>&1
+      
+      fi
+    
+      { cat "$DIR/$file" | sed 's/:.*//' ; cat "$DIR/../edges.txt" ; } | sort -nu > $DIR/../edges.txt.tmp
+      mv $DIR/../edges.txt.tmp $DIR/../edges.txt
+      EDGES=$(cat "$DIR/$file" | wc -l)
+      EDGES_TOTAL=$(cat "$DIR/../edges.txt" | wc -l)
+
+    fi
+
+    getval id; ID="$VAL"
+    getval src; SRC="$VAL"
+    getval time; TIME="$VAL"
+    getval op; OP="$VAL"
+    getval pos; POS="$VAL"
+    getval rep; REP="$VAL"
+    if [ "$file" != "${file/+cov/}" ]; then
+      COV=1
+    else
+      COV=""
+    fi
+
+    if [ -n "$3" -a -s "$DIR/../edges.txt" ]; then
+      echo "$TIME;\"$file\";$ID;$SRC;$COV;$EDGES;$EDGES_TOTAL;\"$OP\";$POS;$REP;UNIQUE$file"
+    else
+      echo "$TIME;\"$file\";$ID;$SRC;$COV;;;\"$OP\";$POS;$REP;"
+    fi
+
+  done
+
+} | tee "$DIR/../queue.csv" > "$2" || exit 1
+
+if [ -n "$3" -a -s "$DIR/../edges.txt" ]; then
+
+  cat "$DIR/"* | sed 's/:.*//' | sort -n | uniq -c | egrep '^[ \t]*1 ' | awk '{print$2}' > $DIR/../unique.txt
+
+  if [ -s "$DIR/../unique.txt" ]; then
+
+    ls "$DIR/id:"* | grep -v ",sync:" |sed 's/.*\/id:/id:/g' | while read file; do
+
+      CNT=$(sed 's/:.*//' "$DIR/$file" | tee "$DIR/../tmp.txt" | wc -l)
+      DIFF=$(diff -u "$DIR/../tmp.txt" "$DIR/../unique.txt" | egrep '^-[0-9]' | wc -l)
+      UNIQUE=$(($CNT - $DIFF))
+      sed -i "s/;UNIQUE$file/;$UNIQUE/" "$DIR/../queue.csv" "$2"
+
+    done
+    
+    rm -f "$DIR/../tmp.txt"
+
+  else
+    
+    sed -i 's/;UNIQUE.*/;/' "$DIR/../queue.csv" "$2"
+  
+  fi  
+
+fi
+
+mv "$DIR/../queue.csv" "$DIR/queue.csv"
+if [ -e "$DIR/../edges.txt" ]; then mv "$DIR/../edges.txt" "$DIR/edges.txt"; fi
+if [ -e "$DIR/../unique.txt" ]; then mv "$DIR/../unique.txt" "$DIR/unique.txt"; fi
+
+echo "Created $2"
diff --git a/utils/argv_fuzzing/Makefile b/utils/argv_fuzzing/Makefile
new file mode 100644
index 00000000..5a0ac6e6
--- /dev/null
+++ b/utils/argv_fuzzing/Makefile
@@ -0,0 +1,58 @@
+#
+# american fuzzy lop++ - argvfuzz
+# --------------------------------
+#
+# Copyright 2019-2020 Kjell Braden <afflux@pentabarf.de>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+
+.PHONY: all install clean
+
+PREFIX     ?= /usr/local
+BIN_PATH    = $(PREFIX)/bin
+HELPER_PATH = $(PREFIX)/lib/afl
+
+CFLAGS = -fPIC -Wall -Wextra
+LDFLAGS = -shared
+
+UNAME_SAYS_LINUX=$(shell uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?)
+UNAME_SAYS_LINUX:sh=uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?
+
+_LDFLAGS_ADD=$(UNAME_SAYS_LINUX:1=)
+LDFLAGS_ADD=$(_LDFLAGS_ADD:0=-ldl)
+LDFLAGS  += $(LDFLAGS_ADD)
+
+# on gcc for arm there is no -m32, but -mbe32
+M32FLAG = -m32
+M64FLAG = -m64
+
+CC_IS_GCC=$(shell $(CC) --version 2>/dev/null | grep -q gcc; echo $$?)
+CC_IS_GCC:sh=$(CC) --version 2>/dev/null | grep -q gcc; echo $$?
+CC_IS_ARMCOMPILER=$(shell $(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?)
+CC_IS_ARMCOMPILER:sh=$(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?
+
+_M32FLAG=$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)
+__M32FLAG=$(_M32FLAG:00=-mbe32)
+___M32FLAG=$(__M32FLAG:$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)=-m32)
+M32FLAG=$(___M32FLAG)
+
+all: argvfuzz32.so argvfuzz64.so
+
+argvfuzz32.so: argvfuzz.c
+	-@$(CC) $(M32FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "argvfuzz32 build failure (that's fine)"
+
+argvfuzz64.so: argvfuzz.c
+	-@$(CC) $(M64FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "argvfuzz64 build failure (that's fine)"
+
+install: argvfuzz32.so argvfuzz64.so
+	install -d -m 755 $(DESTDIR)$(HELPER_PATH)/
+	if [ -f argvfuzz32.so ]; then set -e; install -m 755 argvfuzz32.so $(DESTDIR)$(HELPER_PATH)/; fi
+	if [ -f argvfuzz64.so ]; then set -e; install -m 755 argvfuzz64.so $(DESTDIR)$(HELPER_PATH)/; fi
+
+clean:
+	rm -f argvfuzz32.so argvfuzz64.so
diff --git a/utils/argv_fuzzing/README.md b/utils/argv_fuzzing/README.md
new file mode 100644
index 00000000..fa8cad80
--- /dev/null
+++ b/utils/argv_fuzzing/README.md
@@ -0,0 +1,16 @@
+# argvfuzz
+
+afl supports fuzzing file inputs or stdin. When source is available,
+`argv-fuzz-inl.h` can be used to change `main()` to build argv from stdin.
+
+`argvfuzz` tries to provide the same functionality for binaries. When loaded
+using `LD_PRELOAD`, it will hook the call to `__libc_start_main` and replace
+argv using the same logic of `argv-fuzz-inl.h`.
+
+A few conditions need to be fulfilled for this mechanism to work correctly:
+
+1. As it relies on hooking the loader, it cannot work on static binaries.
+2. If the target binary does not use the default libc's `_start` implementation
+   (crt1.o), the hook may not run.
+3. The hook will replace argv with pointers to `.data` of `argvfuzz.so`. If the
+   target binary expects argv to be living on the stack, things may go wrong.
diff --git a/utils/argv_fuzzing/argv-fuzz-inl.h b/utils/argv_fuzzing/argv-fuzz-inl.h
new file mode 100644
index 00000000..c15c0271
--- /dev/null
+++ b/utils/argv_fuzzing/argv-fuzz-inl.h
@@ -0,0 +1,90 @@
+/*
+   american fuzzy lop++ - sample argv fuzzing wrapper
+   ------------------------------------------------
+
+   Originally written by Michal Zalewski
+
+   Copyright 2015 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   This file shows a simple way to fuzz command-line parameters with stock
+   afl-fuzz. To use, add:
+
+   #include "/path/to/argv-fuzz-inl.h"
+
+   ...to the file containing main(), ideally placing it after all the
+   standard includes. Next, put AFL_INIT_ARGV(); near the very beginning of
+   main().
+
+   This will cause the program to read NUL-delimited input from stdin and
+   put it in argv[]. Two subsequent NULs terminate the array. Empty
+   params are encoded as a lone 0x02. Lone 0x02 can't be generated, but
+   that shouldn't matter in real life.
+
+   If you would like to always preserve argv[0], use this instead:
+   AFL_INIT_SET0("prog_name");
+
+*/
+
+#ifndef _HAVE_ARGV_FUZZ_INL
+#define _HAVE_ARGV_FUZZ_INL
+
+#include <unistd.h>
+
+#define AFL_INIT_ARGV()          \
+  do {                           \
+                                 \
+    argv = afl_init_argv(&argc); \
+                                 \
+  } while (0)
+
+#define AFL_INIT_SET0(_p)        \
+  do {                           \
+                                 \
+    argv = afl_init_argv(&argc); \
+    argv[0] = (_p);              \
+    if (!argc) argc = 1;         \
+                                 \
+  } while (0)
+
+#define MAX_CMDLINE_LEN 100000
+#define MAX_CMDLINE_PAR 50000
+
+static char **afl_init_argv(int *argc) {
+
+  static char  in_buf[MAX_CMDLINE_LEN];
+  static char *ret[MAX_CMDLINE_PAR];
+
+  char *ptr = in_buf;
+  int   rc = 0;
+
+  if (read(0, in_buf, MAX_CMDLINE_LEN - 2) < 0) {}
+
+  while (*ptr && rc < MAX_CMDLINE_PAR) {
+
+    ret[rc] = ptr;
+    if (ret[rc][0] == 0x02 && !ret[rc][1]) ret[rc]++;
+    rc++;
+
+    while (*ptr)
+      ptr++;
+    ptr++;
+
+  }
+
+  *argc = rc;
+
+  return ret;
+
+}
+
+#undef MAX_CMDLINE_LEN
+#undef MAX_CMDLINE_PAR
+
+#endif                                              /* !_HAVE_ARGV_FUZZ_INL */
+
diff --git a/utils/argv_fuzzing/argvfuzz.c b/utils/argv_fuzzing/argvfuzz.c
new file mode 100644
index 00000000..4251ca4c
--- /dev/null
+++ b/utils/argv_fuzzing/argvfuzz.c
@@ -0,0 +1,49 @@
+/*
+   american fuzzy lop++ - LD_PRELOAD for fuzzing argv in binaries
+   ------------------------------------------------------------
+
+   Copyright 2019-2020 Kjell Braden <afflux@pentabarf.de>
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ */
+
+#define _GNU_SOURCE                                        /* for RTLD_NEXT */
+#include <dlfcn.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include "argv-fuzz-inl.h"
+
+int __libc_start_main(int (*main)(int, char **, char **), int argc, char **argv,
+                      void (*init)(void), void (*fini)(void),
+                      void (*rtld_fini)(void), void *stack_end) {
+
+  int (*orig)(int (*main)(int, char **, char **), int argc, char **argv,
+              void (*init)(void), void (*fini)(void), void (*rtld_fini)(void),
+              void *stack_end);
+  int    sub_argc;
+  char **sub_argv;
+
+  (void)argc;
+  (void)argv;
+
+  orig = dlsym(RTLD_NEXT, __func__);
+
+  if (!orig) {
+
+    fprintf(stderr, "hook did not find original %s: %s\n", __func__, dlerror());
+    exit(EXIT_FAILURE);
+
+  }
+
+  sub_argv = afl_init_argv(&sub_argc);
+
+  return orig(main, sub_argc, sub_argv, init, fini, rtld_fini, stack_end);
+
+}
+
diff --git a/utils/asan_cgroups/limit_memory.sh b/utils/asan_cgroups/limit_memory.sh
new file mode 100755
index 00000000..1f0f04ad
--- /dev/null
+++ b/utils/asan_cgroups/limit_memory.sh
@@ -0,0 +1,157 @@
+#!/usr/bin/env bash
+#
+# american fuzzy lop++ - limit memory using cgroups
+# -----------------------------------------------
+#
+# Written by Samir Khakimov <samir.hakim@nyu.edu> and
+#            David A. Wheeler <dwheeler@ida.org>
+#
+# Edits to bring the script in line with afl-cmin and other companion scripts
+# by Michal Zalewski. All bugs are my fault.
+#
+# Copyright 2015 Institute for Defense Analyses.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# This tool allows the amount of actual memory allocated to a program
+# to be limited on Linux systems using cgroups, instead of the traditional
+# setrlimit() API. This helps avoid the address space problems discussed in
+# docs/notes_for_asan.md.
+#
+# Important: the limit covers *both* afl-fuzz and the fuzzed binary. In some
+# hopefully rare circumstances, afl-fuzz could be killed before the fuzzed
+# task.
+#
+
+echo "cgroup tool for afl-fuzz by <samir.hakim@nyu.edu> and <dwheeler@ida.org>"
+echo
+
+unset NEW_USER
+MEM_LIMIT="50"
+
+while getopts "+u:m:" opt; do
+
+  case "$opt" in
+
+    "u")
+         NEW_USER="$OPTARG"
+         ;;
+
+    "m")
+         MEM_LIMIT="$[OPTARG]"
+         ;;
+
+    "?")
+         exit 1
+         ;;
+
+   esac
+
+done
+
+if [ "$MEM_LIMIT" -lt "5" ]; then
+  echo "[-] Error: malformed or dangerously low value of -m." 1>&2
+  exit 1
+fi
+
+shift $((OPTIND-1))
+
+TARGET_BIN="$1"
+
+if [ "$TARGET_BIN" = "" -o "$NEW_USER" = "" ]; then
+
+  cat 1>&2 <<_EOF_
+Usage: $0 [ options ] -- /path/to/afl-fuzz [ ...afl options... ]
+
+Required parameters:
+
+  -u user   - run the fuzzer as a specific user after setting up limits
+
+Optional parameters:
+
+  -m megs   - set memory limit to a specified value ($MEM_LIMIT MB)
+
+This tool configures cgroups-based memory limits for a fuzzing job to simplify
+the task of fuzzing ASAN or MSAN binaries. You would normally want to use it in
+conjunction with '-m none' passed to the afl-fuzz binary itself, say:
+
+  $0 -u joe ./afl-fuzz -i input -o output -m none /path/to/target
+
+_EOF_
+
+  exit 1
+
+fi
+
+# Basic sanity checks
+
+if [ ! "`uname -s`" = "Linux" ]; then
+ echo "[-] Error: this tool does not support non-Linux systems." 1>&2
+ exit 1
+fi
+
+if [ ! "`id -u`" = "0" ]; then
+ echo "[-] Error: you need to run this script as root (sorry!)." 1>&2
+ exit 1
+fi
+
+if ! type cgcreate 2>/dev/null 1>&2; then
+
+  echo "[-] Error: you need to install cgroup tools first." 1>&2
+
+  if type apt-get 2>/dev/null 1>&2; then
+    echo "    (Perhaps 'apt-get install cgroup-bin' will work.)" 1>&2
+  elif type yum 2>/dev/null 1>&2; then
+    echo "    (Perhaps 'yum install libcgroup-tools' will work.)" 1>&2
+  fi
+
+  exit 1
+
+fi
+
+if ! id -u "$NEW_USER" 2>/dev/null 1>&2; then
+  echo "[-] Error: user '$NEW_USER' does not seem to exist." 1>&2
+  exit 1
+fi
+
+# Create a new cgroup path if necessary... We used PID-keyed groups to keep
+# parallel afl-fuzz tasks separate from each other.
