From 65c3db86256b3907404623fe1c52e01c9d12ff97 Mon Sep 17 00:00:00 2001
From: llzmb <46303940+llzmb@users.noreply.github.com>
Date: Thu, 2 Dec 2021 21:03:59 +0100
Subject: Fix punctuation in connection with "e.g."

---
 utils/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'utils/README.md')

diff --git a/utils/README.md b/utils/README.md
index b8df0b47..b7eead8e 100644
--- a/utils/README.md
+++ b/utils/README.md
@@ -13,7 +13,7 @@ Here's a quick overview of the stuff you can find in this directory:
 
   - afl_proxy            - skeleton file example to show how to fuzz
                            something where you gather coverage data via
-                           different means, e.g. hw debugger
+                           different means, e.g., hw debugger
 
   - afl_untracer         - fuzz binary-only libraries much faster but with
                            less coverage than qemu_mode
-- 
cgit 1.4.1


From 6eab6a55af74754cd0229012f1c9543c0c3cb2a7 Mon Sep 17 00:00:00 2001
From: llzmb <46303940+llzmb@users.noreply.github.com>
Date: Sat, 4 Dec 2021 21:14:50 +0100
Subject: Fix spelling of "FRIDA mode" and "QEMU mode"

---
 TODO.md                             |  2 +-
 docs/INSTALL.md                     |  4 ++--
 docs/features.md                    |  8 ++++----
 docs/fuzzing_binary-only_targets.md | 35 ++++++++++++++++++-----------------
 docs/important_changes.md           |  8 ++++----
 instrumentation/README.llvm.md      |  2 +-
 qemu_mode/libqasan/README.md        |  2 +-
 utils/README.md                     |  2 +-
 utils/afl_untracer/README.md        |  2 +-
 utils/aflpp_driver/README.md        |  4 ++--
 utils/qbdi_mode/README.md           |  2 +-
 11 files changed, 36 insertions(+), 35 deletions(-)

(limited to 'utils/README.md')

diff --git a/TODO.md b/TODO.md
index 04f3abab..e6b095fc 100644
--- a/TODO.md
+++ b/TODO.md
@@ -16,7 +16,7 @@
 
 ## Further down the road
 
-qemu_mode/frida_mode:
+QEMU mode/FRIDA mode:
  - non colliding instrumentation
  - rename qemu specific envs to AFL_QEMU (AFL_ENTRYPOINT, AFL_CODE_START/END,
    AFL_COMPCOV_LEVEL?)
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index 08d3283e..9d1309fe 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -23,7 +23,7 @@ sudo apt-get install -y build-essential python3-dev automake git flex bison libg
 # try to install llvm 11 and install the distro default if that fails
 sudo apt-get install -y lld-11 llvm-11 llvm-11-dev clang-11 || sudo apt-get install -y lld llvm llvm-dev clang
 sudo apt-get install -y gcc-$(gcc --version|head -n1|sed 's/.* //'|sed 's/\..*//')-plugin-dev libstdc++-$(gcc --version|head -n1|sed 's/.* //'|sed 's/\..*//')-dev
-sudo apt-get install -y ninja-build # for qemu_mode
+sudo apt-get install -y ninja-build # for QEMU mode
 git clone https://github.com/AFLplusplus/AFLplusplus
 cd AFLplusplus
 make distrib
@@ -33,7 +33,7 @@ sudo make install
 It is recommended to install the newest available gcc, clang and llvm-dev
 possible in your distribution!
 
-Note that "make distrib" also builds instrumentation, qemu_mode, unicorn_mode
+Note that "make distrib" also builds instrumentation, QEMU mode, unicorn_mode
 and more. If you just want plain AFL++, then do "make all". However, compiling
 and using at least instrumentation is highly recommended for much better results
 - hence in this case choose:
diff --git a/docs/features.md b/docs/features.md
index fb688a64..06b1bcbe 100644
--- a/docs/features.md
+++ b/docs/features.md
@@ -4,7 +4,7 @@ AFL++ supports llvm from 3.8 up to version 12, very fast binary fuzzing with
 QEMU 5.1 with laf-intel and redqueen, frida mode, unicorn mode, gcc plugin, full
 *BSD, Mac OS, Solaris and Android support and much, much, much more.
 
