OLD | NEW |
1 ===================== | 1 ===================== |
2 AFL quick start guide | 2 AFL quick start guide |
3 ===================== | 3 ===================== |
4 | 4 |
5 You should read docs/README. It's pretty short. If you really can't, here's | 5 You should read docs/README. It's pretty short. If you really can't, here's |
6 how to hit the ground running: | 6 how to hit the ground running: |
7 | 7 |
8 1) Compile AFL with 'make'. If build fails, see docs/INSTALL for tips. | 8 1) Compile AFL with 'make'. If build fails, see docs/INSTALL for tips. |
9 | 9 |
10 2) Find or write a reasonably fast and simple program that takes data from | 10 2) Find or write a reasonably fast and simple program that takes data from |
11 a file or stdin, processes it in a test-worthy way, then exits cleanly. | 11 a file or stdin, processes it in a test-worthy way, then exits cleanly. |
12 If testing a network service, modify it to run in the foreground and read | 12 If testing a network service, modify it to run in the foreground and read |
13 from stdin. When fuzzing a format that uses checksums, comment out the | 13 from stdin. When fuzzing a format that uses checksums, comment out the |
14 checksum verification code, too. | 14 checksum verification code, too. |
15 | 15 |
16 The program must crash properly when a fault is encountered. Watch out for | 16 The program must crash properly when a fault is encountered. Watch out for |
17 custom SIGSEGV or SIGABRT handlers and background processes. | 17 custom SIGSEGV or SIGABRT handlers and background processes. For tips on |
| 18 detecting non-crashing flaws, see section 11 in docs/README. |
18 | 19 |
19 3) Compile the program / library to be fuzzed using afl-gcc. A common way to | 20 3) Compile the program / library to be fuzzed using afl-gcc. A common way to |
20 do this would be: | 21 do this would be: |
21 | 22 |
22 CC=/path/to/afl-gcc CXX=/path/to/afl-g++ ./configure --disable-shared | 23 CC=/path/to/afl-gcc CXX=/path/to/afl-g++ ./configure --disable-shared |
23 make clean all | 24 make clean all |
24 | 25 |
25 If program build fails, ping <afl-users@googlegroups.com>. | 26 If program build fails, ping <afl-users@googlegroups.com>. |
26 | 27 |
27 4) Get a small but valid input file that makes sense to the program. When | 28 4) Get a small but valid input file that makes sense to the program. When |
28 fuzzing verbose syntax (SQL, HTTP, etc), create a dictionary as described in | 29 fuzzing verbose syntax (SQL, HTTP, etc), create a dictionary as described in |
29 testcases/README.testcases, too. | 30 dictionaries/README.dictionaries, too. |
30 | 31 |
31 5) If the program reads from stdin, run 'afl-fuzz' like so: | 32 5) If the program reads from stdin, run 'afl-fuzz' like so: |
32 | 33 |
33 ./afl-fuzz -i testcase_dir -o findings_dir -- \ | 34 ./afl-fuzz -i testcase_dir -o findings_dir -- \ |
34 /path/to/tested/program [...program's cmdline...] | 35 /path/to/tested/program [...program's cmdline...] |
35 | 36 |
36 If the program takes input from a file, you can put @@ in the program's | 37 If the program takes input from a file, you can put @@ in the program's |
37 command line; AFL will put an auto-generated file name in there for you. | 38 command line; AFL will put an auto-generated file name in there for you. |
38 | 39 |
39 6) Investigate anything shown in red in the fuzzer UI by promptly consulting | 40 6) Investigate anything shown in red in the fuzzer UI by promptly consulting |
40 docs/status_screen.txt. | 41 docs/status_screen.txt. |
41 | 42 |
42 That's it. Sit back, relax, and - time permitting - try to skim through the | 43 That's it. Sit back, relax, and - time permitting - try to skim through the |
43 following files: | 44 following files: |
44 | 45 |
45 - docs/README - A general introduction to AFL, | 46 - docs/README - A general introduction to AFL, |
46 - docs/perf_tips.txt - Simple tips on how to fuzz more quickly, | 47 - docs/perf_tips.txt - Simple tips on how to fuzz more quickly, |
47 - docs/status_screen.txt - An explanation of the tidbits shown in the UI, | 48 - docs/status_screen.txt - An explanation of the tidbits shown in the UI, |
48 - docs/parallel_fuzzing.txt - Advice on running AFL on multiple cores. | 49 - docs/parallel_fuzzing.txt - Advice on running AFL on multiple cores. |
OLD | NEW |