+
+CID="afl-$NEW_USER-$$"
+
+CPATH="/sys/fs/cgroup/memory/$CID"
+
+if [ ! -d "$CPATH" ]; then
+
+  cgcreate -a "$NEW_USER" -g memory:"$CID" || exit 1
+
+fi
+
+# Set the appropriate limit...
+
+if [ -f "$CPATH/memory.memsw.limit_in_bytes" ]; then
+
+  echo "${MEM_LIMIT}M" > "$CPATH/memory.limit_in_bytes" 2>/dev/null
+  echo "${MEM_LIMIT}M" > "$CPATH/memory.memsw.limit_in_bytes" || exit 1
+  echo "${MEM_LIMIT}M" > "$CPATH/memory.limit_in_bytes" || exit 1
+
+elif grep -qE 'partition|file' /proc/swaps; then
+
+  echo "[-] Error: your system requires swap to be disabled first (swapoff -a)." 1>&2
+  exit 1
+
+else
+
+  echo "${MEM_LIMIT}M" > "$CPATH/memory.limit_in_bytes" || exit 1
+
+fi
+
+# All right. At this point, we can just run the command.
+
+cgexec -g "memory:$CID" su -c "$*" "$NEW_USER"
+
+cgdelete -g "memory:$CID"
diff --git a/utils/bash_shellshock/shellshock-fuzz.diff b/utils/bash_shellshock/shellshock-fuzz.diff
new file mode 100644
index 00000000..3fa05bf8
--- /dev/null
+++ b/utils/bash_shellshock/shellshock-fuzz.diff
@@ -0,0 +1,59 @@
+This patch shows a very simple way to find post-Shellshock bugs in bash, as
+discussed here:
+
+  http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html
+
+In essence, it shows a way to fuzz environmental variables. Instructions:
+
+1) Download bash 4.3, apply this patch, compile with:
+
+   CC=/path/to/afl-gcc ./configure
+   make clean all
+
+   Note that the harness puts the fuzzed output in $TEST_VARIABLE. With
+   Florian's Shellshock patch (bash43-028), this is no longer passed down
+   to the parser.
+
+2) Create and cd to an empty directory, put the compiled bash binary in
+   there, and run these commands:
+
+   mkdir in_dir
+   echo -n '() { a() { a; }; : >b; }' >in_dir/script.txt
+
+3) Run the fuzzer with:
+
+   /path/to/afl-fuzz -d -i in_dir -o out_dir ./bash -c :
+
+   The -d parameter is advisable only if the tested shell is fairly slow
+   or if you are in a hurry; will cover more ground faster, but
+   less systematically.
+
+4) Watch for crashes in out_dir/crashes/. Also watch for any new files
+   created in cwd if you're interested in non-crash RCEs (files will be
+   created whenever the shell executes "foo>bar" or something like
+   that). You can correlate their creation date with new entries in
+   out_dir/queue/.
+
+   You can also modify the bash binary to directly check for more subtle
+   fault conditions, or use the synthesized entries in out_dir/queue/
+   as a seed for other, possibly slower or more involved testing regimes.
+
+   Expect several hours to get decent coverage.
+
+--- bash-4.3/shell.c.orig	2014-01-14 14:04:32.000000000 +0100
++++ bash-4.3/shell.c	2015-04-30 05:56:46.000000000 +0200
+@@ -371,6 +371,14 @@
+   env = environ;
+ #endif /* __OPENNT */
+ 
++  {
++
++    static char val[1024 * 16];
++    read(0, val, sizeof(val) - 1);
++    setenv("TEST_VARIABLE", val, 1);
++
++  }
++
+   USE_VAR(argc);
+   USE_VAR(argv);
+   USE_VAR(env);
diff --git a/utils/canvas_harness/canvas_harness.html b/utils/canvas_harness/canvas_harness.html
new file mode 100644
index 00000000..a37b6937
--- /dev/null
+++ b/utils/canvas_harness/canvas_harness.html
@@ -0,0 +1,170 @@
+<html>
+<!--
+
+  american fuzzy lop++ - <canvas> harness
+  -------------------------------------
+ 
+  Originally written by Michal Zalewski
+ 
+  Copyright 2013, 2014 Google Inc. All rights reserved.
+ 
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at:
+ 
+    http://www.apache.org/licenses/LICENSE-2.0
+ 
+  A simple harness for going through afl-generated test cases, rendering them in
+  the browser environment, and discovering the use of uninitialized memory and
+  similar bugs. This code led to the discovery of a fair number of library and
+  browser security bugs!
+
+  The url_list[] array is a placeholder; for this to work properly, it needs to
+  be initialized with web-reachable paths to individual test cases. This can
+  be done manually or with a simple script.
+
+-->
+
+<body onload="set_images()">
+
+<div id="status"></div>
+
+<div id="image_div"></div>
+
+<canvas height=64 width=64 id=cvs></canvas>
+
+<h2>Results</h2>
+
+<ul id="output"></ul>
+
+<script>
+
+var c = document.getElementById('cvs');
+var ctx = c.getContext('2d');
+
+var url_list = [
+  "images/id:000000,[...].jpg",
+  "images/id:000001,[...].jpg",
+  /* ... */
+  null
+];
+
+var USE_IMAGES = 50;
+var cur_image = 0;
+
+if (location.hash) cur_image = parseInt(location.hash.substr(1));
+
+var loaded = 0;
+var image_obj = [];
+
+var msie_cleanup;
+
+function check_results() {
+
+  var uniques = [];
+
+  clearTimeout(msie_cleanup);
+
+  ctx.clearRect(0, 0, 64, 64);
+
+  uniques.push(image_obj[0].imgdata);
+
+  for (var i = 1; i < USE_IMAGES; i++) {
+
+    if (!image_obj[i].imgdata) continue;
+
+    if (image_obj[0].imgdata != image_obj[i].imgdata) {
+
+      for (var j = 1; j < uniques.length; j++)
+        if (uniques[j] == image_obj[i].imgdata) break;
+
+      if (j == uniques.length) uniques.push(image_obj[i].imgdata);
+
+
+    }
+
+  }
+
+  if (uniques.length > 1) {
+
+    var str = '<li> Image ' + url_list[cur_image] + ' has ' + uniques.length + ' variants: ';
+
+    for (var i = 0; i < uniques.length; i++)
+      str += '<img src="' + uniques[i] + '">';
+
+    document.getElementById('output').innerHTML += str;
+
+  }
+
+  cur_image++;
+  set_images();
+}
+
+
+function count_image() {
+
+  if (!this.complete || this.counted) return;
+
+  this.counted = true;
+
+  loaded++;
+
+  ctx.clearRect(0, 0, 64, 64);
+
+  try {
+    ctx.drawImage(this, 0, 0, 64, 64);
+  } catch (e) { }
+
+  this.imgdata = c.toDataURL();
+
+  if (loaded == USE_IMAGES) check_results();
+}
+
+
+function set_images() {
+
+  loaded = 0;
+
+  document.getElementById('status').innerHTML = 'Now processing ' + cur_image + '...';
+  location.hash = '#' + cur_image;
+
+  if (url_list[cur_image] == null) {
+    alert('Done!');
+    return;
+  }
+
+  restart_images();
+
+  msie_cleanup = setTimeout(check_results, 5000);
+
+  for (var i = 0; i < USE_IMAGES; i++)
+    image_obj[i].src = url_list[cur_image] + '?' + Math.random();
+
+}
+
+
+function restart_images() {
+
+  for (var i = 0; i < USE_IMAGES; i++) 
+    if (image_obj[i]) image_obj[i].counted = true;
+
+  document.getElementById('image_div').innerHTML = '';
+  image_obj = [];
+
+  for (var i = 0; i < USE_IMAGES; i++) {
+
+    image_obj[i] = new Image();
+    image_obj[i].height = 64;
+    image_obj[i].width = 64;
+    image_obj[i].onerror = count_image;
+    image_obj[i].onload = count_image;
+
+    document.getElementById('image_div').appendChild(image_obj[i]);
+
+  }
+
+}
+
+</script>
+
+<iframe src='http://www.cnn.com/'></iframe>
diff --git a/utils/clang_asm_normalize/as b/utils/clang_asm_normalize/as
new file mode 100755
index 00000000..45537cae
--- /dev/null
+++ b/utils/clang_asm_normalize/as
@@ -0,0 +1,75 @@
+#!/bin/sh
+#
+# american fuzzy lop++ - clang assembly normalizer
+# ----------------------------------------------
+#
+# Originally written by Michal Zalewski
+# The idea for this wrapper comes from Ryan Govostes.
+#
+# Copyright 2013, 2014 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# This 'as' wrapper should allow you to instrument unruly, hand-written
+# assembly with afl-as.
+#
+# Usage:
+#
+# export AFL_REAL_PATH=/path/to/directory/with/afl-as/
+# AFL_PATH=/path/to/this/directory/ make clean all
+
+if [ "$#" -lt "2" ]; then
+  echo "[-] Error: this utility can't be called directly." 1>&2
+  exit 1
+fi
+
+if [ "$AFL_REAL_PATH" = "" ]; then
+  echo "[-] Error: AFL_REAL_PATH not set!" 1>&2
+  exit 1
+fi
+
+if [ ! -x "$AFL_REAL_PATH/afl-as" ]; then
+  echo "[-] Error: AFL_REAL_PATH does not contain the 'afl-as' binary." 1>&2
+  exit 1
+fi
+
+unset __AFL_AS_CMDLINE __AFL_FNAME
+
+while [ ! "$#" = "0" ]; do
+
+  if [ "$#" = "1" ]; then
+    __AFL_FNAME="$1"
+  else
+    __AFL_AS_CMDLINE="${__AFL_AS_CMDLINE} $1"
+  fi
+
+  shift
+
+done
+
+test "$TMPDIR" = "" && TMPDIR=/tmp
+
+TMPFILE=`mktemp $TMPDIR/.afl-XXXXXXXXXX.s`
+
+test "$TMPFILE" = "" && exit 1
+
+clang -cc1as -filetype asm -output-asm-variant 0 "${__AFL_FNAME}" >"$TMPFILE"
+
+ERR="$?"
+
+if [ ! "$ERR" = "0" ]; then
+  rm -f "$TMPFILE"
+  exit $ERR
+fi
+
+"$AFL_REAL_PATH/afl-as" ${__AFL_AS_CMDLINE} "$TMPFILE"
+
+ERR="$?"
+
+rm -f "$TMPFILE"
+
+exit "$ERR"
diff --git a/utils/crash_triage/triage_crashes.sh b/utils/crash_triage/triage_crashes.sh
new file mode 100755
index 00000000..bf763cba
--- /dev/null
+++ b/utils/crash_triage/triage_crashes.sh
@@ -0,0 +1,115 @@
+#!/bin/sh
+#
+# american fuzzy lop++ - crash triage utility
+# -----------------------------------------
+#
+# Originally written by Michal Zalewski
+#
+# Copyright 2013, 2014, 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Note that this assumes that the targeted application reads from stdin
+# and requires no other cmdline parameters. Modify as needed if this is
+# not the case.
+#
+# Note that on OpenBSD, you may need to install a newer version of gdb
+# (e.g., from ports). You can set GDB=/some/path to point to it if
+# necessary.
+#
+
+echo "crash triage utility for afl-fuzz by Michal Zalewski"
+echo
+
+ulimit -v 100000 2>/dev/null
+ulimit -d 100000 2>/dev/null
+
+if [ "$#" -lt "2" ]; then
+  echo "Usage: $0 /path/to/afl_output_dir /path/to/tested_binary [...target params...]" 1>&2
+  echo 1>&2
+  exit 1
+fi
+
+DIR="$1"
+BIN="$2"
+shift
+shift
+
+if [ "$AFL_ALLOW_TMP" = "" ]; then
+
+  echo "$DIR" | grep -qE '^(/var)?/tmp/'
+  T1="$?"
+
+  echo "$BIN" | grep -qE '^(/var)?/tmp/'
+  T2="$?"
+
+  if [ "$T1" = "0" -o "$T2" = "0" ]; then
+    echo "[-] Error: do not use shared /tmp or /var/tmp directories with this script." 1>&2
+    exit 1
+  fi
+
+fi
+
+if
+ [ "$GDB" = "" ]; then
+  GDB=gdb
+fi
+
+if [ ! -f "$BIN" -o ! -x "$BIN" ]; then
+  echo "[-] Error: binary '$2' not found or is not executable." 1>&2
+  exit 1
+fi
+
+if [ ! -d "$DIR/queue" ]; then
+  echo "[-] Error: directory '$1' not found or not created by afl-fuzz." 1>&2
+  exit 1
+fi
+
+CCOUNT=$((`ls -- "$DIR/crashes" 2>/dev/null | wc -l`))
+
+if [ "$CCOUNT" = "0" ]; then
+  echo "No crashes recorded in the target directory - nothing to be done."
