OLD | NEW |
(Empty) | |
| 1 ===================== |
| 2 AFL quick start guide |
| 3 ===================== |
| 4 |
| 5 You should read docs/README. It's pretty short. If you really can't, here's |
| 6 how to hit the ground running: |
| 7 |
| 8 1) Compile AFL with 'make'. If build fails, see docs/INSTALL for tips. |
| 9 |
| 10 2) Find or write a reasonably fast and simple program that takes data from |
| 11 a file or stdin, processes it in a test-worthy way, then exits cleanly. |
| 12 If testing a network service, modify it to run in the foreground and read |
| 13 from stdin. When fuzzing a format that uses checksums, comment out the |
| 14 checksum verification code, too. |
| 15 |
| 16 The program must crash properly when a fault is encountered. Watch out for |
| 17 custom SIGSEGV or SIGABRT handlers and background processes. |
| 18 |
| 19 3) Compile the program / library to be fuzzed using afl-gcc. A common way to |
| 20 do this would be: |
| 21 |
| 22 CC=/path/to/afl-gcc CXX=/path/to/afl-g++ ./configure --disable-shared |
| 23 make clean all |
| 24 |
| 25 If program build fails, ping <afl-users@googlegroups.com>. |
| 26 |
| 27 4) Get a small but valid input file that makes sense to the program. When |
| 28 fuzzing verbose syntax (SQL, HTTP, etc), create a dictionary as described in |
| 29 testcases/README.testcases, too. |
| 30 |
| 31 5) If the program reads from stdin, run 'afl-fuzz' like so: |
| 32 |
| 33 ./afl-fuzz -i testcase_dir -o findings_dir -- \ |
| 34 /path/to/tested/program [...program's cmdline...] |
| 35 |
| 36 If the program takes input from a file, you can put @@ in the program's |
| 37 command line; AFL will put an auto-generated file name in there for you. |
| 38 |
| 39 6) Investigate anything shown in red in the fuzzer UI by promptly consulting |
| 40 docs/status_screen.txt. |
| 41 |
| 42 That's it. Sit back, relax, and - time permitting - try to skim through the |
| 43 following files: |
| 44 |
| 45 - docs/README - A general introduction to AFL, |
| 46 - docs/perf_tips.txt - Simple tips on how to fuzz more quickly, |
| 47 - docs/status_screen.txt - An explanation of the tidbits shown in the UI, |
| 48 - docs/parallel_fuzzing.txt - Advice on running AFL on multiple cores. |
OLD | NEW |