[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-libafl":3,"mdc-bpysuz-key":32,"related-org-trail-of-bits-libafl":4845,"related-repo-trail-of-bits-libafl":4999},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":20,"repoUrl":21,"updatedAt":22,"license":23,"forks":24,"topics":25,"repo":27,"sourceUrl":30,"mdContent":31},"libafl","build custom fuzzers with LibAFL","LibAFL is a modular fuzzing library for building custom fuzzers. Use for advanced fuzzing needs, custom mutators, or non-standard fuzzing targets.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Testing","testing",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:15.611177",null,541,[26],"agent-skills",{"repoUrl":21,"stars":20,"forks":24,"topics":28,"description":29},[26],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Ftesting-handbook-skills\u002Fskills\u002Flibafl","---\nname: libafl\ntype: fuzzer\ndescription: >\n  LibAFL is a modular fuzzing library for building custom fuzzers. Use for\n  advanced fuzzing needs, custom mutators, or non-standard fuzzing targets.\n---\n\n# LibAFL\n\nLibAFL is a modular fuzzing library that implements features from AFL-based fuzzers like AFL++. Unlike traditional fuzzers, LibAFL provides all functionality in a modular and customizable way as a Rust library. It can be used as a drop-in replacement for libFuzzer or as a library to build custom fuzzers from scratch.\n\n## When to Use\n\n| Fuzzer | Best For | Complexity |\n|--------|----------|------------|\n| libFuzzer | Quick setup, single-threaded | Low |\n| AFL++ | Multi-core, general purpose | Medium |\n| LibAFL | Custom fuzzers, advanced features, research | High |\n\n**Choose LibAFL when:**\n- You need custom mutation strategies or feedback mechanisms\n- Standard fuzzers don't support your target architecture\n- You want to implement novel fuzzing techniques\n- You need fine-grained control over fuzzing components\n- You're conducting fuzzing research\n\n## Quick Start\n\nLibAFL can be used as a drop-in replacement for libFuzzer with minimal setup:\n\n```c++\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F Call your code with fuzzer-provided data\n    my_function(data, size);\n    return 0;\n}\n```\n\nBuild LibAFL's libFuzzer compatibility layer:\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FLibAFL\ncd LibAFL\u002Flibafl_libfuzzer_runtime\n.\u002Fbuild.sh\n```\n\nCompile and run:\n```bash\nclang++ -DNO_MAIN -g -O2 -fsanitize=fuzzer-no-link libFuzzer.a harness.cc main.cc -o fuzz\n.\u002Ffuzz corpus\u002F\n```\n\n## Installation\n\n### Prerequisites\n\n- Clang\u002FLLVM 15-18\n- Rust (via rustup)\n- Additional system dependencies\n\n### Linux\u002FmacOS\n\nInstall Clang:\n```bash\napt install clang\n```\n\nOr install a specific version via apt.llvm.org:\n```bash\nwget https:\u002F\u002Fapt.llvm.org\u002Fllvm.sh\nchmod +x llvm.sh\nsudo .\u002Fllvm.sh 15\n```\n\nConfigure environment for Rust:\n```bash\nexport RUSTFLAGS=\"-C linker=\u002Fusr\u002Fbin\u002Fclang-15\"\nexport CC=\"clang-15\"\nexport CXX=\"clang++-15\"\n```\n\nInstall Rust:\n```bash\ncurl --proto '=https' --tlsv1.2 -sSf https:\u002F\u002Fsh.rustup.rs | sh\n```\n\nInstall additional dependencies:\n```bash\napt install libssl-dev pkg-config\n```\n\nFor libFuzzer compatibility mode, install nightly Rust:\n```bash\nrustup toolchain install nightly --component llvm-tools\n```\n\n### Verification\n\nBuild LibAFL to verify installation:\n```bash\ncd LibAFL\u002Flibafl_libfuzzer_runtime\n.\u002Fbuild.sh\n# Should produce libFuzzer.a\n```\n\n## Writing a Harness\n\nLibAFL harnesses follow the same pattern as libFuzzer when using drop-in replacement mode:\n\n```c++\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F Your fuzzing target code here\n    return 0;\n}\n```\n\nWhen building custom fuzzers with LibAFL as a Rust library, harness logic is integrated directly into the fuzzer. See the \"Writing a Custom Fuzzer\" section below for the full pattern.\n\n> **See Also:** For detailed harness writing techniques, see the **harness-writing** technique skill.\n\n## Usage Modes\n\nLibAFL supports two primary usage modes:\n\n### 1. libFuzzer Drop-in Replacement\n\nUse LibAFL as a replacement for libFuzzer with existing harnesses.\n\n**Compilation:**\n```bash\nclang++ -DNO_MAIN -g -O2 -fsanitize=fuzzer-no-link libFuzzer.a harness.cc main.cc -o fuzz\n```\n\n**Running:**\n```bash\n.\u002Ffuzz corpus\u002F\n```\n\n**Recommended for long campaigns:**\n```bash\n.\u002Ffuzz -fork=1 -ignore_crashes=1 corpus\u002F\n```\n\n### 2. Custom Fuzzer as Rust Library\n\nBuild a fully customized fuzzer using LibAFL components.\n\n**Create project:**\n```bash\ncargo init --lib my_fuzzer\ncd my_fuzzer\ncargo add libafl@0.13 libafl_targets@0.13 libafl_bolts@0.13 libafl_cc@0.13 \\\n  --features \"libafl_targets@0.13\u002Flibfuzzer,libafl_targets@0.13\u002Fsancov_pcguard_hitcounts\"\n```\n\n**Configure Cargo.toml:**\n```toml\n[lib]\ncrate-type = [\"staticlib\"]\n```\n\n## Writing a Custom Fuzzer\n\n> **See Also:** For detailed harness writing techniques, patterns for handling complex inputs,\n> and advanced strategies, see the **fuzz-harness-writing** technique skill.\n\n### Fuzzer Components\n\nA LibAFL fuzzer consists of modular components:\n\n1. **Observers** - Collect execution feedback (coverage, timing)\n2. **Feedback** - Determine if inputs are interesting\n3. **Objective** - Define fuzzing goals (crashes, timeouts)\n4. **State** - Maintain corpus and metadata\n5. **Mutators** - Generate new inputs\n6. **Scheduler** - Select which inputs to mutate\n7. **Executor** - Run the target with inputs\n\n### Basic Fuzzer Structure\n\n```rust\nuse libafl::prelude::*;\nuse libafl_bolts::prelude::*;\nuse libafl_targets::{libfuzzer_test_one_input, std_edges_map_observer};\n\n#[no_mangle]\npub extern \"C\" fn libafl_main() {\n    let mut run_client = |state: Option\u003C_>, mut restarting_mgr, _core_id| {\n        \u002F\u002F 1. Setup observers\n        let edges_observer = HitcountsMapObserver::new(\n            unsafe { std_edges_map_observer(\"edges\") }\n        ).track_indices();\n        let time_observer = TimeObserver::new(\"time\");\n\n        \u002F\u002F 2. Define feedback\n        let mut feedback = feedback_or!(\n            MaxMapFeedback::new(&edges_observer),\n            TimeFeedback::new(&time_observer)\n        );\n\n        \u002F\u002F 3. Define objective\n        let mut objective = feedback_or_fast!(\n            CrashFeedback::new(),\n            TimeoutFeedback::new()\n        );\n\n        \u002F\u002F 4. Create or restore state\n        let mut state = state.unwrap_or_else(|| {\n            StdState::new(\n                StdRand::new(),\n                InMemoryCorpus::new(),\n                OnDiskCorpus::new(&output_dir).unwrap(),\n                &mut feedback,\n                &mut objective,\n            ).unwrap()\n        });\n\n        \u002F\u002F 5. Setup mutator\n        let mutator = StdScheduledMutator::new(havoc_mutations());\n        let mut stages = tuple_list!(StdMutationalStage::new(mutator));\n\n        \u002F\u002F 6. Setup scheduler\n        let scheduler = IndexesLenTimeMinimizerScheduler::new(\n            &edges_observer,\n            QueueScheduler::new()\n        );\n\n        \u002F\u002F 7. Create fuzzer\n        let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);\n\n        \u002F\u002F 8. Define harness\n        let mut harness = |input: &BytesInput| {\n            let buf = input.target_bytes().as_slice();\n            libfuzzer_test_one_input(buf);\n            ExitKind::Ok\n        };\n\n        \u002F\u002F 9. Setup executor\n        let mut executor = InProcessExecutor::with_timeout(\n            &mut harness,\n            tuple_list!(edges_observer, time_observer),\n            &mut fuzzer,\n            &mut state,\n            &mut restarting_mgr,\n            timeout,\n        )?;\n\n        \u002F\u002F 10. Load initial inputs\n        if state.must_load_initial_inputs() {\n            state.load_initial_inputs(\n                &mut fuzzer,\n                &mut executor,\n                &mut restarting_mgr,\n                &input_dir\n            )?;\n        }\n\n        \u002F\u002F 11. Start fuzzing\n        fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut restarting_mgr)?;\n        Ok(())\n    };\n\n    \u002F\u002F Launch fuzzer\n    Launcher::builder()\n        .run_client(&mut run_client)\n        .cores(&cores)\n        .build()\n        .launch()\n        .unwrap();\n}\n```\n\n## Compilation\n\n### Verbose Mode\n\nManually specify all instrumentation flags:\n\n```bash\nclang++-15 -DNO_MAIN -g -O2 \\\n  -fsanitize-coverage=trace-pc-guard \\\n  -fsanitize=address \\\n  -Wl,--whole-archive target\u002Frelease\u002Flibmy_fuzzer.a -Wl,--no-whole-archive \\\n  main.cc harness.cc -o fuzz\n```\n\n### Compiler Wrapper (Recommended)\n\nCreate a LibAFL compiler wrapper to handle instrumentation automatically.\n\n**Create `src\u002Fbin\u002Flibafl_cc.rs`:**\n```rust\nuse libafl_cc::{ClangWrapper, CompilerWrapper, Configuration, ToolWrapper};\n\npub fn main() {\n    let args: Vec\u003CString> = env::args().collect();\n    let mut cc = ClangWrapper::new();\n    cc.cpp(is_cpp)\n      .parse_args(&args)\n      .link_staticlib(&dir, \"my_fuzzer\")\n      .add_args(&Configuration::GenerateCoverageMap.to_flags().unwrap())\n      .add_args(&Configuration::AddressSanitizer.to_flags().unwrap())\n      .run()\n      .unwrap();\n}\n```\n\n**Compile and use:**\n```bash\ncargo build --release\ntarget\u002Frelease\u002Flibafl_cxx -DNO_MAIN -g -O2 main.cc harness.cc -o fuzz\n```\n\n> **See Also:** For detailed sanitizer configuration, common issues, and advanced flags,\n> see the **address-sanitizer** and **undefined-behavior-sanitizer** technique skills.\n\n## Running Campaigns\n\n### Basic Run\n\n```bash\n.\u002Ffuzz --cores 0 --input corpus\u002F\n```\n\n### Multi-Core Fuzzing\n\n```bash\n.\u002Ffuzz --cores 0,8-15 --input corpus\u002F\n```\n\nThis runs 9 clients: one on core 0, and 8 on cores 8-15.\n\n### With Options\n\n```bash\n.\u002Ffuzz --cores 0-7 --input corpus\u002F --output crashes\u002F --timeout 1000\n```\n\n### Text User Interface (TUI)\n\nEnable graphical statistics view:\n\n```bash\n.\u002Ffuzz -tui=1 corpus\u002F\n```\n\n### Interpreting Output\n\n| Output | Meaning |\n|--------|---------|\n| `corpus: N` | Number of interesting test cases found |\n| `objectives: N` | Number of crashes\u002Ftimeouts found |\n| `executions: N` | Total number of target invocations |\n| `exec\u002Fsec: N` | Current execution throughput |\n| `edges: X%` | Code coverage percentage |\n| `clients: N` | Number of parallel fuzzing processes |\n\nThe fuzzer emits two main event types:\n- **UserStats** - Regular heartbeat with current statistics\n- **Testcase** - New interesting input discovered\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| Use `-fork=1 -ignore_crashes=1` | Continue fuzzing after first crash |\n| Use `InMemoryOnDiskCorpus` | Persist corpus across restarts |\n| Enable TUI with `-tui=1` | Better visualization of progress |\n| Use specific LLVM version | Avoid compatibility issues |\n| Set `RUSTFLAGS` correctly | Prevent linking errors |\n\n### Crash Deduplication\n\nAvoid storing duplicate crashes from the same bug:\n\n**Add backtrace observer:**\n```rust\nlet backtrace_observer = BacktraceObserver::owned(\n    \"BacktraceObserver\",\n    libafl::observers::HarnessType::InProcess\n);\n```\n\n**Update executor:**\n```rust\nlet mut executor = InProcessExecutor::with_timeout(\n    &mut harness,\n    tuple_list!(edges_observer, time_observer, backtrace_observer),\n    &mut fuzzer,\n    &mut state,\n    &mut restarting_mgr,\n    timeout,\n)?;\n```\n\n**Update objective with hash feedback:**\n```rust\nlet mut objective = feedback_and!(\n    feedback_or_fast!(CrashFeedback::new(), TimeoutFeedback::new()),\n    NewHashFeedback::new(&backtrace_observer)\n);\n```\n\nThis ensures only crashes with unique backtraces are saved.