+  exit 0
+fi
+
+echo
+
+for crash in $DIR/crashes/id:*; do
+
+  id=`basename -- "$crash" | cut -d, -f1 | cut -d: -f2`
+  sig=`basename -- "$crash" | cut -d, -f2 | cut -d: -f2`
+
+  # Grab the args, converting @@ to $crash
+
+  use_args=""
+  use_stdio=1
+
+  for a in $@; do
+
+    if [ "$a" = "@@" ] ; then
+      use_args="$use_args $crash"
+      unset use_stdio
+    else
+      use_args="$use_args $a"
+    fi
+
+  done
+
+  # Strip the trailing space
+  use_args="${use_args# }"
+
+  echo "+++ ID $id, SIGNAL $sig +++"
+  echo
+
+  if [ "$use_stdio" = "1" ]; then  
+    $GDB --batch -q --ex "r $use_args <$crash" --ex 'back' --ex 'disass $pc, $pc+16' --ex 'info reg' --ex 'quit' "$BIN" 0</dev/null
+  else
+    $GDB --batch -q --ex "r $use_args" --ex 'back' --ex 'disass $pc, $pc+16' --ex 'info reg' --ex 'quit' "$BIN" 0</dev/null
+  fi
+  echo
+
+done
diff --git a/utils/custom_mutators/Makefile b/utils/custom_mutators/Makefile
new file mode 100644
index 00000000..9849f3f4
--- /dev/null
+++ b/utils/custom_mutators/Makefile
@@ -0,0 +1,7 @@
+all: libexamplemutator.so
+
+libexamplemutator.so:
+	$(CC) $(CFLAGS) -D_FORTIFY_SOURCE=2 -O3 -fPIC -shared -g -I ../../include example.c -o libexamplemutator.so
+
+clean:
+	rm -rf libexamplemutator.so
diff --git a/utils/custom_mutators/README.md b/utils/custom_mutators/README.md
new file mode 100644
index 00000000..655f7a5e
--- /dev/null
+++ b/utils/custom_mutators/README.md
@@ -0,0 +1,35 @@
+# Examples for the custom mutator
+
+These are example and helper files for the custom mutator feature.
+See [docs/custom_mutators.md](../../docs/custom_mutators.md) for more information
+
+Note that if you compile with python3.7 you must use python3 scripts, and if
+you use python2.7 to compile python2 scripts!
+
+simple_example.c - most simplest example. generates a random sized buffer
+          filled with 'A'
+
+example.c - this is a simple example written in C and should be compiled to a
+          shared library. Use make to compile it and produce libexamplemutator.so
+
+example.py - this is the template you can use, the functions are there but they
+           are empty
+
+post_library_gif.so.c - fix a fuzz input to ensure it is valid for GIF
+
+post_library_png.so.c - fix a fuzz input to ensure it is valid for PNG
+
+simple-chunk-replace.py - this is a simple example where chunks are replaced
+
+common.py - this can be used for common functions and helpers.
+          the examples do not use this though. But you can :)
+
+wrapper_afl_min.py - mutation of XML documents, loads XmlMutatorMin.py
+
+XmlMutatorMin.py - module for XML mutation
+
+custom_mutator_helpers.h is an header that defines some helper routines
+like surgical_havoc_mutate() that allow to perform a randomly chosen
+mutation from a subset of the havoc mutations.
+If you do so, you have to specify -I /path/to/AFLplusplus/include when
+compiling.
diff --git a/utils/custom_mutators/XmlMutatorMin.py b/utils/custom_mutators/XmlMutatorMin.py
new file mode 100644
index 00000000..4c80a2ba
--- /dev/null
+++ b/utils/custom_mutators/XmlMutatorMin.py
@@ -0,0 +1,332 @@
+#!/usr/bin/python
+
+""" Mutation of XML documents, should be called from one of its wrappers (CLI, AFL, ...) """
+
+from __future__ import print_function
+from copy import deepcopy
+from lxml import etree as ET
+import random, re, io
+
+
+###########################
+# The XmlMutatorMin class #
+###########################
+
+class XmlMutatorMin:
+
+    """
+        Optionals parameters:
+            seed        Seed used by the PRNG (default: "RANDOM")
+            verbose     Verbosity (default: False)
+    """
+
+    def __init__(self, seed="RANDOM", verbose=False):
+
+        """ Initialize seed, database and mutators """
+
+        # Verbosity
+        self.verbose = verbose
+
+        # Initialize PRNG
+        self.seed = str(seed)
+        if self.seed == "RANDOM":
+            random.seed()
+        else:
+            if self.verbose:
+                print("Static seed '%s'" % self.seed)
+            random.seed(self.seed)
+
+        # Initialize input and output documents
+        self.input_tree = None
+        self.tree = None
+
+        # High-level mutators (no database needed)
+        hl_mutators_delete = ["del_node_and_children", "del_node_but_children", "del_attribute", "del_content"]  # Delete items
+        hl_mutators_fuzz = ["fuzz_attribute"]  # Randomly change attribute values
+
+        # Exposed mutators
+        self.hl_mutators_all = hl_mutators_fuzz + hl_mutators_delete
+
+    def __parse_xml(self, xml):
+
+        """ Parse an XML string. Basic wrapper around lxml.parse() """
+
+        try:
+            # Function parse() takes care of comments / DTD / processing instructions / ...
+            tree = ET.parse(io.BytesIO(xml))
+        except ET.ParseError:
+            raise RuntimeError("XML isn't well-formed!")
+        except LookupError as e:
+            raise RuntimeError(e)
+
+        # Return a document wrapper
+        return tree
+
+    def __exec_among(self, module, functions, min_times, max_times):
+
+        """ Randomly execute $functions between $min and $max times """
+
+        for i in xrange(random.randint(min_times, max_times)):
+            # Function names are mangled because they are "private"
+            getattr(module, "_XmlMutatorMin__" + random.choice(functions))()
+
+    def __serialize_xml(self, tree):
+
+        """ Serialize a XML document. Basic wrapper around lxml.tostring() """
+
+        return ET.tostring(tree, with_tail=False, xml_declaration=True, encoding=tree.docinfo.encoding)
+
+    def __ver(self, version):
+
+        """ Helper for displaying lxml version numbers """
+
+        return ".".join(map(str, version))
+
+    def reset(self):
+
+        """ Reset the mutator """
+
+        self.tree = deepcopy(self.input_tree)
+
+    def init_from_string(self, input_string):
+
+        """ Initialize the mutator from a XML string """
+
+        # Get a pointer to the top-element
+        self.input_tree = self.__parse_xml(input_string)
+
+        # Get a working copy
+        self.tree = deepcopy(self.input_tree)
+
+    def save_to_string(self):
+
+        """ Return the current XML document as UTF-8 string """
+
+        # Return a text version of the tree
+        return self.__serialize_xml(self.tree)
+
+    def __pick_element(self, exclude_root_node=False):
+
+        """ Pick a random element from the current document """
+
+        # Get a list of all elements, but nodes like PI and comments
+        elems = list(self.tree.getroot().iter(tag=ET.Element))
+
+        # Is the root node excluded?
+        if exclude_root_node:
+            start = 1
+        else:
+            start = 0
+
+        # Pick a random element
+        try:
+            elem_id = random.randint(start, len(elems) - 1)
+            elem = elems[elem_id]
+        except ValueError:
+            # Should only occurs if "exclude_root_node = True"
+            return (None, None)
+
+        return (elem_id, elem)
+
+    def __fuzz_attribute(self):
+
+        """ Fuzz (part of) an attribute value """
+
+        # Select a node to modify
+        (rand_elem_id, rand_elem) = self.__pick_element()
+
+        # Get all the attributes
+        attribs = rand_elem.keys()
+
+        # Is there attributes?
+        if len(attribs) < 1:
+            if self.verbose:
+                print("No attribute: can't replace!")
+            return
+
+        # Pick a random attribute
+        rand_attrib_id = random.randint(0, len(attribs) - 1)
+        rand_attrib = attribs[rand_attrib_id]
+
+        # We have the attribute to modify
+        # Get its value
+        attrib_value = rand_elem.get(rand_attrib)
+        # print("- Value: " + attrib_value)
+
+        # Should we work on the whole value?
+        func_call = "(?P<func>[a-zA-Z:\-]+)\((?P<args>.*?)\)"
+        p = re.compile(func_call)
+        l = p.findall(attrib_value)
+        if random.choice((True, False)) and l:
+            # Randomly pick one the function calls
+            (func, args) = random.choice(l)
+            # Split by "," and randomly pick one of the arguments
+            value = random.choice(args.split(','))
+            # Remove superfluous characters
+            unclean_value = value
+            value = value.strip(" ").strip("'")
+            # print("Selected argument: [%s]" % value)
+        else:
+            value = attrib_value
+
+        # For each type, define some possible replacement values
+        choices_number =    ( \
+                                "0", \
+                                "11111", \
+                                "-128", \
+                                "2", \
+                                "-1", \
+                                "1/3", \
+                                "42/0", \
+                                "1094861636 idiv 1.0", \
+                                "-1123329771506872 idiv 3.8", \
+                                "17=$numericRTF", \
+                                str(3 + random.randrange(0, 100)), \
+                            )
+
+        choices_letter =    ( \
+                                "P" * (25 * random.randrange(1, 100)), \
+                                "%s%s%s%s%s%s", \
+                                "foobar", \
+                            )
+
+        choices_alnum =     ( \
+                                "Abc123", \
+                                "020F0302020204030204", \
+                                "020F0302020204030204" * (random.randrange(5, 20)), \
+                            )
+
+        # Fuzz the value
+        if random.choice((True,False)) and value == "":
+
+            # Empty
+            new_value = value
+
+        elif random.choice((True,False)) and value.isdigit():
+
+            # Numbers
+            new_value = random.choice(choices_number)
+
+        elif random.choice((True,False)) and value.isalpha():
+
+            # Letters
+            new_value = random.choice(choices_letter)
+
+        elif random.choice((True,False)) and value.isalnum():
+
+            # Alphanumeric
+            new_value = random.choice(choices_alnum)
+
+        else:
+
+            # Default type
+            new_value = random.choice(choices_alnum + choices_letter + choices_number)
+
+        # If we worked on a substring, apply changes to the whole string
+        if value != attrib_value:
+            # No ' around empty values
+            if new_value != "" and value != "":
+                new_value = "'" + new_value + "'"
+            # Apply changes
+            new_value = attrib_value.replace(unclean_value, new_value)
+
+        # Log something
+        if self.verbose:
+            print("Fuzzing attribute #%i '%s' of tag #%i '%s'" % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag))
+
+        # Modify the attribute
+        rand_elem.set(rand_attrib, new_value.decode("utf-8"))
+
+    def __del_node_and_children(self):
+
+        """ High-level minimizing mutator
+            Delete a random node and its children (i.e. delete a random tree) """
+
+        self.__del_node(True)
+
+    def __del_node_but_children(self):
+
+        """ High-level minimizing mutator
+            Delete a random node but its children (i.e. link them to the parent of the deleted node) """
+
+        self.__del_node(False)
+
+    def __del_node(self, delete_children):
+
+        """ Called by the __del_node_* mutators """
+
+        # Select a node to modify (but the root one)
+        (rand_elem_id, rand_elem) = self.__pick_element(exclude_root_node=True)
+
+        # If the document includes only a top-level element
+        # Then we can't pick a element (given that "exclude_root_node = True")
+
+        # Is the document deep enough?
+        if rand_elem is None:
+            if self.verbose:
+                print("Can't delete a node: document not deep enough!")
+            return
+
+        # Log something
+        if self.verbose:
+            but_or_and = "and" if delete_children else "but"
+            print("Deleting tag #%i '%s' %s its children" % (rand_elem_id, rand_elem.tag, but_or_and))
+
+        if delete_children is False:
+            # Link children of the random (soon to be deleted) node to its parent
+            for child in rand_elem:
+                rand_elem.getparent().append(child)
+
+        # Remove the node
+        rand_elem.getparent().remove(rand_elem)
+
+    def __del_content(self):
+
+        """ High-level minimizing mutator
+            Delete the attributes and children of a random node """
+
+        # Select a node to modify
+        (rand_elem_id, rand_elem) = self.__pick_element()
+
+        # Log something
+        if self.verbose:
+            print("Reseting tag #%i '%s'" % (rand_elem_id, rand_elem.tag))
+
+        # Reset the node
+        rand_elem.clear()
+
+    def __del_attribute(self):
+
+        """ High-level minimizing mutator
+            Delete a random attribute from a random node """
+
+        # Select a node to modify
+        (rand_elem_id, rand_elem) = self.__pick_element()
+
+        # Get all the attributes
+        attribs = rand_elem.keys()
+
+        # Is there attributes?
+        if len(attribs) < 1:
+            if self.verbose:
+                print("No attribute: can't delete!")
