Fix spelling of "FRIDA mode" and "QEMU mode"
MODIFY
TODO.md
TODO.md
## Further down the road
-qemu_mode/frida_mode:
+QEMU mode/FRIDA mode:
- non colliding instrumentation
- rename qemu specific envs to AFL_QEMU (AFL_ENTRYPOINT, AFL_CODE_START/END,
AFL_COMPCOV_LEVEL?)

MODIFY
docs/INSTALL.md
docs/INSTALL.md
@@ -23,7 +23,7 @@ sudo apt-get install -y build-essential python3-dev automake git flex bison libg
# try to install llvm 11 and install the distro default if that fails
sudo apt-get install -y lld-11 llvm-11 llvm-11-dev clang-11 || sudo apt-get install -y lld llvm llvm-dev clang
sudo apt-get install -y gcc-$(gcc --version|head -n1|sed 's/.* //'|sed 's/\..*//')-plugin-dev libstdc++-$(gcc --version|head -n1|sed 's/.* //'|sed 's/\..*//')-dev
-sudo apt-get install -y ninja-build # for qemu_mode
+sudo apt-get install -y ninja-build # for QEMU mode
git clone https://github.com/AFLplusplus/AFLplusplus
cd AFLplusplus
make distrib
@@ -33,7 +33,7 @@ sudo make install
It is recommended to install the newest available gcc, clang and llvm-dev
possible in your distribution!
-Note that "make distrib" also builds instrumentation, qemu_mode, unicorn_mode
+Note that "make distrib" also builds instrumentation, QEMU mode, unicorn_mode
and more. If you just want plain AFL++, then do "make all". However, compiling
and using at least instrumentation is highly recommended for much better results
- hence in this case choose:

MODIFY
docs/features.md
docs/features.md
@@ -4,7 +4,7 @@ AFL++ supports llvm from 3.8 up to version 12, very fast binary fuzzing with
QEMU 5.1 with laf-intel and redqueen, frida mode, unicorn mode, gcc plugin, full
*BSD, Mac OS, Solaris and Android support and much, much, much more.
-| Feature/Instrumentation | afl-gcc | llvm | gcc_plugin | frida_mode(9) | qemu_mode(10) |unicorn_mode(10) |coresight_mode(11)|
+| Feature/Instrumentation | afl-gcc | llvm | gcc_plugin | FRIDA mode(9) | QEMU mode(10) |unicorn_mode(10) |coresight_mode(11)|
| -------------------------|:-------:|:---------:|:----------:|:----------------:|:----------------:|:----------------:|:----------------:|
| Threadsafe counters | | x(3) | | | | | |
| NeverZero | x86[_64]| x(1) | x | x | x | x | |
@@ -37,9 +37,9 @@ QEMU 5.1 with laf-intel and redqueen, frida mode, unicorn mode, gcc plugin, full
Among others, the following features and patches have been integrated:
-* NeverZero patch for afl-gcc, instrumentation, qemu_mode and unicorn_mode which
+* NeverZero patch for afl-gcc, instrumentation, QEMU mode and unicorn_mode which
prevents a wrapping map value to zero, increases coverage
-* Persistent mode, deferred forkserver and in-memory fuzzing for qemu_mode
+* Persistent mode, deferred forkserver and in-memory fuzzing for QEMU mode
* Unicorn mode which allows fuzzing of binaries from completely different
platforms (integration provided by domenukk)
* The new CmpLog instrumentation for LLVM and QEMU inspired by
@@ -51,7 +51,7 @@ Among others, the following features and patches have been integrated:
[https://github.com/puppet-meteor/MOpt-AFL](https://github.com/puppet-meteor/MOpt-AFL)
* LLVM mode Ngram coverage by Adrian Herrera
[https://github.com/adrianherrera/afl-ngram-pass](https://github.com/adrianherrera/afl-ngram-pass)
-* LAF-Intel/CompCov support for instrumentation, qemu_mode and unicorn_mode
+* LAF-Intel/CompCov support for instrumentation, QEMU mode and unicorn_mode
(with enhanced capabilities)
* Radamsa and honggfuzz mutators (as custom mutators).
* QBDI mode to fuzz android native libraries via Quarkslab's

