### Installing LLVM via script Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.lto.md Provides an example command to download and execute a script for installing a specific version of LLVM. ```bash wget https://apt.llvm.org/llvm.sh chmod +x llvm.sh sudo ./llvm.sh 19 all ``` -------------------------------- ### Install Docker Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/rpc_statsd.md Installs Docker on the system. Ensure Docker and Docker Compose are installed before proceeding with the setup. ```shell curl -fsSL https://get.docker.com -o get-docker.sh sh get-docker.sh ``` -------------------------------- ### Install Build Dependencies Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/autodict_ql/readme.md Installs necessary packages for building CodeQL and related tools. ```shell sudo apt install build-essential libtool-bin python3-dev python3 automake git vim wget -y ``` -------------------------------- ### Start SAND Fuzzing with Multiple Sanitizers Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/SAND.md Initiate the SAND fuzzing process. Specify the native binary with '--' and provide multiple sanitizer-enabled binaries using the '-w' flag. This setup allows SAND to efficiently utilize multiple sanitizers. ```bash mkdir /tmp/test echo "a" > /tmp/test/a AFL_NO_UI=1 AFL_SKIP_CPUFREQ=1 afl-fuzz -i /tmp/test -o /tmp/out -w ./asanubsan -w ./msan -- ./native @@ ``` -------------------------------- ### Build and Install afl-plot-ui Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/plot_ui/README.md Manually build and install afl-plot-ui by installing dependencies, running make, and then installing the project. ```shell sudo apt install libgtk-3-0 libgtk-3-dev pkg-config make cd ../.. sudo make install ``` -------------------------------- ### Install afl-plot-ui Dependencies and Build Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/afl-fuzz_approach.md Installs necessary GTK development libraries, then builds and installs the afl-plot-ui utility. ```shell sudo apt install libgtk-3-0 libgtk-3-dev pkg-config cd utils/plot_ui make cd ../.. sudo make install ``` -------------------------------- ### Build Example Mutator in Rust Source: https://github.com/aflplusplus/aflplusplus/blob/stable/custom_mutators/rust/README.md Use this command to build a minimal example mutator in Rust. ```bash cargo build --example example_mutator ``` -------------------------------- ### Example Instrument File List (Files) Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.instrument_list.md Create a file listing source files to be instrumented. Filenames can be specific or use wildcards. ```text feature_a/a1.cpp feature_a/a2.cpp ``` -------------------------------- ### Example Autotokens Standalone Usage Source: https://github.com/aflplusplus/aflplusplus/blob/stable/custom_mutators/autotokens/standalone/README.md An example command demonstrating how to run the autotokens-standalone mutator with a dictionary file, input file, and output file. ```bash autotokens-standalone -x foo.dict inputfile outputfile ``` -------------------------------- ### Example modinfo.txt Content Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/unstable_edges/README.md An example of the modinfo.txt file, which maps edge ID ranges to binary modules. ```text /usr/lib/a.so 5 100 /usr/lib/b.so 101 200 /usr/lib/c.so 201 300 ``` -------------------------------- ### Example .gitmodules Entry for QEMU Bridge Source: https://github.com/aflplusplus/aflplusplus/blob/stable/qemu_bridge/IMPLEMENTATION_STATUS.md This is an example of a submodule entry in the .gitmodules file that needs to be removed when retiring qemuafl. ```gitconfig [submodule "qemu_mode/qemuafl"] path = qemu_mode/qemuafl url = https://github.com/AFLplusplus/qemuafl ``` -------------------------------- ### Example pcmap.dump Content Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/unstable_edges/README.md An example of the pcmap.dump file, which maps edge IDs to program counter addresses. ```text 42 0x1a3f20 191 0x3c5d00 232 0x6f89d0 ``` -------------------------------- ### Install MIPS Cross-Compiler Source: https://github.com/aflplusplus/aflplusplus/blob/stable/unicorn_mode/samples/python_simple/COMPILE.md Installs the necessary MIPS cross-compiler toolchain on Ubuntu 16.04 LTS using apt-get. ```bash sudo apt-get install gcc-mips-linux-gnu ``` -------------------------------- ### Install GCC plugin development headers Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.gcc_plugin.md Install the necessary headers for GCC plugins. This is required for using afl-gcc-fast and afl-g++-fast. ```bash apt-get install gcc-VERSION-plugin-dev ``` -------------------------------- ### Example Allowlist for Selective Instrumentation Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/fuzzing_in_depth.md Create a file with filenames or function names (prefixed with 'fun:') to specify which parts of the source code should be instrumented. ```text foo.cpp # will match foo/foo.cpp, bar/foo.cpp, barfoo.cpp etc. fun: foo_func # will match the function foo_func ``` -------------------------------- ### Initialize Git Submodules Source: https://github.com/aflplusplus/aflplusplus/blob/stable/coresight_mode/README.md Run this command to check out all necessary git submodules for CoreSight mode. Ensure you have git installed. ```bash git submodule update --init --recursive ``` -------------------------------- ### Install GUIFuzz++ Dependencies Source: https://github.com/aflplusplus/aflplusplus/blob/stable/custom_mutators/guifuzz/README.md Installs necessary packages for the GUI interaction script, including xdotool, scrot, and Python libraries. ```bash sudo apt update sudo apt install -y xdotool scrot python3-tk python3-dev python3 -m pip install pyautogui ``` -------------------------------- ### Install Dependencies for Manual Build on Linux Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/INSTALL.md Installs essential build tools, libraries, and optional components like LLVM, Python, and QEMU support required for compiling AFL++ from source. ```shell sudo apt-get update sudo apt-get install -y build-essential python3-dev automake cmake git flex bison libglib2.0-dev libpixman-1-dev python3-setuptools cargo libgtk-3-dev # try to install llvm-18 and install the distro default if that fails sudo apt-get install -y lld-18 llvm-18 llvm-18-dev clang-18 || sudo apt-get install -y lld llvm llvm-dev clang sudo apt-get install -y gcc-$(gcc --version|head -n1|sed 's/\..*//'|sed 's/.* //')-plugin-dev libstdc++-$(gcc --version|head -n1|sed 's/\..*//'|sed 's/.* //')-dev sudo apt-get install -y meson ninja-build # for QEMU mode sudo apt-get install -y cpio libcapstone-dev # for Nyx mode sudo apt-get install -y wget curl # for Frida mode sudo apt-get install -y python3-pip # for Unicorn mode ``` -------------------------------- ### Clone, Build, and Install AFL++ from Source Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/INSTALL.md Clones the AFL++ repository, updates submodules, builds the distribution package, and installs it system-wide. This includes all features for both source and binary fuzzing. ```shell git clone https://github.com/AFLplusplus/AFLplusplus cd AFLplusplus git submodule update --init make distrib sudo make install ``` -------------------------------- ### Example Instrument File List (Function with Wildcard) Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.instrument_list.md Match function names using wildcards, especially useful for demangled names with spaces. ```text fun:ns::foo* ``` -------------------------------- ### Configure Environment Variables for Pre-built Toolchain Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/qbdi_mode/README.md Example environment variables to set when using a pre-built toolchain, specifying the toolchain path and compiler. ```bash export STANDALONE_TOOLCHAIN_PATH=~/Android/Sdk/ndk/20.1.5948944/toolchains/llvm/prebuilt/linux-x86_64/ export CC=x86_64-linux-android21-clang export CXX=x86_64-linux-android21-clang++ ``` -------------------------------- ### Example Denylist for Selective