| Index: third_party/afl/src/docs/parallel_fuzzing.txt
|
| diff --git a/third_party/afl/src/docs/parallel_fuzzing.txt b/third_party/afl/src/docs/parallel_fuzzing.txt
|
| index 69c1a9ae2df642e9faa5357c2d03a7288d3b7cd9..58f8d2f412603de55caaf0d4d190e1546c3d2f2a 100644
|
| --- a/third_party/afl/src/docs/parallel_fuzzing.txt
|
| +++ b/third_party/afl/src/docs/parallel_fuzzing.txt
|
| @@ -51,13 +51,27 @@ Each instance will also periodically rescan the top-level sync directory
|
| for any test cases found by other fuzzers - and will incorporate them into
|
| its own fuzzing when they are deemed interesting enough.
|
|
|
| -The only difference between the -M and -S modes is that the master instance
|
| -will still perform deterministic checks; while the secondary instances will
|
| +The difference between the -M and -S modes is that the master instance will
|
| +still perform deterministic checks; while the secondary instances will
|
| proceed straight to random tweaks. If you don't want to do deterministic
|
| fuzzing at all, it's OK to run all instances with -S. With very slow or complex
|
| targets, or when running heavily parallelized jobs, this is usually a good plan.
|
|
|
| -You can monitor the progress of your jobs from the command line with the
|
| +Note that running multiple -M instances is wasteful, although there is an
|
| +experimental support for parallelizing the deterministic checks. To leverage
|
| +that, you need to create -M instances like so:
|
| +
|
| +$ ./afl-fuzz -i testcase_dir -o sync_dir -M masterA:1/3 [...]
|
| +$ ./afl-fuzz -i testcase_dir -o sync_dir -M masterB:2/3 [...]
|
| +$ ./afl-fuzz -i testcase_dir -o sync_dir -M masterC:3/3 [...]
|
| +
|
| +...where the first value after ':' is the sequential ID of a particular master
|
| +instance (starting at 1), and the second value is the total number of fuzzers to
|
| +distribute the deterministic fuzzing across. Note that if you boot up fewer
|
| +fuzzers than indicated by the second number passed to -M, you may end up with
|
| +poor coverage.
|
| +
|
| +You can also monitor the progress of your jobs from the command line with the
|
| provided afl-whatsup tool. When the instances are no longer finding new paths,
|
| it's probably time to stop.
|
|
|
|
|