-| Feature/Instrumentation  | afl-gcc | llvm      | gcc_plugin | frida_mode(9)    | qemu_mode(10)    |unicorn_mode(10)  |coresight_mode(11)|
+| Feature/Instrumentation  | afl-gcc | llvm      | gcc_plugin | FRIDA mode(9)    | QEMU mode(10)    |unicorn_mode(10)  |coresight_mode(11)|
 | -------------------------|:-------:|:---------:|:----------:|:----------------:|:----------------:|:----------------:|:----------------:|
 | Threadsafe counters      |         |     x(3)  |            |                  |                  |                  |                  |
 | NeverZero                | x86[_64]|     x(1)  |     x      |         x        |         x        |         x        |                  |
@@ -37,9 +37,9 @@ QEMU 5.1 with laf-intel and redqueen, frida mode, unicorn mode, gcc plugin, full
 
 Among others, the following features and patches have been integrated:
 
-* NeverZero patch for afl-gcc, instrumentation, qemu_mode and unicorn_mode which
+* NeverZero patch for afl-gcc, instrumentation, QEMU mode and unicorn_mode which
   prevents a wrapping map value to zero, increases coverage
-* Persistent mode, deferred forkserver and in-memory fuzzing for qemu_mode
+* Persistent mode, deferred forkserver and in-memory fuzzing for QEMU mode
 * Unicorn mode which allows fuzzing of binaries from completely different
   platforms (integration provided by domenukk)
 * The new CmpLog instrumentation for LLVM and QEMU inspired by
@@ -51,7 +51,7 @@ Among others, the following features and patches have been integrated:
   [https://github.com/puppet-meteor/MOpt-AFL](https://github.com/puppet-meteor/MOpt-AFL)
 * LLVM mode Ngram coverage by Adrian Herrera
   [https://github.com/adrianherrera/afl-ngram-pass](https://github.com/adrianherrera/afl-ngram-pass)
-* LAF-Intel/CompCov support for instrumentation, qemu_mode and unicorn_mode
+* LAF-Intel/CompCov support for instrumentation, QEMU mode and unicorn_mode
   (with enhanced capabilities)
 * Radamsa and honggfuzz mutators (as custom mutators).
 * QBDI mode to fuzz android native libraries via Quarkslab's
diff --git a/docs/fuzzing_binary-only_targets.md b/docs/fuzzing_binary-only_targets.md
index b3d9ca02..15155111 100644
--- a/docs/fuzzing_binary-only_targets.md
+++ b/docs/fuzzing_binary-only_targets.md
@@ -12,18 +12,18 @@ fuzzed with AFL++.
 
 ## TL;DR:
 
-Qemu_mode in persistent mode is the fastest - if the stability is high enough.
+QEMU mode in persistent mode is the fastest - if the stability is high enough.
 Otherwise, try RetroWrite, Dyninst, and if these fail, too, then try standard
-qemu_mode with AFL_ENTRYPOINT to where you need it.
+QEMU mode with `AFL_ENTRYPOINT` to where you need it.
 
-If your target is a library, then use frida_mode.
+If your target is a library, then use FRIDA mode.
 
 If your target is non-linux, then use unicorn_mode.
 