\n\n### Dictionary Fuzzing\n\nUse dictionaries to guide fuzzing toward specific tokens:\n\n**Add tokens from file:**\n```rust\nlet mut tokens = Tokens::new();\nif let Some(tokenfile) = &tokenfile {\n    tokens.add_from_file(tokenfile)?;\n}\nstate.add_metadata(tokens);\n```\n\n**Update mutator:**\n```rust\nlet mutator = StdScheduledMutator::new(\n    havoc_mutations().merge(tokens_mutations())\n);\n```\n\n**Hard-coded tokens example (PNG):**\n```rust\nstate.add_metadata(Tokens::from([\n    vec![137, 80, 78, 71, 13, 10, 26, 10], \u002F\u002F PNG header\n    \"IHDR\".as_bytes().to_vec(),\n    \"IDAT\".as_bytes().to_vec(),\n    \"PLTE\".as_bytes().to_vec(),\n    \"IEND\".as_bytes().to_vec(),\n]));\n```\n\n> **See Also:** For detailed dictionary creation strategies and format-specific dictionaries,\n> see the **fuzzing-dictionaries** technique skill.\n\n### Auto Tokens\n\nAutomatically extract magic values and checksums from the program:\n\n**Enable in compiler wrapper:**\n```rust\ncc.add_pass(LLVMPasses::AutoTokens)\n```\n\n**Load auto tokens in fuzzer:**\n```rust\ntokens += libafl_targets::autotokens()?;\n```\n\n**Verify tokens section:**\n```bash\necho \"p (uint8_t *)__token_start\" | gdb fuzz\n```\n\n### Performance Tuning\n\n| Setting | Impact |\n|---------|--------|\n| Multi-core fuzzing | Linear speedup with cores |\n| `InMemoryCorpus` | Faster but non-persistent |\n| `InMemoryOnDiskCorpus` | Balanced speed and persistence |\n| Sanitizers | 2-5x slowdown, essential for bugs |\n| Optimization level `-O2` | Balance between speed and coverage |\n\n### Debugging Fuzzer\n\nRun fuzzer in single-process mode for easier debugging:\n\n```rust\n\u002F\u002F Replace launcher with direct call\nrun_client(None, SimpleEventManager::new(monitor), 0).unwrap();\n\n\u002F\u002F Comment out:\n\u002F\u002F Launcher::builder()\n\u002F\u002F     .run_client(&mut run_client)\n\u002F\u002F     ...\n\u002F\u002F     .launch()\n```\n\nThen debug with GDB:\n```bash\ngdb --args .\u002Ffuzz --cores 0 --input corpus\u002F\n```\n\n## Real-World Examples\n\n### Example: libpng\n\nFuzzing libpng using LibAFL:\n\n**1. Get source code:**\n```bash\ncurl -L -O https:\u002F\u002Fdownloads.sourceforge.net\u002Fproject\u002Flibpng\u002Flibpng16\u002F1.6.37\u002Flibpng-1.6.37.tar.xz\ntar xf libpng-1.6.37.tar.xz\ncd libpng-1.6.37\u002F\napt install zlib1g-dev\n```\n\n**2. Set compiler wrapper:**\n```bash\nexport FUZZER_CARGO_DIR=\"\u002Fpath\u002Fto\u002Flibafl\u002Fproject\"\nexport CC=$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cc\nexport CXX=$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cxx\n```\n\n**3. Build static library:**\n```bash\n.\u002Fconfigure --enable-shared=no\nmake\n```\n\n**4. Get harness:**\n```bash\ncurl -O https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Ff8e5fa92b0e37ab597616f554bee254157998227\u002Fcontrib\u002Foss-fuzz\u002Flibpng_read_fuzzer.cc\n```\n\n**5. Link fuzzer:**\n```bash\n$CXX libpng_read_fuzzer.cc .libs\u002Flibpng16.a -lz -o fuzz\n```\n\n**6. Prepare seeds:**\n```bash\nmkdir seeds\u002F\ncurl -o seeds\u002Finput.png https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Facfd50ae0ba3198ad734e5d4dec2b05341e50924\u002Fcontrib\u002Fpngsuite\u002Fiftp1n3p08.png\n```\n\n**7. Get dictionary (optional):**\n```bash\ncurl -O https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002F2fff013a6935967960a5ae626fc21432807933dd\u002Fcontrib\u002Foss-fuzz\u002Fpng.dict\n```\n\n**8. Start fuzzing:**\n```bash\n.\u002Ffuzz --input seeds\u002F --cores 0 -x png.dict\n```\n\n### Example: CMake Project\n\nIntegrate LibAFL with CMake build system:\n\n**CMakeLists.txt:**\n```cmake\nproject(BuggyProgram)\ncmake_minimum_required(VERSION 3.0)\n\nadd_executable(buggy_program main.cc)\n\nadd_executable(fuzz main.cc harness.cc)\ntarget_compile_definitions(fuzz PRIVATE NO_MAIN=1)\ntarget_compile_options(fuzz PRIVATE -g -O2)\n```\n\n**Build non-instrumented binary:**\n```bash\ncmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ .\ncmake --build . --target buggy_program\n```\n\n**Build fuzzer:**\n```bash\nexport FUZZER_CARGO_DIR=\"\u002Fpath\u002Fto\u002Flibafl\u002Fproject\"\ncmake -DCMAKE_C_COMPILER=$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cc \\\n      -DCMAKE_CXX_COMPILER=$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cxx .\ncmake --build . --target fuzz\n```\n\n**Run fuzzing:**\n```bash\n.\u002Ffuzz --input seeds\u002F --cores 0\n```\n\n## Troubleshooting\n\n| Problem | Cause | Solution |\n|---------|-------|----------|\n| No coverage increases | Instrumentation failed | Verify compiler wrapper used, check for `-fsanitize-coverage` |\n| Fuzzer won't start | Empty corpus with no interesting inputs | Provide seed inputs that trigger code paths |\n| Linker errors with `libafl_main` | Runtime not linked | Use `-Wl,--whole-archive` or `-u libafl_main` |\n| LLVM version mismatch | LibAFL requires LLVM 15-18 | Install compatible LLVM version, set environment variables |\n| Rust compilation fails | Outdated Rust or Cargo | Update Rust with `rustup update` |\n| Slow fuzzing | Sanitizers enabled | Expected 2-5x slowdown, necessary for finding bugs |\n| Environment variable interference | `CC`, `CXX`, `RUSTFLAGS` set | Unset after building LibAFL project |\n| Cannot attach debugger | Multi-process fuzzing | Run in single-process mode (see Debugging section) |\n\n## Related Skills\n\n### Technique Skills\n\n| Skill | Use Case |\n|-------|----------|\n| **fuzz-harness-writing** | Detailed guidance on writing effective harnesses |\n| **address-sanitizer** | Memory error detection during fuzzing |\n| **undefined-behavior-sanitizer** | Undefined behavior detection |\n| **coverage-analysis** | Measuring and improving code coverage |\n| **fuzzing-corpus** | Building and managing seed corpora |\n| **fuzzing-dictionaries** | Creating dictionaries for format-aware fuzzing |\n\n### Related Fuzzers\n\n| Skill | When to Consider |\n|-------|------------------|\n| **libfuzzer** | Simpler setup, don't need LibAFL's advanced features |\n| **aflpp** | Multi-core fuzzing without custom fuzzer development |\n| **cargo-fuzz** | Fuzzing Rust projects with less setup |\n\n## Resources\n\n### Official Documentation\n\n- [LibAFL Book](https:\u002F\u002Faflplus.plus\u002Flibafl-book\u002F) - Official handbook with comprehensive documentation\n- [LibAFL GitHub](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FLibAFL) - Source code and examples\n- [LibAFL API Documentation](https:\u002F\u002Fdocs.rs\u002Flibafl\u002Flatest\u002Flibafl\u002F) - Rust API reference\n\n### Examples and Tutorials\n\n- [LibAFL Examples](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FLibAFL\u002Ftree\u002Fmain\u002Ffuzzers) - Collection of example fuzzers\n- [cargo-fuzz with LibAFL](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FLibAFL\u002Ftree\u002Fmain\u002Ffuzzers\u002Ffuzz_anything\u002Fcargo_fuzz) - Using LibAFL as cargo-fuzz backend\n- [Testing Handbook LibAFL Examples](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Ftesting-handbook\u002Ftree\u002Fmain\u002Fmaterials\u002Ffuzzing\u002Flibafl) - Complete working examples from this handbook\n",{"data":33,"body":35},{"name":4,"type":34,"description":6},"fuzzer",{"type":36,"children":37},"root",[38,46,52,59,145,154,184,190,195,254,259,310,315,388,394,401,419,425,430,455,460,517,522,623,628,688,693,721,726,765,771,776,810,816,821,857,862,883,889,894,900,905,913,963,971,989,997,1025,1031,1036,1044,1144,1152,1177,1183,1201,1207,1212,1286,1292,2084,2090,2096,2101,2197,2203,2208,2224,2333,2341,2401,2427,2433,2439,2472,2478,2509,2514,2520,2572,2578,2583,2606,2612,2736,2741,2764,2770,2776,2888,2894,2899,2907,2946,2954,3025,3033,3071,3076,3082,3087,3095,3141,3149,3179,3187,3250,3268,3274,3279,3287,3301,3309,3323,3331,3372,3378,3478,3484,3489,3559,3564,3605,3611,3617,3622,3630,3705,3713,3789,3797,3825,3833,3856,3864,3878,3886,3927,3935,3958,3966,4007,4013,4018,4026,4097,4105,4161,4169,4273,4281,4312,4318,4540,4546,4552,4666,4672,4741,4747,4753,4794,4800,4839],{"type":39,"tag":40,"props":41,"children":42},"element","h1",{"id":4},[43],{"type":44,"value":45},"text","LibAFL",{"type":39,"tag":47,"props":48,"children":49},"p",{},[50],{"type":44,"value":51},"LibAFL is a modular fuzzing library that implements features from AFL-based fuzzers like AFL++. Unlike traditional fuzzers, LibAFL provides all functionality in a modular and customizable way as a Rust library. It can be used as a drop-in replacement for libFuzzer or as a library to build custom fuzzers from scratch.",{"type":39,"tag":53,"props":54,"children":56},"h2",{"id":55},"when-to-use",[57],{"type":44,"value":58},"When to Use",{"type":39,"tag":60,"props":61,"children":62},"table",{},[63,87],{"type":39,"tag":64,"props":65,"children":66},"thead",{},[67],{"type":39,"tag":68,"props":69,"children":70},"tr",{},[71,77,82],{"type":39,"tag":72,"props":73,"children":74},"th",{},[75],{"type":44,"value":76},"Fuzzer",{"type":39,"tag":72,"props":78,"children":79},{},[80],{"type":44,"value":81},"Best For",{"type":39,"tag":72,"props":83,"children":84},{},[85],{"type":44,"value":86},"Complexity",{"type":39,"tag":88,"props":89,"children":90},"tbody",{},[91,110,128],{"type":39,"tag":68,"props":92,"children":93},{},[94,100,105],{"type":39,"tag":95,"props":96,"children":97},"td",{},[98],{"type":44,"value":99},"libFuzzer",{"type":39,"tag":95,"props":101,"children":102},{},[103],{"type":44,"value":104},"Quick setup, single-threaded",{"type":39,"tag":95,"props":106,"children":107},{},[108],{"type":44,"value":109},"Low",{"type":39,"tag":68,"props":111,"children":112},{},[113,118,123],{"type":39,"tag":95,"props":114,"children":115},{},[116],{"type":44,"value":117},"AFL++",{"type":39,"tag":95,"props":119,"children":120},{},[121],{"type":44,"value":122},"Multi-core, general purpose",{"type":39,"tag":95,"props":124,"children":125},{},[126],{"type":44,"value":127},"Medium",{"type":39,"tag":68,"props":129,"children":130},{},[131,135,140],{"type":39,"tag":95,"props":132,"children":133},{},[134],{"type":44,"value":45},{"type":39,"tag":95,"props":136,"children":137},{},[138],{"type":44,"value":139},"Custom fuzzers, advanced features, research",{"type":39,"tag":95,"props":141,"children":142},{},[143],{"type":44,"value":144},"High",{"type":39,"tag":47,"props":146,"children":147},{},[148],{"type":39,"tag":149,"props":150,"children":151},"strong",{},[152],{"type":44,"value":153},"Choose LibAFL when:",{"type":39,"tag":155,"props":156,"children":157},"ul",{},[158,164,169,174,179],{"type":39,"tag":159,"props":160,"children":161},"li",{},[162],{"type":44,"value":163},"You need custom mutation strategies or feedback mechanisms",{"type":39,"tag":159,"props":165,"children":166},{},[167],{"type":44,"value":168},"Standard fuzzers don't support your target architecture",{"type":39,"tag":159,"props":170,"children":171},{},[172],{"type":44,"value":173},"You want to implement novel fuzzing techniques",{"type":39,"tag":159,"props":175,"children":176},{},[177],{"type":44,"value":178},"You need fine-grained control over fuzzing components",{"type":39,"tag":159,"props":180,"children":181},{},[182],{"type":44,"value":183},"You're conducting fuzzing research",{"type":39,"tag":53,"props":185,"children":187},{"id":186},"quick-start",[188],{"type":44,"value":189},"Quick Start",{"type":39,"tag":47,"props":191,"children":192},{},[193],{"type":44,"value":194},"LibAFL can be used as a drop-in replacement for libFuzzer with minimal setup:",{"type":39,"tag":196,"props":197,"children":202},"pre",{"className":198,"code":199,"language":200,"meta":201,"style":201},"language-c++ shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F Call your code with fuzzer-provided data\n    my_function(data, size);\n    return 0;\n}\n","c++","",[203],{"type":39,"tag":204,"props":205,"children":206},"code",{"__ignoreMap":201},[207,218,227,236,245],{"type":39,"tag":208,"props":209,"children":212},"span",{"class":210,"line":211},"line",1,[213],{"type":39,"tag":208,"props":214,"children":215},{},[216],{"type":44,"value":217},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n",{"type":39,"tag":208,"props":219,"children":221},{"class":210,"line":220},2,[222],{"type":39,"tag":208,"props":223,"children":224},{},[225],{"type":44,"value":226},"    \u002F\u002F Call your code with fuzzer-provided data\n",{"type":39,"tag":208,"props":228,"children":230},{"class":210,"line":229},3,[231],{"type":39,"tag":208,"props":232,"children":233},{},[234],{"type":44,"value":235},"    my_function(data, size);\n",{"type":39,"tag":208,"props":237,"children":239},{"class":210,"line":238},4,[240],{"type":39,"tag":208,"props":241,"children":242},{},[243],{"type":44,"value":244},"    return 0;\n",{"type":39,"tag":208,"props":246,"children":248},{"class":210,"line":247},5,[249],{"type":39,"tag":208,"props":250,"children":251},{},[252],{"type":44,"value":253},"}\n",{"type":39,"tag":47,"props":255,"children":256},{},[257],{"type":44,"value":258},"Build LibAFL's libFuzzer compatibility layer:",{"type":39,"tag":196,"props":260,"children":264},{"className":261,"code":262,"language":263,"meta":201,"style":201},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","git clone https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FLibAFL\ncd LibAFL\u002Flibafl_libfuzzer_runtime\n.