Skip to content

An LLVM-based implementation of n-gram branch coverage for AFL

License

Notifications You must be signed in to change notification settings

adrianherrera/afl-ngram-pass

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

14 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

AFL N-Gram Branch Coverage

This is an LLVM-based implementation of the n-gram branch coverage proposed in the paper "Be Sensitive and Collaborative: Analzying Impact of Coverage Metrics in Greybox Fuzzing", by Jinghan Wang, et. al.

Note that the original implementation (available here) is built on top of AFL's QEMU mode. This is essentially a port that uses LLVM vectorized instructions to achieve the same results when compiling source code.

Usage

Simply copy the source files from either circular-buf or vectorized into AFL's llvm_mode directory and build afl-clang-fast as normal.

The size of n (i.e., the number of branches to remember) is an option that can be specified in the AFL_NGRAM_SIZE environment variable.

About

An LLVM-based implementation of n-gram branch coverage for AFL

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published