faster llvm compile, update README
MODIFY
GNUmakefile
GNUmakefile
@@ -307,7 +307,7 @@ all: test_x86 test_shm test_python ready $(PROGS) afl-as llvm gcc_plugin test_bu
.PHONY: llvm
llvm:
- -$(MAKE) -f GNUmakefile.llvm
+ -$(MAKE) -j4 -f GNUmakefile.llvm
@test -e afl-cc || { echo "[-] Compiling afl-cc failed. You seem not to have a working compiler." ; exit 1; }
.PHONY: gcc_plugin
@@ -579,7 +579,7 @@ deepclean: clean
.PHONY: distrib
distrib: all
- -$(MAKE) -f GNUmakefile.llvm
+ -$(MAKE) -j4 -f GNUmakefile.llvm
-$(MAKE) -f GNUmakefile.gcc_plugin
$(MAKE) -C utils/libdislocator
$(MAKE) -C utils/libtokencap
@@ -602,7 +602,7 @@ binary-only: test_shm test_python ready $(PROGS)
.PHONY: source-only
source-only: all
- -$(MAKE) -f GNUmakefile.llvm
+ -$(MAKE) -j4 -f GNUmakefile.llvm
-$(MAKE) -f GNUmakefile.gcc_plugin
$(MAKE) -C utils/libdislocator
$(MAKE) -C utils/libtokencap