\u002Fbuild.sh\n","bash",[265],{"type":39,"tag":204,"props":266,"children":267},{"__ignoreMap":201},[268,288,302],{"type":39,"tag":208,"props":269,"children":270},{"class":210,"line":211},[271,277,283],{"type":39,"tag":208,"props":272,"children":274},{"style":273},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[275],{"type":44,"value":276},"git",{"type":39,"tag":208,"props":278,"children":280},{"style":279},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[281],{"type":44,"value":282}," clone",{"type":39,"tag":208,"props":284,"children":285},{"style":279},[286],{"type":44,"value":287}," https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FLibAFL\n",{"type":39,"tag":208,"props":289,"children":290},{"class":210,"line":220},[291,297],{"type":39,"tag":208,"props":292,"children":294},{"style":293},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[295],{"type":44,"value":296},"cd",{"type":39,"tag":208,"props":298,"children":299},{"style":279},[300],{"type":44,"value":301}," LibAFL\u002Flibafl_libfuzzer_runtime\n",{"type":39,"tag":208,"props":303,"children":304},{"class":210,"line":229},[305],{"type":39,"tag":208,"props":306,"children":307},{"style":273},[308],{"type":44,"value":309},".\u002Fbuild.sh\n",{"type":39,"tag":47,"props":311,"children":312},{},[313],{"type":44,"value":314},"Compile and run:",{"type":39,"tag":196,"props":316,"children":318},{"className":261,"code":317,"language":263,"meta":201,"style":201},"clang++ -DNO_MAIN -g -O2 -fsanitize=fuzzer-no-link libFuzzer.a harness.cc main.cc -o fuzz\n.\u002Ffuzz corpus\u002F\n",[319],{"type":39,"tag":204,"props":320,"children":321},{"__ignoreMap":201},[322,375],{"type":39,"tag":208,"props":323,"children":324},{"class":210,"line":211},[325,330,335,340,345,350,355,360,365,370],{"type":39,"tag":208,"props":326,"children":327},{"style":273},[328],{"type":44,"value":329},"clang++",{"type":39,"tag":208,"props":331,"children":332},{"style":279},[333],{"type":44,"value":334}," -DNO_MAIN",{"type":39,"tag":208,"props":336,"children":337},{"style":279},[338],{"type":44,"value":339}," -g",{"type":39,"tag":208,"props":341,"children":342},{"style":279},[343],{"type":44,"value":344}," -O2",{"type":39,"tag":208,"props":346,"children":347},{"style":279},[348],{"type":44,"value":349}," -fsanitize=fuzzer-no-link",{"type":39,"tag":208,"props":351,"children":352},{"style":279},[353],{"type":44,"value":354}," libFuzzer.a",{"type":39,"tag":208,"props":356,"children":357},{"style":279},[358],{"type":44,"value":359}," harness.cc",{"type":39,"tag":208,"props":361,"children":362},{"style":279},[363],{"type":44,"value":364}," main.cc",{"type":39,"tag":208,"props":366,"children":367},{"style":279},[368],{"type":44,"value":369}," -o",{"type":39,"tag":208,"props":371,"children":372},{"style":279},[373],{"type":44,"value":374}," fuzz\n",{"type":39,"tag":208,"props":376,"children":377},{"class":210,"line":220},[378,383],{"type":39,"tag":208,"props":379,"children":380},{"style":273},[381],{"type":44,"value":382},".\u002Ffuzz",{"type":39,"tag":208,"props":384,"children":385},{"style":279},[386],{"type":44,"value":387}," corpus\u002F\n",{"type":39,"tag":53,"props":389,"children":391},{"id":390},"installation",[392],{"type":44,"value":393},"Installation",{"type":39,"tag":395,"props":396,"children":398},"h3",{"id":397},"prerequisites",[399],{"type":44,"value":400},"Prerequisites",{"type":39,"tag":155,"props":402,"children":403},{},[404,409,414],{"type":39,"tag":159,"props":405,"children":406},{},[407],{"type":44,"value":408},"Clang\u002FLLVM 15-18",{"type":39,"tag":159,"props":410,"children":411},{},[412],{"type":44,"value":413},"Rust (via rustup)",{"type":39,"tag":159,"props":415,"children":416},{},[417],{"type":44,"value":418},"Additional system dependencies",{"type":39,"tag":395,"props":420,"children":422},{"id":421},"linuxmacos",[423],{"type":44,"value":424},"Linux\u002FmacOS",{"type":39,"tag":47,"props":426,"children":427},{},[428],{"type":44,"value":429},"Install Clang:",{"type":39,"tag":196,"props":431,"children":433},{"className":261,"code":432,"language":263,"meta":201,"style":201},"apt install clang\n",[434],{"type":39,"tag":204,"props":435,"children":436},{"__ignoreMap":201},[437],{"type":39,"tag":208,"props":438,"children":439},{"class":210,"line":211},[440,445,450],{"type":39,"tag":208,"props":441,"children":442},{"style":273},[443],{"type":44,"value":444},"apt",{"type":39,"tag":208,"props":446,"children":447},{"style":279},[448],{"type":44,"value":449}," install",{"type":39,"tag":208,"props":451,"children":452},{"style":279},[453],{"type":44,"value":454}," clang\n",{"type":39,"tag":47,"props":456,"children":457},{},[458],{"type":44,"value":459},"Or install a specific version via apt.llvm.org:",{"type":39,"tag":196,"props":461,"children":463},{"className":261,"code":462,"language":263,"meta":201,"style":201},"wget https:\u002F\u002Fapt.llvm.org\u002Fllvm.sh\nchmod +x llvm.sh\nsudo .\u002Fllvm.sh 15\n",[464],{"type":39,"tag":204,"props":465,"children":466},{"__ignoreMap":201},[467,480,498],{"type":39,"tag":208,"props":468,"children":469},{"class":210,"line":211},[470,475],{"type":39,"tag":208,"props":471,"children":472},{"style":273},[473],{"type":44,"value":474},"wget",{"type":39,"tag":208,"props":476,"children":477},{"style":279},[478],{"type":44,"value":479}," https:\u002F\u002Fapt.llvm.org\u002Fllvm.sh\n",{"type":39,"tag":208,"props":481,"children":482},{"class":210,"line":220},[483,488,493],{"type":39,"tag":208,"props":484,"children":485},{"style":273},[486],{"type":44,"value":487},"chmod",{"type":39,"tag":208,"props":489,"children":490},{"style":279},[491],{"type":44,"value":492}," +x",{"type":39,"tag":208,"props":494,"children":495},{"style":279},[496],{"type":44,"value":497}," llvm.sh\n",{"type":39,"tag":208,"props":499,"children":500},{"class":210,"line":229},[501,506,511],{"type":39,"tag":208,"props":502,"children":503},{"style":273},[504],{"type":44,"value":505},"sudo",{"type":39,"tag":208,"props":507,"children":508},{"style":279},[509],{"type":44,"value":510}," .\u002Fllvm.sh",{"type":39,"tag":208,"props":512,"children":514},{"style":513},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[515],{"type":44,"value":516}," 15\n",{"type":39,"tag":47,"props":518,"children":519},{},[520],{"type":44,"value":521},"Configure environment for Rust:",{"type":39,"tag":196,"props":523,"children":525},{"className":261,"code":524,"language":263,"meta":201,"style":201},"export RUSTFLAGS=\"-C linker=\u002Fusr\u002Fbin\u002Fclang-15\"\nexport CC=\"clang-15\"\nexport CXX=\"clang++-15\"\n",[526],{"type":39,"tag":204,"props":527,"children":528},{"__ignoreMap":201},[529,565,594],{"type":39,"tag":208,"props":530,"children":531},{"class":210,"line":211},[532,538,544,550,555,560],{"type":39,"tag":208,"props":533,"children":535},{"style":534},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[536],{"type":44,"value":537},"export",{"type":39,"tag":208,"props":539,"children":541},{"style":540},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[542],{"type":44,"value":543}," RUSTFLAGS",{"type":39,"tag":208,"props":545,"children":547},{"style":546},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[548],{"type":44,"value":549},"=",{"type":39,"tag":208,"props":551,"children":552},{"style":546},[553],{"type":44,"value":554},"\"",{"type":39,"tag":208,"props":556,"children":557},{"style":279},[558],{"type":44,"value":559},"-C linker=\u002Fusr\u002Fbin\u002Fclang-15",{"type":39,"tag":208,"props":561,"children":562},{"style":546},[563],{"type":44,"value":564},"\"\n",{"type":39,"tag":208,"props":566,"children":567},{"class":210,"line":220},[568,572,577,581,585,590],{"type":39,"tag":208,"props":569,"children":570},{"style":534},[571],{"type":44,"value":537},{"type":39,"tag":208,"props":573,"children":574},{"style":540},[575],{"type":44,"value":576}," CC",{"type":39,"tag":208,"props":578,"children":579},{"style":546},[580],{"type":44,"value":549},{"type":39,"tag":208,"props":582,"children":583},{"style":546},[584],{"type":44,"value":554},{"type":39,"tag":208,"props":586,"children":587},{"style":279},[588],{"type":44,"value":589},"clang-15",{"type":39,"tag":208,"props":591,"children":592},{"style":546},[593],{"type":44,"value":564},{"type":39,"tag":208,"props":595,"children":596},{"class":210,"line":229},[597,601,606,610,614,619],{"type":39,"tag":208,"props":598,"children":599},{"style":534},[600],{"type":44,"value":537},{"type":39,"tag":208,"props":602,"children":603},{"style":540},[604],{"type":44,"value":605}," CXX",{"type":39,"tag":208,"props":607,"children":608},{"style":546},[609],{"type":44,"value":549},{"type":39,"tag":208,"props":611,"children":612},{"style":546},[613],{"type":44,"value":554},{"type":39,"tag":208,"props":615,"children":616},{"style":279},[617],{"type":44,"value":618},"clang++-15",{"type":39,"tag":208,"props":620,"children":621},{"style":546},[622],{"type":44,"value":564},{"type":39,"tag":47,"props":624,"children":625},{},[626],{"type":44,"value":627},"Install Rust:",{"type":39,"tag":196,"props":629,"children":631},{"className":261,"code":630,"language":263,"meta":201,"style":201},"curl --proto '=https' --tlsv1.2 -sSf https:\u002F\u002Fsh.rustup.rs | sh\n",[632],{"type":39,"tag":204,"props":633,"children":634},{"__ignoreMap":201},[635],{"type":39,"tag":208,"props":636,"children":637},{"class":210,"line":211},[638,643,648,653,658,663,668,673,678,683],{"type":39,"tag":208,"props":639,"children":640},{"style":273},[641],{"type":44,"value":642},"curl",{"type":39,"tag":208,"props":644,"children":645},{"style":279},[646],{"type":44,"value":647}," --proto",{"type":39,"tag":208,"props":649,"children":650},{"style":546},[651],{"type":44,"value":652}," '",{"type":39,"tag":208,"props":654,"children":655},{"style":279},[656],{"type":44,"value":657},"=https",{"type":39,"tag":208,"props":659,"children":660},{"style":546},[661],{"type":44,"value":662},"'",{"type":39,"tag":208,"props":664,"children":665},{"style":279},[666],{"type":44,"value":667}," --tlsv1.2",{"type":39,"tag":208,"props":669,"children":670},{"style":279},[671],{"type":44,"value":672}," -sSf",{"type":39,"tag":208,"props":674,"children":675},{"style":279},[676],{"type":44,"value":677}," https:\u002F\u002Fsh.rustup.rs",{"type":39,"tag":208,"props":679,"children":680},{"style":546},[681],{"type":44,"value":682}," |",{"type":39,"tag":208,"props":684,"children":685},{"style":273},[686],{"type":44,"value":687}," sh\n",{"type":39,"tag":47,"props":689,"children":690},{},[691],{"type":44,"value":692},"Install additional dependencies:",{"type":39,"tag":196,"props":694,"children":696},{"className":261,"code":695,"language":263,"meta":201,"style":201},"apt install libssl-dev pkg-config\n",[697],{"type":39,"tag":204,"props":698,"children":699},{"__ignoreMap":201},[700],{"type":39,"tag":208,"props":701,"children":702},{"class":210,"line":211},[703,707,711,716],{"type":39,"tag":208,"props":704,"children":705},{"style":273},[706],{"type":44,"value":444},{"type":39,"tag":208,"props":708,"children":709},{"style":279},[710],{"type":44,"value":449},{"type":39,"tag":208,"props":712,"children":713},{"style":279},[714],{"type":44,"value":715}," libssl-dev",{"type":39,"tag":208,"props":717,"children":718},{"style":279},[719],{"type":44,"value":720}," pkg-config\n",{"type":39,"tag":47,"props":722,"children":723},{},[724],{"type":44,"value":725},"For libFuzzer compatibility mode, install nightly Rust:",{"type":39,"tag":196,"props":727,"children":729},{"className":261,"code":728,"language":263,"meta":201,"style":201},"rustup toolchain install nightly --component llvm-tools\n",[730],{"type":39,"tag":204,"props":731,"children":732},{"__ignoreMap":201},[733],{"type":39,"tag":208,"props":734,"children":735},{"class":210,"line":211},[736,741,746,750,755,760],{"type":39,"tag":208,"props":737,"children":738},{"style":273},[739],{"type":44,"value":740},"rustup",{"type":39,"tag":208,"props":742,"children":743},{"style":279},[744],{"type":44,"value":745}," toolchain",{"type":39,"tag":208,"props":747,"children":748},{"style":279},[749],{"type":44,"value":449},{"type":39,"tag":208,"props":751,"children":752},{"style":279},[753],{"type":44,"value":754}," nightly",{"type":39,"tag":208,"props":756,"children":757},{"style":279},[758],{"type":44,"value":759}," --component",{"type":39,"tag":208,"props":761,"children":762},{"style":279},[763],{"type":44,"value":764}," llvm-tools\n",{"type":39,"tag":395,"props":766,"children":768},{"id":767},"verification",[769],{"type":44,"value":770},"Verification",{"type":39,"tag":47,"props":772,"children":773},{},[774],{"type":44,"value":775},"Build LibAFL to verify installation:",{"type":39,"tag":196,"props":777,"children":779},{"className":261,"code":778,"language":263,"meta":201,"style":201},"cd LibAFL\u002Flibafl_libfuzzer_runtime\n.