1# TODO list for AFL++ 2 3## Must 4 5 - UI revamp 6 - hardened_usercopy=0 page_alloc.shuffle=0 7 - add value_profile but only enable after 15 minutes without finds 8 - cmplog max len, cmplog max items envs? 9 - adapt MOpt to new mutation engine 10 - Update afl->pending_not_fuzzed for MOpt 11 - cmplog rtn sanity check on fixed length? currently we ignore the length 12 - afl-showmap -f support 13 - afl-fuzz multicore wrapper script 14 - when trimming then perform crash detection 15 - problem: either -L0 and/or -p mmopt results in zero new coverage 16 17 18## Should 19 20 - afl-crash-analysis 21 - support persistent and deferred fork server in afl-showmap? 22 - better autodetection of shifting runtime timeout values 23 - afl-plot to support multiple plot_data 24 - parallel builds for source-only targets 25 - get rid of check_binary, replace with more forkserver communication 26 - first fuzzer should be a main automatically? not sure. 27 28## Maybe 29 30 - forkserver tells afl-fuzz if cmplog is supported and if so enable 31 it by default, with AFL_CMPLOG_NO=1 (?) set to skip? 32 - afl_custom_splice() 33 - cmdline option from-to range for mutations 34 35## Further down the road 36 37QEMU mode/FRIDA mode: 38 - non colliding instrumentation 39 - rename qemu specific envs to AFL_QEMU (AFL_ENTRYPOINT, AFL_CODE_START/END, 40 AFL_COMPCOV_LEVEL?) 41 - add AFL_QEMU_EXITPOINT (maybe multiple?) 42 43## Ideas 44 45 - LTO/sancov: write current edge to prev_loc and use that information when 46 using cmplog or __sanitizer_cov_trace_cmp*. maybe we can deduct by follow up 47 edge numbers that both following cmp paths have been found and then disable 48 working on this edge id -> cmplog_intelligence branch 49 - use cmplog colorization taint result for havoc locations? 50