+            return
+
+        # Pick a random attribute
+        rand_attrib_id = random.randint(0, len(attribs) - 1)
+        rand_attrib = attribs[rand_attrib_id]
+
+        # Log something
+        if self.verbose:
+            print("Deleting attribute #%i '%s' of tag #%i '%s'" % (rand_attrib_id, rand_attrib, rand_elem_id, rand_elem.tag))
+
+        # Delete the attribute
+        rand_elem.attrib.pop(rand_attrib)
+
+    def mutate(self, min=1, max=5):
+
+        """ Execute some high-level mutators between $min and $max times, then some medium-level ones """
+
+        # High-level mutation
+        self.__exec_among(self, self.hl_mutators_all, min, max)
+
diff --git a/utils/custom_mutators/common.py b/utils/custom_mutators/common.py
new file mode 100644
index 00000000..9a1ef0a3
--- /dev/null
+++ b/utils/custom_mutators/common.py
@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+# encoding: utf-8
+'''
+Module containing functions shared between multiple AFL modules
+
+@author:     Christian Holler (:decoder)
+
+@license:
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+@contact:    choller@mozilla.com
+'''
+
+from __future__ import print_function
+import random
+import os
+import re
+
+
+def randel(l):
+    if not l:
+        return None
+    return l[random.randint(0, len(l)-1)]
+
+
+def randel_pop(l):
+    if not l:
+        return None
+    return l.pop(random.randint(0, len(l)-1))
+
+
+def write_exc_example(data, exc):
+    exc_name = re.sub(r'[^a-zA-Z0-9]', '_', repr(exc))
+
+    if not os.path.exists(exc_name):
+        with open(exc_name, 'w') as f:
+            f.write(data)
diff --git a/utils/custom_mutators/custom_mutator_helpers.h b/utils/custom_mutators/custom_mutator_helpers.h
new file mode 100644
index 00000000..62e6efba
--- /dev/null
+++ b/utils/custom_mutators/custom_mutator_helpers.h
@@ -0,0 +1,342 @@
+#ifndef CUSTOM_MUTATOR_HELPERS
+#define CUSTOM_MUTATOR_HELPERS
+
+#include "config.h"
+#include "types.h"
+#include <stdlib.h>
+
+#define INITIAL_GROWTH_SIZE (64)
+
+#define RAND_BELOW(limit) (rand() % (limit))
+
+/* Use in a struct: creates a name_buf and a name_size variable. */
+#define BUF_VAR(type, name) \
+  type * name##_buf;        \
+  size_t name##_size;
+/* this fills in `&structptr->something_buf, &structptr->something_size`. */
+#define BUF_PARAMS(struct, name) \
+  (void **)&struct->name##_buf, &struct->name##_size
+
+typedef struct {
+
+} afl_t;
+
+static void surgical_havoc_mutate(u8 *out_buf, s32 begin, s32 end) {
+
+  static s8  interesting_8[] = {INTERESTING_8};
+  static s16 interesting_16[] = {INTERESTING_8, INTERESTING_16};
+  static s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32};
+
+  switch (RAND_BELOW(12)) {
+
+    case 0: {
+
+      /* Flip a single bit somewhere. Spooky! */
+
+      s32 bit_idx = ((RAND_BELOW(end - begin) + begin) << 3) + RAND_BELOW(8);
+
+      out_buf[bit_idx >> 3] ^= 128 >> (bit_idx & 7);
+
+      break;
+
+    }
+
+    case 1: {
+
+      /* Set byte to interesting value. */
+
+      u8 val = interesting_8[RAND_BELOW(sizeof(interesting_8))];
+      out_buf[(RAND_BELOW(end - begin) + begin)] = val;
+
+      break;
+
+    }
+
+    case 2: {
+
+      /* Set word to interesting value, randomly choosing endian. */
+
+      if (end - begin < 2) break;
+
+      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
+
+      if (byte_idx >= end - 1) break;
+
+      switch (RAND_BELOW(2)) {
+
+        case 0:
+          *(u16 *)(out_buf + byte_idx) =
+              interesting_16[RAND_BELOW(sizeof(interesting_16) >> 1)];
+          break;
+        case 1:
+          *(u16 *)(out_buf + byte_idx) =
+              SWAP16(interesting_16[RAND_BELOW(sizeof(interesting_16) >> 1)]);
+          break;
+
+      }
+
+      break;
+
+    }
+
+    case 3: {
+
+      /* Set dword to interesting value, randomly choosing endian. */
+
+      if (end - begin < 4) break;
+
+      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
+
+      if (byte_idx >= end - 3) break;
+
+      switch (RAND_BELOW(2)) {
+
+        case 0:
+          *(u32 *)(out_buf + byte_idx) =
+              interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
+          break;
+        case 1:
+          *(u32 *)(out_buf + byte_idx) =
+              SWAP32(interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
+          break;
+
+      }
+
+      break;
+
+    }
+
+    case 4: {
+
+      /* Set qword to interesting value, randomly choosing endian. */
+
+      if (end - begin < 8) break;
+
+      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
+
+      if (byte_idx >= end - 7) break;
+
+      switch (RAND_BELOW(2)) {
+
+        case 0:
+          *(u64 *)(out_buf + byte_idx) =
+              (s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)];
+          break;
+        case 1:
+          *(u64 *)(out_buf + byte_idx) = SWAP64(
+              (s64)interesting_32[RAND_BELOW(sizeof(interesting_32) >> 2)]);
+          break;
+
+      }
+
+      break;
+
+    }
+
+    case 5: {
+
+      /* Randomly subtract from byte. */
+
+      out_buf[(RAND_BELOW(end - begin) + begin)] -= 1 + RAND_BELOW(ARITH_MAX);
+
+      break;
+
+    }
+
+    case 6: {
+
+      /* Randomly add to byte. */
+
+      out_buf[(RAND_BELOW(end - begin) + begin)] += 1 + RAND_BELOW(ARITH_MAX);
+
+      break;
+
+    }
+
+    case 7: {
+
+      /* Randomly subtract from word, random endian. */
+
+      if (end - begin < 2) break;
+
+      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
+
+      if (byte_idx >= end - 1) break;
+
+      if (RAND_BELOW(2)) {
+
+        *(u16 *)(out_buf + byte_idx) -= 1 + RAND_BELOW(ARITH_MAX);
+
+      } else {
+
+        u16 num = 1 + RAND_BELOW(ARITH_MAX);
+
+        *(u16 *)(out_buf + byte_idx) =
+            SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) - num);
+
+      }
+
+      break;
+
+    }
+
+    case 8: {
+
+      /* Randomly add to word, random endian. */
+
+      if (end - begin < 2) break;
+
+      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
+
+      if (byte_idx >= end - 1) break;
+
+      if (RAND_BELOW(2)) {
+
+        *(u16 *)(out_buf + byte_idx) += 1 + RAND_BELOW(ARITH_MAX);
+
+      } else {
+
+        u16 num = 1 + RAND_BELOW(ARITH_MAX);
+
+        *(u16 *)(out_buf + byte_idx) =
+            SWAP16(SWAP16(*(u16 *)(out_buf + byte_idx)) + num);
+
+      }
+
+      break;
+
+    }
+
+    case 9: {
+
+      /* Randomly subtract from dword, random endian. */
+
+      if (end - begin < 4) break;
+
+      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
+
+      if (byte_idx >= end - 3) break;
+
+      if (RAND_BELOW(2)) {
+
+        *(u32 *)(out_buf + byte_idx) -= 1 + RAND_BELOW(ARITH_MAX);
+
+      } else {
+
+        u32 num = 1 + RAND_BELOW(ARITH_MAX);
+
+        *(u32 *)(out_buf + byte_idx) =
+            SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) - num);
+
+      }
+
+      break;
+
+    }
+
+    case 10: {
+
+      /* Randomly add to dword, random endian. */
+
+      if (end - begin < 4) break;
+
+      s32 byte_idx = (RAND_BELOW(end - begin) + begin);
+
+      if (byte_idx >= end - 3) break;
+
+      if (RAND_BELOW(2)) {
+
+        *(u32 *)(out_buf + byte_idx) += 1 + RAND_BELOW(ARITH_MAX);
+
+      } else {
+
+        u32 num = 1 + RAND_BELOW(ARITH_MAX);
+
+        *(u32 *)(out_buf + byte_idx) =
+            SWAP32(SWAP32(*(u32 *)(out_buf + byte_idx)) + num);
+
+      }
+
+      break;
+
+    }
+
+    case 11: {
+
+      /* Just set a random byte to a random value. Because,
+         why not. We use XOR with 1-255 to eliminate the
+         possibility of a no-op. */
+
+      out_buf[(RAND_BELOW(end - begin) + begin)] ^= 1 + RAND_BELOW(255);
+
+      break;
+
+    }
+
+  }
+
+}
+
+/* This function calculates the next power of 2 greater or equal its argument.
+ @return The rounded up power of 2 (if no overflow) or 0 on overflow.
+*/
+static inline size_t next_pow2(size_t in) {
+
+  if (in == 0 || in > (size_t)-1)
+    return 0;                  /* avoid undefined behaviour under-/overflow */
+  size_t out = in - 1;
+  out |= out >> 1;
+  out |= out >> 2;
+  out |= out >> 4;
+  out |= out >> 8;
+  out |= out >> 16;
+  return out + 1;
+
+}
+
+/* This function makes sure *size is > size_needed after call.
+ It will realloc *buf otherwise.
+ *size will grow exponentially as per:
+ https://blog.mozilla.org/nnethercote/2014/11/04/please-grow-your-buffers-exponentially/
+ Will return NULL and free *buf if size_needed is <1 or realloc failed.
+ @return For convenience, this function returns *buf.
+ */
+static inline void *maybe_grow(void **buf, size_t *size, size_t size_needed) {
+
+  /* No need to realloc */
+  if (likely(size_needed && *size >= size_needed)) return *buf;
+
+  /* No initial size was set */
+  if (size_needed < INITIAL_GROWTH_SIZE) size_needed = INITIAL_GROWTH_SIZE;
+
+  /* grow exponentially */
+  size_t next_size = next_pow2(size_needed);
+
+  /* handle overflow */
+  if (!next_size) { next_size = size_needed; }
+
+  /* alloc */
+  *buf = realloc(*buf, next_size);
+  *size = *buf ? next_size : 0;
+
+  return *buf;
+
+}
+
+/* Swaps buf1 ptr and buf2 ptr, as well as their sizes */
+static inline void afl_swap_bufs(void **buf1, size_t *size1, void **buf2,
+                                 size_t *size2) {
+
+  void * scratch_buf = *buf1;
+  size_t scratch_size = *size1;
+  *buf1 = *buf2;
+  *size1 = *size2;
+  *buf2 = scratch_buf;
+  *size2 = scratch_size;
+
+}
+
+#undef INITIAL_GROWTH_SIZE
+
+#endif
+
diff --git a/utils/custom_mutators/example.c b/utils/custom_mutators/example.c
new file mode 100644
index 00000000..23add128
--- /dev/null
+++ b/utils/custom_mutators/example.c
@@ -0,0 +1,376 @@
+/*
+  New Custom Mutator for AFL++
+  Written by Khaled Yakdan <yakdan@code-intelligence.de>
+             Andrea Fioraldi <andreafioraldi@gmail.com>
+             Shengtuo Hu <h1994st@gmail.com>
+             Dominik Maier <mail@dmnk.co>
+*/
+
+// You need to use -I /path/to/AFLplusplus/include
+#include "custom_mutator_helpers.h"
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+#define DATA_SIZE (100)
+
+static const char *commands[] = {
+
+    "GET",
+    "PUT",
+    "DEL",
+
+};
+
+typedef struct my_mutator {
+
+  afl_t *afl;
+
+  // any additional data here!
+  size_t trim_size_current;
+  int    trimmming_steps;
+  int    cur_step;
+
+  // Reused buffers:
+  BUF_VAR(u8, fuzz);
+  BUF_VAR(u8, data);
+  BUF_VAR(u8, havoc);
+  BUF_VAR(u8, trim);
+  BUF_VAR(u8, post_process);
+
+} my_mutator_t;
+
+/**
+ * Initialize this custom mutator
+ *
+ * @param[in] afl a pointer to the internal state object. Can be ignored for
+ * now.
+ * @param[in] seed A seed for this mutator - the same seed should always mutate
+ * in the same way.
+ * @return Pointer to the data object this custom mutator instance should use.
+ *         There may be multiple instances of this mutator in one afl-fuzz run!
+ *         Return NULL on error.
+ */
+my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) {
+
+  srand(seed);  // needed also by surgical_havoc_mutate()
+
+  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
+  if (!data) {
+
+    perror("afl_custom_init alloc");
+    return NULL;
+
+  }
+
+  data->afl = afl;
+
+  return data;
+
+}
+
+/**
+ * Perform custom mutations on a given input
+ *
+ * (Optional for now. Required in the future)
+ *
+ * @param[in] data pointer returned in afl_custom_init for this fuzz case
+ * @param[in] buf Pointer to input data to be mutated
+ * @param[in] buf_size Size of input data
+ * @param[out] out_buf the buffer we will work on. we can reuse *buf. NULL on
+ * error.
+ * @param[in] add_buf Buffer containing the additional test case
+ * @param[in] add_buf_size Size of the additional test case
+ * @param[in] max_size Maximum size of the mutated output. The mutation must not
+ *     produce data larger than max_size.
+ * @return Size of the mutated output.
+ */
+size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
+                       u8 **out_buf, uint8_t *add_buf,
+                       size_t add_buf_size,  // add_buf can be NULL
+                       size_t max_size) {
+
+  // Make sure that the packet size does not exceed the maximum size expected by
+  // the fuzzer
+  size_t mutated_size = DATA_SIZE <= max_size ? DATA_SIZE : max_size;
+
+  // maybe_grow is optimized to be quick for reused buffers.
+  u8 *mutated_out = maybe_grow(BUF_PARAMS(data, fuzz), mutated_size);
+  if (!mutated_out) {
+
+    *out_buf = NULL;
+    perror("custom mutator allocation (maybe_grow)");
+    return 0;            /* afl-fuzz will very likely error out after this. */
+
+  }
+
+  // Randomly select a command string to add as a header to the packet
+  memcpy(mutated_out, commands[rand() % 3], 3);
+
+  // Mutate the payload of the packet
+  int i;
+  for (i = 0; i < 8; ++i) {
+
+    // Randomly perform one of the (no len modification) havoc mutations
+    surgical_havoc_mutate(mutated_out, 3, mutated_size);
+
+  }
+
+  *out_buf = mutated_out;
+  return mutated_size;
+
+}
+
+/**
+ * A post-processing function to use right before AFL writes the test case to
+ * disk in order to execute the target.
+ *
+ * (Optional) If this functionality is not needed, simply don't define this
+ * function.
+ *
+ * @param[in] data pointer returned in afl_custom_init for this fuzz case
+ * @param[in] buf Buffer containing the test case to be executed
+ * @param[in] buf_size Size of the test case
+ * @param[out] out_buf Pointer to the buffer containing the test case after
+ *     processing. External library should allocate memory for out_buf.
+ *     The buf pointer may be reused (up to the given buf_size);
+ * @return Size of the output buffer after processing or the needed amount.
+ *     A return of 0 indicates an error.
+ */
+size_t afl_custom_post_process(my_mutator_t *data, uint8_t *buf,
+                               size_t buf_size, uint8_t **out_buf) {
+
+  uint8_t *post_process_buf =
+      maybe_grow(BUF_PARAMS(data, post_process), buf_size + 5);
+  if (!post_process_buf) {
+
+    perror("custom mutator realloc failed.");
+    *out_buf = NULL;
+    return 0;
+
+  }
+
+  memcpy(post_process_buf + 5, buf, buf_size);
+  post_process_buf[0] = 'A';
+  post_process_buf[1] = 'F';
+  post_process_buf[2] = 'L';
+  post_process_buf[3] = '+';
+  post_process_buf[4] = '+';
+
+  *out_buf = post_process_buf;
+
+  return buf_size + 5;
+
+}
+
+/**
+ * This method is called at the start of each trimming operation and receives
+ * the initial buffer. It should return the amount of iteration steps possible
+ * on this input (e.g. if your input has n elements and you want to remove
+ * them one by one, return n, if you do a binary search, return log(n),
+ * and so on...).
