FeedbackDrivenFuzzing.md (honggfuzz-2.4) | : | FeedbackDrivenFuzzing.md (honggfuzz-2.5) | ||
---|---|---|---|---|
# Feedback-driven fuzzing # | # Feedback-driven fuzzing # | |||
Honggfuzz is capable of performing feedback-guided (code coverage driven) fuzzin g. It can utilize the following sources of data: | Honggfuzz is capable of performing feedback-guided (code coverage driven) fuzzin g. It can utilize the following sources of data: | |||
* (Linux) Hardware-based counters (instructions, branches) | * (Linux) Hardware-based counters (instructions, branches) | |||
* (Linux) Intel BTS code coverage (kernel >= 4.2) | * (Linux) Intel BTS code coverage (kernel >= 4.2) | |||
* (Linux) Intel PT code coverage (kernel >= 4.2) | * (Linux) Intel PT code coverage (kernel >= 4.2) | |||
* Sanitzer-coverage instrumentation (`-fsanitize-coverage=bb`) | * Sanitizer-coverage instrumentation (`-fsanitize-coverage=bb`) | |||
* Compile-time instrumentation (`-finstrument-functions` or `-fsanitize-covera ge=trace-pc[-guard],indirect-calls,trace-cmp` or both) | * Compile-time instrumentation (`-finstrument-functions` or `-fsanitize-covera ge=trace-pc[-guard],indirect-calls,trace-cmp` or both) | |||
Developers may provide the initial file corpus which will be gradually improved upon, but it's not necessary with feedback-driven modes. | Developers may provide the initial file corpus which will be gradually improved upon, but it's not necessary with feedback-driven modes. | |||
--- | --- | |||
# Requirements for software-based coverage-guided fuzzing # | # Requirements for software-based coverage-guided fuzzing # | |||
* `-fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp` - Clang >= 5.0 | * `-fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp` - Clang >= 5.0 | |||
* `-fsanitize-coverage=trace-pc` - GCC >= 9.0 | * `-fsanitize-coverage=trace-pc` - GCC >= 9.0 | |||
* `-fsanitize-coverage=bb` - Clang >= 3.7 | * `-fsanitize-coverage=bb` - Clang >= 3.7 | |||
* `-finstrument-functions` - GCC or Clang | * `-finstrument-functions` - GCC or Clang | |||
End of changes. 1 change blocks. | ||||
1 lines changed or deleted | 1 lines changed or added |