Instrumentation Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/fuzzing_in_depth.md Create a file with filenames or function names to specify which parts of the source code should be excluded from instrumentation. ```text foo.cpp fun: bar_func ``` -------------------------------- ### AFL++ Overall Results Example Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/afl-fuzz_approach.md Presents the number of cycles completed, total paths discovered, and the count of unique crashes and hangs. ```text +-----------------------+ | cycles done : 0 | | total paths : 2095 | | uniq crashes : 0 | | uniq hangs : 19 | +-----------------------+ ``` -------------------------------- ### Example Instrument File List (Files - Shorter Names) Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.instrument_list.md Alternatively, use shorter filenames if they are unique within the project. Be cautious of potential name collisions. ```text a1.cpp a2.cpp ``` -------------------------------- ### Fuzzing with afl-untracer Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/afl_untracer/README.md Example command to start fuzzing a target library using afl-untracer. Ensure afl-untracer.c is modified, compiled, and patches.txt is generated. ```bash LD_LIBRARY_PATH=/path/to/target/library AFL_UNTRACER_FILE=./patches.txt afl-fuzz -i in -o out -- ./afl-untracer ``` -------------------------------- ### Set up and run AFL++ with CompareCoverage Source: https://github.com/aflplusplus/aflplusplus/blob/stable/qemu_mode/libcompcov/README.md Preload the library using AFL_PRELOAD and set the coverage level with AFL_COMPCOV_LEVEL. Then, run afl-fuzz with the -Q option for QEMU mode. ```bash export AFL_PRELOAD=/path/to/libcompcov.so export AFL_COMPCOV_LEVEL=1 afl-fuzz -Q -i input -o output -- ``` -------------------------------- ### Prepare WebKit Build Environment Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.lto.md Create a Release build directory and create symbolic links for LLVM 12 assembler and ranlib tools. ```bash mkdir -p WebKitBuild/Release cd WebKitBuild/Release ln -s ../../../../../usr/bin/llvm-ar-12 llvm-ar-12 ln -s ../../../../../usr/bin/llvm-ranlib-12 llvm-ranlib-12 cd ../.. ``` -------------------------------- ### Example Instrument File List (Function Name) Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.instrument_list.md Use 'fun:' prefix for explicit function name matching. Exact match is required unless wildcards are used. ```text fun: MallocFoo ``` -------------------------------- ### Example Instrument File List (Allowlist with src:* and fun:) Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.instrument_list.md For clang compatibility, 'src:*' on the first line is ignored, allowing subsequent 'fun:' entries to specify reachable functions. ```text # reachable functions src:* fun:MallocFoo fun:MallocBar ``` -------------------------------- ### Start Nyx Fuzzing in Multiprocessor Mode (Secondary Instance) Source: https://github.com/aflplusplus/aflplusplus/blob/stable/nyx_mode/README.md Starts a secondary AFL++ fuzzing instance in Nyx multiprocessor mode using `-Y -S `, where `` is an increasing value starting from 1. ```shell afl-fuzz -i in -o out -Y -S 1 -- ./PACKAGE-DIRECTORY ``` ```shell afl-fuzz -i in -o out -Y -S 2 -- ./PACKAGE-DIRECTORY ``` -------------------------------- ### Install TritonDSE Source: https://github.com/aflplusplus/aflplusplus/blob/stable/custom_mutators/aflpp_tritondse/README.md Install the TritonDSE library using pip. This is a prerequisite for using the custom mutator. ```bash pip3 install tritondse ``` -------------------------------- ### Set up and run AFL++ with CompareCoverage Source: https://github.com/aflplusplus/aflplusplus/blob/stable/qemu_bridge/libcompcov/README.md Export the necessary environment variables and run afl-fuzz with the -Q option to enable QEMU mode and preload the CompareCoverage library. Adjust AFL_COMPCOV_LEVEL to control the logging granularity. ```bash export AFL_PRELOAD=/path/to/libcompcov.so export AFL_COMPCOV_LEVEL=1 afl-fuzz -Q -i input -o output -- ``` -------------------------------- ### Example Instrument File List (Specific Source File Pattern) Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.instrument_list.md Use 'src:' prefix for explicit source file matching, with optional wildcards. ```text src: *malloc.c ``` -------------------------------- ### Start Monitoring Services Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/rpc_statsd.md Starts the Docker containers defined in the `docker-compose.yml` file in detached mode. ```shell docker-compose up -d ``` -------------------------------- ### Configure and Create CodeQL Database Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/autodict_ql/readme.md Configures the target project and creates a CodeQL database for it. Assumes you are in the project's root directory. ```shell ./configure --disable-shared codeql database create libxml-db --language=cpp --command="make -j$(nproc)" ``` -------------------------------- ### Build and Initialize CodeQL Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/autodict_ql/readme.md Builds CodeQL using the provided script and sources the environment variables. ```shell # chmod +x codeql-build.sh # ./codeql-build.sh # source ~/.bashrc # codeql ``` -------------------------------- ### Python Setup Script for Native Extension Source: https://github.com/aflplusplus/aflplusplus/blob/stable/qemu_mode/README.deferred_initialization_example.md A standard Python setup.py script to define and build a native extension module named 'memory' from a C source file 'fuzz_target.c'. ```python from distutils.core import setup, Extension module = Extension("memory", sources=["fuzz_target.c"]) setup( name="memory", version="1.0", description='A simple "BOOM!" extension', ext_modules=[module], ) ``` -------------------------------- ### Setting Persistent Loop Start Address Source: https://github.com/aflplusplus/aflplusplus/blob/stable/qemu_bridge/README.md Define the starting address for the persistent fuzzing loop using AFL_QEMU_PERSISTENT_ADDR. This is typically the address of a function. If no RET or EXITS are set, QEMU patches the return address to loop back to START. ```sh AFL_QEMU_PERSISTENT_ADDR=0x ``` -------------------------------- ### Build Non-Instrumented Binary for Benchmarking Source: https://github.com/aflplusplus/aflplusplus/blob/stable/qemu_mode/README.md Build the target binary with specific optimization flags and static linking for accurate QEMU instrumentation benchmarking against afl-clang-fast. ```bash CFLAGS="-O3 -funroll-loops" ./configure --disable-shared make clean all ``` -------------------------------- ### Build Unicorn Support Source: https://github.com/aflplusplus/aflplusplus/blob/stable/unicorn_mode/samples/c/COMPILE.md Run this script to build the necessary unicorn support before compiling C samples. ```bash cd /path/to/afl/unicorn_mode ./build_unicorn_support.py ``` -------------------------------- ### Example fuzzer_stats Content Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/unstable_edges/README.md A partial example of the fuzzer_stats file, showing the 'var_bytes' field which contains unstable edge IDs. ```text ... var_bytes : 42 191 232 ``` -------------------------------- ### Example Build Output with afl-clang-lto Source: https://github.com/aflplusplus/aflplusplus/blob/stable/instrumentation/README.lto.md Illustrates the output during a build process using afl-clang-lto, showing instrumentation details and detected strings for AUTODICTIONARY. ```text libtool: link: afl-clang-lto -g -O2 -Wall -W -o thumbnail thumbnail.o ../libtiff/.libs/libtiff.a ../port/.libs/libport.a -llzma -ljbig -ljpeg -lz -lm afl-clang-lto++2.63d by Marc "vanHauser" Heuse in mode LTO afl-llvm-lto++2.63d by Marc "vanHauser" Heuse AUTODICTIONARY: 11 strings found [+] Instrumented 12071 locations with no collisions (on average 1046 collisions would be in afl-clang-fast CLASSIC) (non-hardened mode). ``` -------------------------------- ### Install Nyx Mode Dependencies Source: https://github.com/aflplusplus/aflplusplus/blob/stable/nyx_mode/README.md