blob: 146b4620e6b40a5fb798b54209b7931a55888ab5 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
# CmpLog instrumentation
The CmpLog instrumentation enables logging of comparison operands in a shared
memory.
These values can be used by various mutators built on top of it. At the moment,
we support the RedQueen mutator (input-2-state instructions only), for details
see
[the RedQueen paper](https://www.syssec.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2018/12/17/NDSS19-Redqueen.pdf).
## Build
To use CmpLog, you have to build two versions of the instrumented target
program.
The first version is built using the regular AFL++ instrumentation.
The second one, the CmpLog binary, is built with setting AFL_LLVM_CMPLOG during
the compilation.
For example:
```
./configure --cc=~/path/to/afl-clang-fast
make
cp ./program ./program.afl
make clean
export AFL_LLVM_CMPLOG=1
./configure --cc=~/path/to/afl-clang-fast
make
cp ./program ./program.cmplog
unset AFL_LLVM_CMPLOG
```
## Use
AFL++ has the new `-c` option that needs to be used to specify the CmpLog binary
(the second build).
For example:
```
afl-fuzz -i input -o output -c ./program.cmplog -m none -- ./program.afl @@
```
Be sure to use `-m none` because CmpLog can map a lot of pages.
|
