xref: /aosp_15_r20/external/AFLplusplus/utils/aflpp_driver/README.md (revision 08b48e0b10e97b33e7b60c5b6e2243bd915777f2)

# AFL++ drivers

## aflpp_driver

aflpp_driver is used to compile directly libfuzzer `LLVMFuzzerTestOneInput()`
targets.

Just do `afl-clang-fast++ -o fuzz fuzzer_harness.cc libAFLDriver.a [plus
required linking]`.

You can also sneakily do this little trick: If this is the clang compile command
to build for libfuzzer: `clang++ -o fuzz -fsanitize=fuzzer fuzzer_harness.cc
-lfoo`, then just switch `clang++` with `afl-clang-fast++` and our compiler will
magically insert libAFLDriver.a :)

To use shared-memory test cases, you need nothing to do. To use stdin test
cases, give `-` as the only command line parameter. To use file input test
cases, give `@@` as the only command line parameter.

IMPORTANT: if you use `afl-cmin` or `afl-cmin.bash`, then either pass `-` or
`@@` as command line parameters.

## aflpp_qemu_driver

Note that you can use the driver too for FRIDA mode (`-O`).

aflpp_qemu_driver is used for libfuzzer `LLVMFuzzerTestOneInput()` targets that
are to be fuzzed in QEMU mode. So compile them with clang/clang++, without
-fsantize=fuzzer or afl-clang-fast, and link in libAFLQemuDriver.a:

`clang++ -o fuzz fuzzer_harness.cc libAFLQemuDriver.a [plus required linking]`.

Then just do (where the name of the binary is `fuzz`):

```
AFL_QEMU_PERSISTENT_ADDR=0x$(nm fuzz | grep "T LLVMFuzzerTestOneInput" | awk '{print $1}')
AFL_QEMU_PERSISTENT_HOOK=/path/to/aflpp_qemu_driver_hook.so afl-fuzz -Q ... -- ./fuzz`
```

if you use afl-cmin or `afl-showmap -C` with the aflpp_qemu_driver you need to
set the set same AFL_QEMU_... (or AFL_FRIDA_...) environment variables. If you
want to use afl-showmap (without -C) or afl-cmin.bash, then you may not set
these environment variables and rather set `AFL_QEMU_DRIVER_NO_HOOK=1`.