Installs necessary packages for building Nyx mode, including GTK, capstone, and Python libraries. ```shell apt-get install -y libgtk-3-dev pax-utils python3-msgpack python3-jinja2 libcapstone-dev ``` -------------------------------- ### Build coresight-trace Source: https://github.com/aflplusplus/aflplusplus/blob/stable/coresight_mode/README.md Build the coresight-trace component. Use 'make build' for a standard build or 'make debug' for a debug build. Refer to the coresight-trace README for detailed build instructions. ```bash make build ``` ```bash make debug ``` -------------------------------- ### Install iOS Cross-Compilation Dependencies on macOS Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/INSTALL.md Install ldid for signing binaries, in addition to the macOS build dependencies, when cross-compiling for iOS. ```shell brew install ldid-procursus ``` -------------------------------- ### Install Rust Compiler for Nyx Source: https://github.com/aflplusplus/aflplusplus/blob/stable/nyx_mode/README.md Installs the latest Rust compiler using rustup, as distribution packages are often outdated for building Nyx. ```shell curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh ``` -------------------------------- ### Compile and Run C Speedtest Harness Source: https://github.com/aflplusplus/aflplusplus/blob/stable/unicorn_mode/samples/speedtest/README.md Compile the C harness using 'make' and then run AFL++ with the harness. Ensure you have built unicornafl and are in the 'c' directory. ```bash cd c make ../../../../afl-fuzz -i ../sample_inputs -o out -U -- ./harness @@ ``` -------------------------------- ### Install Python Development Package Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/custom_mutators.md Install the Python 3 development package on Debian/Ubuntu/Kali systems to enable Python mutator support in AFL++. ```bash sudo apt install python3-dev # or sudo apt install python-dev ``` -------------------------------- ### Build and Open Rust Documentation Source: https://github.com/aflplusplus/aflplusplus/blob/stable/custom_mutators/rust/README.md Run this command to build the Rust documentation for custom mutators and open it in your browser. ```bash cargo doc -p custom_mutator --open ``` -------------------------------- ### Example Usage of AFL++ Standalone Mutator Source: https://github.com/aflplusplus/aflplusplus/blob/stable/custom_mutators/aflpp/standalone/README.md This example demonstrates how to pipe input data to the standalone mutator, specifying mutation options and output files. ```bash cat file | aflpp-standalone -m 4 -x foo.dict - outputfile splicefile # example ``` -------------------------------- ### CodeQL CLI Help Output Source: https://github.com/aflplusplus/aflplusplus/blob/stable/utils/autodict_ql/readme.md Displays the usage information for the CodeQL command-line interface, including common options and available commands. ```text Usage: codeql ... Create and query CodeQL databases, or work with the QL language. GitHub makes this program freely available for the analysis of open-source software and certain other uses, but it is not itself free software. Type codeql --license to see the license terms. --license Show the license terms for the CodeQL toolchain. Common options: -h, --help Show this help text. -v, --verbose Incrementally increase the number of progress messages printed. -q, --quiet Incrementally decrease the number of progress messages printed. Some advanced options have been hidden; try --help -v for a fuller view. Commands: query Compile and execute QL code. bqrs Get information from .bqrs files. database Create, analyze and process CodeQL databases. dataset [Plumbing] Work with raw QL datasets. test Execute QL unit tests. resolve [Deep plumbing] Helper commands to resolve disk locations etc. execute [Deep plumbing] Low-level commands that need special JVM options. version Show the version of the CodeQL toolchain. generate Generate formatted QL documentation. github Commands useful for interacting with the GitHub API through