Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

QoL patch: also use @@ instead of AFL_FILE #41

Open
wants to merge 45 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
45 commits
Select commit Hold shift + click to select a range
5ee5403
QoL patch: also use @@ instead of AFL_FILE
vanhauser-thc Jun 22, 2019
b8b9007
version bump
vanhauser-thc Aug 27, 2019
3d709e5
add helper scripts
vanhauser-thc May 13, 2020
b0cdf59
add helper script, bump version to 0.6.3
vanhauser-thc May 13, 2020
89801bb
display time as clock too
vanhauser-thc May 14, 2020
6699b50
fix writing to stat file
vanhauser-thc May 14, 2020
71ce66c
fix script
vanhauser-thc May 22, 2020
c0da127
add support for stdin
vanhauser-thc May 23, 2020
9b9d121
-v option
vanhauser-thc May 23, 2020
7567328
better stat output
vanhauser-thc May 27, 2020
e6a6fb9
add Makefile
vanhauser-thc May 27, 2020
0a750c0
switch to python3
vanhauser-thc May 28, 2020
fd7ba2b
small change to build script
vanhauser-thc May 29, 2020
0c582d3
small change to build script
vanhauser-thc May 29, 2020
ec8b03d
libfuzzer_driver for fuzzbench
vanhauser-thc Jun 11, 2020
e67f2c4
add clang support
vanhauser-thc Jun 11, 2020
c83749c
display days on afl-stat
vanhauser-thc Jun 21, 2020
ce1e72d
fix afl-cov
vanhauser-thc Jun 24, 2020
e4f3a97
timeout option, auto use default/ if necessary
vanhauser-thc Feb 9, 2021
572c75b
fix open call
vanhauser-thc Feb 21, 2021
db64d33
fix the fix
vanhauser-thc Feb 22, 2021
ba95180
fix afl-cov for python3. python sucks.
vanhauser-thc Feb 22, 2021
14124eb
fix
vanhauser-thc Feb 22, 2021
c315486
fix
vanhauser-thc Feb 25, 2021
ff90139
py3 fixes
domenukk Mar 3, 2021
050aab4
Merge pull request #1 from domenukk/py3
vanhauser-thc Mar 6, 2021
912a278
update docs
vanhauser-thc Mar 6, 2021
25910eb
fix readme
vanhauser-thc Apr 1, 2021
0befe13
add stuff from nirizr
vanhauser-thc Jul 30, 2021
47903f6
add stuff from nirizr
vanhauser-thc Jul 30, 2021
f51eff6
support afl-fuzz -f
mmmds Nov 3, 2021
bb51de0
add fuzzer define
vanhauser-thc Jan 14, 2022
e90d5fe
avoid O(n^2) file scan
kcwu May 24, 2022
971c222
Fixed "-T option don't work" bug
Aug 23, 2022
7355fc2
Fixed fail during processing input file with no-utf characters.
Aug 23, 2022
d64ba0e
Merge pull request #6 from kcwu/master
vanhauser-thc Aug 24, 2022
2f22201
Merge pull request #5 from mmmds/master
vanhauser-thc Aug 24, 2022
9345417
Merge pull request #7 from gvozdila/master
vanhauser-thc Aug 25, 2022
722f235
egrep -> grep -e
vanhauser-thc Sep 5, 2022
f97a535
detect afl compiler
vanhauser-thc Nov 23, 2023
d484811
Prevent repeated coverage calculation for files
JamesLee-Jones Jun 17, 2024
a1bf1a9
Fix progress counter
JamesLee-Jones Jun 17, 2024
babdc94
Merge pull request #8 from JamesLee-Jones/master
vanhauser-thc Jun 22, 2024
17f92df
fixing * escape
kevin-valerio Dec 26, 2024
03eeb85
Merge pull request #9 from kevin-valerio/patch-1
vanhauser-thc Dec 28, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions ChangeLog
Original file line number Diff line number Diff line change
@@ -1,3 +1,20 @@
afl-cov-0.7.0
- python3 improvements by @domenukk - much faster now

afl-cov-0.6.6
- support clang for gathering coverage

afl-cov-0.6.5 (2020-05-28)
- switched to python3

afl-cov-0.6.4 (2020-05-23):
- afl-cov now supports stdin targets (just omit @@/AFL_FILE)
- enhance scripts

afl-cov-0.6.3 (2020-05-13):
- Allow @@ additionally to AFL_FILE
- added three helper scripts

afl-cov-0.6.2 (12/26/2018):
- (Tim Strazzere) Add support for llvm-cov compiled binaries. Add a check
when ensuring the binary was instrumented with gcov to catch an llvm-cov
Expand Down
5 changes: 5 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
all:
@echo nothing to do, just run \"sudo make install\"

install:
install -m 0755 afl-* /usr/local/bin
50 changes: 40 additions & 10 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
# afl-cov - AFL Fuzzing Code Coverage

