added AFL_MAP_SIZE to env help output
MODIFY
llvm_mode/afl-clang-fast.c
llvm_mode/afl-clang-fast.c
@@ -716,30 +716,30 @@ int main(int argc, char **argv, char **envp) {
"Environment variables used:\n"
"AFL_CC: path to the C compiler to use\n"
"AFL_CXX: path to the C++ compiler to use\n"
- "AFL_PATH: path to instrumenting pass and runtime "
- "(afl-llvm-rt.*o)\n"
- "AFL_DONT_OPTIMIZE: disable optimization instead of -O3\n"
- "AFL_NO_BUILTIN: compile for use with libtokencap.so\n"
- "AFL_INST_RATIO: percentage of branches to instrument\n"
- "AFL_QUIET: suppress verbose output\n"
"AFL_DEBUG: enable developer debugging output\n"
+ "AFL_DONT_OPTIMIZE: disable optimization instead of -O3\n"
"AFL_HARDEN: adds code hardening to catch memory bugs\n"
- "AFL_USE_ASAN: activate address sanitizer\n"
- "AFL_USE_MSAN: activate memory sanitizer\n"
- "AFL_USE_UBSAN: activate undefined behaviour sanitizer\n"
- "AFL_USE_CFISAN: activate control flow sanitizer\n"
- "AFL_LLVM_WHITELIST: enable whitelisting (selective "
- "instrumentation)\n"
+ "AFL_INST_RATIO: percentage of branches to instrument\n"
"AFL_LLVM_NOT_ZERO: use cycling trace counters that skip zero\n"
"AFL_LLVM_LAF_SPLIT_COMPARES: enable cascaded comparisons\n"
- "AFL_LLVM_LAF_SPLIT_SWITCHES: casc. comp. in 'switch'\n"
- "AFL_LLVM_LAF_TRANSFORM_COMPARES: transform library comparison "
- "function calls\n"
- " to cascaded comparisons\n"
"AFL_LLVM_LAF_SPLIT_FLOATS: transform floating point comp. to "
"cascaded "
"comp.\n"
- "AFL_LLVM_LAF_SPLIT_COMPARES_BITW: size limit (default 8)\n",
+ "AFL_LLVM_LAF_SPLIT_SWITCHES: casc. comp. in 'switch'\n"
+ " to cascaded comparisons\n"
+ "AFL_LLVM_LAF_TRANSFORM_COMPARES: transform library comparison "
+ "function calls\n"
+ "AFL_LLVM_LAF_SPLIT_COMPARES_BITW: size limit (default 8)\n"
+ "AFL_LLVM_WHITELIST: enable whitelisting (selective "
+ "instrumentation)\n"
+ "AFL_NO_BUILTIN: compile for use with libtokencap.so\n"
+ "AFL_PATH: path to instrumenting pass and runtime "
+ "(afl-llvm-rt.*o)\n"
+ "AFL_QUIET: suppress verbose output\n"
+ "AFL_USE_ASAN: activate address sanitizer\n"
+ "AFL_USE_CFISAN: activate control flow sanitizer\n"
+ "AFL_USE_MSAN: activate memory sanitizer\n"
+ "AFL_USE_UBSAN: activate undefined behaviour sanitizer\n",
callname, BIN_PATH, BIN_PATH);
SAYF(
@@ -747,7 +747,7 @@ int main(int argc, char **argv, char **envp) {
"AFL_LLVM_CMPLOG: log operands of comparisons (RedQueen mutator)\n"
"AFL_LLVM_INSTRUMENT: set instrumentation mode: DEFAULT, CFG "
"(INSTRIM), LTO, CTX, NGRAM-2 ... NGRAM-16\n"
- "You can also use the old environment variables:"
+ " You can also use the old environment variables instead:"
" AFL_LLVM_CTX: use context sensitive coverage\n"
" AFL_LLVM_USE_TRACE_PC: use LLVM trace-pc-guard instrumentation\n"
" AFL_LLVM_NGRAM_SIZE: use ngram prev_loc count coverage\n"
@@ -758,10 +758,10 @@ int main(int argc, char **argv, char **envp) {
#ifdef AFL_CLANG_FLTO
SAYF(
"\nafl-clang-lto specific environment variables:\n"
- "AFL_LLVM_LTO_STARTID: from which ID to start counting from for a "
- "bb\n"
"AFL_LLVM_LTO_DONTWRITEID: don't write the highest ID used to a "
"global var\n"
+ "AFL_LLVM_LTO_STARTID: from which ID to start counting from for a "
+ "bb\n"
"AFL_REAL_LD: use this lld linker instead of the compiled in path\n"
"\nafl-clang-lto was built with linker target \"%s\" and LTO flags "
"\"%s\"\n"

