How to calculate coverage？

[1789120321]

AFL is a classic fuzzer. There are many studies based on AFL. However, my known work does not explain how to calculate coverage.

I use llvm mode for instrumentation. Accumulate the inst_blocks in afl_llvm_pass.so.cc as the total number of instrumentation. Use ((MAP_SIZE << 3)-count_bits(virgin_bits)) as the number of positions covered in the code. However, the results did not meet expectations.

If anyone knows how to get the coverage, can I trouble you with some suggestions? Thank you!

[walter708]

https://github.com/mrash/afl-cov

[1789120321]

@walter708 But afl-cov only supports gcc, and I want to collect the coverage of chakracore compiled by afl-clang-fast. So I use Clang's SOURCE-BASED CODE COVERAGE to collect coverage, but I found that when there are many running files, it cannot be calculated. So is there any other way?

[domenukk]

The afl-cov fork by @vanhauser-thc works with llvm.
https://github.com/vanhauser-thc/afl-cov

[1789120321]

The afl-cov fork by @vanhauser-thc works with llvm.
https://github.com/vanhauser-thc/afl-cov

Because if afl runs for a long time, it will generate tens of thousands of files. Does this version of afl-cov support processing a large number of files?