xref: /aosp_15_r20/external/AFLplusplus/utils/target_intelligence/README.md (revision 08b48e0b10e97b33e7b60c5b6e2243bd915777f2)

# Target Intelligence

These are some ideas you can do so that your target that you are fuzzing can
give helpful feedback to AFL++.

## Add to the AFL++ dictionary from your target

For this you target must be compiled for CMPLOG (`AFL_LLVM_CMPLOG=1`).

Add in your source code:

```
__attribute__((weak)) void __cmplog_rtn_hook_strn(u8 *ptr1, u8 *ptr2, u64 len);
__attribute__((weak)) void __cmplog_ins_hook1(uint8_t arg1, uint8_t arg2, uint8_t attr);
__attribute__((weak)) void __cmplog_ins_hook2(uint16_t arg1, uint16_t arg2, uint8_t attr);
__attribute__((weak)) void __cmplog_ins_hook4(uint32_t arg1, uint32_t arg2, uint8_t attr);
__attribute__((weak)) void __cmplog_ins_hook8(uint64_t arg1, uint64_t arg2, uint8_t attr);

int in_your_function(...) {

  // to add two strings to the AFL++ dictionary:
  if (__cmplog_rtn_hook_strn)
    __cmplog_rtn_hook_strn(string1, length_of_string1, string2, length_of_string2);

  // to add two 32 bit integers to the AFL++ dictionary:
  if (__cmplog_ins_hook4)
    __cmplog_ins_hook4(first_32_bit_var, second_32_bit_var, 0);

}
```

Note that this only makes sense if these values are in-depth processed in the
target in a way that AFL++ CMPLOG cannot uncover these, e.g. if these values
are transformed by a matrix computation.

Fixed values are always better to give to afl-fuzz via a `-x dictionary`.

## Add inputs to AFL++ dictionary from your target

If for whatever reason you want your target to propose new inputs to AFL++,
then this is actually very easy.
The environment variable `AFL_CUSTOM_INFO_OUT` contains the output directory
of this run - including the fuzzer instance name (e.g. `default`), so if you
run `afl-fuzz -o out -S foobar`, the value would be `out/foobar`).

To show afl-fuzz an input it should consider just do the following:

1. create the directory `$AFL_CUSTOM_INFO_OUT/../target/queue`
2. create any new inputs you want afl-fuzz to notice in that directory with the
   following naming convention: `id:NUMBER-OF-LENGTH-SIX-WITH-LEADING-ZEROES,whatever`
   where that number has to be increasing.
   e.g.:
```
   id:000000,first_file
   id:000001,second_file
   id:000002,third_file
   etc.
```

Note that this will not work in nyx_mode because afl-fuzz cannot see inside the
virtual machine.