MODIFY
docs/fuzzing_binary-only_targets.md
docs/fuzzing_binary-only_targets.md
@@ -12,18 +12,18 @@ fuzzed with AFL++.
## TL;DR:
-Qemu_mode in persistent mode is the fastest - if the stability is high enough.
+QEMU mode in persistent mode is the fastest - if the stability is high enough.
Otherwise, try RetroWrite, Dyninst, and if these fail, too, then try standard
-qemu_mode with AFL_ENTRYPOINT to where you need it.
+QEMU mode with `AFL_ENTRYPOINT` to where you need it.
-If your target is a library, then use frida_mode.
+If your target is a library, then use FRIDA mode.
If your target is non-linux, then use unicorn_mode.
## Fuzzing binary-only targets with AFL++
-### Qemu_mode
+### QEMU mode
-Qemu_mode is the "native" solution to the program. It is available in the
+QEMU mode is the "native" solution to the program. It is available in the
./qemu_mode/ directory and, once compiled, it can be accessed by the afl-fuzz -Q
command line option. It is the easiest to use alternative and even works for
cross-platform binaries.
@@ -37,11 +37,12 @@ cd qemu_mode
./build_qemu_support.sh
```
-The following setup to use qemu_mode is recommended:
+The following setup to use QEMU mode is recommended:
+
* run 1 afl-fuzz -Q instance with CMPLOG (`-c 0` + `AFL_COMPCOV_LEVEL=2`)
* run 1 afl-fuzz -Q instance with QASAN (`AFL_USE_QASAN=1`)
* run 1 afl-fuzz -Q instance with LAF (`AFL_PRELOAD=libcmpcov.so` +
- `AFL_COMPCOV_LEVEL=2`), alternatively you can use frida_mode, just switch `-Q`
+ `AFL_COMPCOV_LEVEL=2`), alternatively you can use FRIDA mode, just switch `-Q`
with `-O` and remove the LAF instance
Then run as many instances as you have cores left with either -Q mode or - even
@@ -49,16 +50,16 @@ better - use a binary rewriter like Dyninst, RetroWrite, ZAFL, etc.
If [afl-dyninst](https://github.com/vanhauser-thc/afl-dyninst) works for your
binary, then you can use afl-fuzz normally and it will have twice the speed
-compared to qemu_mode (but slower than qemu persistent mode). Note that several
+compared to QEMU mode (but slower than QEMU persistent mode). Note that several
other binary rewriters exist, all with their advantages and caveats.
-The speed decrease of qemu_mode is at about 50%. However, various options exist
+The speed decrease of QEMU mode is at about 50%. However, various options exist
to increase the speed:
- using AFL_ENTRYPOINT to move the forkserver entry to a later basic block in
the binary (+5-10% speed)
- using persistent mode
[qemu_mode/README.persistent.md](../qemu_mode/README.persistent.md) this will
- result in a 150-300% overall speed increase - so 3-8x the original qemu_mode
+ result in a 150-300% overall speed increase - so 3-8x the original QEMU mode
speed!
- using AFL_CODE_START/AFL_CODE_END to only instrument specific parts
@@ -71,7 +72,7 @@ conducive to parallelization.
Note that there is also honggfuzz:
[https://github.com/google/honggfuzz](https://github.com/google/honggfuzz) which
-now has a qemu_mode, but its performance is just 1.5% ...
+now has a QEMU mode, but its performance is just 1.5% ...
If you like to code a customized fuzzer without much work, we highly recommend
to check out our sister project libafl which supports QEMU, too:
@@ -87,14 +88,14 @@ It is included in AFL++.
For more information, see
[qemu_mode/README.wine.md](../qemu_mode/README.wine.md).
-### Frida_mode
+### FRIDA mode
-In frida_mode, you can fuzz binary-only targets as easily as with QEMU.
-Frida_mode is sometimes faster and sometimes slower than Qemu_mode. It is also
+In FRIDA mode, you can fuzz binary-only targets as easily as with QEMU mode.
+FRIDA mode is sometimes faster and sometimes slower than QEMU mode. It is also
newer, lacks COMPCOV, and has the advantage that it works on MacOS (both intel
and M1).
-To build frida_mode:
+To build FRIDA mode:
```shell
cd frida_mode
@@ -149,11 +150,11 @@ For further information, check out
If the goal is to fuzz a dynamic library, then there are two options available.
For both, you need to write a small harness that loads and calls the library.
-Then you fuzz this with either frida_mode or qemu_mode and either use
+Then you fuzz this with either FRIDA mode or QEMU mode and either use
`AFL_INST_LIBS=1` or `AFL_QEMU/FRIDA_INST_RANGES`.
Another, less precise and slower option is to fuzz it with utils/afl_untracer/
-and use afl-untracer.c as a template. It is slower than frida_mode.
+and use afl-untracer.c as a template. It is slower than FRIDA mode.
For more information, see
[utils/afl_untracer/README.md](../utils/afl_untracer/README.md).