Version: 0.7.0

- [Preface](#preface)
- [Introduction](#introduction)
- [Prerequisites](#prerequisites)
- [Workflow](#workflow)
Expand All @@ -10,9 +13,32 @@
- [License](#license)
- [Contact](#contact)

## Preface

This is a modified afl-cov fork because the original author's account is
inactive :-(

It has several improvements:
* Much, much faster (thanks to @domenukk)!
* afl-cov now accepts "@@" like AFL++ in the target command parameters
* afl-cov now can send to targets that read on stdin (just omit @@)
* afl-cov has a timeout -T option, so hangs are not an issue. default: 5s
* afl-cov.sh makes using afl-cov easier (just needs two parameters)
* afl-cov-build.sh makes builing a target for coverage easier, just type e.g.
`afl-cov-build.sh ./configure ; make`
* afl-cov/afl-cov.sh/afl-cov-build.sh now support clang coverage, just add
-c to afl-cov.sh/afl-cov-build.sh and --clang for afl-cov
* afl-stat.sh shows the statistics of a run (in progress or completed)
* For `LLVMFuzzerTestOneInput()` harnesses you can build + link with
`libfuzzer_driver.cpp`

Enjoy!

Marc "van Hauser" Heuse

## Introduction
`afl-cov` uses test case files produced by the
[AFL fuzzer](http://lcamtuf.coredump.cx/afl/) `afl-fuzz` to generate gcov code
[AFL++ fuzzer](http://github.com/AFLplusplus/aflplusplus) `afl-fuzz` to generate gcov code
coverage results for a targeted binary. Code coverage is interpreted from one
case to the next by `afl-cov` in order to determine which new functions and
lines are hit by AFL with each new test case. Further, `afl-cov` allows for
Expand Down Expand Up @@ -82,32 +108,36 @@ the output directory used by `afl-fuzz`, and the command to execute along with
associated arguments. This command and arguments should closely resemble the
manner in which `afl-fuzz` executes the targeted binary during the fuzzing
cycle. If there is already an existing directory of AFL fuzzing results, then
just omit the `--live` argument to process the existing results. Here is an
example:
just omit the `--live` argument to process the existing results.

NOTE: you can use both afl's "@@" or afl-cov's original "AFL_FILE" placeholder for
the --coverage-cmd line parameter.

Here is an example:

```bash
$ cd /path/to/project-gcov/
$ afl-cov -d /path/to/afl-fuzz-output/ --live --coverage-cmd \
"cat AFL_FILE | LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -a -b -c" \
"LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -a -b -c" \
--code-dir .
```

`/path/to/afl-fuzz-output/` is the output directory of afl-fuzz.

The `AFL_FILE` string above refers to the test case file that AFL will
The `AFL_FILE` string refers to the test case file that AFL will
build in the `queue/` directory under `/path/to/afl-fuzz-output`. Just leave this
string as-is since `afl-cov` will automatically substitute it with each AFL
`queue/id:NNNNNN*` in succession as it builds the code coverage reports.
You can also use @@ instead of AFL_FILE, both notations work.

Also, in the above command, this handles the case where the AFL fuzzing cycle
is fuzzing the targeted binary via stdin. This explains the
`cat AFL_FILE | ... ./bin/.lib/somebin ...` invocation. For the other style of
fuzzing with AFL where a file is read from the filesystem, here is an example:
is fuzzing the targeted binary via stdin.
For the other style of fuzzing with AFL where a file is read from the filesystem, here is an example:

```bash
$ cd /path/to/project-gcov/
$ afl-cov -d /path/to/afl-fuzz-output/ --live --coverage-cmd \
"LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f AFL_FILE -a -b -c" \
"LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f @@ -a -b -c" \
--code-dir .
```

Expand Down Expand Up @@ -137,7 +167,7 @@ the `--enable-branch-coverage` argument as described above):

```bash
$ afl-cov -d /path/to/afl-fuzz-output/ --live --coverage-cmd \
"LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f AFL_FILE -a -b -c" \
"LD_LIBRARY_PATH=./lib/.libs ./bin/.libs/somebin -f @@ -a -b -c" \
--code-dir . --enable-branch-coverage
[+] Imported 184 files from: /path/to/afl-fuzz-output/queue
[+] AFL file: id:000000,orig:somestr.start (1 / 184), cycle: 0
Expand Down
2 changes: 1 addition & 1 deletion VERSION
Original file line number Diff line number Diff line change
@@ -1 +1 @@
0.6.2
0.6.6
2 changes: 2 additions & 0 deletions afl-clang-cov.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
#!/bin/sh
llvm-cov gcov $*
Loading