From 7867e610b5cffd2c0749703eca1333bdd7840824 Mon Sep 17 00:00:00 2001
From: van Hauser <vh@thc.org>
Date: Thu, 1 Mar 2018 13:20:26 +0100
Subject: added -S switch, make install, updated README

---
 README.txt | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

(limited to 'README.txt')

diff --git a/README.txt b/README.txt
index adecc8b..b8a4b07 100644
--- a/README.txt
+++ b/README.txt
@@ -8,6 +8,10 @@ Instrumentation tool (afl-dyninst) instruments the supplied binary by
 inserting callbacks for each basic block and an initialization 
 callback either at _init or at specified entry point.
 
+
+Commandline options
+-------------------
+
 Usage: ./afl-dyninst -i <binary> -o <binary> -l <library> -e <address> -s <number>
   -i: Input binary 
   -o: Output binary
@@ -17,6 +21,7 @@ Usage: ./afl-dyninst -i <binary> -o <binary> -l <library> -e <address> -s <numbe
   -s: Number of basic blocks to skip
   -m: minimum size of a basic bock to instrument (default: 1)
   -f: fix dyninst bug to sometimes not save edi/rdi register
+  -S: do not instrument this function (can be specified only once)
   -v: Verbose output
 
 Switch -l is used to supply the names of the libraries that should 
@@ -53,15 +58,20 @@ uses the edi/rdi. However dyninst does not always saves and restores it when
 instrumenting that function leading to crashes and changed program behaviour
 when the register is used for function parameters.
 
-The instrumentation library "libDyninst.so" must be available in the current working
-directory as that is where the instrumented binary will be looking for it.
+Switch -S allows you to not instrument a specific function.
+This options is mainly to hunt down bugs in dyninst. It can only be set once.
+
 
 Compiling:
+----------
 
 1. Edit the Makefile and set DYNINST_ROOT and AFL_ROOT to appropriate paths. 
 2. make
+3. make install
+
 
-Example of running the tool:
+Example of running the tool
+---------------------------
 
 Dyninst requires DYNINSTAPI_RT_LIB environment variable to point to the location
 of libdyninstAPI_RT.so.
@@ -78,7 +88,12 @@ Here we are instrumenting  the rar binary with entrypoint at 0x4034c0
 (manualy found address of main), skipping the first 100 basic blocks 
 and outputing to rar_ins. 
 
+
 Running AFL on instrumented binary
+----------------------------------
+
+NOTE: The instrumentation library "libDyninst.so" must be available in the current working
+directory or LD_LIBRARY_PATH as that is where the instrumented binary will be looking for it.
 
 Since AFL checks if the binary has been instrumented by afl-gcc,AFL_SKIP_BIN_CHECK environment 
 variable needs to be set. No modifications to AFL it self is needed. 
@@ -86,5 +101,5 @@ $ export AFL_SKIP_BIN_CHECK=1
 Then, AFL can be run as usual:
 $ afl-fuzz  -i testcases/archives/common/gzip/ -o test_gzip -- ./gzip_ins -d -c 
 
-
-
+Note that there are the helper scripts afl-fuzz.sh and afl-dyninst.sh for you which set the
+required environment variables for you.
-- 
cgit 1.4.1