AFL_Runner
AFL_Runner copied to clipboard
Allow to specify options for certain instances only
Implements #39
- [x] Parsing of config file
- [x] Generating command based on the partial flags
- [ ] Add a cleanup stage after command is generated in order to merge same env variable (e.g.
AFL_PRELOAD) - [ ] Document TOML format
Example TOML:
[target]
# Target binary to fuzz
path = "/bin/ls"
# Target binary arguments, including @@ if needed
args = []
[afl_cfg]
# Amount of processes to spin up
runners = 2
# Custom path to 'afl-fuzz' binary
afl_binary = "/tmp/afl-fuzz"
# Seed corpus directory
seed_dir = "/tmp/in/"
# Solution/Crash output directory
solution_dir = "/tmp/out"
# Token dictionary to use
#dictionary = "/path/to/dictionary"
# Custom AFL flags
afl_flags = "-Q"
# Use afl-fuzz defaults
use_afl_defaults = false
[[afl_cfg.flags_partial]]
probability = 0.5
AFL_USE_QASAN=1
[[afl_cfg.flags_partial]]
probability = 0.2
AFL_PRELOAD = "/path/to/libcompcov.so"
AFL_COMPCOV_LEVEL = 1
[[afl_cfg.flags_partial]]
count = 4
-x = "/tmp/dictionary1"
[[afl_cfg.flags_partial]]
count = 3
-x = "/tmp/dictionary2"
[[afl_cfg.flags_partial]]
probability = 0.4
-G = 1234
[session]
# Spin up a custom tmux session with the fuzzers
dry_run = false
# Custom tmux session name
name = "fuzz"
# Runner backend to use: [tmux, screen]
runner = "tmux"
[misc]
# Enable TUI mode
@wizche I rewrote most if not all the core-logic of the code to hopefully increase maintainability and having easier access for adding new features. That said, the bad news is that adding your feature requires a significant rebase now