 ## Fuzzing binary-only targets with AFL++
-### Qemu_mode
+### QEMU mode
 
-Qemu_mode is the "native" solution to the program. It is available in the
+QEMU mode is the "native" solution to the program. It is available in the
 ./qemu_mode/ directory and, once compiled, it can be accessed by the afl-fuzz -Q
 command line option. It is the easiest to use alternative and even works for
 cross-platform binaries.
@@ -37,11 +37,12 @@ cd qemu_mode
 ./build_qemu_support.sh
 ```
 
-The following setup to use qemu_mode is recommended:
+The following setup to use QEMU mode is recommended:
+
 * run 1 afl-fuzz -Q instance with CMPLOG (`-c 0` + `AFL_COMPCOV_LEVEL=2`)
 * run 1 afl-fuzz -Q instance with QASAN (`AFL_USE_QASAN=1`)
 * run 1 afl-fuzz -Q instance with LAF (`AFL_PRELOAD=libcmpcov.so` +
-  `AFL_COMPCOV_LEVEL=2`), alternatively you can use frida_mode, just switch `-Q`
+  `AFL_COMPCOV_LEVEL=2`), alternatively you can use FRIDA mode, just switch `-Q`
   with `-O` and remove the LAF instance
 
 Then run as many instances as you have cores left with either -Q mode or - even
@@ -49,16 +50,16 @@ better - use a binary rewriter like Dyninst, RetroWrite, ZAFL, etc.
 
 If [afl-dyninst](https://github.com/vanhauser-thc/afl-dyninst) works for your
 binary, then you can use afl-fuzz normally and it will have twice the speed
-compared to qemu_mode (but slower than qemu persistent mode). Note that several
+compared to QEMU mode (but slower than QEMU persistent mode). Note that several
 other binary rewriters exist, all with their advantages and caveats.
 
-The speed decrease of qemu_mode is at about 50%. However, various options exist
+The speed decrease of QEMU mode is at about 50%. However, various options exist
 to increase the speed:
 - using AFL_ENTRYPOINT to move the forkserver entry to a later basic block in
   the binary (+5-10% speed)
 - using persistent mode
   [qemu_mode/README.persistent.md](../qemu_mode/README.persistent.md) this will
-  result in a 150-300% overall speed increase - so 3-8x the original qemu_mode
+  result in a 150-300% overall speed increase - so 3-8x the original QEMU mode
   speed!
 - using AFL_CODE_START/AFL_CODE_END to only instrument specific parts
 
@@ -71,7 +72,7 @@ conducive to parallelization.
 
 Note that there is also honggfuzz:
 [https://github.com/google/honggfuzz](https://github.com/google/honggfuzz) which
-now has a qemu_mode, but its performance is just 1.5% ...
+now has a QEMU mode, but its performance is just 1.5% ...
 
 If you like to code a customized fuzzer without much work, we highly recommend
 to check out our sister project libafl which supports QEMU, too:
@@ -87,14 +88,14 @@ It is included in AFL++.
 For more information, see
 [qemu_mode/README.wine.md](../qemu_mode/README.wine.md).
 
-### Frida_mode
+### FRIDA mode
 
-In frida_mode, you can fuzz binary-only targets as easily as with QEMU.
-Frida_mode is sometimes faster and sometimes slower than Qemu_mode. It is also
+In FRIDA mode, you can fuzz binary-only targets as easily as with QEMU mode.
+FRIDA mode is sometimes faster and sometimes slower than QEMU mode. It is also
 newer, lacks COMPCOV, and has the advantage that it works on MacOS (both intel
 and M1).
 
-To build frida_mode:
+To build FRIDA mode:
 
 ```shell
 cd frida_mode
@@ -149,11 +150,11 @@ For further information, check out
 
 If the goal is to fuzz a dynamic library, then there are two options available.
 For both, you need to write a small harness that loads and calls the library.
-Then you fuzz this with either frida_mode or qemu_mode and either use
+Then you fuzz this with either FRIDA mode or QEMU mode and either use
 `AFL_INST_LIBS=1` or `AFL_QEMU/FRIDA_INST_RANGES`.
 
 Another, less precise and slower option is to fuzz it with utils/afl_untracer/
-and use afl-untracer.c as a template. It is slower than frida_mode.
+and use afl-untracer.c as a template. It is slower than FRIDA mode.
 
 For more information, see
 [utils/afl_untracer/README.md](../utils/afl_untracer/README.md).
diff --git a/docs/important_changes.md b/docs/important_changes.md
index 203c5a66..d5e67f75 100644
--- a/docs/important_changes.md
+++ b/docs/important_changes.md
@@ -5,8 +5,8 @@ changes.
 
 ## From version 3.00 onwards
 
-With AFL++ 3.13-3.20, we introduce frida_mode (-O) to have an alternative for
-binary-only fuzzing. It is slower than Qemu mode but works on MacOS, Android,
+With AFL++ 3.13-3.20, we introduce FRIDA mode (`-O`) to have an alternative for
+binary-only fuzzing. It is slower than QEMU mode but works on MacOS, Android,
 iOS etc.
 