\u002Fbuild.sh\n# Should produce libFuzzer.a\n",[780],{"type":39,"tag":204,"props":781,"children":782},{"__ignoreMap":201},[783,794,801],{"type":39,"tag":208,"props":784,"children":785},{"class":210,"line":211},[786,790],{"type":39,"tag":208,"props":787,"children":788},{"style":293},[789],{"type":44,"value":296},{"type":39,"tag":208,"props":791,"children":792},{"style":279},[793],{"type":44,"value":301},{"type":39,"tag":208,"props":795,"children":796},{"class":210,"line":220},[797],{"type":39,"tag":208,"props":798,"children":799},{"style":273},[800],{"type":44,"value":309},{"type":39,"tag":208,"props":802,"children":803},{"class":210,"line":229},[804],{"type":39,"tag":208,"props":805,"children":807},{"style":806},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[808],{"type":44,"value":809},"# Should produce libFuzzer.a\n",{"type":39,"tag":53,"props":811,"children":813},{"id":812},"writing-a-harness",[814],{"type":44,"value":815},"Writing a Harness",{"type":39,"tag":47,"props":817,"children":818},{},[819],{"type":44,"value":820},"LibAFL harnesses follow the same pattern as libFuzzer when using drop-in replacement mode:",{"type":39,"tag":196,"props":822,"children":824},{"className":198,"code":823,"language":200,"meta":201,"style":201},"extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n    \u002F\u002F Your fuzzing target code here\n    return 0;\n}\n",[825],{"type":39,"tag":204,"props":826,"children":827},{"__ignoreMap":201},[828,835,843,850],{"type":39,"tag":208,"props":829,"children":830},{"class":210,"line":211},[831],{"type":39,"tag":208,"props":832,"children":833},{},[834],{"type":44,"value":217},{"type":39,"tag":208,"props":836,"children":837},{"class":210,"line":220},[838],{"type":39,"tag":208,"props":839,"children":840},{},[841],{"type":44,"value":842},"    \u002F\u002F Your fuzzing target code here\n",{"type":39,"tag":208,"props":844,"children":845},{"class":210,"line":229},[846],{"type":39,"tag":208,"props":847,"children":848},{},[849],{"type":44,"value":244},{"type":39,"tag":208,"props":851,"children":852},{"class":210,"line":238},[853],{"type":39,"tag":208,"props":854,"children":855},{},[856],{"type":44,"value":253},{"type":39,"tag":47,"props":858,"children":859},{},[860],{"type":44,"value":861},"When building custom fuzzers with LibAFL as a Rust library, harness logic is integrated directly into the fuzzer. See the \"Writing a Custom Fuzzer\" section below for the full pattern.",{"type":39,"tag":863,"props":864,"children":865},"blockquote",{},[866],{"type":39,"tag":47,"props":867,"children":868},{},[869,874,876,881],{"type":39,"tag":149,"props":870,"children":871},{},[872],{"type":44,"value":873},"See Also:",{"type":44,"value":875}," For detailed harness writing techniques, see the ",{"type":39,"tag":149,"props":877,"children":878},{},[879],{"type":44,"value":880},"harness-writing",{"type":44,"value":882}," technique skill.",{"type":39,"tag":53,"props":884,"children":886},{"id":885},"usage-modes",[887],{"type":44,"value":888},"Usage Modes",{"type":39,"tag":47,"props":890,"children":891},{},[892],{"type":44,"value":893},"LibAFL supports two primary usage modes:",{"type":39,"tag":395,"props":895,"children":897},{"id":896},"_1-libfuzzer-drop-in-replacement",[898],{"type":44,"value":899},"1. libFuzzer Drop-in Replacement",{"type":39,"tag":47,"props":901,"children":902},{},[903],{"type":44,"value":904},"Use LibAFL as a replacement for libFuzzer with existing harnesses.",{"type":39,"tag":47,"props":906,"children":907},{},[908],{"type":39,"tag":149,"props":909,"children":910},{},[911],{"type":44,"value":912},"Compilation:",{"type":39,"tag":196,"props":914,"children":916},{"className":261,"code":915,"language":263,"meta":201,"style":201},"clang++ -DNO_MAIN -g -O2 -fsanitize=fuzzer-no-link libFuzzer.a harness.cc main.cc -o fuzz\n",[917],{"type":39,"tag":204,"props":918,"children":919},{"__ignoreMap":201},[920],{"type":39,"tag":208,"props":921,"children":922},{"class":210,"line":211},[923,927,931,935,939,943,947,951,955,959],{"type":39,"tag":208,"props":924,"children":925},{"style":273},[926],{"type":44,"value":329},{"type":39,"tag":208,"props":928,"children":929},{"style":279},[930],{"type":44,"value":334},{"type":39,"tag":208,"props":932,"children":933},{"style":279},[934],{"type":44,"value":339},{"type":39,"tag":208,"props":936,"children":937},{"style":279},[938],{"type":44,"value":344},{"type":39,"tag":208,"props":940,"children":941},{"style":279},[942],{"type":44,"value":349},{"type":39,"tag":208,"props":944,"children":945},{"style":279},[946],{"type":44,"value":354},{"type":39,"tag":208,"props":948,"children":949},{"style":279},[950],{"type":44,"value":359},{"type":39,"tag":208,"props":952,"children":953},{"style":279},[954],{"type":44,"value":364},{"type":39,"tag":208,"props":956,"children":957},{"style":279},[958],{"type":44,"value":369},{"type":39,"tag":208,"props":960,"children":961},{"style":279},[962],{"type":44,"value":374},{"type":39,"tag":47,"props":964,"children":965},{},[966],{"type":39,"tag":149,"props":967,"children":968},{},[969],{"type":44,"value":970},"Running:",{"type":39,"tag":196,"props":972,"children":974},{"className":261,"code":973,"language":263,"meta":201,"style":201},".\u002Ffuzz corpus\u002F\n",[975],{"type":39,"tag":204,"props":976,"children":977},{"__ignoreMap":201},[978],{"type":39,"tag":208,"props":979,"children":980},{"class":210,"line":211},[981,985],{"type":39,"tag":208,"props":982,"children":983},{"style":273},[984],{"type":44,"value":382},{"type":39,"tag":208,"props":986,"children":987},{"style":279},[988],{"type":44,"value":387},{"type":39,"tag":47,"props":990,"children":991},{},[992],{"type":39,"tag":149,"props":993,"children":994},{},[995],{"type":44,"value":996},"Recommended for long campaigns:",{"type":39,"tag":196,"props":998,"children":1000},{"className":261,"code":999,"language":263,"meta":201,"style":201},".\u002Ffuzz -fork=1 -ignore_crashes=1 corpus\u002F\n",[1001],{"type":39,"tag":204,"props":1002,"children":1003},{"__ignoreMap":201},[1004],{"type":39,"tag":208,"props":1005,"children":1006},{"class":210,"line":211},[1007,1011,1016,1021],{"type":39,"tag":208,"props":1008,"children":1009},{"style":273},[1010],{"type":44,"value":382},{"type":39,"tag":208,"props":1012,"children":1013},{"style":279},[1014],{"type":44,"value":1015}," -fork=1",{"type":39,"tag":208,"props":1017,"children":1018},{"style":279},[1019],{"type":44,"value":1020}," -ignore_crashes=1",{"type":39,"tag":208,"props":1022,"children":1023},{"style":279},[1024],{"type":44,"value":387},{"type":39,"tag":395,"props":1026,"children":1028},{"id":1027},"_2-custom-fuzzer-as-rust-library",[1029],{"type":44,"value":1030},"2. Custom Fuzzer as Rust Library",{"type":39,"tag":47,"props":1032,"children":1033},{},[1034],{"type":44,"value":1035},"Build a fully customized fuzzer using LibAFL components.",{"type":39,"tag":47,"props":1037,"children":1038},{},[1039],{"type":39,"tag":149,"props":1040,"children":1041},{},[1042],{"type":44,"value":1043},"Create project:",{"type":39,"tag":196,"props":1045,"children":1047},{"className":261,"code":1046,"language":263,"meta":201,"style":201},"cargo init --lib my_fuzzer\ncd my_fuzzer\ncargo add libafl@0.13 libafl_targets@0.13 libafl_bolts@0.13 libafl_cc@0.13 \\\n  --features \"libafl_targets@0.13\u002Flibfuzzer,libafl_targets@0.13\u002Fsancov_pcguard_hitcounts\"\n",[1048],{"type":39,"tag":204,"props":1049,"children":1050},{"__ignoreMap":201},[1051,1074,1085,1122],{"type":39,"tag":208,"props":1052,"children":1053},{"class":210,"line":211},[1054,1059,1064,1069],{"type":39,"tag":208,"props":1055,"children":1056},{"style":273},[1057],{"type":44,"value":1058},"cargo",{"type":39,"tag":208,"props":1060,"children":1061},{"style":279},[1062],{"type":44,"value":1063}," init",{"type":39,"tag":208,"props":1065,"children":1066},{"style":279},[1067],{"type":44,"value":1068}," --lib",{"type":39,"tag":208,"props":1070,"children":1071},{"style":279},[1072],{"type":44,"value":1073}," my_fuzzer\n",{"type":39,"tag":208,"props":1075,"children":1076},{"class":210,"line":220},[1077,1081],{"type":39,"tag":208,"props":1078,"children":1079},{"style":293},[1080],{"type":44,"value":296},{"type":39,"tag":208,"props":1082,"children":1083},{"style":279},[1084],{"type":44,"value":1073},{"type":39,"tag":208,"props":1086,"children":1087},{"class":210,"line":229},[1088,1092,1097,1102,1107,1112,1117],{"type":39,"tag":208,"props":1089,"children":1090},{"style":273},[1091],{"type":44,"value":1058},{"type":39,"tag":208,"props":1093,"children":1094},{"style":279},[1095],{"type":44,"value":1096}," add",{"type":39,"tag":208,"props":1098,"children":1099},{"style":279},[1100],{"type":44,"value":1101}," libafl@0.13",{"type":39,"tag":208,"props":1103,"children":1104},{"style":279},[1105],{"type":44,"value":1106}," libafl_targets@0.13",{"type":39,"tag":208,"props":1108,"children":1109},{"style":279},[1110],{"type":44,"value":1111}," libafl_bolts@0.13",{"type":39,"tag":208,"props":1113,"children":1114},{"style":279},[1115],{"type":44,"value":1116}," libafl_cc@0.13",{"type":39,"tag":208,"props":1118,"children":1119},{"style":540},[1120],{"type":44,"value":1121}," \\\n",{"type":39,"tag":208,"props":1123,"children":1124},{"class":210,"line":238},[1125,1130,1135,1140],{"type":39,"tag":208,"props":1126,"children":1127},{"style":279},[1128],{"type":44,"value":1129},"  --features",{"type":39,"tag":208,"props":1131,"children":1132},{"style":546},[1133],{"type":44,"value":1134}," \"",{"type":39,"tag":208,"props":1136,"children":1137},{"style":279},[1138],{"type":44,"value":1139},"libafl_targets@0.13\u002Flibfuzzer,libafl_targets@0.13\u002Fsancov_pcguard_hitcounts",{"type":39,"tag":208,"props":1141,"children":1142},{"style":546},[1143],{"type":44,"value":564},{"type":39,"tag":47,"props":1145,"children":1146},{},[1147],{"type":39,"tag":149,"props":1148,"children":1149},{},[1150],{"type":44,"value":1151},"Configure Cargo.toml:",{"type":39,"tag":196,"props":1153,"children":1157},{"className":1154,"code":1155,"language":1156,"meta":201,"style":201},"language-toml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","[lib]\ncrate-type = [\"staticlib\"]\n","toml",[1158],{"type":39,"tag":204,"props":1159,"children":1160},{"__ignoreMap":201},[1161,1169],{"type":39,"tag":208,"props":1162,"children":1163},{"class":210,"line":211},[1164],{"type":39,"tag":208,"props":1165,"children":1166},{},[1167],{"type":44,"value":1168},"[lib]\n",{"type":39,"tag":208,"props":1170,"children":1171},{"class":210,"line":220},[1172],{"type":39,"tag":208,"props":1173,"children":1174},{},[1175],{"type":44,"value":1176},"crate-type = [\"staticlib\"]\n",{"type":39,"tag":53,"props":1178,"children":1180},{"id":1179},"writing-a-custom-fuzzer",[1181],{"type":44,"value":1182},"Writing a Custom Fuzzer",{"type":39,"tag":863,"props":1184,"children":1185},{},[1186],{"type":39,"tag":47,"props":1187,"children":1188},{},[1189,1193,1195,1200],{"type":39,"tag":149,"props":1190,"children":1191},{},[1192],{"type":44,"value":873},{"type":44,"value":1194}," For detailed harness writing techniques, patterns for handling complex inputs,\nand advanced strategies, see the ",{"type":39,"tag":149,"props":1196,"children":1197},{},[1198],{"type":44,"value":1199},"fuzz-harness-writing",{"type":44,"value":882},{"type":39,"tag":395,"props":1202,"children":1204},{"id":1203},"fuzzer-components",[1205],{"type":44,"value":1206},"Fuzzer Components",{"type":39,"tag":47,"props":1208,"children":1209},{},[1210],{"type":44,"value":1211},"A LibAFL fuzzer consists of modular components:",{"type":39,"tag":1213,"props":1214,"children":1215},"ol",{},[1216,1226,1236,1246,1256,1266,1276],{"type":39,"tag":159,"props":1217,"children":1218},{},[1219,1224],{"type":39,"tag":149,"props":1220,"children":1221},{},[1222],{"type":44,"value":1223},"Observers",{"type":44,"value":1225}," - Collect execution feedback (coverage, timing)",{"type":39,"tag":159,"props":1227,"children":1228},{},[1229,1234],{"type":39,"tag":149,"props":1230,"children":1231},{},[1232],{"type":44,"value":1233},"Feedback",{"type":44,"value":1235}," - Determine if inputs are interesting",{"type":39,"tag":159,"props":1237,"children":1238},{},[1239,1244],{"type":39,"tag":149,"props":1240,"children":1241},{},[1242],{"type":44,"value":1243},"Objective",{"type":44,"value":1245}," - Define fuzzing goals (crashes, timeouts)",{"type":39,"tag":159,"props":1247,"children":1248},{},[1249,1254],{"type":39,"tag":149,"props":1250,"children":1251},{},[1252],{"type":44,"value":1253},"State",{"type":44,"value":1255}," - Maintain corpus and metadata",{"type":39,"tag":159,"props":1257,"children":1258},{},[1259,1264],{"type":39,"tag":149,"props":1260,"children":1261},{},[1262],{"type":44,"value":1263},"Mutators",{"type":44,"value":1265}," - Generate new inputs",{"type":39,"tag":159,"props":1267,"children":1268},{},[1269,1274],{"type":39,"tag":149,"props":1270,"children":1271},{},[1272],{"type":44,"value":1273},"Scheduler",{"type":44,"value":1275}," - Select which inputs to mutate",{"type":39,"tag":159,"props":1277,"children":1278},{},[1279,1284],{"type":39,"tag":149,"props":1280,"children":1281},{},[1282],{"type":44,"value":1283},"Executor",{"type":44,"value":1285}," - Run the target with inputs",{"type":39,"tag":395,"props":1287,"children":1289},{"id":1288},"basic-fuzzer-structure",[1290],{"type":44,"value":1291},"Basic Fuzzer Structure",{"type":39,"tag":196,"props":1293,"children":1297},{"className":1294,"code":1295,"language":1296,"meta":201,"style":201},"language-rust shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","use libafl::prelude::*;\nuse libafl_bolts::prelude::*;\nuse libafl_targets::{libfuzzer_test_one_input, std_edges_map_observer};\n\n#[no_mangle]\npub extern \"C\" fn libafl_main() {\n    let mut run_client = |state: Option\u003C_>, mut restarting_mgr, _core_id| {\n        \u002F\u002F 1. Setup observers\n        let edges_observer = HitcountsMapObserver::new(\n            unsafe { std_edges_map_observer(\"edges\") }\n        ).track_indices();\n        let time_observer = TimeObserver::new(\"time\");\n\n        \u002F\u002F 2. Define feedback\n        let mut feedback = feedback_or!(\n            MaxMapFeedback::new(&edges_observer),\n            TimeFeedback::new(&time_observer)\n        );\n\n        \u002F\u002F 3. Define objective\n        let mut objective = feedback_or_fast!(\n            CrashFeedback::new(),\n            TimeoutFeedback::new()\n        );\n\n        \u002F\u002F 4. Create or restore state\n        let mut state = state.unwrap_or_else(|| {\n            StdState::new(\n                StdRand::new(),\n                InMemoryCorpus::new(),\n                OnDiskCorpus::new(&output_dir).unwrap(),\n                &mut feedback,\n                &mut objective,\n            ).unwrap()\n        });\n\n        \u002F\u002F 5. Setup mutator\n        let mutator = StdScheduledMutator::new(havoc_mutations());\n        let mut stages = tuple_list!(StdMutationalStage::new(mutator));\n\n        \u002F\u002F 6. Setup scheduler\n        let scheduler = IndexesLenTimeMinimizerScheduler::new(\n            &edges_observer,\n            QueueScheduler::new()\n        );\n\n        \u002F\u002F 7. Create fuzzer\n        let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);\n\n        \u002F\u002F 8. Define harness\n        let mut harness = |input: &BytesInput| {\n            let buf = input.target_bytes().as_slice();\n            libfuzzer_test_one_input(buf);\n            ExitKind::Ok\n        };\n\n        \u002F\u002F 9. Setup executor\n        let mut executor = InProcessExecutor::with_timeout(\n            &mut harness,\n            tuple_list!(edges_observer, time_observer),\n            &mut fuzzer,\n            &mut state,\n            &mut restarting_mgr,\n            timeout,\n        )?;\n\n        \u002F\u002F 10. Load initial inputs\n        if state.must_load_initial_inputs() {\n            state.load_initial_inputs(\n                &mut fuzzer,\n                &mut executor,\n                &mut restarting_mgr,\n                &input_dir\n            )?;\n        }\n\n        \u002F\u002F 11. Start fuzzing\n        fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut restarting_mgr)?;\n        Ok(())\n    };\n\n    \u002F\u002F Launch fuzzer\n    Launcher::builder()\n        .run_client(&mut run_client)\n        .cores(&cores)\n        .build()\n        .launch()\n        .unwrap();\n}\n","rust",[1298],{"type":39,"tag":204,"props":1299,"children":1300},{"__ignoreMap":201},[1301,1309,1317,1325,1334,1342,1351,1360,1369,1378,1387,1396,1405,1413,1422,1431,1440,1449,1458,1466,1475,1484,1493,1502,1510,1518,1527,1536,1545,1554,1563,1572,1581,1590,1599,1608,1616,1625,1634,1643,1651,1660,1669,1678,1687,1695,1703,1712,1721,1729,1738,1747,1756,1765,1774,1783,1791,1800,1809,1818,1827,1836,1845,1854,1863,1872,1880,1889,1898,1907,1916,1925,1934,1943,1952,1961,1969,1978,1987,1996,2005,2013,2022,2031,2040,2049,2058,2067,2076],{"type":39,"tag":208,"props":1302,"children":1303},{"class":210,"line":211},[1304],{"type":39,"tag":208,"props":1305,"children":1306},{},[1307],{"type":44,"value":1308},"use libafl::prelude::*;\n",{"type":39,"tag":208,"props":1310,"children":1311},{"class":210,"line":220},[1312],{"type":39,"tag":208,"props":1313,"children":1314},{},[1315],{"type":44,"value":1316},"use libafl_bolts::prelude::*;\n",{"type":39,"tag":208,"props":1318,"children":1319},{"class":210,"line":229},[1320],{"type":39,"tag":208,"props":1321,"children":1322},{},[1323],{"type":44,"value":1324},"use libafl_targets::{libfuzzer_test_one_input, std_edges_map_observer};\n",{"type":39,"tag":208,"props":1326,"children":1327},{"class":210,"line":238},[1328],{"type":39,"tag":208,"props":1329,"children":1331},{"emptyLinePlaceholder":1330},true,[1332],{"type":44,"value":1333},"\n",{"type":39,"tag":208,"props":1335,"children":1336},{"class":210,"line":247},[1337],{"type":39,"tag":208,"props":1338,"children":1339},{},[1340],{"type":44,"value":1341},"#[no_mangle]\n",{"type":39,"tag":208,"props":1343,"children":1345},{"class":210,"line":1344},6,[1346],{"type":39,"tag":208,"props":1347,"children":1348},{},[1349],{"type":44,"value":1350},"pub extern \"C\" fn libafl_main() {\n",{"type":39,"tag":208,"props":1352,"children":1354},{"class":210,"line":1353},7,[1355],{"type":39,"tag":208,"props":1356,"children":1357},{},[1358],{"type":44,"value":1359},"    let mut run_client = |state: Option\u003C_>, mut restarting_mgr, _core_id| {\n",{"type":39,"tag":208,"props":1361,"children":1363},{"class":210,"line":1362},8,[1364],{"type":39,"tag":208,"props":1365,"children":1366},{},[1367],{"type":44,"value":1368},"        \u002F\u002F 1. Setup observers\n",{"type":39,"tag":208,"props":1370,"children":1372},{"class":210,"line":1371},9,[1373],{"type":39,"tag":208,"props":1374,"children":1375},{},[1376],{"type":44,"value":1377},"        let edges_observer = HitcountsMapObserver::new(\n",{"type":39,"tag":208,"props":1379,"children":1381},{"class":210,"line":1380},10,[1382],{"type":39,"tag":208,"props":1383,"children":1384},{},[1385],{"type":44,"value":1386},"            unsafe { std_edges_map_observer(\"edges\") }\n",{"type":39,"tag":208,"props":1388,"children":1390},{"class":210,"line":1389},11,[1391],{"type":39,"tag":208,"props":1392,"children":1393},{},[1394],{"type":44,"value":1395},"        ).track_indices();\n",{"type":39,"tag":208,"props":1397,"children":1399},{"class":210,"line":1398},12,[1400],{"type":39,"tag":208,"props":1401,"children":1402},{},[1403],{"type":44,"value":1404},"        let time_observer = TimeObserver::new(\"time\");\n",{"type":39,"tag":208,"props":1406,"children":1408},{"class":210,"line":1407},13,[1409],{"type":39,"tag":208,"props":1410,"children":1411},{"emptyLinePlaceholder":1330},[1412],{"type":44,"value":1333},{"type":39,"tag":208,"props":1414,"children":1416},{"class":210,"line":1415},14,[1417],{"type":39,"tag":208,"props":1418,"children":1419},{},[1420],{"type":44,"value":1421},"        \u002F\u002F 2. Define feedback\n",{"type":39,"tag":208,"props":1423,"children":1425},{"class":210,"line":1424},15,[1426],{"type":39,"tag":208,"props":1427,"children":1428},{},[1429],{"type":44,"value":1430},"        let mut feedback = feedback_or!(\n",{"type":39,"tag":208,"props":1432,"children":1434},{"class":210,"line":1433},16,[1435],{"type":39,"tag":208,"props":1436,"children":1437},{},[1438],{"type":44,"value":1439},"            MaxMapFeedback::new(&edges_observer),\n",{"type":39,"tag":208,"props":1441,"children":1443},{"class":210,"line":1442},17,[1444],{"type":39,"tag":208,"props":1445,"children":1446},{},[1447],{"type":44,"value":1448},"            TimeFeedback::new(&time_observer)\n",{"type":39,"tag":208,"props":1450,"children":1452},{"class":210,"line":1451},18,[1453],{"type":39,"tag":208,"props":1454,"children":1455},{},[1456],{"type":44,"value":1457},"        );\n",{"type":39,"tag":208,"props":1459,"children":1461},{"class":210,"line":1460},19,[1462],{"type":39,"tag":208,"props":1463,"children":1464},{"emptyLinePlaceholder":1330},[1465],{"type":44,"value":1333},{"type":39,"tag":208,"props":1467,"children":1469},{"class":210,"line":1468},20,[1470],{"type":39,"tag":208,"props":1471,"children":1472},{},[1473],{"type":44,"value":1474},"        \u002F\u002F 3. Define objective\n",{"type":39,"tag":208,"props":1476,"children":1478},{"class":210,"line":1477},21,[1479],{"type":39,"tag":208,"props":1480,"children":1481},{},[1482],{"type":44,"value":1483},"        let mut objective = feedback_or_fast!