CodeQL. ``` -------------------------------- ### Start Nyx Fuzzing in Multiprocessor Mode (Main Instance) Source: https://github.com/aflplusplus/aflplusplus/blob/stable/nyx_mode/README.md Starts the main AFL++ fuzzing instance in Nyx multiprocessor mode using `-Y -M 0`. ```shell afl-fuzz -i in -o out -Y -M 0 -- ./PACKAGE-DIRECTORY ``` -------------------------------- ### Start Nyx Fuzzing in Standalone Mode Source: https://github.com/aflplusplus/aflplusplus/blob/stable/nyx_mode/README.md Starts AFL++ fuzzing with Nyx mode enabled using the `-X` option, specifying the prepared package directory as the target. ```shell afl-fuzz -i in -o out -X -- ./PACKAGE-DIRECTORY ``` -------------------------------- ### Generate .lib File with lib Source: https://github.com/aflplusplus/aflplusplus/blob/stable/qemu_mode/README.wine.md Create a static library (.lib) file from a DLL's exports using the lib utility. This .lib file can then be linked with your harness to ensure early DLL loading. ```bash lib /def: /OUT: ``` -------------------------------- ### Frida Mode Statistics Output Example Source: https://github.com/aflplusplus/aflplusplus/blob/stable/frida_mode/README.md This is an example of the statistics output generated when AFL_FRIDA_STATS_FILE is set. It shows transitions, instrumentation details, EOB instructions, and relocated instructions. ```text stats ----- Time 2021-07-21 11:45:49 Elapsed 1 seconds Transitions cumulative delta ---------- ---------- ----- total 753619 17645 call_imm 9193 ( 1.22%) 344 ( 1.95%) [ 344/s] call_reg 0 ( 0.00%) 0 ( 0.00%) [ 0/s] call_mem 0 ( 0.00%) 0 ( 0.00%) [ 0/s] ret_slow_path 67974 ( 9.02%) 2988 (16.93%) [ 2988/s] post_call_invoke 7996 ( 1.06%) 299 ( 1.69%) [ 299/s] excluded_call_imm 3804 ( 0.50%) 200 ( 1.13%) [ 200/s] jmp_imm 5445 ( 0.72%) 255 ( 1.45%) [ 255/s] jmp_reg 42081 ( 5.58%) 1021 ( 5.79%) [ 1021/s] jmp_mem 578092 (76.71%) 10956 (62.09%) [ 10956/s] jmp_cond_imm 38951 ( 5.17%) 1579 ( 8.95%) [ 1579/s] jmp_cond_mem 0 ( 0.00%) 0 ( 0.00%) [ 0/s] jmp_cond_reg 0 ( 0.00%) 0 ( 0.00%) [ 0/s] jmp_cond_jcxz 0 ( 0.00%) 0 ( 0.00%) [ 0/s] jmp_continuation 84 ( 0.01%) 3 ( 0.02%) [ 3/s] Instrumentation --------------- Instructions 7907 Blocks 1764 Avg Instructions / Block 4 EOB Instructions ---------------- Total 1763 (22.30%) Call Immediates 358 ( 4.53%) Call Immediates Excluded 74 ( 0.94%) Call Register 0 ( 0.00%) Call Memory 0 ( 0.00%) Jump Immediates 176 ( 2.23%) Jump Register 8 ( 0.10%) Jump Memory 10 ( 0.13%) Conditional Jump Immediates 1051 (13.29%) Conditional Jump CX Immediate 0 ( 0.00%) Conditional Jump Register 0 ( 0.00%) Conditional Jump Memory 0 ( 0.00%) Returns 160 ( 2.02%) Relocated Instructions ---------------------- Total 232 ( 2.93%) addsd 2 ( 0.86%) cmp 46 (19.83%) comisd 2 ( 0.86%) divsd 2 ( 0.86%) divss 2 ( 0.86%) lea 142 (61.21%) mov 32 (13.79%) movsd 2 ( 0.86%) ucomisd 2 ( 0.86%) ``` -------------------------------- ### Install macOS Build Dependencies with Homebrew Source: https://github.com/aflplusplus/aflplusplus/blob/stable/docs/INSTALL.md Install necessary packages like wget, git, make, cmake, llvm, lld, gdb, and coreutils using Homebrew on macOS. ```shell brew install wget git make cmake llvm lld gdb coreutils ``` -------------------------------- ### Build AFL++ QEMU Bridge Support Source: https://github.com/aflplusplus/aflplusplus/blob/stable/qemu_bridge/README.md Build the core AFL++ first, then navigate to the qemu_bridge directory and execute the build script. Alternatively, perform a binary-only build from the repository root. ```shell make # build the AFL++ core first cd qemu_bridge ./build_qemu_bridge_support.sh ``` ```shell make binary-only ``` -------------------------------- ### Setting Persistent Loop Return Address Source: https://github.com/aflplusplus/aflplusplus/blob/stable/qemu_bridge/README.md Specify the last instruction of the persistent loop using AFL_QEMU_PERSISTENT_RET. The emulator will jump back to START when this address is reached. Apply the same PIE base offset as for START. ```sh AFL_QEMU_PERSISTENT_RET=0x ```