afl-analyze
afl-analyze [ options ] -- /path/to/target_app [ ... ]
Required
parameters:
-i file - input test case to be analyzed by the tool
Execution
control settings:
-f file - input file read by the tested program (stdin)
-t msec - timeout for each run (1000 ms)
-m megs - memory limit for child process (0 MB)
-O - use binary-only instrumentation (FRIDA mode)
-Q - use binary-only instrumentation (QEMU mode)
-U - use unicorn-based instrumentation (Unicorn mode)
-W - use qemu-based instrumentation with Wine (Wine mode)
-X - use Nyx mode
Analysis
settings:
-e - look for edge coverage only, ignore hit counts
For additional tips, please consult docs/README.md.
Environment
variables used:
TMPDIR: directory to use for temporary input files
ASAN_OPTIONS: custom settings for ASAN
(must contain abort_on_error=1 and symbolize=0)
MSAN_OPTIONS: custom settings for MSAN
(must contain exitcode=86 and symbolize=0)
AFL_ANALYZE_HEX: print file offsets in hexadecimal instead
of decimal
AFL_KILL_SIGNAL: Signal ID delivered to child processes on
timeout, etc.
(default: SIGKILL)
AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server
on termination
(default: SIGTERM). If unset and AFL_KILL_SIGNAL is
set, that value will be used.
AFL_MAP_SIZE: the shared memory size for that target. must
be >= the size
the target was compiled for
AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for
target
AFL_SKIP_BIN_CHECK: skip checking the location of and the
target
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <[email protected]>, Dominik Maier <[email protected]>, Andrea Fioraldi <[email protected]> and Heiko "hexcoder-" Eissfeldt <[email protected]> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus
Apache License Version 2.0, January 2004