+ *
+ * If your trimming algorithm doesn't allow you to determine the amount of
+ * (remaining) steps easily (esp. while running), then you can alternatively
+ * return 1 here and always return 0 in post_trim until you are finished and
+ * no steps remain. In that case, returning 1 in post_trim will end the
+ * trimming routine. The whole current index/max iterations stuff is only used
+ * to show progress.
+ *
+ * (Optional)
+ *
+ * @param data pointer returned in afl_custom_init for this fuzz case
+ * @param buf Buffer containing the test case
+ * @param buf_size Size of the test case
+ * @return The amount of possible iteration steps to trim the input.
+ *        negative on error.
+ */
+int32_t afl_custom_init_trim(my_mutator_t *data, uint8_t *buf,
+                             size_t buf_size) {
+
+  // We simply trim once
+  data->trimmming_steps = 1;
+
+  data->cur_step = 0;
+
+  if (!maybe_grow(BUF_PARAMS(data, trim), buf_size)) {
+
+    perror("init_trim grow");
+    return -1;
+
+  }
+
+  memcpy(data->trim_buf, buf, buf_size);
+
+  data->trim_size_current = buf_size;
+
+  return data->trimmming_steps;
+
+}
+
+/**
+ * This method is called for each trimming operation. It doesn't have any
+ * arguments because we already have the initial buffer from init_trim and we
+ * can memorize the current state in *data. This can also save
+ * reparsing steps for each iteration. It should return the trimmed input
+ * buffer, where the returned data must not exceed the initial input data in
+ * length. Returning anything that is larger than the original data (passed
+ * to init_trim) will result in a fatal abort of AFLFuzz.
+ *
+ * (Optional)
+ *
+ * @param[in] data pointer returned in afl_custom_init for this fuzz case
+ * @param[out] out_buf Pointer to the buffer containing the trimmed test case.
+ *     External library should allocate memory for out_buf.
+ *     AFL++ will not release the memory after saving the test case.
+ *     Keep a ref in *data.
+ *     *out_buf = NULL is treated as error.
+ * @return Pointer to the size of the trimmed test case
+ */
+size_t afl_custom_trim(my_mutator_t *data, uint8_t **out_buf) {
+
+  *out_buf = data->trim_buf;
+
+  // Remove the last byte of the trimming input
+  return data->trim_size_current - 1;
+
+}
+
+/**
+ * This method is called after each trim operation to inform you if your
+ * trimming step was successful or not (in terms of coverage). If you receive
+ * a failure here, you should reset your input to the last known good state.
+ *
+ * (Optional)
+ *
+ * @param[in] data pointer returned in afl_custom_init for this fuzz case
+ * @param success Indicates if the last trim operation was successful.
+ * @return The next trim iteration index (from 0 to the maximum amount of
+ *     steps returned in init_trim). negative ret on failure.
+ */
+int32_t afl_custom_post_trim(my_mutator_t *data, int success) {
+
+  if (success) {
+
+    ++data->cur_step;
+    return data->cur_step;
+
+  }
+
+  return data->trimmming_steps;
+
+}
+
+/**
+ * Perform a single custom mutation on a given input.
+ * This mutation is stacked with the other muatations in havoc.
+ *
+ * (Optional)
+ *
+ * @param[in] data pointer returned in afl_custom_init for this fuzz case
+ * @param[in] buf Pointer to the input data to be mutated and the mutated
+ *     output
+ * @param[in] buf_size Size of input data
+ * @param[out] out_buf The output buffer. buf can be reused, if the content
+ * fits. *out_buf = NULL is treated as error.
+ * @param[in] max_size Maximum size of the mutated output. The mutation must
+ *     not produce data larger than max_size.
+ * @return Size of the mutated output.
+ */
+size_t afl_custom_havoc_mutation(my_mutator_t *data, u8 *buf, size_t buf_size,
+                                 u8 **out_buf, size_t max_size) {
+
+  if (buf_size == 0) {
+
+    *out_buf = maybe_grow(BUF_PARAMS(data, havoc), 1);
+    if (!*out_buf) {
+
+      perror("custom havoc: maybe_grow");
+      return 0;
+
+    }
+
+    **out_buf = rand() % 256;
+    buf_size = 1;
+
+  } else {
+
+    // We reuse buf here. It's legal and faster.
+    *out_buf = buf;
+
+  }
+
+  size_t victim = rand() % buf_size;
+  (*out_buf)[victim] += rand() % 10;
+
+  return buf_size;
+
+}
+
+/**
+ * Return the probability (in percentage) that afl_custom_havoc_mutation
+ * is called in havoc. By default it is 6 %.
+ *
+ * (Optional)
+ *
+ * @param[in] data pointer returned in afl_custom_init for this fuzz case
+ * @return The probability (0-100).
+ */
+uint8_t afl_custom_havoc_mutation_probability(my_mutator_t *data) {
+
+  return 5;  // 5 %
+
+}
+
+/**
+ * Determine whether the fuzzer should fuzz the queue entry or not.
+ *
+ * (Optional)
+ *
+ * @param[in] data pointer returned in afl_custom_init for this fuzz case
+ * @param filename File name of the test case in the queue entry
+ * @return Return True(1) if the fuzzer will fuzz the queue entry, and
+ *     False(0) otherwise.
+ */
+uint8_t afl_custom_queue_get(my_mutator_t *data, const uint8_t *filename) {
+
+  return 1;
+
+}
+
+/**
+ * Allow for additional analysis (e.g. calling a different tool that does a
+ * different kind of coverage and saves this for the custom mutator).
+ *
+ * (Optional)
+ *
+ * @param data pointer returned in afl_custom_init for this fuzz case
+ * @param filename_new_queue File name of the new queue entry
+ * @param filename_orig_queue File name of the original queue entry
+ */
+void afl_custom_queue_new_entry(my_mutator_t * data,
+                                const uint8_t *filename_new_queue,
+                                const uint8_t *filename_orig_queue) {
+
+  /* Additional analysis on the original or new test case */
+
+}
+
+/**
+ * Deinitialize everything
+ *
+ * @param data The data ptr from afl_custom_init
+ */
+void afl_custom_deinit(my_mutator_t *data) {
+
+  free(data->post_process_buf);
+  free(data->havoc_buf);
+  free(data->data_buf);
+  free(data->fuzz_buf);
+  free(data->trim_buf);
+  free(data);
+
+}
+
diff --git a/utils/custom_mutators/example.py b/utils/custom_mutators/example.py
new file mode 100644
index 00000000..cf659e5a
--- /dev/null
+++ b/utils/custom_mutators/example.py
@@ -0,0 +1,186 @@
+#!/usr/bin/env python
+# encoding: utf-8
+'''
+Example Python Module for AFLFuzz
+
+@author:     Christian Holler (:decoder)
+
+@license:
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+@contact:    choller@mozilla.com
+'''
+
+import random
+
+
+COMMANDS = [
+    b"GET",
+    b"PUT",
+    b"DEL",
+    b"AAAAAAAAAAAAAAAAA",
+]
+
+
+def init(seed):
+    '''
+    Called once when AFLFuzz starts up. Used to seed our RNG.
+
+    @type seed: int
+    @param seed: A 32-bit random value
+    '''
+    random.seed(seed)
+
+
+def deinit():
+    pass
+
+
+def fuzz(buf, add_buf, max_size):
+    '''
+    Called per fuzzing iteration.
+
+    @type buf: bytearray
+    @param buf: The buffer that should be mutated.
+
+    @type add_buf: bytearray
+    @param add_buf: A second buffer that can be used as mutation source.
+
+    @type max_size: int
+    @param max_size: Maximum size of the mutated output. The mutation must not
+        produce data larger than max_size.
+
+    @rtype: bytearray
+    @return: A new bytearray containing the mutated data
+    '''
+    ret = bytearray(100)
+
+    ret[:3] = random.choice(COMMANDS)
+
+    return ret
+
+# Uncomment and implement the following methods if you want to use a custom
+# trimming algorithm. See also the documentation for a better API description.
+
+# def init_trim(buf):
+#     '''
+#     Called per trimming iteration.
+#
+#     @type buf: bytearray
+#     @param buf: The buffer that should be trimmed.
+#
+#     @rtype: int
+#     @return: The maximum number of trimming steps.
+#     '''
+#     global ...
+#
+#     # Initialize global variables
+#
+#     # Figure out how many trimming steps are possible.
+#     # If this is not possible for your trimming, you can
+#     # return 1 instead and always return 0 in post_trim
+#     # until you are done (then you return 1).
+#
+#     return steps
+#
+# def trim():
+#     '''
+#     Called per trimming iteration.
+#
+#     @rtype: bytearray
+#     @return: A new bytearray containing the trimmed data.
+#     '''
+#     global ...
+#
+#     # Implement the actual trimming here
+#
+#     return bytearray(...)
+#
+# def post_trim(success):
+#     '''
+#     Called after each trimming operation.
+#
+#     @type success: bool
+#     @param success: Indicates if the last trim operation was successful.
+#
+#     @rtype: int
+#     @return: The next trim index (0 to max number of steps) where max
+#              number of steps indicates the trimming is done.
+#     '''
+#     global ...
+#
+#     if not success:
+#         # Restore last known successful input, determine next index
+#     else:
+#         # Just determine the next index, based on what was successfully
+#         # removed in the last step
+#
+#     return next_index
+#
+# def post_process(buf):
+#     '''
+#     Called just before the execution to write the test case in the format
+#     expected by the target
+#
+#     @type buf: bytearray
+#     @param buf: The buffer containing the test case to be executed
+#
+#     @rtype: bytearray
+#     @return: The buffer containing the test case after
+#     '''
+#     return buf
+#
+# def havoc_mutation(buf, max_size):
+#     '''
+#     Perform a single custom mutation on a given input.
+#
+#     @type buf: bytearray
+#     @param buf: The buffer that should be mutated.
+#
+#     @type max_size: int
+#     @param max_size: Maximum size of the mutated output. The mutation must not
+#         produce data larger than max_size.
+#
+#     @rtype: bytearray
+#     @return: A new bytearray containing the mutated data
+#     '''
+#     return mutated_buf
+#
+# def havoc_mutation_probability():
+#     '''
+#     Called for each `havoc_mutation`. Return the probability (in percentage)
+#     that `havoc_mutation` is called in havoc. Be default it is 6%.
+#
+#     @rtype: int
+#     @return: The probability (0-100)
+#     '''
+#     return prob
+#
+# def queue_get(filename):
+#     '''
+#     Called at the beginning of each fuzz iteration to determine whether the
+#     test case should be fuzzed
+#
+#     @type filename: str
+#     @param filename: File name of the test case in the current queue entry
+#
+#     @rtype: bool
+#     @return: Return True if the custom mutator decides to fuzz the test case,
+#         and False otherwise
+#     '''
+#     return True
+#
+# def queue_new_entry(filename_new_queue, filename_orig_queue):
+#     '''
+#     Called after adding a new test case to the queue
+#
+#     @type filename_new_queue: str
+#     @param filename_new_queue: File name of the new queue entry
+#
+#     @type filename_orig_queue: str
+#     @param filename_orig_queue: File name of the original queue entry
+#     '''
+#     pass
diff --git a/utils/custom_mutators/post_library_gif.so.c b/utils/custom_mutators/post_library_gif.so.c
new file mode 100644
index 00000000..ac10f409
--- /dev/null
+++ b/utils/custom_mutators/post_library_gif.so.c
@@ -0,0 +1,165 @@
+/*
+   american fuzzy lop++ - postprocessor library example
+   --------------------------------------------------
+
+   Originally written by Michal Zalewski
+   Edited by Dominik Maier, 2020
+
+   Copyright 2015 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   Postprocessor libraries can be passed to afl-fuzz to perform final cleanup
+   of any mutated test cases - for example, to fix up checksums in PNG files.
+
+   Please heed the following warnings:
+
+   1) In almost all cases, it is more productive to comment out checksum logic
+      in the targeted binary (as shown in ../libpng_no_checksum/). One possible
+      exception is the process of fuzzing binary-only software in QEMU mode.
+
+   2) The use of postprocessors for anything other than checksums is
+   questionable and may cause more harm than good. AFL is normally pretty good
+   about dealing with length fields, magic values, etc.
+
+   3) Postprocessors that do anything non-trivial must be extremely robust to
+      gracefully handle malformed data and other error conditions - otherwise,
+      they will crash and take afl-fuzz down with them. Be wary of reading past
+      *len and of integer overflows when calculating file offsets.
+
+   In other words, THIS IS PROBABLY NOT WHAT YOU WANT - unless you really,
+   honestly know what you're doing =)
+
+   With that out of the way: the postprocessor library is passed to afl-fuzz
+   via AFL_POST_LIBRARY. The library must be compiled with:
+
+     gcc -shared -Wall -O3 post_library.so.c -o post_library.so
+
+   AFL will call the afl_custom_post_process() function for every mutated output
+   buffer. From there, you have three choices:
+
+   1) If you don't want to modify the test case, simply set `*out_buf = in_buf`
+      and return the original `len`.
+
+   2) If you want to skip this test case altogether and have AFL generate a
+      new one, return 0 or set `*out_buf = NULL`.
+      Use this sparingly - it's faster than running the target program
+      with patently useless inputs, but still wastes CPU time.
+
+   3) If you want to modify the test case, allocate an appropriately-sized
+      buffer, move the data into that buffer, make the necessary changes, and
+      then return the new pointer as out_buf. Return an appropriate len
+   afterwards.
+
+      Note that the buffer will *not* be freed for you. To avoid memory leaks,
+      you need to free it or reuse it on subsequent calls (as shown below).
+
+      *** Feel free to reuse the original 'in_buf' BUFFER and return it. ***
+
+    Aight. The example below shows a simple postprocessor that tries to make
+    sure that all input files start with "GIF89a".
