mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Andrew Cooper
7dfd103efb
This is rather faster for afl-fuzz to arrange than using an explicit file parameter. Also update the README to recommend using a tmpfs for findings_dir which reduces disk load and is more performant. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Wei Liu <wei.liu2@citrix.com>
36 lines
1010 B
Plaintext
36 lines
1010 B
Plaintext
# OVERVIEW
|
|
|
|
Some fuzzing targets have American Fuzzy Lop (AFL) support.
|
|
|
|
See also http://lcamtuf.coredump.cx/afl/
|
|
|
|
# HOW IT WORKS
|
|
|
|
AFL provides a customised toolchain to build an executable, which in
|
|
turn is launched by the fuzzer.
|
|
|
|
# HOW TO USE IT
|
|
|
|
Use the x86 instruction emulator fuzzer as an example.
|
|
|
|
1. download and compile AFL in $AFLPATH.
|
|
|
|
2. run the following commands to build:
|
|
$ cd tools/fuzz/x86_instruction_emulator
|
|
$ make distclean
|
|
$ make CC=$AFLPATH/afl-gcc afl # produces afl-harness
|
|
|
|
3. provide initial test case (fuzzer dependent, see afl-*.c):
|
|
$ mkdir testcase_dir
|
|
$ dd if=/dev/urandom of=testcase_dir/rand.bin \
|
|
bs=`./afl-harness --min-input-size` count=1
|
|
|
|
3a. use a tmpfs for findings_dir (Perf improvement and reduced disk load)
|
|
$ mkdir findings_dir
|
|
$ mount -t tmpfs -o size=512M tmpfs findings_dir
|
|
|
|
4. run the fuzzer with AFL:
|
|
$ $AFLPATH/afl-fuzz -t 1000 -i testcase_dir -o findings_dir -- ./afl-harness
|
|
|
|
Please see AFL documentation for more information.
|