Remove the word "simply"
MODIFY
custom_mutators/gramatron/README.md
custom_mutators/gramatron/README.md
@@ -9,7 +9,7 @@ grammars is presented below:
# Compiling
-Simply execute `./build_gramatron_mutator.sh`
+Execute `./build_gramatron_mutator.sh`
# Running

MODIFY
docs/env_variables.md
docs/env_variables.md
@@ -59,9 +59,9 @@ fairly broad use of environment variables instead:
otherwise.
- By default, the wrapper appends `-O3` to optimize builds. Very rarely, this
- will cause problems in programs built with -Werror, simply because `-O3`
- enables more thorough code analysis and can spew out additional warnings. To
- disable optimizations, set `AFL_DONT_OPTIMIZE`. However, if `-O...` and/or
+ will cause problems in programs built with -Werror, because `-O3` enables
+ more thorough code analysis and can spew out additional warnings. To disable
+ optimizations, set `AFL_DONT_OPTIMIZE`. However, if `-O...` and/or
`-fno-unroll-loops` are set, these are not overridden.
- Setting `AFL_HARDEN` automatically adds code hardening options when invoking
@@ -651,8 +651,8 @@ call back into FRIDA to find the next block. Default is 32.
* `AFL_FRIDA_STATS_FILE` - Write statistics information about the code being
instrumented to the given file name. The statistics are written only for the
child process when new block is instrumented (when the
-`AFL_FRIDA_STATS_INTERVAL` has expired). Note that simply because a new path is
-found does not mean a new block needs to be compiled. It could simply be that
+`AFL_FRIDA_STATS_INTERVAL` has expired). Note that just because a new path is
+found does not mean a new block needs to be compiled. It could be that
the existing blocks instrumented have been executed in a different order.
* `AFL_FRIDA_STATS_INTERVAL` - The maximum frequency to output statistics
information. Stats will be written whenever they are updated if the given

MODIFY
docs/fuzzing_binary-only_targets.md
docs/fuzzing_binary-only_targets.md
@@ -129,8 +129,7 @@ Unicorn is a fork of QEMU. The instrumentation is, therefore, very similar. In
contrast to QEMU, Unicorn does not offer a full system or even userland
emulation. Runtime environment and/or loaders have to be written from scratch,
if needed. On top, block chaining has been removed. This means the speed boost
-introduced in the patched QEMU Mode of AFL++ cannot simply be ported over to
-Unicorn.
+introduced in the patched QEMU Mode of AFL++ cannot be ported over to Unicorn.
For non-Linux binaries, you can use AFL++'s unicorn_mode which can emulate
anything you want - for the price of speed and user written scripts.

MODIFY
docs/fuzzing_in_depth.md
docs/fuzzing_in_depth.md
@@ -427,8 +427,8 @@ It can be valuable to run afl-fuzz in a screen or tmux shell so you can log off,
or afl-fuzz is not aborted if you are running it in a remote ssh session where
the connection fails in between.
Only do that though once you have verified that your fuzzing setup works!
-Simply run it like `screen -dmS afl-main -- afl-fuzz -M main-$HOSTNAME -i ...`
-and it will start away in a screen session. To enter this session simply type
+Run it like `screen -dmS afl-main -- afl-fuzz -M main-$HOSTNAME -i ...`
+and it will start away in a screen session. To enter this session, type
`screen -r afl-main`. You see - it makes sense to name the screen session
same as the afl-fuzz -M/-S naming :-)
For more information on screen or tmux please check their documentation.
@@ -457,7 +457,7 @@ handling in the target. Play around with various -m values until you find one
that safely works for all your input seeds (if you have good ones and then
double or quadruple that.
-By default afl-fuzz never stops fuzzing. To terminate AFL++ simply press
+By default afl-fuzz never stops fuzzing. To terminate AFL++, press
Control-C or send a signal SIGINT. You can limit the number of executions or
approximate runtime in seconds with options also.
@@ -554,7 +554,7 @@ recommended!
### d) Using multiple machines for fuzzing
Maybe you have more than one machine you want to fuzz the same target on.
-Simply start the `afl-fuzz` (and perhaps libfuzzer, honggfuzz, ...)
+Start the `afl-fuzz` (and perhaps libfuzzer, honggfuzz, ...)
orchestra as you like, just ensure that your have one and only one `-M`
instance per server, and that its name is unique, hence the recommendation
for `-M main-$HOSTNAME`.
@@ -609,7 +609,7 @@ e.g., `afl-plot out/default /srv/www/htdocs/plot`.
### f) Stopping fuzzing, restarting fuzzing, adding new seeds
-To stop an afl-fuzz run, simply press Control-C.
+To stop an afl-fuzz run, press Control-C.
To restart an afl-fuzz run, just reuse the same command line but replace the `-i
directory` with `-i -` or set `AFL_AUTORESUME=1`.

MODIFY
frida_mode/DEBUGGING.md
frida_mode/DEBUGGING.md
@@ -160,9 +160,9 @@ Lastly, if your defect only occurs when using `afl-fuzz` (e.g., when using
shared memory mapping being created for it to record its data), it is possible
to enable the creation of a core dump for post-mortem analysis.
-Firstly, check if your `/proc/sys/kernel/core_pattern` configuration is simply
-set to a filename (AFL++ encourages you to set it to the value `core` in any
-case since it doesn't want any handler applications getting in the way).
+Firstly, check if your `/proc/sys/kernel/core_pattern` configuration is set to a
+filename (AFL++ encourages you to set it to the value `core` in any case since
+it doesn't want any handler applications getting in the way).
Next, set `ulimit -c unlimited` to remove any size limitations for core files.

