1afl-analyze(8) System Manager's Manual afl-analyze(8)
2
3
4
6 afl-analyze
7
8
10 afl-analyze [ options ] -- /path/to/target_app [ ... ]
11
12
14 Required parameters:
15 -i file - input test case to be analyzed by the tool
16
17 Execution control settings:
18 -f file - input file read by the tested program (stdin)
19 -t msec - timeout for each run (1000 ms)
20 -m megs - memory limit for child process (0 MB)
21 -O - use binary-only instrumentation (FRIDA mode)
22 -Q - use binary-only instrumentation (QEMU mode)
23 -U - use unicorn-based instrumentation (Unicorn mode)
24 -W - use qemu-based instrumentation with Wine (Wine mode)
25
26 Analysis settings:
27 -e - look for edge coverage only, ignore hit counts
28
29 For additional tips, please consult docs/README.md.
30
31 Environment variables used:
32 TMPDIR: directory to use for temporary input files
33 ASAN_OPTIONS: custom settings for ASAN
34 (must contain abort_on_error=1 and symbolize=0)
35 MSAN_OPTIONS: custom settings for MSAN
36 (must contain exitcode=86 and symbolize=0)
37 AFL_ANALYZE_HEX: print file offsets in hexadecimal instead of decimal
38 AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc.
39 (default: SIGKILL)
40 AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server on termination
41 (default: SIGTERM). If unset and AFL_KILL_SIGNAL is
42 set, that value will be used.
43 AFL_MAP_SIZE: the shared memory size for that target. must be >= the size
44 the target was compiled for
45 AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target
46 AFL_SKIP_BIN_CHECK: skip checking the location of and the target
47
48
50 afl++ was written by Michal "lcamtuf" Zalewski and is maintained by
51 Marc "van Hauser" Heuse <mh@mh-sec.de>, Heiko "hexcoder-" Eissfeldt
52 <heiko.eissfeldt@hexco.de>, Andrea Fioraldi <andreafioraldi@gmail.com>
53 and Dominik Maier <domenukk@gmail.com> The homepage of afl++ is:
54 https://github.com/AFLplusplus/AFLplusplus
55
56
58 Apache License Version 2.0, January 2004
59
60
61
62afl++ 2023-04-03 afl-analyze(8)