(\n",{"type":39,"tag":208,"props":1485,"children":1487},{"class":210,"line":1486},22,[1488],{"type":39,"tag":208,"props":1489,"children":1490},{},[1491],{"type":44,"value":1492},"            CrashFeedback::new(),\n",{"type":39,"tag":208,"props":1494,"children":1496},{"class":210,"line":1495},23,[1497],{"type":39,"tag":208,"props":1498,"children":1499},{},[1500],{"type":44,"value":1501},"            TimeoutFeedback::new()\n",{"type":39,"tag":208,"props":1503,"children":1505},{"class":210,"line":1504},24,[1506],{"type":39,"tag":208,"props":1507,"children":1508},{},[1509],{"type":44,"value":1457},{"type":39,"tag":208,"props":1511,"children":1513},{"class":210,"line":1512},25,[1514],{"type":39,"tag":208,"props":1515,"children":1516},{"emptyLinePlaceholder":1330},[1517],{"type":44,"value":1333},{"type":39,"tag":208,"props":1519,"children":1521},{"class":210,"line":1520},26,[1522],{"type":39,"tag":208,"props":1523,"children":1524},{},[1525],{"type":44,"value":1526},"        \u002F\u002F 4. Create or restore state\n",{"type":39,"tag":208,"props":1528,"children":1530},{"class":210,"line":1529},27,[1531],{"type":39,"tag":208,"props":1532,"children":1533},{},[1534],{"type":44,"value":1535},"        let mut state = state.unwrap_or_else(|| {\n",{"type":39,"tag":208,"props":1537,"children":1539},{"class":210,"line":1538},28,[1540],{"type":39,"tag":208,"props":1541,"children":1542},{},[1543],{"type":44,"value":1544},"            StdState::new(\n",{"type":39,"tag":208,"props":1546,"children":1548},{"class":210,"line":1547},29,[1549],{"type":39,"tag":208,"props":1550,"children":1551},{},[1552],{"type":44,"value":1553},"                StdRand::new(),\n",{"type":39,"tag":208,"props":1555,"children":1557},{"class":210,"line":1556},30,[1558],{"type":39,"tag":208,"props":1559,"children":1560},{},[1561],{"type":44,"value":1562},"                InMemoryCorpus::new(),\n",{"type":39,"tag":208,"props":1564,"children":1566},{"class":210,"line":1565},31,[1567],{"type":39,"tag":208,"props":1568,"children":1569},{},[1570],{"type":44,"value":1571},"                OnDiskCorpus::new(&output_dir).unwrap(),\n",{"type":39,"tag":208,"props":1573,"children":1575},{"class":210,"line":1574},32,[1576],{"type":39,"tag":208,"props":1577,"children":1578},{},[1579],{"type":44,"value":1580},"                &mut feedback,\n",{"type":39,"tag":208,"props":1582,"children":1584},{"class":210,"line":1583},33,[1585],{"type":39,"tag":208,"props":1586,"children":1587},{},[1588],{"type":44,"value":1589},"                &mut objective,\n",{"type":39,"tag":208,"props":1591,"children":1593},{"class":210,"line":1592},34,[1594],{"type":39,"tag":208,"props":1595,"children":1596},{},[1597],{"type":44,"value":1598},"            ).unwrap()\n",{"type":39,"tag":208,"props":1600,"children":1602},{"class":210,"line":1601},35,[1603],{"type":39,"tag":208,"props":1604,"children":1605},{},[1606],{"type":44,"value":1607},"        });\n",{"type":39,"tag":208,"props":1609,"children":1611},{"class":210,"line":1610},36,[1612],{"type":39,"tag":208,"props":1613,"children":1614},{"emptyLinePlaceholder":1330},[1615],{"type":44,"value":1333},{"type":39,"tag":208,"props":1617,"children":1619},{"class":210,"line":1618},37,[1620],{"type":39,"tag":208,"props":1621,"children":1622},{},[1623],{"type":44,"value":1624},"        \u002F\u002F 5. Setup mutator\n",{"type":39,"tag":208,"props":1626,"children":1628},{"class":210,"line":1627},38,[1629],{"type":39,"tag":208,"props":1630,"children":1631},{},[1632],{"type":44,"value":1633},"        let mutator = StdScheduledMutator::new(havoc_mutations());\n",{"type":39,"tag":208,"props":1635,"children":1637},{"class":210,"line":1636},39,[1638],{"type":39,"tag":208,"props":1639,"children":1640},{},[1641],{"type":44,"value":1642},"        let mut stages = tuple_list!(StdMutationalStage::new(mutator));\n",{"type":39,"tag":208,"props":1644,"children":1646},{"class":210,"line":1645},40,[1647],{"type":39,"tag":208,"props":1648,"children":1649},{"emptyLinePlaceholder":1330},[1650],{"type":44,"value":1333},{"type":39,"tag":208,"props":1652,"children":1654},{"class":210,"line":1653},41,[1655],{"type":39,"tag":208,"props":1656,"children":1657},{},[1658],{"type":44,"value":1659},"        \u002F\u002F 6. Setup scheduler\n",{"type":39,"tag":208,"props":1661,"children":1663},{"class":210,"line":1662},42,[1664],{"type":39,"tag":208,"props":1665,"children":1666},{},[1667],{"type":44,"value":1668},"        let scheduler = IndexesLenTimeMinimizerScheduler::new(\n",{"type":39,"tag":208,"props":1670,"children":1672},{"class":210,"line":1671},43,[1673],{"type":39,"tag":208,"props":1674,"children":1675},{},[1676],{"type":44,"value":1677},"            &edges_observer,\n",{"type":39,"tag":208,"props":1679,"children":1681},{"class":210,"line":1680},44,[1682],{"type":39,"tag":208,"props":1683,"children":1684},{},[1685],{"type":44,"value":1686},"            QueueScheduler::new()\n",{"type":39,"tag":208,"props":1688,"children":1690},{"class":210,"line":1689},45,[1691],{"type":39,"tag":208,"props":1692,"children":1693},{},[1694],{"type":44,"value":1457},{"type":39,"tag":208,"props":1696,"children":1698},{"class":210,"line":1697},46,[1699],{"type":39,"tag":208,"props":1700,"children":1701},{"emptyLinePlaceholder":1330},[1702],{"type":44,"value":1333},{"type":39,"tag":208,"props":1704,"children":1706},{"class":210,"line":1705},47,[1707],{"type":39,"tag":208,"props":1708,"children":1709},{},[1710],{"type":44,"value":1711},"        \u002F\u002F 7. Create fuzzer\n",{"type":39,"tag":208,"props":1713,"children":1715},{"class":210,"line":1714},48,[1716],{"type":39,"tag":208,"props":1717,"children":1718},{},[1719],{"type":44,"value":1720},"        let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);\n",{"type":39,"tag":208,"props":1722,"children":1724},{"class":210,"line":1723},49,[1725],{"type":39,"tag":208,"props":1726,"children":1727},{"emptyLinePlaceholder":1330},[1728],{"type":44,"value":1333},{"type":39,"tag":208,"props":1730,"children":1732},{"class":210,"line":1731},50,[1733],{"type":39,"tag":208,"props":1734,"children":1735},{},[1736],{"type":44,"value":1737},"        \u002F\u002F 8. Define harness\n",{"type":39,"tag":208,"props":1739,"children":1741},{"class":210,"line":1740},51,[1742],{"type":39,"tag":208,"props":1743,"children":1744},{},[1745],{"type":44,"value":1746},"        let mut harness = |input: &BytesInput| {\n",{"type":39,"tag":208,"props":1748,"children":1750},{"class":210,"line":1749},52,[1751],{"type":39,"tag":208,"props":1752,"children":1753},{},[1754],{"type":44,"value":1755},"            let buf = input.target_bytes().as_slice();\n",{"type":39,"tag":208,"props":1757,"children":1759},{"class":210,"line":1758},53,[1760],{"type":39,"tag":208,"props":1761,"children":1762},{},[1763],{"type":44,"value":1764},"            libfuzzer_test_one_input(buf);\n",{"type":39,"tag":208,"props":1766,"children":1768},{"class":210,"line":1767},54,[1769],{"type":39,"tag":208,"props":1770,"children":1771},{},[1772],{"type":44,"value":1773},"            ExitKind::Ok\n",{"type":39,"tag":208,"props":1775,"children":1777},{"class":210,"line":1776},55,[1778],{"type":39,"tag":208,"props":1779,"children":1780},{},[1781],{"type":44,"value":1782},"        };\n",{"type":39,"tag":208,"props":1784,"children":1786},{"class":210,"line":1785},56,[1787],{"type":39,"tag":208,"props":1788,"children":1789},{"emptyLinePlaceholder":1330},[1790],{"type":44,"value":1333},{"type":39,"tag":208,"props":1792,"children":1794},{"class":210,"line":1793},57,[1795],{"type":39,"tag":208,"props":1796,"children":1797},{},[1798],{"type":44,"value":1799},"        \u002F\u002F 9. Setup executor\n",{"type":39,"tag":208,"props":1801,"children":1803},{"class":210,"line":1802},58,[1804],{"type":39,"tag":208,"props":1805,"children":1806},{},[1807],{"type":44,"value":1808},"        let mut executor = InProcessExecutor::with_timeout(\n",{"type":39,"tag":208,"props":1810,"children":1812},{"class":210,"line":1811},59,[1813],{"type":39,"tag":208,"props":1814,"children":1815},{},[1816],{"type":44,"value":1817},"            &mut harness,\n",{"type":39,"tag":208,"props":1819,"children":1821},{"class":210,"line":1820},60,[1822],{"type":39,"tag":208,"props":1823,"children":1824},{},[1825],{"type":44,"value":1826},"            tuple_list!(edges_observer, time_observer),\n",{"type":39,"tag":208,"props":1828,"children":1830},{"class":210,"line":1829},61,[1831],{"type":39,"tag":208,"props":1832,"children":1833},{},[1834],{"type":44,"value":1835},"            &mut fuzzer,\n",{"type":39,"tag":208,"props":1837,"children":1839},{"class":210,"line":1838},62,[1840],{"type":39,"tag":208,"props":1841,"children":1842},{},[1843],{"type":44,"value":1844},"            &mut state,\n",{"type":39,"tag":208,"props":1846,"children":1848},{"class":210,"line":1847},63,[1849],{"type":39,"tag":208,"props":1850,"children":1851},{},[1852],{"type":44,"value":1853},"            &mut restarting_mgr,\n",{"type":39,"tag":208,"props":1855,"children":1857},{"class":210,"line":1856},64,[1858],{"type":39,"tag":208,"props":1859,"children":1860},{},[1861],{"type":44,"value":1862},"            timeout,\n",{"type":39,"tag":208,"props":1864,"children":1866},{"class":210,"line":1865},65,[1867],{"type":39,"tag":208,"props":1868,"children":1869},{},[1870],{"type":44,"value":1871},"        )?;\n",{"type":39,"tag":208,"props":1873,"children":1875},{"class":210,"line":1874},66,[1876],{"type":39,"tag":208,"props":1877,"children":1878},{"emptyLinePlaceholder":1330},[1879],{"type":44,"value":1333},{"type":39,"tag":208,"props":1881,"children":1883},{"class":210,"line":1882},67,[1884],{"type":39,"tag":208,"props":1885,"children":1886},{},[1887],{"type":44,"value":1888},"        \u002F\u002F 10. Load initial inputs\n",{"type":39,"tag":208,"props":1890,"children":1892},{"class":210,"line":1891},68,[1893],{"type":39,"tag":208,"props":1894,"children":1895},{},[1896],{"type":44,"value":1897},"        if state.must_load_initial_inputs() {\n",{"type":39,"tag":208,"props":1899,"children":1901},{"class":210,"line":1900},69,[1902],{"type":39,"tag":208,"props":1903,"children":1904},{},[1905],{"type":44,"value":1906},"            state.load_initial_inputs(\n",{"type":39,"tag":208,"props":1908,"children":1910},{"class":210,"line":1909},70,[1911],{"type":39,"tag":208,"props":1912,"children":1913},{},[1914],{"type":44,"value":1915},"                &mut fuzzer,\n",{"type":39,"tag":208,"props":1917,"children":1919},{"class":210,"line":1918},71,[1920],{"type":39,"tag":208,"props":1921,"children":1922},{},[1923],{"type":44,"value":1924},"                &mut executor,\n",{"type":39,"tag":208,"props":1926,"children":1928},{"class":210,"line":1927},72,[1929],{"type":39,"tag":208,"props":1930,"children":1931},{},[1932],{"type":44,"value":1933},"                &mut restarting_mgr,\n",{"type":39,"tag":208,"props":1935,"children":1937},{"class":210,"line":1936},73,[1938],{"type":39,"tag":208,"props":1939,"children":1940},{},[1941],{"type":44,"value":1942},"                &input_dir\n",{"type":39,"tag":208,"props":1944,"children":1946},{"class":210,"line":1945},74,[1947],{"type":39,"tag":208,"props":1948,"children":1949},{},[1950],{"type":44,"value":1951},"            )?;\n",{"type":39,"tag":208,"props":1953,"children":1955},{"class":210,"line":1954},75,[1956],{"type":39,"tag":208,"props":1957,"children":1958},{},[1959],{"type":44,"value":1960},"        }\n",{"type":39,"tag":208,"props":1962,"children":1964},{"class":210,"line":1963},76,[1965],{"type":39,"tag":208,"props":1966,"children":1967},{"emptyLinePlaceholder":1330},[1968],{"type":44,"value":1333},{"type":39,"tag":208,"props":1970,"children":1972},{"class":210,"line":1971},77,[1973],{"type":39,"tag":208,"props":1974,"children":1975},{},[1976],{"type":44,"value":1977},"        \u002F\u002F 11. Start fuzzing\n",{"type":39,"tag":208,"props":1979,"children":1981},{"class":210,"line":1980},78,[1982],{"type":39,"tag":208,"props":1983,"children":1984},{},[1985],{"type":44,"value":1986},"        fuzzer.fuzz_loop(&mut stages, &mut executor, &mut state, &mut restarting_mgr)?;\n",{"type":39,"tag":208,"props":1988,"children":1990},{"class":210,"line":1989},79,[1991],{"type":39,"tag":208,"props":1992,"children":1993},{},[1994],{"type":44,"value":1995},"        Ok(())\n",{"type":39,"tag":208,"props":1997,"children":1999},{"class":210,"line":1998},80,[2000],{"type":39,"tag":208,"props":2001,"children":2002},{},[2003],{"type":44,"value":2004},"    };\n",{"type":39,"tag":208,"props":2006,"children":2008},{"class":210,"line":2007},81,[2009],{"type":39,"tag":208,"props":2010,"children":2011},{"emptyLinePlaceholder":1330},[2012],{"type":44,"value":1333},{"type":39,"tag":208,"props":2014,"children":2016},{"class":210,"line":2015},82,[2017],{"type":39,"tag":208,"props":2018,"children":2019},{},[2020],{"type":44,"value":2021},"    \u002F\u002F Launch fuzzer\n",{"type":39,"tag":208,"props":2023,"children":2025},{"class":210,"line":2024},83,[2026],{"type":39,"tag":208,"props":2027,"children":2028},{},[2029],{"type":44,"value":2030},"    Launcher::builder()\n",{"type":39,"tag":208,"props":2032,"children":2034},{"class":210,"line":2033},84,[2035],{"type":39,"tag":208,"props":2036,"children":2037},{},[2038],{"type":44,"value":2039},"        .run_client(&mut run_client)\n",{"type":39,"tag":208,"props":2041,"children":2043},{"class":210,"line":2042},85,[2044],{"type":39,"tag":208,"props":2045,"children":2046},{},[2047],{"type":44,"value":2048},"        .cores(&cores)\n",{"type":39,"tag":208,"props":2050,"children":2052},{"class":210,"line":2051},86,[2053],{"type":39,"tag":208,"props":2054,"children":2055},{},[2056],{"type":44,"value":2057},"        .build()\n",{"type":39,"tag":208,"props":2059,"children":2061},{"class":210,"line":2060},87,[2062],{"type":39,"tag":208,"props":2063,"children":2064},{},[2065],{"type":44,"value":2066},"        .launch()\n",{"type":39,"tag":208,"props":2068,"children":2070},{"class":210,"line":2069},88,[2071],{"type":39,"tag":208,"props":2072,"children":2073},{},[2074],{"type":44,"value":2075},"        .unwrap();\n",{"type":39,"tag":208,"props":2077,"children":2079},{"class":210,"line":2078},89,[2080],{"type":39,"tag":208,"props":2081,"children":2082},{},[2083],{"type":44,"value":253},{"type":39,"tag":53,"props":2085,"children":2087},{"id":2086},"compilation",[2088],{"type":44,"value":2089},"Compilation",{"type":39,"tag":395,"props":2091,"children":2093},{"id":2092},"verbose-mode",[2094],{"type":44,"value":2095},"Verbose Mode",{"type":39,"tag":47,"props":2097,"children":2098},{},[2099],{"type":44,"value":2100},"Manually specify all instrumentation flags:",{"type":39,"tag":196,"props":2102,"children":2104},{"className":261,"code":2103,"language":263,"meta":201,"style":201},"clang++-15 -DNO_MAIN -g -O2 \\\n  -fsanitize-coverage=trace-pc-guard \\\n  -fsanitize=address \\\n  -Wl,--whole-archive target\u002Frelease\u002Flibmy_fuzzer.a -Wl,--no-whole-archive \\\n  main.cc harness.cc -o fuzz\n",[2105],{"type":39,"tag":204,"props":2106,"children":2107},{"__ignoreMap":201},[2108,2131,2143,2155,2177],{"type":39,"tag":208,"props":2109,"children":2110},{"class":210,"line":211},[2111,2115,2119,2123,2127],{"type":39,"tag":208,"props":2112,"children":2113},{"style":273},[2114],{"type":44,"value":618},{"type":39,"tag":208,"props":2116,"children":2117},{"style":279},[2118],{"type":44,"value":334},{"type":39,"tag":208,"props":2120,"children":2121},{"style":279},[2122],{"type":44,"value":339},{"type":39,"tag":208,"props":2124,"children":2125},{"style":279},[2126],{"type":44,"value":344},{"type":39,"tag":208,"props":2128,"children":2129},{"style":540},[2130],{"type":44,"value":1121},{"type":39,"tag":208,"props":2132,"children":2133},{"class":210,"line":220},[2134,2139],{"type":39,"tag":208,"props":2135,"children":2136},{"style":279},[2137],{"type":44,"value":2138},"  -fsanitize-coverage=trace-pc-guard",{"type":39,"tag":208,"props":2140,"children":2141},{"style":540},[2142],{"type":44,"value":1121},{"type":39,"tag":208,"props":2144,"children":2145},{"class":210,"line":229},[2146,2151],{"type":39,"tag":208,"props":2147,"children":2148},{"style":279},[2149],{"type":44,"value":2150},"  -fsanitize=address",{"type":39,"tag":208,"props":2152,"children":2153},{"style":540},[2154],{"type":44,"value":1121},{"type":39,"tag":208,"props":2156,"children":2157},{"class":210,"line":238},[2158,2163,2168,2173],{"type":39,"tag":208,"props":2159,"children":2160},{"style":279},[2161],{"type":44,"value":2162},"  -Wl,--whole-archive",{"type":39,"tag":208,"props":2164,"children":2165},{"style":279},[2166],{"type":44,"value":2167}," target\u002Frelease\u002Flibmy_fuzzer.a",{"type":39,"tag":208,"props":2169,"children":2170},{"style":279},[2171],{"type":44,"value":2172}," -Wl,--no-whole-archive",{"type":39,"tag":208,"props":2174,"children":2175},{"style":540},[2176],{"type":44,"value":1121},{"type":39,"tag":208,"props":2178,"children":2179},{"class":210,"line":247},[2180,2185,2189,2193],{"type":39,"tag":208,"props":2181,"children":2182},{"style":279},[2183],{"type":44,"value":2184},"  main.cc",{"type":39,"tag":208,"props":2186,"children":2187},{"style":279},[2188],{"type":44,"value":359},{"type":39,"tag":208,"props":2190,"children":2191},{"style":279},[2192],{"type":44,"value":369},{"type":39,"tag":208,"props":2194,"children":2195},{"style":279},[2196],{"type":44,"value":374},{"type":39,"tag":395,"props":2198,"children":2200},{"id":2199},"compiler-wrapper-recommended",[2201],{"type":44,"value":2202},"Compiler Wrapper (Recommended)",{"type":39,"tag":47,"props":2204,"children":2205},{},[2206],{"type":44,"value":2207},"Create a LibAFL compiler wrapper to handle instrumentation automatically.",{"type":39,"tag":47,"props":2209,"children":2210},{},[2211],{"type":39,"tag":149,"props":2212,"children":2213},{},[2214,2216,2222],{"type":44,"value":2215},"Create ",{"type":39,"tag":204,"props":2217,"children":2219},{"className":2218},[],[2220],{"type":44,"value":2221},"src\u002Fbin\u002Flibafl_cc.rs",{"type":44,"value":2223},":",{"type":39,"tag":196,"props":2225,"children":2227},{"className":1294,"code":2226,"language":1296,"meta":201,"style":201},"use libafl_cc::{ClangWrapper, CompilerWrapper, Configuration, ToolWrapper};\n\npub fn main() {\n    let args: Vec\u003CString> = env::args().collect();\n    let mut cc = ClangWrapper::new();\n    cc.cpp(is_cpp)\n      .parse_args(&args)\n      .link_staticlib(&dir, \"my_fuzzer\")\n      .add_args(&Configuration::GenerateCoverageMap.to_flags().unwrap())\n      .add_args(&Configuration::AddressSanitizer.to_flags().unwrap())\n      .run()\n      .unwrap();\n}\n",[2228],{"type":39,"tag":204,"props":2229,"children":2230},{"__ignoreMap":201},[2231,2239,2246,2254,2262,2270,2278,2286,2294,2302,2310,2318,2326],{"type":39,"tag":208,"props":2232,"children":2233},{"class":210,"line":211},[2234],{"type":39,"tag":208,"props":2235,"children":2236},{},[2237],{"type":44,"value":2238},"use libafl_cc::{ClangWrapper, CompilerWrapper, Configuration, ToolWrapper};\n",{"type":39,"tag":208,"props":2240,"children":2241},{"class":210,"line":220},[2242],{"type":39,"tag":208,"props":2243,"children":2244},{"emptyLinePlaceholder":1330},[2245],{"type":44,"value":1333},{"type":39,"tag":208,"props":2247,"children":2248},{"class":210,"line":229},[2249],{"type":39,"tag":208,"props":2250,"children":2251},{},[2252],{"type":44,"value":2253},"pub fn main() {\n",{"type":39,"tag":208,"props":2255,"children":2256},{"class":210,"line":238},[2257],{"type":39,"tag":208,"props":2258,"children":2259},{},[2260],{"type":44,"value":2261},"    let args: Vec\u003CString> = env::args().collect();\n",{"type":39,"tag":208,"props":2263,"children":2264},{"class":210,"line":247},[2265],{"type":39,"tag":208,"props":2266,"children":2267},{},[2268],{"type":44,"value":2269},"    let mut cc = ClangWrapper::new();\n",{"type":39,"tag":208,"props":2271,"children":2272},{"class":210,"line":1344},[2273],{"type":39,"tag":208,"props":2274,"children":2275},{},[2276],{"type":44,"value":2277},"    cc.cpp(is_cpp)\n",{"type":39,"tag":208,"props":2279,"children":2280},{"class":210,"line":1353},[2281],{"type":39,"tag":208,"props":2282,"children":2283},{},[2284],{"type":44,"value":2285},"      .parse_args(&args)\n",{"type":39,"tag":208,"props":2287,"children":2288},{"class":210,"line":1362},[2289],{"type":39,"tag":208,"props":2290,"children":2291},{},[2292],{"type":44,"value":2293},"      .link_staticlib(&dir, \"my_fuzzer\")\n",{"type":39,"tag":208,"props":2295,"children":2296},{"class":210,"line":1371},[2297],{"type":39,"tag":208,"props":2298,"children":2299},{},[2300],{"type":44,"value":2301},"      .add_args(&Configuration::GenerateCoverageMap.to_flags().unwrap())\n",{"type":39,"tag":208,"props":2303,"children":2304},{"class":210,"line":1380},[2305],{"type":39,"tag":208,"props":2306,"children":2307},{},[2308],{"type":44,"value":2309},"      .add_args(&Configuration::AddressSanitizer.to_flags().unwrap())\n",{"type":39,"tag":208,"props":2311,"children":2312},{"class":210,"line":1389},[2313],{"type":39,"tag":208,"props":2314,"children":2315},{},[2316],{"type":44,"value":2317},"      .run()\n",{"type":39,"tag":208,"props":2319,"children":2320},{"class":210,"line":1398},[2321],{"type":39,"tag":208,"props":2322,"children":2323},{},[2324],{"type":44,"value":2325},"      .unwrap();\n",{"type":39,"tag":208,"props":2327,"children":2328},{"class":210,"line":1407},[2329],{"type":39,"tag":208,"props":2330,"children":2331},{},[2332],{"type":44,"value":253},{"type":39,"tag":47,"props":2334,"children":2335},{},[2336],{"type":39,"tag":149,"props":2337,"children":2338},{},[2339],{"type":44,"value":2340},"Compile and use:",{"type":39,"tag":196,"props":2342,"children":2344},{"className":261,"code":2343,"language":263,"meta":201,"style":201},"cargo build --release\ntarget\u002Frelease\u002Flibafl_cxx -DNO_MAIN -g -O2 main.cc harness.cc -o fuzz\n",[2345],{"type":39,"tag":204,"props":2346,"children":2347},{"__ignoreMap":201},[2348,2365],{"type":39,"tag":208,"props":2349,"children":2350},{"class":210,"line":211},[2351,2355,2360],{"type":39,"tag":208,"props":2352,"children":2353},{"style":273},[2354],{"type":44,"value":1058},{"type":39,"tag":208,"props":2356,"children":2357},{"style":279},[2358],{"type":44,"value":2359}," build",{"type":39,"tag":208,"props":2361,"children":2362},{"style":279},[2363],{"type":44,"value":2364}," --release\n",{"type":39,"tag":208,"props":2366,"children":2367},{"class":210,"line":220},[2368,2373,2377,2381,2385,2389,2393,2397],{"type":39,"tag":208,"props":2369,"children":2370},{"style":273},[2371],{"type":44,"value":2372},"target\u002Frelease\u002Flibafl_cxx",{"type":39,"tag":208,"props":2374,"children":2375},{"style":279},[2376],{"type":44,"value":334},{"type":39,"tag":208,"props":2378,"children":2379},{"style":279},[2380],{"type":44,"value":339},{"type":39,"tag":208,"props":2382,"children":2383},{"style":279},[2384],{"type":44,"value":344},{"type":39,"tag":208,"props":2386,"children":2387},{"style":279},[2388],{"type":44,"value":364},{"type":39,"tag":208,"props":2390,"children":2391},{"style":279},[2392],{"type":44,"value":359},{"type":39,"tag":208,"props":2394,"children":2395},{"style":279},[2396],{"type":44,"value":369},{"type":39,"tag":208,"props":2398,"children":2399},{"style":279},[2400],{"type":44,"value":374},{"type":39,"tag":863,"props":2402,"children":2403},{},[2404],{"type":39,"tag":47,"props":2405,"children":2406},{},[2407,2411,2413,2418,2420,2425],{"type":39,"tag":149,"props":2408,"children":2409},{},[2410],{"type":44,"value":873},{"type":44,"value":2412}," For detailed sanitizer configuration, common issues, and advanced flags,\nsee the ",{"type":39,"tag":149,"props":2414,"children":2415},{},[2416],{"type":44,"value":2417},"address-sanitizer",{"type":44,"value":2419}," and ",{"type":39,"tag":149,"props":2421,"children":2422},{},[2423],{"type":44,"value":2424},"undefined-behavior-sanitizer",{"type":44,"value":2426}," technique skills.",{"type":39,"tag":53,"props":2428,"children":2430},{"id":2429},"running-campaigns",[2431],{"type":44,"value":2432},"Running Campaigns",{"type":39,"tag":395,"props":2434,"children":2436},{"id":2435},"basic-run",[2437],{"type":44,"value":2438},"Basic Run",{"type":39,"tag":196,"props":2440,"children":2442},{"className":261,"code":2441,"language":263,"meta":201,"style":201},".\u002Ffuzz --cores 0 --input corpus\u002F\n",[2443],{"type":39,"tag":204,"props":2444,"children":2445},{"__ignoreMap":201},[2446],{"type":39,"tag":208,"props":2447,"children":2448},{"class":210,"line":211},[2449,2453,2458,2463,2468],{"type":39,"tag":208,"props":2450,"children":2451},{"style":273},[2452],{"type":44,"value":382},{"type":39,"tag":208,"props":2454,"children":2455},{"style":279},[2456],{"type":44,"value":2457}," --cores",{"type":39,"tag":208,"props":2459,"children":2460},{"style":513},[2461],{"type":44,"value":2462}," 0",{"type":39,"tag":208,"props":2464,"children":2465},{"style":279},[2466],{"type":44,"value":2467}," --input",{"type":39,"tag":208,"props":2469,"children":2470},{"style":279},[2471],{"type":44,"value":387},{"type":39,"tag":395,"props":2473,"children":2475},{"id":2474},"multi-core-fuzzing",[2476],{"type":44,"value":2477},"Multi-Core Fuzzing",{"type":39,"tag":196,"props":2479,"children":2481},{"className":261,"code":2480,"language":263,"meta":201,"style":201},".