MODIFY
docs/important_changes.md
docs/important_changes.md
@@ -5,8 +5,8 @@ changes.
## From version 3.00 onwards
-With AFL++ 3.13-3.20, we introduce frida_mode (-O) to have an alternative for
-binary-only fuzzing. It is slower than Qemu mode but works on MacOS, Android,
+With AFL++ 3.13-3.20, we introduce FRIDA mode (`-O`) to have an alternative for
+binary-only fuzzing. It is slower than QEMU mode but works on MacOS, Android,
iOS etc.
With AFL++ 3.15, we introduced the following changes from previous behaviors:
@@ -31,8 +31,8 @@ behaviors and defaults:
All instrumentation source code is now in the `instrumentation/` folder.
* The gcc_plugin was replaced with a new version submitted by AdaCore that
supports more features. Thank you!
- * qemu_mode got upgraded to QEMU 5.1, but to be able to build this a current
- ninja build tool version and python3 setuptools are required. qemu_mode also
+ * QEMU mode got upgraded to QEMU 5.1, but to be able to build this a current
+ ninja build tool version and python3 setuptools are required. QEMU mode also
got new options like snapshotting, instrumenting specific shared libraries,
etc. Additionally QEMU 5.1 supports more CPU targets so this is really worth
it.

MODIFY
instrumentation/README.llvm.md
instrumentation/README.llvm.md
@@ -218,7 +218,7 @@ by Jinghan Wang, et. al.
Note that the original implementation (available
[here](https://github.com/bitsecurerlab/afl-sensitive)) is built on top of AFL's
-qemu_mode. This is essentially a port that uses LLVM vectorized instructions
+QEMU mode. This is essentially a port that uses LLVM vectorized instructions
(available from llvm versions 4.0.1 and higher) to achieve the same results when
compiling source code.

MODIFY
qemu_mode/libqasan/README.md
qemu_mode/libqasan/README.md
@@ -9,7 +9,7 @@ and this runtime is injected via LD_PRELOAD (so works just for dynamically
linked binaries).
The usage is super simple, just set the env var `AFL_USE_QASAN=1` when fuzzing
-in qemu mode (-Q). afl-fuzz will automatically set AFL_PRELOAD to load this
+in QEMU mode (-Q). afl-fuzz will automatically set AFL_PRELOAD to load this
library and enable the QASan instrumentation in afl-qemu-trace.
For debugging purposes, we still suggest to run the original QASan as the

MODIFY
utils/README.md
utils/README.md
@@ -16,7 +16,7 @@ Here's a quick overview of the stuff you can find in this directory:
different means, e.g., hw debugger
- afl_untracer - fuzz binary-only libraries much faster but with
- less coverage than qemu_mode
+ less coverage than QEMU mode
- analysis_scripts - random -o out analysis scripts

MODIFY
utils/afl_untracer/README.md
utils/afl_untracer/README.md
afl-untracer is an example skeleton file which can easily be used to fuzz
a closed source library.
-It requires less memory and is x3-5 faster than qemu_mode, however, it is way
+It requires less memory and is x3-5 faster than QEMU mode, however, it is way
more course grained and does not provide interesting features like compcov or
cmplog.

MODIFY
utils/aflpp_driver/README.md
utils/aflpp_driver/README.md
@@ -22,10 +22,10 @@ or `@@` as command line parameters.
## aflpp_qemu_driver
-Note that you can use the driver too for frida_mode (`-O`).
+Note that you can use the driver too for FRIDA mode (`-O`).
aflpp_qemu_driver is used for libfuzzer `LLVMFuzzerTestOneInput()` targets that
-are to be fuzzed in qemu_mode. So compile them with clang/clang++, without
+are to be fuzzed in QEMU mode. So compile them with clang/clang++, without
-fsantize=fuzzer or afl-clang-fast, and link in libAFLQemuDriver.a:
`clang++ -o fuzz fuzzer_harness.cc libAFLQemuDriver.a [plus required linking]`.

MODIFY
utils/qbdi_mode/README.md
utils/qbdi_mode/README.md
NOTE: this code is outdated and first would need to be adapted to the current
AFL++ versions.
-Try frida_mode or fpicker [https://github.com/ttdennis/fpicker/](https://github.com/ttdennis/fpicker/) first, maybe they suite your need.
+Try FRIDA mode or fpicker [https://github.com/ttdennis/fpicker/](https://github.com/ttdennis/fpicker/) first, maybe they suite your need.
## 1) Introduction

Fix spelling of "FRIDA mode" and "QEMU mode"