MODIFY
src/afl-analyze.c
src/afl-analyze.c
@@ -796,8 +796,10 @@ static void usage(u8 *argv0) {
" (must contain abort_on_error=1 and symbolize=0)\n"
"MSAN_OPTIONS: custom settings for MSAN\n"
" (must contain exitcode="STRINGIFY(MSAN_ERROR)" and symbolize=0)\n"
- "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
"AFL_ANALYZE_HEX: print file offsets in hexadecimal instead of decimal\n"
+ "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
+ " the target was compiled for\n"
+ "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
"AFL_SKIP_BIN_CHECK: skip checking the location of and the target\n"
, argv0, EXEC_TIMEOUT, MEM_LIMIT, doc_path);

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -150,44 +150,46 @@ static void usage(afl_state_t *afl, u8 *argv0, int more_help) {
if (more_help > 1)
SAYF(
"Environment variables used:\n"
- "AFL_PATH: path to AFL support binaries\n"
- "AFL_QUIET: suppress forkserver status messages\n"
- "AFL_DEBUG_CHILD_OUTPUT: do not suppress stdout/stderr from target\n"
"LD_BIND_LAZY: do not set LD_BIND_NOW env var for target\n"
+ "ASAN_OPTIONS: custom settings for ASAN\n"
+ " (must contain abort_on_error=1 and symbolize=0)\n"
+ "MSAN_OPTIONS: custom settings for MSAN\n"
+ " (must contain exitcode="STRINGIFY(MSAN_ERROR)" and symbolize=0)\n"
+ "AFL_AUTORESUME: resume fuzzing if directory specified by -o already exists\n"
"AFL_BENCH_JUST_ONE: run the target just once\n"
- "AFL_DUMB_FORKSRV: use fork server without feedback from target\n"
+ "AFL_BENCH_UNTIL_CRASH: exit soon when the first crashing input has been found\n"
"AFL_CUSTOM_MUTATOR_LIBRARY: lib with afl_custom_fuzz() to mutate inputs\n"
"AFL_CUSTOM_MUTATOR_ONLY: avoid AFL++'s internal mutators\n"
- "AFL_PYTHON_MODULE: mutate and trim inputs with the specified Python module\n"
"AFL_DEBUG: extra debugging output for Python mode trimming\n"
+ "AFL_DEBUG_CHILD_OUTPUT: do not suppress stdout/stderr from target\n"
"AFL_DISABLE_TRIM: disable the trimming of test cases\n"
- "AFL_NO_UI: switch status screen off\n"
- "AFL_FORCE_UI: force showing the status screen (for virtual consoles)\n"
- "AFL_NO_CPU_RED: avoid red color for showing very high cpu usage\n"
- "AFL_SKIP_CPUFREQ: do not warn about variable cpu clocking\n"
- "AFL_NO_SNAPSHOT: do not use the snapshot feature (if the snapshot lkm is loaded)\n"
- "AFL_NO_FORKSRV: run target via execve instead of using the forkserver\n"
- "AFL_NO_ARITH: skip arithmetic mutations in deterministic stage\n"
- "AFL_SHUFFLE_QUEUE: reorder the input queue randomly on startup\n"
+ "AFL_DUMB_FORKSRV: use fork server without feedback from target\n"
+ "AFL_EXIT_WHEN_DONE: exit when all inputs are run and no new finds are found\n"
"AFL_FAST_CAL: limit the calibration stage to three cycles for speedup\n"
+ "AFL_FORCE_UI: force showing the status screen (for virtual consoles)\n"
"AFL_HANG_TMOUT: override timeout value (in milliseconds)\n"
- "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
- "AFL_TMPDIR: directory to use for input file generation (ramdisk recommended)\n"
+ "AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: don't warn about core dump handlers\n"
"AFL_IMPORT_FIRST: sync and import test cases from other fuzzer instances first\n"
+ "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
+ " the target was compiled for\n"
"AFL_NO_AFFINITY: do not check for an unused cpu core to use for fuzzing\n"
+ "AFL_NO_ARITH: skip arithmetic mutations in deterministic stage\n"
+ "AFL_NO_CPU_RED: avoid red color for showing very high cpu usage\n"
+ "AFL_NO_FORKSRV: run target via execve instead of using the forkserver\n"
+ "AFL_NO_SNAPSHOT: do not use the snapshot feature (if the snapshot lkm is loaded)\n"
+ "AFL_NO_UI: switch status screen off\n"
+ "AFL_PATH: path to AFL support binaries\n"
"AFL_POST_LIBRARY: postprocess generated test cases before use as target input\n"
- "AFL_SKIP_CRASHES: during initial dry run do not terminate for crashing inputs\n"
- "AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: don't warn about core dump handlers\n"
- "ASAN_OPTIONS: custom settings for ASAN\n"
- " (must contain abort_on_error=1 and symbolize=0)\n"
- "MSAN_OPTIONS: custom settings for MSAN\n"
- " (must contain exitcode="STRINGIFY(MSAN_ERROR)" and symbolize=0)\n"
+ "AFL_PYTHON_MODULE: mutate and trim inputs with the specified Python module\n"
+ "AFL_QUIET: suppress forkserver status messages\n"
+ "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
+ "AFL_SHUFFLE_QUEUE: reorder the input queue randomly on startup\n"
"AFL_SKIP_BIN_CHECK: skip the check, if the target is an excutable\n"
+ "AFL_SKIP_CPUFREQ: do not warn about variable cpu clocking\n"
+ "AFL_SKIP_CRASHES: during initial dry run do not terminate for crashing inputs\n"
+ "AFL_TMPDIR: directory to use for input file generation (ramdisk recommended)\n"
//"AFL_PERSISTENT: not supported anymore -> no effect, just a warning\n"
//"AFL_DEFER_FORKSRV: not supported anymore -> no effect, just a warning\n"
- "AFL_EXIT_WHEN_DONE: exit when all inputs are run and no new finds are found\n"
- "AFL_BENCH_UNTIL_CRASH: exit soon when the first crashing input has been found\n"
- "AFL_AUTORESUME: resume fuzzing if directory specified by -o already exists\n"
"\n"
);
else