 With AFL++ 3.15, we introduced the following changes from previous behaviors:
@@ -31,8 +31,8 @@ behaviors and defaults:
     All instrumentation source code is now in the `instrumentation/` folder.
   * The gcc_plugin was replaced with a new version submitted by AdaCore that
     supports more features. Thank you!
-  * qemu_mode got upgraded to QEMU 5.1, but to be able to build this a current
-    ninja build tool version and python3 setuptools are required. qemu_mode also
+  * QEMU mode got upgraded to QEMU 5.1, but to be able to build this a current
+    ninja build tool version and python3 setuptools are required. QEMU mode also
     got new options like snapshotting, instrumenting specific shared libraries,
     etc. Additionally QEMU 5.1 supports more CPU targets so this is really worth
     it.
diff --git a/instrumentation/README.llvm.md b/instrumentation/README.llvm.md
index c93cd312..fa025643 100644
--- a/instrumentation/README.llvm.md
+++ b/instrumentation/README.llvm.md
@@ -218,7 +218,7 @@ by Jinghan Wang, et. al.
 
 Note that the original implementation (available
 [here](https://github.com/bitsecurerlab/afl-sensitive)) is built on top of AFL's
-qemu_mode. This is essentially a port that uses LLVM vectorized instructions
+QEMU mode. This is essentially a port that uses LLVM vectorized instructions
 (available from llvm versions 4.0.1 and higher) to achieve the same results when
 compiling source code.
 
diff --git a/qemu_mode/libqasan/README.md b/qemu_mode/libqasan/README.md
index 6a65c12b..41195933 100644
--- a/qemu_mode/libqasan/README.md
+++ b/qemu_mode/libqasan/README.md
@@ -9,7 +9,7 @@ and this runtime is injected via LD_PRELOAD (so works just for dynamically
 linked binaries).
 
 The usage is super simple, just set the env var `AFL_USE_QASAN=1` when fuzzing
-in qemu mode (-Q). afl-fuzz will automatically set AFL_PRELOAD to load this
+in QEMU mode (-Q). afl-fuzz will automatically set AFL_PRELOAD to load this
 library and enable the QASan instrumentation in afl-qemu-trace.
 
 For debugging purposes, we still suggest to run the original QASan as the
diff --git a/utils/README.md b/utils/README.md
index b7eead8e..5f5745b9 100644
--- a/utils/README.md
+++ b/utils/README.md
@@ -16,7 +16,7 @@ Here's a quick overview of the stuff you can find in this directory:
                            different means, e.g., hw debugger
 
   - afl_untracer         - fuzz binary-only libraries much faster but with
-                           less coverage than qemu_mode
+                           less coverage than QEMU mode
 
   - analysis_scripts     - random -o out analysis scripts
 
diff --git a/utils/afl_untracer/README.md b/utils/afl_untracer/README.md
index 9f41618f..3fff5f83 100644
--- a/utils/afl_untracer/README.md
+++ b/utils/afl_untracer/README.md
@@ -5,7 +5,7 @@
 afl-untracer is an example skeleton file which can easily be used to fuzz
 a closed source library.
 
-It requires less memory and is x3-5 faster than qemu_mode, however, it is way
+It requires less memory and is x3-5 faster than QEMU mode, however, it is way
 more course grained and does not provide interesting features like compcov or
 cmplog.
 
diff --git a/utils/aflpp_driver/README.md b/utils/aflpp_driver/README.md
index d534cd7f..8b9fe15f 100644
--- a/utils/aflpp_driver/README.md
+++ b/utils/aflpp_driver/README.md
@@ -22,10 +22,10 @@ or `@@` as command line parameters.
 
 ## aflpp_qemu_driver
 
-Note that you can use the driver too for frida_mode (`-O`).
+Note that you can use the driver too for FRIDA mode (`-O`).
 
 aflpp_qemu_driver is used for libfuzzer `LLVMFuzzerTestOneInput()` targets that
-are to be fuzzed in qemu_mode. So compile them with clang/clang++, without
+are to be fuzzed in QEMU mode. So compile them with clang/clang++, without
 -fsantize=fuzzer or afl-clang-fast, and link in libAFLQemuDriver.a:
 
 `clang++ -o fuzz fuzzer_harness.cc libAFLQemuDriver.a [plus required linking]`.
diff --git a/utils/qbdi_mode/README.md b/utils/qbdi_mode/README.md
index c8d46fca..02dd3c74 100755
--- a/utils/qbdi_mode/README.md
+++ b/utils/qbdi_mode/README.md
@@ -2,7 +2,7 @@
 
 NOTE: this code is outdated and first would need to be adapted to the current
 AFL++ versions.
-Try frida_mode or fpicker [https://github.com/ttdennis/fpicker/](https://github.com/ttdennis/fpicker/) first, maybe they suite your need.
+Try FRIDA mode or fpicker [https://github.com/ttdennis/fpicker/](https://github.com/ttdennis/fpicker/) first, maybe they suite your need.
 