+
+    PS. If you don't like C, you can try out the unix-based wrapper from
+    Ben Nagy instead: https://github.com/bnagy/aflfix
+
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* Header that must be present at the beginning of every test case: */
+
+#define HEADER "GIF89a"
+
+typedef struct post_state {
+
+  unsigned char *buf;
+  size_t         size;
+
+} post_state_t;
+
+void *afl_custom_init(void *afl) {
+
+  post_state_t *state = malloc(sizeof(post_state_t));
+  if (!state) {
+
+    perror("malloc");
+    return NULL;
+
+  }
+
+  state->buf = calloc(sizeof(unsigned char), 4096);
+  if (!state->buf) {
+
+    free(state);
+    perror("calloc");
+    return NULL;
+
+  }
+
+  return state;
+
+}
+
+/* The actual postprocessor routine called by afl-fuzz: */
+
+size_t afl_custom_post_process(post_state_t *data, unsigned char *in_buf,
+                               unsigned int len, unsigned char **out_buf) {
+
+  /* Skip execution altogether for buffers shorter than 6 bytes (just to
+     show how it's done). We can trust len to be sane. */
+
+  if (len < strlen(HEADER)) return 0;
+
+  /* Do nothing for buffers that already start with the expected header. */
+
+  if (!memcmp(in_buf, HEADER, strlen(HEADER))) {
+
+    *out_buf = in_buf;
+    return len;
+
+  }
+
+  /* Allocate memory for new buffer, reusing previous allocation if
+     possible. */
+
+  *out_buf = realloc(data->buf, len);
+
+  /* If we're out of memory, the most graceful thing to do is to return the
+     original buffer and give up on modifying it. Let AFL handle OOM on its
+     own later on. */
+
+  if (!*out_buf) {
+
+    *out_buf = in_buf;
+    return len;
+
+  }
+
+  /* Copy the original data to the new location. */
+
+  memcpy(*out_buf, in_buf, len);
+
+  /* Insert the new header. */
+
+  memcpy(*out_buf, HEADER, strlen(HEADER));
+
+  /* Return the new len. It hasn't changed, so it's just len. */
+
+  return len;
+
+}
+
+/* Gets called afterwards */
+void afl_custom_deinit(post_state_t *data) {
+
+  free(data->buf);
+  free(data);
+
+}
+
diff --git a/utils/custom_mutators/post_library_png.so.c b/utils/custom_mutators/post_library_png.so.c
new file mode 100644
index 00000000..941f7e55
--- /dev/null
+++ b/utils/custom_mutators/post_library_png.so.c
@@ -0,0 +1,163 @@
+/*
+   american fuzzy lop++ - postprocessor for PNG
+   ------------------------------------------
+
+   Originally written by Michal Zalewski
+
+   Copyright 2015 Google Inc. All rights reserved.
+   Adapted to the new API, 2020 by Dominik Maier
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   See post_library.so.c for a general discussion of how to implement
+   postprocessors. This specific postprocessor attempts to fix up PNG
+   checksums, providing a slightly more complicated example than found
+   in post_library.so.c.
+
+   Compile with:
+
+     gcc -shared -Wall -O3 post_library_png.so.c -o post_library_png.so -lz
+
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <zlib.h>
+
+#include <arpa/inet.h>
+
+/* A macro to round an integer up to 4 kB. */
+
+#define UP4K(_i) ((((_i) >> 12) + 1) << 12)
+
+typedef struct post_state {
+
+  unsigned char *buf;
+  size_t         size;
+
+} post_state_t;
+
+void *afl_custom_init(void *afl) {
+
+  post_state_t *state = malloc(sizeof(post_state_t));
+  if (!state) {
+
+    perror("malloc");
+    return NULL;
+
+  }
+
+  state->buf = calloc(sizeof(unsigned char), 4096);
+  if (!state->buf) {
+
+    free(state);
+    perror("calloc");
+    return NULL;
+
+  }
+
+  return state;
+
+}
+
+size_t afl_custom_post_process(post_state_t *data, const unsigned char *in_buf,
+                               unsigned int          len,
+                               const unsigned char **out_buf) {
+
+  unsigned char *new_buf = (unsigned char *)in_buf;
+  unsigned int   pos = 8;
+
+  /* Don't do anything if there's not enough room for the PNG header
+     (8 bytes). */
+
+  if (len < 8) {
+
+    *out_buf = in_buf;
+    return len;
+
+  }
+
+  /* Minimum size of a zero-length PNG chunk is 12 bytes; if we
+     don't have that, we can bail out. */
+
+  while (pos + 12 <= len) {
+
+    unsigned int chunk_len, real_cksum, file_cksum;
+
+    /* Chunk length is the first big-endian dword in the chunk. */
+
+    chunk_len = ntohl(*(uint32_t *)(in_buf + pos));
+
+    /* Bail out if chunk size is too big or goes past EOF. */
+
+    if (chunk_len > 1024 * 1024 || pos + 12 + chunk_len > len) break;
+
+    /* Chunk checksum is calculated for chunk ID (dword) and the actual
+       payload. */
+
+    real_cksum = htonl(crc32(0, in_buf + pos + 4, chunk_len + 4));
+
+    /* The in-file checksum is the last dword past the chunk data. */
+
+    file_cksum = *(uint32_t *)(in_buf + pos + 8 + chunk_len);
+
+    /* If the checksums do not match, we need to fix the file. */
+
+    if (real_cksum != file_cksum) {
+
+      /* First modification? Make a copy of the input buffer. Round size
+         up to 4 kB to minimize the number of reallocs needed. */
+
+      if (new_buf == in_buf) {
+
+        if (len <= data->size) {
+
+          new_buf = data->buf;
+
+        } else {
+
+          new_buf = realloc(data->buf, UP4K(len));
+          if (!new_buf) {
+
+            *out_buf = in_buf;
+            return len;
+
+          }
+
+          data->buf = new_buf;
+          data->size = UP4K(len);
+          memcpy(new_buf, in_buf, len);
+
+        }
+
+      }
+
+      *(uint32_t *)(new_buf + pos + 8 + chunk_len) = real_cksum;
+
+    }
+
+    /* Skip the entire chunk and move to the next one. */
+
+    pos += 12 + chunk_len;
+
+  }
+
+  *out_buf = new_buf;
+  return len;
+
+}
+
+/* Gets called afterwards */
+void afl_custom_deinit(post_state_t *data) {
+
+  free(data->buf);
+  free(data);
+
+}
+
diff --git a/utils/custom_mutators/simple-chunk-replace.py b/utils/custom_mutators/simple-chunk-replace.py
new file mode 100644
index 00000000..df2f4ca7
--- /dev/null
+++ b/utils/custom_mutators/simple-chunk-replace.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python
+# encoding: utf-8
+'''
+Simple Chunk Cross-Over Replacement Module for AFLFuzz
+
+@author:     Christian Holler (:decoder)
+
+@license:
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+@contact:    choller@mozilla.com
+'''
+
+import random
+
+
+def init(seed):
+    '''
+    Called once when AFLFuzz starts up. Used to seed our RNG.
+
+    @type seed: int
+    @param seed: A 32-bit random value
+    '''
+    # Seed our RNG
+    random.seed(seed)
+
+
+def fuzz(buf, add_buf, max_size):
+    '''
+    Called per fuzzing iteration.
+
+    @type buf: bytearray
+    @param buf: The buffer that should be mutated.
+
+    @type add_buf: bytearray
+    @param add_buf: A second buffer that can be used as mutation source.
+
+    @type max_size: int
+    @param max_size: Maximum size of the mutated output. The mutation must not
+        produce data larger than max_size.
+
+    @rtype: bytearray
+    @return: A new bytearray containing the mutated data
+    '''
+    # Make a copy of our input buffer for returning
+    ret = bytearray(buf)
+
+    # Take a random fragment length between 2 and 32 (or less if add_buf is shorter)
+    fragment_len = random.randint(1, min(len(add_buf), 32))
+
+    # Determine a random source index where to take the data chunk from
+    rand_src_idx = random.randint(0, len(add_buf) - fragment_len)
+
+    # Determine a random destination index where to put the data chunk
+    rand_dst_idx = random.randint(0, len(buf))
+
+    # Make the chunk replacement
+    ret[rand_dst_idx:rand_dst_idx + fragment_len] = add_buf[rand_src_idx:rand_src_idx + fragment_len]
+
+    # Return data
+    return ret
diff --git a/utils/custom_mutators/simple_example.c b/utils/custom_mutators/simple_example.c
new file mode 100644
index 00000000..d888ec1f
--- /dev/null
+++ b/utils/custom_mutators/simple_example.c
@@ -0,0 +1,74 @@
+// This simple example just creates random buffer <= 100 filled with 'A'
+// needs -I /path/to/AFLplusplus/include
+#include "custom_mutator_helpers.h"
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+#ifndef _FIXED_CHAR
+  #define _FIXED_CHAR 0x41
+#endif
+
+typedef struct my_mutator {
+
+  afl_t *afl;
+
+  // Reused buffers:
+  BUF_VAR(u8, fuzz);
+
+} my_mutator_t;
+
+my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) {
+
+  srand(seed);
+  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
+  if (!data) {
+
+    perror("afl_custom_init alloc");
+    return NULL;
+
+  }
+
+  data->afl = afl;
+
+  return data;
+
+}
+
+size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
+                       u8 **out_buf, uint8_t *add_buf,
+                       size_t add_buf_size,  // add_buf can be NULL
+                       size_t max_size) {
+
+  int size = (rand() % 100) + 1;
+  if (size > max_size) size = max_size;
+  u8 *mutated_out = maybe_grow(BUF_PARAMS(data, fuzz), size);
+  if (!mutated_out) {
+
+    *out_buf = NULL;
+    perror("custom mutator allocation (maybe_grow)");
+    return 0;            /* afl-fuzz will very likely error out after this. */
+
+  }
+
+  memset(mutated_out, _FIXED_CHAR, size);
+
+  *out_buf = mutated_out;
+  return size;
+
+}
+
+/**
+ * Deinitialize everything
+ *
+ * @param data The data ptr from afl_custom_init
+ */
+void afl_custom_deinit(my_mutator_t *data) {
+
+  free(data->fuzz_buf);
+  free(data);
+
+}
+
diff --git a/utils/custom_mutators/wrapper_afl_min.py b/utils/custom_mutators/wrapper_afl_min.py
new file mode 100644
index 00000000..ecb03b55
--- /dev/null
+++ b/utils/custom_mutators/wrapper_afl_min.py
@@ -0,0 +1,118 @@
+#!/usr/bin/env python
+
+from XmlMutatorMin import XmlMutatorMin
+
+# Default settings (production mode)
+
+__mutator__ = None
+__seed__ = "RANDOM"
+__log__ = False
+__log_file__ = "wrapper.log"
+
+
+# AFL functions
+def log(text):
+    """
+    Logger
+    """
+
+    global __seed__
+    global __log__
+    global __log_file__
+
+    if __log__:
+        with open(__log_file__, "a") as logf:
+            logf.write("[%s] %s\n" % (__seed__, text))
+
+
+def init(seed):
+    """
+          Called once when AFL starts up. Seed is used to identify the AFL instance in log files
+    """
+
+    global __mutator__
+    global __seed__
+
+    # Get the seed
+    __seed__ = seed
+
+    # Create a global mutation class
+    try:
+        __mutator__ = XmlMutatorMin(__seed__, verbose=__log__)
+        log("init(): Mutator created")
+    except RuntimeError as e:
+        log("init(): Can't create mutator: %s" % e.message)
+
+
+def fuzz(buf, add_buf, max_size):
+    """
+    Called for each fuzzing iteration.
+    """
+
+    global __mutator__
+
+    # Do we have a working mutator object?
+    if __mutator__ is None:
+        log("fuzz(): Can't fuzz, no mutator available")
+        return buf
+
+    # Try to use the AFL buffer
+    via_buffer = True
+
+    # Interpret the AFL buffer (an array of bytes) as a string
+    if via_buffer:
+        try:
+            buf_str = str(buf)
+            log("fuzz(): AFL buffer converted to a string")
+        except Exception:
+            via_buffer = False
+            log("fuzz(): Can't convert AFL buffer to a string")
+
+    # Load XML from the AFL string
+    if via_buffer:
+        try:
+            __mutator__.init_from_string(buf_str)
+            log("fuzz(): Mutator successfully initialized with AFL buffer (%d bytes)" % len(buf_str))
+        except Exception:
+            via_buffer = False
+            log("fuzz(): Can't initialize mutator with AFL buffer")
+
+    # If init from AFL buffer wasn't succesful
+    if not via_buffer:
+        log("fuzz(): Returning unmodified AFL buffer")
+        return buf
+
+    # Sucessful initialization -> mutate
+    try:
+        __mutator__.mutate(max=5)
+        log("fuzz(): Input mutated")
+    except Exception:
+        log("fuzz(): Can't mutate input => returning buf")
+        return buf
+
+    # Convert mutated data to a array of bytes
+    try:
+        data = bytearray(__mutator__.save_to_string())
+        log("fuzz(): Mutated data converted as bytes")
+    except Exception:
+        log("fuzz(): Can't convert mutated data to bytes => returning buf")
+        return buf
+
+    # Everything went fine, returning mutated content
+    log("fuzz(): Returning %d bytes" % len(data))
+    return data
+
+
+# Main (for debug)
+if __name__ == '__main__':
+
+    __log__ = True
+    __log_file__ = "/dev/stdout"
+    __seed__ = "RANDOM"
+
+    init(__seed__)
+
+    in_1 = bytearray("<foo ddd='eeee'>ffff<a b='c' d='456' eee='ffffff'>zzzzzzzzzzzz</a><b yyy='YYY' zzz='ZZZ'></b></foo>")
+    in_2 = bytearray("<abc abc123='456' abcCBA='ppppppppppppppppppppppppppppp'/>")
+    out = fuzz(in_1, in_2)
+    print(out)
diff --git a/utils/defork/Makefile b/utils/defork/Makefile
new file mode 100644
index 00000000..e8240dba
--- /dev/null
+++ b/utils/defork/Makefile
@@ -0,0 +1,64 @@
+#
+# american fuzzy lop++ - defork
+# ----------------------------------
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+
+.PHONY: all install clean
+
+PREFIX     ?= /usr/local
+BIN_PATH    = $(PREFIX)/bin
+HELPER_PATH = $(PREFIX)/lib/afl
+
+CFLAGS = -fPIC -Wall -Wextra
+LDFLAGS = -shared
+
+UNAME_SAYS_LINUX=$(shell uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?)
+UNAME_SAYS_LINUX:sh=uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?
