Change "AFL" to "AFL++"
MODIFY
README.md
README.md
@@ -99,7 +99,7 @@ Step-by-step quick start:
To add a dictionary, add `-x /path/to/dictionary.txt` to afl-fuzz.
If the program takes input from a file, you can put `@@` in the program's
- command line; AFL will put an auto-generated file name in there for you.
+ command line; AFL++ will put an auto-generated file name in there for you.
4. Investigate anything shown in red in the fuzzer UI by promptly consulting
[docs/afl-fuzz_approach.md#understanding-the-status-screen](docs/afl-fuzz_approach.md#understanding-the-status-screen).

MODIFY
coresight_mode/README.md
coresight_mode/README.md
@@ -12,7 +12,10 @@ Currently the following hardware boards are supported:
Please read the [RICSec/coresight-trace README](https://github.com/RICSecLab/coresight-trace/blob/master/README.md) and check the prerequisites (capstone) before getting started.
-CoreSight mode supports the AFL fork server mode to reduce `exec` system call overhead. To support it for binary-only fuzzing, it needs to modify the target ELF binary to re-link to the patched glibc. We employ this design from [PTrix](https://github.com/junxzm1990/afl-pt).
+CoreSight mode supports the AFL++ fork server mode to reduce `exec` system call
+overhead. To support it for binary-only fuzzing, it needs to modify the target
+ELF binary to re-link to the patched glibc. We employ this design from
+[PTrix](https://github.com/junxzm1990/afl-pt).
Check out all the git submodules in the `cs_mode` directory:

MODIFY
dictionaries/README.md
dictionaries/README.md
-# AFL dictionaries
+# AFL++ dictionaries
(See [../README.md](../README.md) for the general instruction manual.)

MODIFY
docs/INSTALL.md
docs/INSTALL.md
@@ -114,8 +114,8 @@ This means two things:
- Fuzzing will be probably slower than on Linux. In fact, some folks report
considerable performance gains by running the jobs inside a Linux VM on
MacOS X.
- - Some non-portable, platform-specific code may be incompatible with the
- AFL forkserver. If you run into any problems, set `AFL_NO_FORKSRV=1` in the
+ - Some non-portable, platform-specific code may be incompatible with the AFL++
+ forkserver. If you run into any problems, set `AFL_NO_FORKSRV=1` in the
environment before starting afl-fuzz.
User emulation mode of QEMU does not appear to be supported on MacOS X, so black-box instrumentation mode (`-Q`) will not work.

MODIFY
docs/afl-fuzz_approach.md
docs/afl-fuzz_approach.md
@@ -348,7 +348,7 @@ That last bit is actually fairly interesting: it measures the consistency of
observed traces. If a program always behaves the same for the same input data,
it will earn a score of 100%. When the value is lower but still shown in purple,
the fuzzing process is unlikely to be negatively affected. If it goes into red,
-you may be in trouble, since AFL will have difficulty discerning between
+you may be in trouble, since AFL++ will have difficulty discerning between
meaningful and "phantom" effects of tweaking the input file.
Now, most targets will just get a 100% score, but when you see lower figures,
@@ -506,7 +506,7 @@ directory. This includes:
- `edges_found` - how many edges have been found
- `var_byte_count` - how many edges are non-deterministic
- `afl_banner` - banner text (e.g. the target name)
-- `afl_version` - the version of AFL used
+- `afl_version` - the version of AFL++ used
- `target_mode` - default, persistent, qemu, unicorn, non-instrumented
- `command_line` - full command line used for the fuzzing session

MODIFY
docs/custom_mutators.md
docs/custom_mutators.md
@@ -21,7 +21,8 @@ fuzzing by using libraries that perform mutations according to a given grammar.
The custom mutator is passed to `afl-fuzz` via the `AFL_CUSTOM_MUTATOR_LIBRARY`
or `AFL_PYTHON_MODULE` environment variable, and must export a fuzz function.
-Now AFL also supports multiple custom mutators which can be specified in the same `AFL_CUSTOM_MUTATOR_LIBRARY` environment variable like this.
+Now AFL++ also supports multiple custom mutators which can be specified in the
+same `AFL_CUSTOM_MUTATOR_LIBRARY` environment variable like this.
```bash
export AFL_CUSTOM_MUTATOR_LIBRARY="full/path/to/mutator_first.so;full/path/to/mutator_second.so"
```

MODIFY
docs/env_variables.md
docs/env_variables.md
@@ -307,7 +307,7 @@ checks or alter some of the more exotic semantics of the tool:
(`-i in`). This is an important feature to set when resuming a fuzzing
session.
- - Setting `AFL_CRASH_EXITCODE` sets the exit code AFL treats as crash. For
+ - Setting `AFL_CRASH_EXITCODE` sets the exit code AFL++ treats as crash. For
example, if `AFL_CRASH_EXITCODE='-1'` is set, each input resulting in a `-1`
return code (i.e. `exit(-1)` got called), will be treated as if a crash had
occurred. This may be beneficial if you look for higher-level faulty
@@ -493,7 +493,7 @@ checks or alter some of the more exotic semantics of the tool:
This is especially useful when running multiple instances (`-M/-S` for
example). Applied tags are `banner` and `afl_version`. `banner` corresponds
to the name of the fuzzer provided through `-M/-S`. `afl_version`
- corresponds to the currently running AFL version (e.g. `++3.0c`). Default
+ corresponds to the currently running AFL++ version (e.g. `++3.0c`). Default
(empty/non present) will add no tags to the metrics. For more information,
see [rpc_statsd.md](rpc_statsd.md).