 ## 1) Introduction
 
-- 
cgit 1.4.1


From 89df436290c67b1c03122bfe5c68cf4f92e581c0 Mon Sep 17 00:00:00 2001
From: llzmb <46303940+llzmb@users.noreply.github.com>
Date: Sun, 5 Dec 2021 19:03:48 +0100
Subject: Fix broken links - 1st run

---
 docs/INSTALL.md                     |  9 ++++----
 docs/afl-fuzz_approach.md           | 14 ++++++------
 docs/env_variables.md               | 11 +++++-----
 docs/fuzzing_binary-only_targets.md |  8 +++----
 docs/fuzzing_in_depth.md            |  9 ++++----
 frida_mode/Scripting.md             |  4 ++--
 instrumentation/README.llvm.md      | 43 ++++++++++++++++++++++++++++++++++++-
 utils/README.md                     |  2 +-
 8 files changed, 72 insertions(+), 28 deletions(-)

(limited to 'utils/README.md')

diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index 9d1309fe..906d3f8e 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -60,10 +60,9 @@ These build targets exist:
 * unit: perform unit tests (based on cmocka)
 * help: shows these build options
 
-[Unless you are on Mac OS
-X](https://developer.apple.com/library/archive/qa/qa1118/_index.html), you can
-also build statically linked versions of the AFL++ binaries by passing the
-`STATIC=1` argument to make:
+[Unless you are on Mac OS X](https://developer.apple.com/library/archive/qa/qa1118/_index.html),
+you can also build statically linked versions of the AFL++ binaries by passing
+the `STATIC=1` argument to make:
 
 ```shell
 make STATIC=1
@@ -169,5 +168,5 @@ sysctl kern.sysv.shmall=98304
 ```
 
 See
-[https://www.spy-hill.com/help/apple/SharedMemory.html](https://www.spy-hill.com/help/apple/SharedMemory.html)
+[http://www.spy-hill.com/help/apple/SharedMemory.html](http://www.spy-hill.com/help/apple/SharedMemory.html)
 for documentation for these settings and how to make them permanent.
\ No newline at end of file
diff --git a/docs/afl-fuzz_approach.md b/docs/afl-fuzz_approach.md
index a72087c2..01888935 100644
--- a/docs/afl-fuzz_approach.md
+++ b/docs/afl-fuzz_approach.md
@@ -243,9 +243,10 @@ now. It tells you about the current stage, which can be any of:
   together two random inputs from the queue at some arbitrarily selected
   midpoint.
 - sync - a stage used only when `-M` or `-S` is set (see
-  [parallel_fuzzing.md](parallel_fuzzing.md)). No real fuzzing is involved, but
-  the tool scans the output from other fuzzers and imports test cases as
-  necessary. The first time this is done, it may take several minutes or so.
+  [fuzzing_in_depth.md:3c) Using multiple cores](fuzzing_in_depth.md#c-using-multiple-cores)).
+  No real fuzzing is involved, but the tool scans the output from other fuzzers
+  and imports test cases as necessary. The first time this is done, it may take
+  several minutes or so.
 
 The remaining fields should be fairly self-evident: there's the exec count
 progress indicator for the current stage, a global exec counter, and a benchmark
@@ -254,8 +255,8 @@ to another, but the benchmark should be ideally over 500 execs/sec most of the
 time - and if it stays below 100, the job will probably take very long.
 
 The fuzzer will explicitly warn you about slow targets, too. If this happens,
-see the [perf_tips.md](perf_tips.md) file included with the fuzzer for ideas on
-how to speed things up.
+see the [best_practices.md#improving-speed](best_practices.md#improving-speed)
+for ideas on how to speed things up.
 
