qemuafl
qemuafl copied to clipboard
Add ability to generate a drcov trace
Using the tracing facility would be cool if you can pass something like AFL_QEMU_DRCOV_TRACE="/tmp/trace.drcov"
and qemu will trace the execution with -trace exec_tb
and, once done, it convert the trace into drcov format like in https://github.com/RobertBuhren/qemutrace2drcov/blob/master/qemutrace2drcov.py that u can drop into lighthouse.
What u think?