MODIFY
docs/fuzzing_in_depth.md
docs/fuzzing_in_depth.md
@@ -106,9 +106,9 @@ You can select the mode for the afl-cc compiler by:
MODE can be one of: LTO (afl-clang-lto*), LLVM (afl-clang-fast*), GCC_PLUGIN
(afl-g*-fast) or GCC (afl-gcc/afl-g++) or CLANG(afl-clang/afl-clang++).
-Because no AFL specific command-line options are accepted (beside the --afl-MODE
-command), the compile-time tools make fairly broad use of environment variables,
-which can be listed with `afl-cc -hh` or by reading
+Because no AFL++ specific command-line options are accepted (beside the
+--afl-MODE command), the compile-time tools make fairly broad use of environment
+variables, which can be listed with `afl-cc -hh` or by reading
[env_variables.md](env_variables.md).
### b) Selecting instrumentation options
@@ -213,7 +213,7 @@ is more effective).
If the target has features that make fuzzing more difficult, e.g. checksums,
HMAC, etc. then modify the source code so that checks for these values are
removed. This can even be done safely for source code used in operational
-products by eliminating these checks within these AFL specific blocks:
+products by eliminating these checks within these AFL++ specific blocks:
```
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION

MODIFY
testcases/README.md
testcases/README.md
-# AFL starting test cases
+# AFL++ starting test cases
(See [../README.md](../README.md) for the general instruction manual.)

MODIFY
unicorn_mode/README.md
unicorn_mode/README.md
@@ -8,7 +8,8 @@ The CompareCoverage and NeverZero counters features are by Andrea Fioraldi <andr
## 1) Introduction
-The code in ./unicorn_mode allows you to build the (Unicorn Engine)[https://github.com/unicorn-engine/unicorn] with AFL support.
+The code in ./unicorn_mode allows you to build the
+(Unicorn Engine)[https://github.com/unicorn-engine/unicorn] with AFL++ support.
This means, you can run anything that can be emulated in unicorn and obtain instrumentation
output for black-box, closed-source binary code snippets. This mechanism
can be then used by afl-fuzz to stress-test targets that couldn't be built
@@ -46,7 +47,7 @@ To use unicorn-mode effectively you need to prepare the following:
* Relevant binary code to be fuzzed
* Knowledge of the memory map and good starting state
* Folder containing sample inputs to start fuzzing with
- + Same ideas as any other AFL inputs
+ + Same ideas as any other AFL++ inputs
+ Quality/speed of results will depend greatly on the quality of starting
samples
+ See AFL's guidance on how to create a sample corpus
@@ -55,13 +56,12 @@ To use unicorn-mode effectively you need to prepare the following:
+ Loads binary code into memory
+ Calls uc.afl_fuzz() / uc.afl_start_forkserver
+ Loads and verifies data to fuzz from a command-line specified file
- + AFL will provide mutated inputs by changing the file passed to
+ + AFL++ will provide mutated inputs by changing the file passed to
the test harness
+ Presumably the data to be fuzzed is at a fixed buffer address
+ If input constraints (size, invalid bytes, etc.) are known they
should be checked in the place_input handler. If a constraint
- fails, just return false from the handler. AFL will treat the input as
- 'uninteresting' and move on.
+ fails, just return false from the handler. AFL++ will treat the input as 'uninteresting' and move on.
+ Sets up registers and memory state for beginning of test
+ Emulates the interesting code from beginning to end
+ If a crash is detected, the test harness must 'crash' by

MODIFY
utils/argv_fuzzing/README.md
utils/argv_fuzzing/README.md
# argvfuzz
-AFL supports fuzzing file inputs or stdin. When source is available,
+AFL++ supports fuzzing file inputs or stdin. When source is available,
`argv-fuzz-inl.h` can be used to change `main()` to build argv from stdin.
`argvfuzz` tries to provide the same functionality for binaries. When loaded

MODIFY
utils/libdislocator/README.md
utils/libdislocator/README.md
@@ -49,7 +49,7 @@ The allocator is slow and memory-intensive (even the tiniest allocation uses up
for "production" uses; but it can be faster and more hassle-free than ASAN / MSAN
when fuzzing small, self-contained binaries.
-To use this library, run AFL like so:
+To use this library, run AFL++ like so:
```
AFL_PRELOAD=/path/to/libdislocator.so ./afl-fuzz [...other params...]
@@ -62,7 +62,7 @@ Similarly to afl-tmin, the library is not "proprietary" and can be used with
other fuzzers or testing tools without the need for any code tweaks. It does not
require AFL-instrumented binaries to work.
-Note that the AFL_PRELOAD approach (which AFL internally maps to LD_PRELOAD or
+Note that the AFL_PRELOAD approach (which AFL++ internally maps to LD_PRELOAD or
DYLD_INSERT_LIBRARIES, depending on the OS) works only if the target binary is
dynamically linked. Otherwise, attempting to use the library will have no
effect.
\ No newline at end of file

MODIFY
utils/libtokencap/README.md
utils/libtokencap/README.md
@@ -43,7 +43,7 @@ when using afl-gcc. This setting specifically adds the following flags:
The next step is to load this library via LD_PRELOAD. The optimal usage pattern
is to allow afl-fuzz to fuzz normally for a while and build up a corpus, and
then fire off the target binary, with libtokencap.so loaded, on every file found
-by AFL in that earlier run. This demonstrates the basic principle:
+by AFL++ in that earlier run. This demonstrates the basic principle:
```
export AFL_TOKEN_FILE=$PWD/temp_output.txt

Change "AFL" to "AFL++"