 ### Findings in depth
 
@@ -396,7 +397,8 @@ comparing it to the number of logical cores on the system.
 
 If the value is shown in green, you are using fewer CPU cores than available on
 your system and can probably parallelize to improve performance; for tips on how
-to do that, see [parallel_fuzzing.md](parallel_fuzzing.md).
+to do that, see
+[fuzzing_in_depth.md:3c) Using multiple cores](fuzzing_in_depth.md#c-using-multiple-cores).
 
 If the value is shown in red, your CPU is *possibly* oversubscribed, and running
 additional fuzzers may not give you any benefits.
diff --git a/docs/env_variables.md b/docs/env_variables.md
index 86ebf25c..0952b960 100644
--- a/docs/env_variables.md
+++ b/docs/env_variables.md
@@ -583,10 +583,11 @@ The QEMU wrapper used to instrument binary-only code supports several settings:
 
 The FRIDA wrapper used to instrument binary-only code supports many of the same
 options as `afl-qemu-trace`, but also has a number of additional advanced
-options. These are listed in brief below (see [here](../frida_mode/README.md)
-for more details). These settings are provided for compatibiltiy with QEMU mode,
-the preferred way to configure FRIDA mode is through its
-[scripting](../frida_mode/Scripting.md) support.
+options. These are listed in brief below (see
+[frida_mode/README.md](../frida_mode/README.md) for more details). These
+settings are provided for compatibiltiy with QEMU mode, the preferred way to
+configure FRIDA mode is through its [scripting](../frida_mode/Scripting.md)
+support.
 
 * `AFL_FRIDA_DEBUG_MAPS` - See `AFL_QEMU_DEBUG_MAPS`
 * `AFL_FRIDA_DRIVER_NO_HOOK` - See `AFL_QEMU_DRIVER_NO_HOOK`. When using the
@@ -627,7 +628,7 @@ the preferred way to configure FRIDA mode is through its
   coverage information for unstable edges (e.g., to be loaded within IDA
   lighthouse).
 * `AFL_FRIDA_JS_SCRIPT` - Set the script to be loaded by the FRIDA scripting
-  engine. See [here](Scripting.md) for details.
+  engine. See [frida_mode/Scripting.md](../frida_mode/Scripting.md) for details.
 * `AFL_FRIDA_OUTPUT_STDOUT` - Redirect the standard output of the target
   application to the named file (supersedes the setting of `AFL_DEBUG_CHILD`)
 * `AFL_FRIDA_OUTPUT_STDERR` - Redirect the standard error of the target
diff --git a/docs/fuzzing_binary-only_targets.md b/docs/fuzzing_binary-only_targets.md
index eaed3a91..fd18b5c1 100644
--- a/docs/fuzzing_binary-only_targets.md
+++ b/docs/fuzzing_binary-only_targets.md
@@ -107,10 +107,10 @@ For additional instructions and caveats, see
 [frida_mode/README.md](../frida_mode/README.md).
 
 If possible, you should use the persistent mode, see
-[qemu_frida/README.md](../qemu_frida/README.md). The mode is approximately 2-5x
-slower than compile-time instrumentation, and is less conducive to
-parallelization. But for binary-only fuzzing, it gives a huge speed improvement
-if it is possible to use.
+[instrumentation/README.persistent_mode.md](../instrumentation/README.persistent_mode.md).
+The mode is approximately 2-5x slower than compile-time instrumentation, and is
+less conducive to parallelization. But for binary-only fuzzing, it gives a huge
+speed improvement if it is possible to use.
 
 If you want to fuzz a binary-only library, then you can fuzz it with frida-gum
 via frida_mode/. You will have to write a harness to call the target function in
diff --git a/docs/fuzzing_in_depth.md b/docs/fuzzing_in_depth.md
index 4a1ddf45..29e8f817 100644
--- a/docs/fuzzing_in_depth.md
+++ b/docs/fuzzing_in_depth.md
@@ -153,12 +153,12 @@ only instrument parts of the target that you are interested in:
 
 There are many more options and modes available, however, these are most of the
 time less effective. See:
-* [instrumentation/README.ctx.md](../instrumentation/README.ctx.md)
-* [instrumentation/README.ngram.md](../instrumentation/README.ngram.md)
+* [instrumentation/README.llvm.md#6) AFL++ Context Sensitive Branch Coverage](../instrumentation/README.llvm.md#6-afl-context-sensitive-branch-coverage)
+* [instrumentation/README.llvm.md#7) AFL++ N-Gram Branch Coverage](../instrumentation/README.llvm.md#7-afl-n-gram-branch-coverage)
 