+
+_LDFLAGS_ADD=$(UNAME_SAYS_LINUX:1=)
+LDFLAGS_ADD=$(_LDFLAGS_ADD:0=-ldl)
+LDFLAGS  += $(LDFLAGS_ADD)
+
+# on gcc for arm there is no -m32, but -mbe32
+M32FLAG = -m32
+M64FLAG = -m64
+
+CC_IS_GCC=$(shell $(CC) --version 2>/dev/null | grep -q gcc; echo $$?)
+CC_IS_GCC:sh=$(CC) --version 2>/dev/null | grep -q gcc; echo $$?
+CC_IS_ARMCOMPILER=$(shell $(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?)
+CC_IS_ARMCOMPILER:sh=$(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?
+
+_M32FLAG=$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)
+__M32FLAG=$(_M32FLAG:00=-mbe32)
+___M32FLAG=$(__M32FLAG:$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)=-m32)
+M32FLAG=$(___M32FLAG)
+#ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" ""
+# ifneq (,$(findstring arm, "$(shell $(CC) -v 2>&1 >/dev/null)"))
+#  M32FLAG = -mbe32
+# endif
+#endif
+
+all: defork32.so defork64.so
+
+defork32.so: defork.c
+	-@$(CC) $(M32FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "defork32 build failure (that's fine)"
+
+defork64.so: defork.c
+	-@$(CC) $(M64FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "defork64 build failure (that's fine)"
+
+install: defork32.so defork64.so
+	install -d -m 755 $(DESTDIR)$(HELPER_PATH)/
+	if [ -f defork32.so ]; then set -e; install -m 755 defork32.so $(DESTDIR)$(HELPER_PATH)/; fi
+	if [ -f defork64.so ]; then set -e; install -m 755 defork64.so $(DESTDIR)$(HELPER_PATH)/; fi
+
+target:
+	../../afl-clang forking_target.c -o forking_target -Wall -Wextra -Werror
+
+clean:
+	rm -f defork32.so defork64.so forking_target
diff --git a/utils/defork/README.md b/utils/defork/README.md
new file mode 100644
index 00000000..7e950323
--- /dev/null
+++ b/utils/defork/README.md
@@ -0,0 +1,11 @@
+# defork
+
+when the target forks, this breaks all normal fuzzing runs.
+Sometimes, though, it is enough to just run the child process.
+If this is the case, then this LD_PRELOAD library will always return 0 on fork,
+the target will belive it is running as the child, post-fork.
+
+This is defork.c from the amazing preeny project
+https://github.com/zardus/preeny
+
+It is altered for afl++ to work with its fork-server: the initial fork will go through, the second fork will be blocked.
diff --git a/utils/defork/defork.c b/utils/defork/defork.c
new file mode 100644
index 00000000..f71d1124
--- /dev/null
+++ b/utils/defork/defork.c
@@ -0,0 +1,50 @@
+#define __GNU_SOURCE
+#include <dlfcn.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <stdbool.h>
+
+#include "../../include/config.h"
+
+/* we want to fork once (for the afl++ forkserver),
+   then immediately return as child on subsequent forks. */
+static bool forked = 0;
+
+pid_t (*original_fork)(void);
+
+/* In case we are not running in afl, we use a dummy original_fork */
+static pid_t nop(void) {
+
+  return 0;
+
+}
+
+__attribute__((constructor)) void preeny_fork_orig() {
+
+  if (getenv(SHM_ENV_VAR)) {
+
+    printf("defork: running in AFL++. Allowing forkserver.\n");
+    original_fork = dlsym(RTLD_NEXT, "socket");
+
+  } else {
+
+    printf("defork: no AFL++ detected. Disabling fork from the start.\n");
+    original_fork = &nop;
+
+  }
+
+}
+
+pid_t fork(void) {
+
+  /* If we forked before, or if we're in the child (pid==0),
+    we don't want to fork anymore, else, we are still in the forkserver.
+    The forkserver parent needs to fork infinite times, each child should never
+    fork again. This can be written without branches and I hate myself for it.
+  */
+  pid_t ret = !forked && original_fork();
+  forked = !ret;
+  return ret;
+
+}
+
diff --git a/utils/defork/forking_target.c b/utils/defork/forking_target.c
new file mode 100644
index 00000000..628d23c9
--- /dev/null
+++ b/utils/defork/forking_target.c
@@ -0,0 +1,49 @@
+#include <stdio.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <sys/types.h>
+
+/* This is an example target for defork.c - fuzz using
+```
+mkdir in; echo a > ./in/a
+AFL_PRELOAD=./defork64.so ../../afl-fuzz -i in -o out -- ./forking_target @@
+```
+*/
+
+int main(int argc, char **argv) {
+
+  if (argc < 2) {
+
+    printf("Example tool to test defork.\nUsage ./forking_target <input>\n");
+    return -1;
+
+  }
+
+  pid_t pid = fork();
+  if (pid == 0) {
+
+    printf("We're in the child.\n");
+    FILE *f = fopen(argv[1], "r");
+    char  buf[4096];
+    fread(buf, 1, 4096, f);
+    fclose(f);
+    uint32_t offset = buf[100] + (buf[101] << 8);
+    char     test_val = buf[offset];
+    return test_val < 100;
+
+  } else if (pid < 0) {
+
+    perror("fork");
+    return -1;
+
+  } else {
+
+    printf("We are in the parent - defork didn't work! :( (pid=%d)\n",
+           (int)pid);
+
+  }
+
+  return 0;
+
+}
+
diff --git a/utils/distributed_fuzzing/sync_script.sh b/utils/distributed_fuzzing/sync_script.sh
new file mode 100755
index 00000000..b28ff6cd
--- /dev/null
+++ b/utils/distributed_fuzzing/sync_script.sh
@@ -0,0 +1,97 @@
+#!/bin/sh
+#
+# american fuzzy lop++ - fuzzer synchronization tool
+# --------------------------------------------------
+#
+# Originally written by Michal Zalewski
+#
+# Copyright 2014 Google Inc. All rights reserved.
+# Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# To make this script work:
+#
+# - Edit FUZZ_HOSTS, FUZZ_DOMAIN, FUZZ_USER, and SYNC_DIR to reflect your
+#   environment.
+#
+# - Make sure that the system you are running this on can log into FUZZ_HOSTS
+#   without a password (authorized_keys or otherwise).
+#
+# - Make sure that every fuzzer is running with -o pointing to SYNC_DIR and -S
+#   that consists of its local host name, followed by an underscore, and then
+#   by some host-local fuzzer ID.
+#
+
+# Hosts to synchronize the data across.
+FUZZ_HOSTS='host1 host2 host3 host4'
+
+# Domain for all hosts
+FUZZ_DOMAIN='example.com'
+
+# Remote user for SSH
+FUZZ_USER=bob
+
+# Directory to synchronize
+SYNC_DIR='/home/bob/sync_dir'
+
+# We only capture -M main nodes, set the name to your chosen naming scheme
+MAIN_NAME='main'
+
+# Interval (seconds) between sync attempts (eg one hour)
+SYNC_INTERVAL=$((60 * 60))
+
+if [ "$AFL_ALLOW_TMP" = "" ]; then
+
+  if [ "$PWD" = "/tmp" -o "$PWD" = "/var/tmp" ]; then
+    echo "[-] Error: do not use shared /tmp or /var/tmp directories with this script." 1>&2
+    exit 1
+  fi
+
+fi
+
+rm -rf .sync_tmp 2>/dev/null
+mkdir .sync_tmp || exit 1
+
+while :; do
+
+  # Pull data in...
+
+  for host in $FUZZ_HOSTS; do
+
+    echo "[*] Retrieving data from ${host}.${FUZZ_DOMAIN}..."
+
+    ssh -o 'passwordauthentication no' ${FUZZ_USER}@${host}.$FUZZ_DOMAIN \
+      "cd '$SYNC_DIR' && tar -czf - ${host}_${MAIN_NAME}*/" > ".sync_tmp/${host}.tgz"
+
+  done
+
+  # Distribute data. For large fleets, see tips in the docs/ directory.
+
+  for dst_host in $FUZZ_HOSTS; do
+
+    echo "[*] Distributing data to ${dst_host}.${FUZZ_DOMAIN}..."
+
+    for src_host in $FUZZ_HOSTS; do
+
+      test "$src_host" = "$dst_host" && continue
+
+      echo "    Sending fuzzer data from ${src_host}.${FUZZ_DOMAIN}..."
+
+      ssh -o 'passwordauthentication no' ${FUZZ_USER}@$dst_host \
+        "cd '$SYNC_DIR' && tar -xkzf - " < ".sync_tmp/${src_host}.tgz"
+
+    done
+
+  done
+
+  echo "[+] Done. Sleeping for $SYNC_INTERVAL seconds (Ctrl-C to quit)."
+
+  sleep $SYNC_INTERVAL
+
+done
+
diff --git a/utils/libpng_no_checksum/libpng-nocrc.patch b/utils/libpng_no_checksum/libpng-nocrc.patch
new file mode 100644
index 00000000..0a3793a0
--- /dev/null
+++ b/utils/libpng_no_checksum/libpng-nocrc.patch
@@ -0,0 +1,15 @@
+--- pngrutil.c.orig	2014-06-12 03:35:16.000000000 +0200
++++ pngrutil.c	2014-07-01 05:08:31.000000000 +0200
+@@ -268,7 +268,11 @@
+    if (need_crc != 0)
+    {
+       crc = png_get_uint_32(crc_bytes);
+-      return ((int)(crc != png_ptr->crc));
++
++      if (crc != png_ptr->crc)
++        fprintf(stderr, "NOTE: CRC in the file is 0x%08x, change to 0x%08x\n", crc, png_ptr->crc);
++
++      return ((int)(1 != 1));
+    }
+ 
+    else
diff --git a/utils/persistent_mode/Makefile b/utils/persistent_mode/Makefile
new file mode 100644
index 00000000..6fa1c30e
--- /dev/null
+++ b/utils/persistent_mode/Makefile
@@ -0,0 +1,10 @@
+all:
+	afl-clang-fast -o persistent_demo persistent_demo.c
+	afl-clang-fast -o persistent_demo_new persistent_demo_new.c
+	AFL_DONT_OPTIMIZE=1 afl-clang-fast -o test-instr test-instr.c
+
+document:
+	AFL_DONT_OPTIMIZE=1 afl-clang-fast -D_AFL_DOCUMENT_MUTATIONS -o test-instr test-instr.c
+
+clean:
+	rm -f persistent_demo persistent_demo_new test-instr
diff --git a/utils/persistent_mode/persistent_demo.c b/utils/persistent_mode/persistent_demo.c
new file mode 100644
index 00000000..4cedc32c
--- /dev/null
+++ b/utils/persistent_mode/persistent_demo.c
@@ -0,0 +1,112 @@
+/*
+   american fuzzy lop++ - persistent mode example
+   --------------------------------------------
+
+   Originally written by Michal Zalewski
+
+   Copyright 2015 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   This file demonstrates the high-performance "persistent mode" that may be
+   suitable for fuzzing certain fast and well-behaved libraries, provided that
+   they are stateless or that their internal state can be easily reset
+   across runs.
+
+   To make this work, the library and this shim need to be compiled in LLVM
+   mode using afl-clang-fast (other compiler wrappers will *not* work).
+
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <signal.h>
+#include <string.h>
+
+/* Main entry point. */
+
+int main(int argc, char **argv) {
+
+  ssize_t len;                               /* how much input did we read? */
+  char buf[100]; /* Example-only buffer, you'd replace it with other global or
+                    local variables appropriate for your use case. */
+
+  /* The number passed to __AFL_LOOP() controls the maximum number of
+     iterations before the loop exits and the program is allowed to
+     terminate normally. This limits the impact of accidental memory leaks
+     and similar hiccups. */
+
+  __AFL_INIT();
+  while (__AFL_LOOP(1000)) {
+
+    /*** PLACEHOLDER CODE ***/
+
+    /* STEP 1: Fully re-initialize all critical variables. In our example, this
+               involves zeroing buf[], our input buffer. */
+
+    memset(buf, 0, 100);
+
+    /* STEP 2: Read input data. When reading from stdin, no special preparation
+               is required. When reading from a named file, you need to close
+               the old descriptor and reopen the file first!
+
+               Beware of reading from buffered FILE* objects such as stdin. Use
+               raw file descriptors or call fopen() / fdopen() in every pass. */
+
+    len = read(0, buf, 100);
+
+    /* STEP 3: This is where we'd call the tested library on the read data.
+               We just have some trivial inline code that faults on 'foo!'. */
+
+    /* do we have enough data? */
+    if (len < 8) continue;
+
+    if (buf[0] == 'f') {
+
+      printf("one\n");
+      if (buf[1] == 'o') {
+
+        printf("two\n");
+        if (buf[2] == 'o') {
+
+          printf("three\n");
+          if (buf[3] == '!') {
+
+            printf("four\n");
+            if (buf[4] == '!') {
+
+              printf("five\n");
+              if (buf[5] == '!') {
+
+                printf("six\n");
+                abort();
+
+              }
+
+            }
+
+          }
+
+        }
+
+      }
+
+    }
+
+    /*** END PLACEHOLDER CODE ***/
+
+  }
+
+  /* Once the loop is exited, terminate normally - AFL will restart the process
+     when this happens, with a clean slate when it comes to allocated memory,
+     leftover file descriptors, etc. */
+
+  return 0;
+
+}
+
diff --git a/utils/persistent_mode/persistent_demo_new.c b/utils/persistent_mode/persistent_demo_new.c
new file mode 100644
index 00000000..a29792ff
--- /dev/null
+++ b/utils/persistent_mode/persistent_demo_new.c
@@ -0,0 +1,117 @@
+/*
+   american fuzzy lop++ - persistent mode example
+   --------------------------------------------
+
+   Originally written by Michal Zalewski
+
+   Copyright 2015 Google Inc. All rights reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   This file demonstrates the high-performance "persistent mode" that may be
+   suitable for fuzzing certain fast and well-behaved libraries, provided that
+   they are stateless or that their internal state can be easily reset
+   across runs.
+
+   To make this work, the library and this shim need to be compiled in LLVM
+   mode using afl-clang-fast (other compiler wrappers will *not* work).