MODIFY
README.md
README.md
@@ -31,9 +31,8 @@ With afl++ 3.0 we introduced changes that break some previous afl and afl++
behaviours and defaults:
* There are no llvm_mode and gcc_plugin subdirectories anymore and there is
- only one compiler: afl-cc. All previous compilers now symlink to this one
- compiler. All instrumentation source code is now in the `instrumentation/`
- folder.
+ only one compiler: afl-cc. All previous compilers now symlink to this.
+ All instrumentation source code is now in the `instrumentation/` folder.
* The gcc_plugin was replaced with a new version submitted by AdaCore that
supports more features. thank you!
* qemu_mode got upgraded to QEMU 5.1, but to be able to build this a current
@@ -41,8 +40,9 @@ behaviours and defaults:
qemu_mode also got new options like snapshotting, instrumenting specific
shared libraries, etc. Additionally QEMU 5.1 supports more CPU targets so
this is really worth it.
- * When instrumenting targets, afl-cc will not supersede optimizations. This
- allows to fuzz targets as same as they are built for debug or release.
+ * When instrumenting targets, afl-cc will not supersede optimizations anymore
+ if any were given. This allows to fuzz targets as same as they are built
+ for debug or release.
* afl-fuzz:
* if neither -M or -S is specified, `-S default` is assumed, so more
fuzzers can easily be added later
@@ -88,7 +88,7 @@ behaviours and defaults:
| Ngram prev_loc Coverage | | x(6) | | | |
| Context Coverage | | x(6) | | | |
| Auto Dictionary | | x(7) | | | |
- | Snapshot LKM Support | | x | x | (x)(5) | |
+ | Snapshot LKM Support | | x(8) | x(8) | (x)(5) | |
1. default for LLVM >= 9.0, env var for older version due an efficiency bug in llvm <= 8
2. GCC creates non-performant code, hence it is disabled in gcc_plugin
@@ -97,6 +97,7 @@ behaviours and defaults:
5. upcoming, development in the branch
6. not compatible with LTO instrumentation and needs at least LLVM >= 4.1
7. automatic in LTO mode with LLVM >= 11, an extra pass for all LLVM version that writes to a file to use with afl-fuzz' `-x`
+ 8. the snapshot LKM is currently unmaintained due to too many kernel changes coming too fast :-(
Among others, the following features and patches have been integrated:
@@ -139,9 +140,6 @@ behaviours and defaults:
## Help wanted
-We were happy to be part of [Google Summer of Code 2020](https://summerofcode.withgoogle.com/organizations/5100744400699392/)
-and we will try to participate again in 2021!
-
We have several ideas we would like to see in AFL++ to make it even better.
However, we already work on so many things that we do not have the time for
all the big ideas.
@@ -206,7 +204,7 @@ These build targets exist:
afl++ binaries by passing the STATIC=1 argument to make:
```shell
-make all STATIC=1
+make STATIC=1
```
These build options exist:
@@ -283,9 +281,9 @@ anything below 9 is not recommended.
|
v
+--------------------------------+
- | if you want to instrument only | -> use GCC_PLUGIN mode (afl-gcc-fast/afl-g++-fast)
- | parts of the target | see [instrumentation/README.gcc_plugin.md](instrumentation/README.gcc_plugin.md) and
- +--------------------------------+ [instrumentation/README.instrument_list.md](instrumentation/README.instrument_list.md)
+ | gcc 5+ is available | -> use GCC_PLUGIN mode (afl-gcc-fast/afl-g++-fast)
+ +--------------------------------+ see [instrumentation/README.gcc_plugin.md](instrumentation/README.gcc_plugin.md) and
+ [instrumentation/README.instrument_list.md](instrumentation/README.instrument_list.md)
|
| if not, or if you do not have a gcc with plugin support
|
@@ -298,17 +296,17 @@ Clickable README links for the chosen compiler:
* [LTO mode - afl-clang-lto](instrumentation/README.lto.md)
* [LLVM mode - afl-clang-fast](instrumentation/README.llvm.md)
* [GCC_PLUGIN mode - afl-gcc-fast](instrumentation/README.gcc_plugin.md)
- * GCC mode (afl-gcc) has no README as it has no own features
+ * GCC/CLANG mode (afl-gcc/afl-clant) have no README as they have no own features
You can select the mode for the afl-cc compiler by:
- 1. passing --afl-MODE command line options to the compiler via CFLAGS/CXXFLAGS/CPPFLAGS
- 2. use a symlink to afl-cc: afl-gcc, afl-g++, afl-clang, afl-clang++,
+ 1. use a symlink to afl-cc: afl-gcc, afl-g++, afl-clang, afl-clang++,
afl-clang-fast, afl-clang-fast++, afl-clang-lto, afl-clang-lto++,
- afl-gcc-fast, afl-g++-fast
- 3. using the environment variable AFL_CC_COMPILER with MODE
+ afl-gcc-fast, afl-g++-fast (recommended!)
+ 2. using the environment variable AFL_CC_COMPILER with MODE
+ 3. passing --afl-MODE command line options to the compiler via CFLAGS/CXXFLAGS/CPPFLAGS
MODE can be one of: LTO (afl-clang-lto*), LLVM (afl-clang-fast*), GCC_PLUGIN
-(afl-g*-fast) or GCC (afl-gcc/afl-g++).
+(afl-g*-fast) or GCC (afl-gcc/afl-g++) or CLANG(afl-clang/afl-clang++).
Because no afl specific command-line options are accepted (beside the
--afl-MODE command), the compile-time tools make fairly broad use of environment
@@ -344,8 +342,8 @@ are interested in:
* To instrument only those parts of the target that you are interested in
create a file with all the filenames of the source code that should be
instrumented.
- For afl-clang-lto and afl-gcc-fast - or afl-clang-fast if either the clang
- version is below 7 or the CLASSIC instrumentation is used - just put one
+ For afl-clang-lto and afl-gcc-fast - or afl-clang-fast if a mode other than
+ DEFAULT/PCGUARD is used or you have llvm > 10.0.0 - just put one
filename or function per line (no directory information necessary for
filenames9, and either set `export AFL_LLVM_ALLOWLIST=allowlist.txt` **or**
`export AFL_LLVM_DENYLIST=denylist.txt` - depending on if you want per
@@ -353,10 +351,6 @@ are interested in:
unless requested (ALLOWLIST).
**NOTE:** During optimization functions might be inlined and then would not match!
See [instrumentation/README.instrument_list.md](instrumentation/README.instrument_list.md)
- For afl-clang-fast > 6.0 or if PCGUARD instrumentation is used then use the
- llvm sancov allow-list feature: [http://clang.llvm.org/docs/SanitizerCoverage.html](http://clang.llvm.org/docs/SanitizerCoverage.html)
- The llvm sancov format works with the allowlist/denylist feature of afl++
- however afl++'s format is more flexible.
There are many more options and modes available however these are most of the
time less effective. See:

MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -22,6 +22,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- added AFL_LLVM_INSTRUMENT option NATIVE for native clang pc-guard
support (less performant than our own), GCC for old afl-gcc and
CLANG for old afl-clang
+ - LLVM mode is now compiled with -j4, unicorn with all cores. qemu was
+ already building with all cores, the gcc plugin needs only one.
- added dummy Makefile to instrumentation/

faster llvm compile, update README