MODIFY
src/afl-showmap.c
src/afl-showmap.c
@@ -515,13 +515,16 @@ static void usage(u8 *argv0) {
"For additional help, consult %s/README.md.\n\n"
"Environment variables used:\n"
- "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
- "AFL_DEBUG: enable extra developer output\n"
- "AFL_QUIET: do not print extra informational output"
+ "LD_BIND_LAZY: do not set LD_BIND_NOW env var for target\n",
"AFL_CMIN_CRASHES_ONLY: (cmin_mode) only write tuples for crashing "
"inputs\n"
"AFL_CMIN_ALLOW_ANY: (cmin_mode) write tuples for crashing inputs also\n"
- "LD_BIND_LAZY: do not set LD_BIND_NOW env var for target\n",
+ "AFL_DEBUG: enable extra developer output\n"
+ "AFL_MAP_SIZE: the shared memory size for that target. must be >= the "
+ "size\n"
+ " the target was compiled for\n"
+ "AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
+ "AFL_QUIET: do not print extra informational output"
argv0, MEM_LIMIT, doc_path);
exit(1);

MODIFY
src/afl-tmin.c
src/afl-tmin.c
@@ -741,6 +741,8 @@ static void usage(u8 *argv0) {
" (must contain abort_on_error=1 and symbolize=0)\n"
"MSAN_OPTIONS: custom settings for MSAN\n"
" (must contain exitcode="STRINGIFY(MSAN_ERROR)" and symbolize=0)\n"
+ "AFL_MAP_SIZE: the shared memory size for that target. must be >= the size\n"
+ " the target was compiled for\n"
"AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
"AFL_TMIN_EXACT: require execution paths to match for crashing inputs\n"

added AFL_MAP_SIZE to env help output