 AFL++ performs "never zero" counting in its bitmap. You can read more about this
 here:
-* [instrumentation/README.neverzero.md](../instrumentation/README.neverzero.md)
+* [instrumentation/README.llvm.md#8-neverzero-counters](../instrumentation/README.llvm.md#8-neverzero-counters)
 
 ### c) Selecting sanitizers
 
@@ -474,7 +474,8 @@ is:
 
 ![resources/screenshot.png](resources/screenshot.png)
 
-All labels are explained in [status_screen.md](status_screen.md).
+All labels are explained in
+[afl-fuzz_approach.md#understanding-the-status-screen](afl-fuzz_approach.md#understanding-the-status-screen).
 
 ### b) Keeping memory use and timeouts in check
 
diff --git a/frida_mode/Scripting.md b/frida_mode/Scripting.md
index 63ab1718..ad86fdd3 100644
--- a/frida_mode/Scripting.md
+++ b/frida_mode/Scripting.md
@@ -109,8 +109,8 @@ Afl.setPersistentAddress(address);
 
 A persistent hook can be implemented using a conventional shared object, sample
 source code for a hook suitable for the prototype of `LLVMFuzzerTestOneInput`
-can be found in [hook/hook.c](hook/hook.c). This can be configured using code
-similar to the following.
+can be found in [hook/](hook/). This can be configured using code similar to the
+following.
 
 ```js
 const path = Afl.module.path;
diff --git a/instrumentation/README.llvm.md b/instrumentation/README.llvm.md
index fa025643..ca9ce933 100644
--- a/instrumentation/README.llvm.md
+++ b/instrumentation/README.llvm.md
@@ -234,4 +234,45 @@ are 2-16.
 
 It is highly recommended to increase the MAP_SIZE_POW2 definition in config.h to
 at least 18 and maybe up to 20 for this as otherwise too many map collisions
-occur.
\ No newline at end of file
+occur.
+
+## 8) NeverZero counters
+
+In larger, complex, or reiterative programs, the byte sized counters that
+collect the edge coverage can easily fill up and wrap around. This is not that
+much of an issue - unless, by chance, it wraps just to a value of zero when the
+program execution ends. In this case, afl-fuzz is not able to see that the edge
+has been accessed and will ignore it.
+
+NeverZero prevents this behavior. If a counter wraps, it jumps over the value 0
+directly to a 1. This improves path discovery (by a very small amount) at a very
+low cost (one instruction per edge).
+
+(The alternative of saturated counters has been tested also and proved to be
+inferior in terms of path discovery.)
+
+This is implemented in afl-gcc and afl-gcc-fast, however, for llvm_mode this is
+optional if multithread safe counters are selected or the llvm version is below
+9 - as there are severe performance costs in these cases.
+
+If you want to enable this for llvm versions below 9 or thread safe counters,
+then set
+
+```
+export AFL_LLVM_NOT_ZERO=1
+```
+
+In case you are on llvm 9 or greater and you do not want this behavior, then you
+can set:
+
+```
+AFL_LLVM_SKIP_NEVERZERO=1
+```
+
+If the target does not have extensive loops or functions that are called a lot
+then this can give a small performance boost.
+
+Please note that the default counter implementations are not thread safe!
+
+Support for thread safe counters in mode LLVM CLASSIC can be activated with
+setting `AFL_LLVM_THREADSAFE_INST=1`.
\ No newline at end of file
diff --git a/utils/README.md b/utils/README.md
index 5f5745b9..debc86e8 100644
--- a/utils/README.md
+++ b/utils/README.md
@@ -48,7 +48,7 @@ Here's a quick overview of the stuff you can find in this directory:
   - defork               - intercept fork() in targets
 
   - distributed_fuzzing  - a sample script for synchronizing fuzzer instances
-                           across multiple machines (see parallel_fuzzing.md).
+                           across multiple machines.
 
   - libdislocator        - like ASAN but lightweight.
 
-- 
cgit 1.4.1