blob: 62d791932f28de61de2a3252030d0691cc90846a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
# AFL++ Examples
Here's a quick overview of the stuff you can find in this directory:
- aflpp_driver - easily instrument LLVMFuzzerTestOneInput()
harnesses.
- afl_network_proxy - fuzz a target over the network: afl-fuzz on
a host, target on an embedded system.
- plot_ui - simple UI window utility to display the
plots generated by afl-plot
- afl_proxy - skeleton file example to show how to fuzz
something where you gather coverage data via
different means, e.g., hw debugger
- afl_untracer - fuzz binary-only libraries much faster but with
less coverage than QEMU mode
- analysis_scripts - random -o out analysis scripts
- argv_fuzzing - a simple wrapper to allow cmdline to be fuzzed
(e.g., to test setuid programs).
- asan_cgroups - a contributed script to simplify fuzzing ASAN
binaries with robust memory limits on Linux.
- autodict_ql - generate dictionary files from source code.
- bash_shellshock - a simple hack used to find a bunch of
post-Shellshock bugs in bash.
- canvas_harness - a test harness used to find browser bugs with a
corpus generated using simple image parsing
binaries & afl-fuzz.
- clang_asm_normalize - a script that makes it easy to instrument
hand-written assembly, provided that you have clang.
- crash_triage - a very rudimentary example of how to annotate crashes
with additional gdb metadata.
- custom_mutators - examples for the AFL++ custom mutator interface in
C and Python. Note: They were moved to
../custom_mutators/examples/
- defork - intercept fork() in targets
- distributed_fuzzing - a sample script for synchronizing fuzzer instances
across multiple machines.
- libdislocator - like ASAN but lightweight.
- libtokencap - collect string tokens for a dictionary.
- libpng_no_checksum - a sample patch for removing CRC checks in libpng.
- persistent_mode - an example of how to use the LLVM persistent process
mode to speed up certain fuzzing jobs.
- qemu_persistent_hook - persistent mode support module for qemu.
- socket_fuzzing - a LD_PRELOAD library 'redirects' a socket to stdin
for fuzzing access with AFL++
Note that the minimize_corpus.sh tool has graduated from the utils/
directory and is now available as ../afl-cmin. The LLVM mode has likewise
graduated to ../instrumentation/*.
Most of the tools in this directory are meant chiefly as examples that need to
be tweaked for your specific needs. They come with some basic documentation,
but are not necessarily production-grade.
|
