NAME¶

afl-showmap

SYNOPSIS¶

afl-showmap [ options ] -- /path/to/target_app [ ... ]

OPTIONS¶

Required parameters:


  -o file    - file to write the trace data to (not required with -S)
Execution control settings:


  -t msec    - timeout for each run (default: 1000ms)


  -m megs    - memory limit for child process (default: none)


  -O         - use binary-only instrumentation (FRIDA mode)


  -Q         - use binary-only instrumentation (QEMU mode)


  -U         - use Unicorn-based instrumentation (Unicorn mode)


  -W         - use qemu-based instrumentation with Wine (Wine mode)


               (Not necessary, here for consistency with other afl-* tools)


  -X         - use Nyx mode
Other settings:


  -f file    - input file read by the tested program


  -S         - streaming mode: read test cases from stdin, write coverage


               to stdout using a length-value protocol. Allows using


               afl-showmap as a coverage proxy to leverage the AFL++


               forkserver without implementing it.


               Protocol: Input  [u32 len][data]


                         Output [u16 status][u32 edges][(u32,u8)*]


                                [u32 stdout_len][stdout_data*]


                                [u32 stderr_len][stderr_data*]


               Status: bits [0:1] = exit (0=ok, 1=timeout, 2=crash),


                       bits [2:7] = reserved (0),


                       bits [8:15] = exit code (ok) or signal (crash)


               Note: stdout_len/stderr_len are currently always 0


                     (output capture not yet implemented)


  -i dir     - process all files below this directory, must be combined with -o.


               With -C, -o is a file, without -C it must be a directory


               and each bitmap will be written there individually.


  -I filelist - alternatively to -i, -I is a list of files


  -C         - collect coverage, writes all edges to -o and gives a summary


               Must be combined with -i.


  -q         - sink program's output and don't show messages


  -e         - show edge coverage only, ignore hit counts


  -r         - show real tuple values instead of AFL filter values


  -s         - do not classify the map


  -c         - allow core dumps
This tool displays raw tuple data captured by AFL instrumentation.
For additional help, consult docs/README.md.
If you use -i/-I mode, then custom mutator post_process send send functionality
is supported.
Environment variables used:
LD_BIND_LAZY: do not set LD_BIND_NOW env var for target
AFL_CMIN_CRASHES_ONLY: (cmin_mode) only write tuples for crashing inputs
AFL_CMIN_ALLOW_ANY: (cmin_mode) write tuples for crashing inputs also
AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash
AFL_DEBUG: enable extra developer output
AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)
AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc.


                 (default: SIGKILL)
AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server on termination


                             (default: SIGTERM). If unset and AFL_KILL_SIGNAL is


                             set, that value will be used.
AFL_MAP_SIZE: the shared memory size for that target. must be >= the size the


              target was compiled for
AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target
AFL_INPUT_PLACEHOLDER: custom placeholder for input file (default: @@)
AFL_PRINT_FILENAMES: Print the queue entry currently processed will to stdout
AFL_QUIET: do not print extra informational output
AFL_NO_FORKSRV: run target via execve instead of using the forkserver

AUTHOR¶

AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

LICENSE¶

Apache License Version 2.0, January 2004