1# AFL++ Examples 2 3Here's a quick overview of the stuff you can find in this directory: 4 5 - aflpp_driver - easily instrument LLVMFuzzerTestOneInput() 6 harnesses. 7 8 - afl_network_proxy - fuzz a target over the network: afl-fuzz on 9 a host, target on an embedded system. 10 11 - plot_ui - simple UI window utility to display the 12 plots generated by afl-plot 13 14 - afl_proxy - skeleton file example to show how to fuzz 15 something where you gather coverage data via 16 different means, e.g., hw debugger 17 18 - afl_untracer - fuzz binary-only libraries much faster but with 19 less coverage than QEMU mode 20 21 - analysis_scripts - random -o out analysis scripts 22 23 - argv_fuzzing - a simple wrapper to allow cmdline to be fuzzed 24 (e.g., to test setuid programs). 25 26 - asan_cgroups - a contributed script to simplify fuzzing ASAN 27 binaries with robust memory limits on Linux. 28 29 - autodict_ql - generate dictionary files from source code. 30 31 - bash_shellshock - a simple hack used to find a bunch of 32 post-Shellshock bugs in bash. 33 34 - canvas_harness - a test harness used to find browser bugs with a 35 corpus generated using simple image parsing 36 binaries & afl-fuzz. 37 38 - clang_asm_normalize - a script that makes it easy to instrument 39 hand-written assembly, provided that you have clang. 40 41 - crash_triage - a very rudimentary example of how to annotate crashes 42 with additional gdb metadata. 43 44 - custom_mutators - examples for the AFL++ custom mutator interface in 45 C and Python. Note: They were moved to 46 ../custom_mutators/examples/ 47 48 - defork - intercept fork() in targets 49 50 - distributed_fuzzing - a sample script for synchronizing fuzzer instances 51 across multiple machines. 52 53 - libdislocator - like ASAN but lightweight. 54 55 - libtokencap - collect string tokens for a dictionary. 56 57 - libpng_no_checksum - a sample patch for removing CRC checks in libpng. 58 59 - persistent_mode - an example of how to use the LLVM persistent process 60 mode to speed up certain fuzzing jobs. 61 62 - qemu_persistent_hook - persistent mode support module for qemu. 63 64 - socket_fuzzing - a LD_PRELOAD library 'redirects' a socket to stdin 65 for fuzzing access with AFL++ 66 67Note that the minimize_corpus.sh tool has graduated from the utils/ 68directory and is now available as ../afl-cmin. The LLVM mode has likewise 69graduated to ../instrumentation/*. 70 71Most of the tools in this directory are meant chiefly as examples that need to 72be tweaked for your specific needs. They come with some basic documentation, 73but are not necessarily production-grade. 74