documentation for AFL_PERSISTENT_RECORD
MODIFY
docs/env_variables.md
docs/env_variables.md
@@ -400,6 +400,15 @@ checks or alter some of the more exotic semantics of the tool:
- Setting `AFL_FORCE_UI` will force painting the UI on the screen even if
no valid terminal was detected (for virtual consoles)
+ - If you are using persistent mode (you should, see [instrumentation/README.persistent_mode.md](instrumentation/README.persistent_mode.md))
+ some targets keep inherent state due which a detected crash testcase does
+ not crash the target again when the testcase is given. To be able to still
+ re-trigger these crashes you can use the `AFL_PERSISTENT_RECORD` variable
+ with a value of how many previous fuzz cases to keep prio a crash.
+ if set to e.g. 10, then the 9 previous inputs are written to
+ out/default/crashes as RECORD:000000,cnt:000000 to RECORD:000000,cnt:000008
+ and RECORD:000000,cnt:000009 being the crash case.
+
- If you are Jakub, you may need `AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES`.
Others need not apply.

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -218,6 +218,7 @@ static void usage(u8 *argv0, int more_help) {
"AFL_PATH: path to AFL support binaries\n"
"AFL_PYTHON_MODULE: mutate and trim inputs with the specified Python module\n"
"AFL_QUIET: suppress forkserver status messages\n"
+ "AFL_PERSISTENT_RECORD: record the last X inputs to every crash in out/crashes\n"
"AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target\n"
"AFL_SHUFFLE_QUEUE: reorder the input queue randomly on startup\n"
"AFL_SKIP_BIN_CHECK: skip the check, if the target is an executable\n"

documentation for AFL_PERSISTENT_RECORD