$ cd $HOME $ git clone https://github.com/AFLplusplus/AFLplusplus && cd AFLplusplus $ export LLVM_CONFIG="llvm-config-11" $ make distrib $ sudo make install
Required parameters: -i dir - input directory with test cases -o dir - output directory for fuzzer findings
Execution control settings: -p schedule - power schedules compute a seed's performance score: fast(default), explore, exploit, seek, rare, mmopt, coe, lin quad -- see docs/FAQ.md for more information -f file - location read by the fuzzed program (default: stdin or @@) -t msec - timeout for each run (auto-scaled, default 1000 ms). Add a '+' to auto-calculate the timeout, the value being the maximum. -m megs - memory limit for child process (0 MB, 0 = no limit [default]) -O - use binary-only instrumentation (FRIDA mode) -Q - use binary-only instrumentation (QEMU mode) -U - use unicorn-based instrumentation (Unicorn mode) -W - use qemu-based instrumentation with Wine (Wine mode) -X - use VM fuzzing (NYX mode - standalone mode) -Y - use VM fuzzing (NYX mode - multiple instances mode)
Mutator settings: -g minlength - set min length of generated fuzz input (default: 1) -G maxlength - set max length of generated fuzz input (default: 1048576) -D - enable deterministic fuzzing (once per queue entry) -L minutes - use MOpt(imize) mode and set the time limit for entering the pacemaker mode (minutes of no new finds). 0 = immediately, -1 = immediately and together with normal mutation. See docs/README.MOpt.md -c program - enable CmpLog by specifying a binary compiled for it. if using QEMU, just use -c 0. -l cmplog_opts - CmpLog configuration values (e.g. "2AT"): 1=small files, 2=larger files (default), 3=all files, A=arithmetic solving, T=transformational solving.
Fuzzing behavior settings: -Z - sequential queue selection instead of weighted random -N - do not unlink the fuzzing input file (for devices etc.) -n - fuzz without instrumentation (non-instrumented mode) -x dict_file - fuzzer dictionary (see README.md, specify up to 4 times)
Test settings: -s seed - use a fixed seed for the RNG -V seconds - fuzz for a specified time then terminate -E execs - fuzz for an approx. no. of total executions then terminate Note: not precise and can have several more executions.
Other stuff: -M/-S id - distributed mode (see docs/parallel_fuzzing.md) -M auto-sets -D, -Z (use -d to disable -D) and no trimming -F path - sync to a foreign fuzzer queue directory (requires -M, can be specified up to 32 times) -T text - text banner to show on the screen -I command - execute this command/script when a new crash is found -C - crash exploration mode (the peruvian rabbit thing) -b cpu_id - bind the fuzzing process to the specified CPU core (0-...) -e ext - file extension for the fuzz test input file (if needed)
To view also the supported environment variables of afl-fuzz please use "-hh".
Compiled with Python 3.8.10 module support, see docs/custom_mutator.md Compiled without AFL_PERSISTENT_RECORD support. Compiled with shmat support. For additional help please consult /usr/local/share/doc/afl/README.md :)
插桩与运行
用 AFL 的编译器编译代码
首先要清理所有之前编译的目标文件和可执行文件
1 2 3
$ rm -r $HOME/fuzzing_xpdf/install $ cd $HOME/fuzzing_xpdf/xpdf-3.02/ $ make clean
接着使用 afl-clang-fast 编译器构建 Xpdf
1 2 3 4
$ export LLVM_CONFIG="llvm-config-11" $ CC=$HOME/AFLplusplus/afl-clang-fast CXX=$HOME/AFLplusplus/afl-clang-fast++ ./configure --prefix="$HOME/fuzzing_xpdf/install/" $ make $ make install
