1# AFL++ drivers 2 3## aflpp_driver 4 5aflpp_driver is used to compile directly libfuzzer `LLVMFuzzerTestOneInput()` 6targets. 7 8Just do `afl-clang-fast++ -o fuzz fuzzer_harness.cc libAFLDriver.a [plus 9required linking]`. 10 11You can also sneakily do this little trick: If this is the clang compile command 12to build for libfuzzer: `clang++ -o fuzz -fsanitize=fuzzer fuzzer_harness.cc 13-lfoo`, then just switch `clang++` with `afl-clang-fast++` and our compiler will 14magically insert libAFLDriver.a :) 15 16To use shared-memory test cases, you need nothing to do. To use stdin test 17cases, give `-` as the only command line parameter. To use file input test 18cases, give `@@` as the only command line parameter. 19 20IMPORTANT: if you use `afl-cmin` or `afl-cmin.bash`, then either pass `-` or 21`@@` as command line parameters. 22 23## aflpp_qemu_driver 24 25Note that you can use the driver too for FRIDA mode (`-O`). 26 27aflpp_qemu_driver is used for libfuzzer `LLVMFuzzerTestOneInput()` targets that 28are to be fuzzed in QEMU mode. So compile them with clang/clang++, without 29-fsantize=fuzzer or afl-clang-fast, and link in libAFLQemuDriver.a: 30 31`clang++ -o fuzz fuzzer_harness.cc libAFLQemuDriver.a [plus required linking]`. 32 33Then just do (where the name of the binary is `fuzz`): 34 35``` 36AFL_QEMU_PERSISTENT_ADDR=0x$(nm fuzz | grep "T LLVMFuzzerTestOneInput" | awk '{print $1}') 37AFL_QEMU_PERSISTENT_HOOK=/path/to/aflpp_qemu_driver_hook.so afl-fuzz -Q ... -- ./fuzz` 38``` 39 40if you use afl-cmin or `afl-showmap -C` with the aflpp_qemu_driver you need to 41set the set same AFL_QEMU_... (or AFL_FRIDA_...) environment variables. If you 42want to use afl-showmap (without -C) or afl-cmin.bash, then you may not set 43these environment variables and rather set `AFL_QEMU_DRIVER_NO_HOOK=1`.