MODIFY
frida_mode/MapDensity.md
frida_mode/MapDensity.md
@@ -77,13 +77,13 @@ evenly distributed.
We start with a large address and need to discard a large number of the bits to
generate a block ID which is within range. But how do we choose the unique bits
of the address versus those which are the same for every block? The high bits of
-the address may simply be all `0s` or all `1s` to make the address canonical,
-the middle portion of the address may be the same for all blocks (since if they
-are all within the same binary, then they will all be adjacent in memory), and
-on some systems, even the low bits may have poor entropy as some use fixed
-length aligned instructions. Then we need to consider that a portion of each
-binary may contain the `.data` or `.bss` sections and so may not contain any
-blocks of code at all.
+the address may be all `0s` or all `1s` to make the address canonical, the
+middle portion of the address may be the same for all blocks (since if they are
+all within the same binary, then they will all be adjacent in memory), and on
+some systems, even the low bits may have poor entropy as some use fixed length
+aligned instructions. Then we need to consider that a portion of each binary may
+contain the `.data` or `.bss` sections and so may not contain any blocks of code
+at all.
### Edge IDs

MODIFY
frida_mode/README.md
frida_mode/README.md
@@ -229,9 +229,9 @@ instances run CMPLOG mode and instrumentation of the binary is less frequent
* `AFL_FRIDA_STATS_FILE` - Write statistics information about the code being
instrumented to the given file name. The statistics are written only for the
child process when new block is instrumented (when the
- `AFL_FRIDA_STATS_INTERVAL` has expired). Note that simply because a new path
- is found does not mean a new block needs to be compiled. It could simply be
- that the existing blocks instrumented have been executed in a different order.
+ `AFL_FRIDA_STATS_INTERVAL` has expired). Note that just because a new path is
+ found does not mean a new block needs to be compiled. It could be that the
+ existing blocks instrumented have been executed in a different order.
```
stats
@@ -359,8 +359,8 @@ An example of how to fuzz a dynamic library on OSX is included, see
[test/osx-lib](test/osx-lib). This requires the use of a simple test harness
executable which will load the library and call a target function within it. The
dependent library can either be loaded in using `dlopen` and `dlsym` in a
-function marked `__attribute__((constructor()))` or the test harness can simply
-be linked against it. It is important that the target library is loaded before
+function marked `__attribute__((constructor()))` or the test harness can be
+linked against it. It is important that the target library is loaded before
execution of `main`, since this is the point where FRIDA mode is initialized.
Otherwise, it will not be possible to configure coverage for the test library
using `AFL_FRIDA_INST_RANGES` or similar.

MODIFY
frida_mode/Scripting.md
frida_mode/Scripting.md
@@ -511,7 +511,7 @@ int main(int argc, char **argv) {
```
There are a couple of obstacles with our target application. Unlike when fuzzing
-source code, though, we can't simply edit it and recompile it. The following
+source code, though, we can't just edit it and recompile it. The following
script shows how we can use the normal functionality of FRIDA to modify any
troublesome behavior.

MODIFY
instrumentation/README.llvm.md
instrumentation/README.llvm.md
@@ -126,8 +126,8 @@ Then there are different ways of instrumenting the target:
1. An better instrumentation strategy uses LTO and link time instrumentation.
Note that not all targets can compile in this mode, however if it works it is
- the best option you can use. Simply use afl-clang-lto/afl-clang-lto++ to use
- this option. See [README.lto.md](README.lto.md).
+ the best option you can use. To go with this option, use
+ afl-clang-lto/afl-clang-lto++. See [README.lto.md](README.lto.md).
2. Alternatively you can choose a completely different coverage method:

MODIFY
qemu_mode/libcompcov/README.md
qemu_mode/libcompcov/README.md
@@ -33,5 +33,5 @@ logs all the comparisons.
The library make use of https://github.com/ouadev/proc_maps_parser and so it is
Linux specific. However this is not a strict dependency, other UNIX operating
-systems can be supported simply replacing the code related to the
+systems can be supported by replacing the code related to the
/proc/self/maps parsing.
\ No newline at end of file

MODIFY
utils/libtokencap/README.md
utils/libtokencap/README.md
@@ -40,10 +40,10 @@ when using afl-gcc. This setting specifically adds the following flags:
-fno-builtin-strcasestr
```
-The next step is simply loading this library via LD_PRELOAD. The optimal usage
-pattern is to allow afl-fuzz to fuzz normally for a while and build up a corpus,
-and then fire off the target binary, with libtokencap.so loaded, on every file
-found by AFL in that earlier run. This demonstrates the basic principle:
+The next step is to load this library via LD_PRELOAD. The optimal usage pattern
+is to allow afl-fuzz to fuzz normally for a while and build up a corpus, and
+then fire off the target binary, with libtokencap.so loaded, on every file found
+by AFL in that earlier run. This demonstrates the basic principle:
```
export AFL_TOKEN_FILE=$PWD/temp_output.txt

Remove the word "simply"