+
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <signal.h>
+#include <string.h>
+
+/* this lets the source compile without afl-clang-fast/lto */
+#ifndef __AFL_FUZZ_TESTCASE_LEN
+
+ssize_t       fuzz_len;
+unsigned char fuzz_buf[1024000];
+
+  #define __AFL_FUZZ_TESTCASE_LEN fuzz_len
+  #define __AFL_FUZZ_TESTCASE_BUF fuzz_buf
+  #define __AFL_FUZZ_INIT() void sync(void);
+  #define __AFL_LOOP(x) \
+    ((fuzz_len = read(0, fuzz_buf, sizeof(fuzz_buf))) > 0 ? 1 : 0)
+  #define __AFL_INIT() sync()
+
+#endif
+
+__AFL_FUZZ_INIT();
+
+/* Main entry point. */
+
+int main(int argc, char **argv) {
+
+  ssize_t        len;                        /* how much input did we read? */
+  unsigned char *buf;                        /* test case buffer pointer    */
+
+  /* The number passed to __AFL_LOOP() controls the maximum number of
+     iterations before the loop exits and the program is allowed to
+     terminate normally. This limits the impact of accidental memory leaks
+     and similar hiccups. */
+
+  __AFL_INIT();
+  buf = __AFL_FUZZ_TESTCASE_BUF;  // this must be assigned before __AFL_LOOP!
+
+  while (__AFL_LOOP(1000)) {  // increase if you have good stability
+
+    len = __AFL_FUZZ_TESTCASE_LEN;  // do not use the macro directly in a call!
+
+    fprintf(stderr, "input: %zd \"%s\"\n", len, buf);
+
+    /* do we have enough data? */
+    if (len < 8) continue;
+
+    if (strcmp((char *)buf, "thisisateststring") == 0) printf("teststring\n");
+
+    if (buf[0] == 'f') {
+
+      printf("one\n");
+      if (buf[1] == 'o') {
+
+        printf("two\n");
+        if (buf[2] == 'o') {
+
+          printf("three\n");
+          if (buf[3] == '!') {
+
+            printf("four\n");
+            if (buf[4] == '!') {
+
+              printf("five\n");
+              if (buf[6] == '!') {
+
+                printf("six\n");
+                abort();
+
+              }
+
+            }
+
+          }
+
+        }
+
+      }
+
+    }
+
+    /*** END PLACEHOLDER CODE ***/
+
+  }
+
+  /* Once the loop is exited, terminate normally - AFL will restart the process
+     when this happens, with a clean slate when it comes to allocated memory,
+     leftover file descriptors, etc. */
+
+  return 0;
+
+}
+
diff --git a/utils/persistent_mode/test-instr.c b/utils/persistent_mode/test-instr.c
new file mode 100644
index 00000000..a6188b22
--- /dev/null
+++ b/utils/persistent_mode/test-instr.c
@@ -0,0 +1,69 @@
+/*
+   american fuzzy lop++ - a trivial program to test the build
+   --------------------------------------------------------
+   Originally written by Michal Zalewski
+   Copyright 2014 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+     http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+__AFL_FUZZ_INIT();
+
+int main(int argc, char **argv) {
+
+  __AFL_INIT();
+  unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
+
+  while (__AFL_LOOP(2147483647)) {  // MAX_INT if you have 100% stability
+
+    unsigned int len = __AFL_FUZZ_TESTCASE_LEN;
+
+#ifdef _AFL_DOCUMENT_MUTATIONS
+    static unsigned int counter = 0;
+    char                fn[32];
+    sprintf(fn, "%09u:test-instr", counter);
+    int fd_doc = open(fn, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    if (fd_doc >= 0) {
+
+      if (write(fd_doc, buf, len) != __afl_fuzz_len) {
+
+        fprintf(stderr, "write of mutation file failed: %s\n", fn);
+        unlink(fn);
+
+      }
+
+      close(fd_doc);
+
+    }
+
+    counter++;
+#endif
+
+    // fprintf(stderr, "len: %u\n", len);
+
+    if (!len) continue;
+
+    if (buf[0] == '0')
+      printf("Looks like a zero to me!\n");
+    else if (buf[0] == '1')
+      printf("Pretty sure that is a one!\n");
+    else
+      printf("Neither one or zero? How quaint!\n");
+
+  }
+
+  return 0;
+
+}
+
diff --git a/utils/qemu_persistent_hook/Makefile b/utils/qemu_persistent_hook/Makefile
new file mode 100644
index 00000000..85db1b46
--- /dev/null
+++ b/utils/qemu_persistent_hook/Makefile
@@ -0,0 +1,6 @@
+all:
+	$(CC) -no-pie test.c -o test
+	$(CC) -fPIC -shared read_into_rdi.c -o read_into_rdi.so
+
+clean:
+	rm -rf in out test read_into_rdi.so
diff --git a/utils/qemu_persistent_hook/README.md b/utils/qemu_persistent_hook/README.md
new file mode 100644
index 00000000..3f908c22
--- /dev/null
+++ b/utils/qemu_persistent_hook/README.md
@@ -0,0 +1,19 @@
+# QEMU persistent hook example
+
+Compile the test binary and the library:
+
+```
+make
+```
+
+Fuzz with:
+
+```
+export AFL_QEMU_PERSISTENT_ADDR=0x$(nm test | grep "T target_func" | awk '{print $1}')
+export AFL_QEMU_PERSISTENT_HOOK=./read_into_rdi.so
+
+mkdir in
+echo 0000 > in/in
+
+../../afl-fuzz -Q -i in -o out -- ./test
+```
diff --git a/utils/qemu_persistent_hook/read_into_rdi.c b/utils/qemu_persistent_hook/read_into_rdi.c
new file mode 100644
index 00000000..f4a8ae59
--- /dev/null
+++ b/utils/qemu_persistent_hook/read_into_rdi.c
@@ -0,0 +1,34 @@
+#include "../../qemu_mode/qemuafl/qemuafl/api.h"
+
+#include <stdio.h>
+#include <string.h>
+
+void afl_persistent_hook(struct x86_64_regs *regs, uint64_t guest_base,
+                         uint8_t *input_buf, uint32_t input_buf_len) {
+\
+#define g2h(x) ((void *)((unsigned long)(x) + guest_base))
+#define h2g(x) ((uint64_t)(x)-guest_base)
+
+  // In this example the register RDI is pointing to the memory location
+  // of the target buffer, and the length of the input is in RSI.
+  // This can be seen with a debugger, e.g. gdb (and "disass main")
+
+  printf("Placing input into 0x%lx\n", regs->rdi);
+
+  if (input_buf_len > 1024) input_buf_len = 1024;
+  memcpy(g2h(regs->rdi), input_buf, input_buf_len);
+  regs->rsi = input_buf_len;
+
+#undef g2h
+#undef h2g
+
+}
+
+int afl_persistent_hook_init(void) {
+
+  // 1 for shared memory input (faster), 0 for normal input (you have to use
+  // read(), input_buf will be NULL)
+  return 1;
+
+}
+
diff --git a/utils/qemu_persistent_hook/test.c b/utils/qemu_persistent_hook/test.c
new file mode 100644
index 00000000..afeff202
--- /dev/null
+++ b/utils/qemu_persistent_hook/test.c
@@ -0,0 +1,35 @@
+#include <stdio.h>
+
+int target_func(unsigned char *buf, int size) {
+
+  printf("buffer:%p, size:%p\n", buf, size);
+  switch (buf[0]) {
+
+    case 1:
+      if (buf[1] == '\x44') { puts("a"); }
+      break;
+    case 0xff:
+      if (buf[2] == '\xff') {
+
+        if (buf[1] == '\x44') { puts("b"); }
+
+      }
+
+      break;
+    default:
+      break;
+
+  }
+
+  return 1;
+
+}
+
+char data[1024];
+
+int main() {
+
+  target_func(data, 1024);
+
+}
+
diff --git a/utils/socket_fuzzing/Makefile b/utils/socket_fuzzing/Makefile
new file mode 100644
index 00000000..9476e2d5
--- /dev/null
+++ b/utils/socket_fuzzing/Makefile
@@ -0,0 +1,61 @@
+#
+# american fuzzy lop++ - socket_fuzz
+# ----------------------------------
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at:
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+
+.PHONY: all install clean
+
+PREFIX     ?= /usr/local
+BIN_PATH    = $(PREFIX)/bin
+HELPER_PATH = $(PREFIX)/lib/afl
+
+CFLAGS = -fPIC -Wall -Wextra
+LDFLAGS = -shared
+
+UNAME_SAYS_LINUX=$(shell uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?)
+UNAME_SAYS_LINUX:sh=uname | grep -E '^Linux|^GNU' >/dev/null; echo $$?
+
+_LDFLAGS_ADD=$(UNAME_SAYS_LINUX:1=)
+LDFLAGS_ADD=$(_LDFLAGS_ADD:0=-ldl)
+LDFLAGS  += $(LDFLAGS_ADD)
+
+# on gcc for arm there is no -m32, but -mbe32
+M32FLAG = -m32
+M64FLAG = -m64
+
+CC_IS_GCC=$(shell $(CC) --version 2>/dev/null | grep -q gcc; echo $$?)
+CC_IS_GCC:sh=$(CC) --version 2>/dev/null | grep -q gcc; echo $$?
+CC_IS_ARMCOMPILER=$(shell $(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?)
+CC_IS_ARMCOMPILER:sh=$(CC) -v 2>&1 >/dev/null | grep -q arm; echo $$?
+
+_M32FLAG=$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)
+__M32FLAG=$(_M32FLAG:00=-mbe32)
+___M32FLAG=$(__M32FLAG:$(CC_IS_GCC)$(CC_IS_ARMCOMPILER)=-m32)
+M32FLAG=$(___M32FLAG)
+#ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" ""
+# ifneq (,$(findstring arm, "$(shell $(CC) -v 2>&1 >/dev/null)"))
+#  M32FLAG = -mbe32
+# endif
+#endif
+
+all: socketfuzz32.so socketfuzz64.so
+
+socketfuzz32.so: socketfuzz.c
+	-@$(CC) $(M32FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "socketfuzz32 build failure (that's fine)"
+
+socketfuzz64.so: socketfuzz.c
+	-@$(CC) $(M64FLAG) $(CFLAGS) $^ $(LDFLAGS) -o $@ 2>/dev/null || echo "socketfuzz64 build failure (that's fine)"
+
+install: socketfuzz32.so socketfuzz64.so
+	install -d -m 755 $(DESTDIR)$(HELPER_PATH)/
+	if [ -f socketfuzz32.so ]; then set -e; install -m 755 socketfuzz32.so $(DESTDIR)$(HELPER_PATH)/; fi
+	if [ -f socketfuzz64.so ]; then set -e; install -m 755 socketfuzz64.so $(DESTDIR)$(HELPER_PATH)/; fi
+
+clean:
+	rm -f socketfuzz32.so socketfuzz64.so
diff --git a/utils/socket_fuzzing/README.md b/utils/socket_fuzzing/README.md
new file mode 100644
index 00000000..79f28bea
--- /dev/null
+++ b/utils/socket_fuzzing/README.md
@@ -0,0 +1,11 @@
+# socketfuzz
+
+when you want to fuzz a network service and you can not/do not want to modify
+the source (or just have a binary), then this LD_PRELOAD library will allow
+for sending input to stdin which the target binary will think is coming from
+a network socket.
+
+This is desock_dup.c from the amazing preeny project
+https://github.com/zardus/preeny
+
+It is packaged in afl++ to have it at hand if needed
diff --git a/utils/socket_fuzzing/socketfuzz.c b/utils/socket_fuzzing/socketfuzz.c
new file mode 100644
index 00000000..3ec8383b
--- /dev/null
+++ b/utils/socket_fuzzing/socketfuzz.c
@@ -0,0 +1,110 @@
+/*
+ * This is desock_dup.c from the amazing preeny project
+ * https://github.com/zardus/preeny
+ *
+ * It is packaged in afl++ to have it at hand if needed
+ *
+ */
+
+#define _GNU_SOURCE
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/types.h>   //
+#include <sys/socket.h>  //
+#include <sys/stat.h>    //
+#include <fcntl.h>       //
+#include <netinet/in.h>
+#include <pthread.h>
+#include <signal.h>
+#include <dlfcn.h>
+#include <errno.h>
+#include <stdio.h>
+#include <poll.h>
+//#include "logging.h" // switche from preeny_info() to fprintf(stderr, "Info: "
+
+//
+// originals
+//
+int (*original_close)(int);
+int (*original_dup2)(int, int);
+__attribute__((constructor)) void preeny_desock_dup_orig() {
+
+  original_close = dlsym(RTLD_NEXT, "close");
+  original_dup2 = dlsym(RTLD_NEXT, "dup2");
+
+}
+
+int close(int sockfd) {
+
+  if (sockfd <= 2) {
+
+    fprintf(stderr, "Info: Disabling close on %d\n", sockfd);
+    return 0;
+
+  } else {
+
+    return original_close(sockfd);
+
+  }
+
+}
+
+int dup2(int old, int new) {
+
+  if (new <= 2) {
+
+    fprintf(stderr, "Info: Disabling dup from %d to %d\n", old, new);
+    return 0;
+
+  } else {
+
+    return original_dup2(old, new);
+
+  }
+
+}
+
+int accept(int sockfd, struct sockaddr *addr, socklen_t *addrlen) {
+
+  (void)sockfd;
+  (void)addr;
+  (void)addrlen;
+  fprintf(stderr, "Info: Emulating accept on %d\n", sockfd);
+  return 0;
+
+}
+
+int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen) {
+
+  (void)sockfd;
+  (void)addr;
+  (void)addrlen;
+  fprintf(stderr, "Info: Emulating bind on port %d\n",
+          ntohs(((struct sockaddr_in *)addr)->sin_port));
+  return 0;
+
+}
+
+int listen(int sockfd, int backlog) {
+
+  (void)sockfd;
+  (void)backlog;
+  return 0;
+
+}
+
+int setsockopt(int sockfd, int level, int optid, const void *optdata,
+               socklen_t optdatalen) {
+
+  (void)sockfd;
+  (void)level;
+  (void)optid;
+  (void)optdata;
+  (void)optdatalen;
+  return 0;
+
+}
+
-- 
cgit 1.4.1