\u002Ffuzz --cores 0,8-15 --input corpus\u002F\n",[2482],{"type":39,"tag":204,"props":2483,"children":2484},{"__ignoreMap":201},[2485],{"type":39,"tag":208,"props":2486,"children":2487},{"class":210,"line":211},[2488,2492,2496,2501,2505],{"type":39,"tag":208,"props":2489,"children":2490},{"style":273},[2491],{"type":44,"value":382},{"type":39,"tag":208,"props":2493,"children":2494},{"style":279},[2495],{"type":44,"value":2457},{"type":39,"tag":208,"props":2497,"children":2498},{"style":279},[2499],{"type":44,"value":2500}," 0,8-15",{"type":39,"tag":208,"props":2502,"children":2503},{"style":279},[2504],{"type":44,"value":2467},{"type":39,"tag":208,"props":2506,"children":2507},{"style":279},[2508],{"type":44,"value":387},{"type":39,"tag":47,"props":2510,"children":2511},{},[2512],{"type":44,"value":2513},"This runs 9 clients: one on core 0, and 8 on cores 8-15.",{"type":39,"tag":395,"props":2515,"children":2517},{"id":2516},"with-options",[2518],{"type":44,"value":2519},"With Options",{"type":39,"tag":196,"props":2521,"children":2523},{"className":261,"code":2522,"language":263,"meta":201,"style":201},".\u002Ffuzz --cores 0-7 --input corpus\u002F --output crashes\u002F --timeout 1000\n",[2524],{"type":39,"tag":204,"props":2525,"children":2526},{"__ignoreMap":201},[2527],{"type":39,"tag":208,"props":2528,"children":2529},{"class":210,"line":211},[2530,2534,2538,2543,2547,2552,2557,2562,2567],{"type":39,"tag":208,"props":2531,"children":2532},{"style":273},[2533],{"type":44,"value":382},{"type":39,"tag":208,"props":2535,"children":2536},{"style":279},[2537],{"type":44,"value":2457},{"type":39,"tag":208,"props":2539,"children":2540},{"style":279},[2541],{"type":44,"value":2542}," 0-7",{"type":39,"tag":208,"props":2544,"children":2545},{"style":279},[2546],{"type":44,"value":2467},{"type":39,"tag":208,"props":2548,"children":2549},{"style":279},[2550],{"type":44,"value":2551}," corpus\u002F",{"type":39,"tag":208,"props":2553,"children":2554},{"style":279},[2555],{"type":44,"value":2556}," --output",{"type":39,"tag":208,"props":2558,"children":2559},{"style":279},[2560],{"type":44,"value":2561}," crashes\u002F",{"type":39,"tag":208,"props":2563,"children":2564},{"style":279},[2565],{"type":44,"value":2566}," --timeout",{"type":39,"tag":208,"props":2568,"children":2569},{"style":513},[2570],{"type":44,"value":2571}," 1000\n",{"type":39,"tag":395,"props":2573,"children":2575},{"id":2574},"text-user-interface-tui",[2576],{"type":44,"value":2577},"Text User Interface (TUI)",{"type":39,"tag":47,"props":2579,"children":2580},{},[2581],{"type":44,"value":2582},"Enable graphical statistics view:",{"type":39,"tag":196,"props":2584,"children":2586},{"className":261,"code":2585,"language":263,"meta":201,"style":201},".\u002Ffuzz -tui=1 corpus\u002F\n",[2587],{"type":39,"tag":204,"props":2588,"children":2589},{"__ignoreMap":201},[2590],{"type":39,"tag":208,"props":2591,"children":2592},{"class":210,"line":211},[2593,2597,2602],{"type":39,"tag":208,"props":2594,"children":2595},{"style":273},[2596],{"type":44,"value":382},{"type":39,"tag":208,"props":2598,"children":2599},{"style":279},[2600],{"type":44,"value":2601}," -tui=1",{"type":39,"tag":208,"props":2603,"children":2604},{"style":279},[2605],{"type":44,"value":387},{"type":39,"tag":395,"props":2607,"children":2609},{"id":2608},"interpreting-output",[2610],{"type":44,"value":2611},"Interpreting Output",{"type":39,"tag":60,"props":2613,"children":2614},{},[2615,2631],{"type":39,"tag":64,"props":2616,"children":2617},{},[2618],{"type":39,"tag":68,"props":2619,"children":2620},{},[2621,2626],{"type":39,"tag":72,"props":2622,"children":2623},{},[2624],{"type":44,"value":2625},"Output",{"type":39,"tag":72,"props":2627,"children":2628},{},[2629],{"type":44,"value":2630},"Meaning",{"type":39,"tag":88,"props":2632,"children":2633},{},[2634,2651,2668,2685,2702,2719],{"type":39,"tag":68,"props":2635,"children":2636},{},[2637,2646],{"type":39,"tag":95,"props":2638,"children":2639},{},[2640],{"type":39,"tag":204,"props":2641,"children":2643},{"className":2642},[],[2644],{"type":44,"value":2645},"corpus: N",{"type":39,"tag":95,"props":2647,"children":2648},{},[2649],{"type":44,"value":2650},"Number of interesting test cases found",{"type":39,"tag":68,"props":2652,"children":2653},{},[2654,2663],{"type":39,"tag":95,"props":2655,"children":2656},{},[2657],{"type":39,"tag":204,"props":2658,"children":2660},{"className":2659},[],[2661],{"type":44,"value":2662},"objectives: N",{"type":39,"tag":95,"props":2664,"children":2665},{},[2666],{"type":44,"value":2667},"Number of crashes\u002Ftimeouts found",{"type":39,"tag":68,"props":2669,"children":2670},{},[2671,2680],{"type":39,"tag":95,"props":2672,"children":2673},{},[2674],{"type":39,"tag":204,"props":2675,"children":2677},{"className":2676},[],[2678],{"type":44,"value":2679},"executions: N",{"type":39,"tag":95,"props":2681,"children":2682},{},[2683],{"type":44,"value":2684},"Total number of target invocations",{"type":39,"tag":68,"props":2686,"children":2687},{},[2688,2697],{"type":39,"tag":95,"props":2689,"children":2690},{},[2691],{"type":39,"tag":204,"props":2692,"children":2694},{"className":2693},[],[2695],{"type":44,"value":2696},"exec\u002Fsec: N",{"type":39,"tag":95,"props":2698,"children":2699},{},[2700],{"type":44,"value":2701},"Current execution throughput",{"type":39,"tag":68,"props":2703,"children":2704},{},[2705,2714],{"type":39,"tag":95,"props":2706,"children":2707},{},[2708],{"type":39,"tag":204,"props":2709,"children":2711},{"className":2710},[],[2712],{"type":44,"value":2713},"edges: X%",{"type":39,"tag":95,"props":2715,"children":2716},{},[2717],{"type":44,"value":2718},"Code coverage percentage",{"type":39,"tag":68,"props":2720,"children":2721},{},[2722,2731],{"type":39,"tag":95,"props":2723,"children":2724},{},[2725],{"type":39,"tag":204,"props":2726,"children":2728},{"className":2727},[],[2729],{"type":44,"value":2730},"clients: N",{"type":39,"tag":95,"props":2732,"children":2733},{},[2734],{"type":44,"value":2735},"Number of parallel fuzzing processes",{"type":39,"tag":47,"props":2737,"children":2738},{},[2739],{"type":44,"value":2740},"The fuzzer emits two main event types:",{"type":39,"tag":155,"props":2742,"children":2743},{},[2744,2754],{"type":39,"tag":159,"props":2745,"children":2746},{},[2747,2752],{"type":39,"tag":149,"props":2748,"children":2749},{},[2750],{"type":44,"value":2751},"UserStats",{"type":44,"value":2753}," - Regular heartbeat with current statistics",{"type":39,"tag":159,"props":2755,"children":2756},{},[2757,2762],{"type":39,"tag":149,"props":2758,"children":2759},{},[2760],{"type":44,"value":2761},"Testcase",{"type":44,"value":2763}," - New interesting input discovered",{"type":39,"tag":53,"props":2765,"children":2767},{"id":2766},"advanced-usage",[2768],{"type":44,"value":2769},"Advanced Usage",{"type":39,"tag":395,"props":2771,"children":2773},{"id":2772},"tips-and-tricks",[2774],{"type":44,"value":2775},"Tips and Tricks",{"type":39,"tag":60,"props":2777,"children":2778},{},[2779,2795],{"type":39,"tag":64,"props":2780,"children":2781},{},[2782],{"type":39,"tag":68,"props":2783,"children":2784},{},[2785,2790],{"type":39,"tag":72,"props":2786,"children":2787},{},[2788],{"type":44,"value":2789},"Tip",{"type":39,"tag":72,"props":2791,"children":2792},{},[2793],{"type":44,"value":2794},"Why It Helps",{"type":39,"tag":88,"props":2796,"children":2797},{},[2798,2817,2835,2854,2867],{"type":39,"tag":68,"props":2799,"children":2800},{},[2801,2812],{"type":39,"tag":95,"props":2802,"children":2803},{},[2804,2806],{"type":44,"value":2805},"Use ",{"type":39,"tag":204,"props":2807,"children":2809},{"className":2808},[],[2810],{"type":44,"value":2811},"-fork=1 -ignore_crashes=1",{"type":39,"tag":95,"props":2813,"children":2814},{},[2815],{"type":44,"value":2816},"Continue fuzzing after first crash",{"type":39,"tag":68,"props":2818,"children":2819},{},[2820,2830],{"type":39,"tag":95,"props":2821,"children":2822},{},[2823,2824],{"type":44,"value":2805},{"type":39,"tag":204,"props":2825,"children":2827},{"className":2826},[],[2828],{"type":44,"value":2829},"InMemoryOnDiskCorpus",{"type":39,"tag":95,"props":2831,"children":2832},{},[2833],{"type":44,"value":2834},"Persist corpus across restarts",{"type":39,"tag":68,"props":2836,"children":2837},{},[2838,2849],{"type":39,"tag":95,"props":2839,"children":2840},{},[2841,2843],{"type":44,"value":2842},"Enable TUI with ",{"type":39,"tag":204,"props":2844,"children":2846},{"className":2845},[],[2847],{"type":44,"value":2848},"-tui=1",{"type":39,"tag":95,"props":2850,"children":2851},{},[2852],{"type":44,"value":2853},"Better visualization of progress",{"type":39,"tag":68,"props":2855,"children":2856},{},[2857,2862],{"type":39,"tag":95,"props":2858,"children":2859},{},[2860],{"type":44,"value":2861},"Use specific LLVM version",{"type":39,"tag":95,"props":2863,"children":2864},{},[2865],{"type":44,"value":2866},"Avoid compatibility issues",{"type":39,"tag":68,"props":2868,"children":2869},{},[2870,2883],{"type":39,"tag":95,"props":2871,"children":2872},{},[2873,2875,2881],{"type":44,"value":2874},"Set ",{"type":39,"tag":204,"props":2876,"children":2878},{"className":2877},[],[2879],{"type":44,"value":2880},"RUSTFLAGS",{"type":44,"value":2882}," correctly",{"type":39,"tag":95,"props":2884,"children":2885},{},[2886],{"type":44,"value":2887},"Prevent linking errors",{"type":39,"tag":395,"props":2889,"children":2891},{"id":2890},"crash-deduplication",[2892],{"type":44,"value":2893},"Crash Deduplication",{"type":39,"tag":47,"props":2895,"children":2896},{},[2897],{"type":44,"value":2898},"Avoid storing duplicate crashes from the same bug:",{"type":39,"tag":47,"props":2900,"children":2901},{},[2902],{"type":39,"tag":149,"props":2903,"children":2904},{},[2905],{"type":44,"value":2906},"Add backtrace observer:",{"type":39,"tag":196,"props":2908,"children":2910},{"className":1294,"code":2909,"language":1296,"meta":201,"style":201},"let backtrace_observer = BacktraceObserver::owned(\n    \"BacktraceObserver\",\n    libafl::observers::HarnessType::InProcess\n);\n",[2911],{"type":39,"tag":204,"props":2912,"children":2913},{"__ignoreMap":201},[2914,2922,2930,2938],{"type":39,"tag":208,"props":2915,"children":2916},{"class":210,"line":211},[2917],{"type":39,"tag":208,"props":2918,"children":2919},{},[2920],{"type":44,"value":2921},"let backtrace_observer = BacktraceObserver::owned(\n",{"type":39,"tag":208,"props":2923,"children":2924},{"class":210,"line":220},[2925],{"type":39,"tag":208,"props":2926,"children":2927},{},[2928],{"type":44,"value":2929},"    \"BacktraceObserver\",\n",{"type":39,"tag":208,"props":2931,"children":2932},{"class":210,"line":229},[2933],{"type":39,"tag":208,"props":2934,"children":2935},{},[2936],{"type":44,"value":2937},"    libafl::observers::HarnessType::InProcess\n",{"type":39,"tag":208,"props":2939,"children":2940},{"class":210,"line":238},[2941],{"type":39,"tag":208,"props":2942,"children":2943},{},[2944],{"type":44,"value":2945},");\n",{"type":39,"tag":47,"props":2947,"children":2948},{},[2949],{"type":39,"tag":149,"props":2950,"children":2951},{},[2952],{"type":44,"value":2953},"Update executor:",{"type":39,"tag":196,"props":2955,"children":2957},{"className":1294,"code":2956,"language":1296,"meta":201,"style":201},"let mut executor = InProcessExecutor::with_timeout(\n    &mut harness,\n    tuple_list!(edges_observer, time_observer, backtrace_observer),\n    &mut fuzzer,\n    &mut state,\n    &mut restarting_mgr,\n    timeout,\n)?;\n",[2958],{"type":39,"tag":204,"props":2959,"children":2960},{"__ignoreMap":201},[2961,2969,2977,2985,2993,3001,3009,3017],{"type":39,"tag":208,"props":2962,"children":2963},{"class":210,"line":211},[2964],{"type":39,"tag":208,"props":2965,"children":2966},{},[2967],{"type":44,"value":2968},"let mut executor = InProcessExecutor::with_timeout(\n",{"type":39,"tag":208,"props":2970,"children":2971},{"class":210,"line":220},[2972],{"type":39,"tag":208,"props":2973,"children":2974},{},[2975],{"type":44,"value":2976},"    &mut harness,\n",{"type":39,"tag":208,"props":2978,"children":2979},{"class":210,"line":229},[2980],{"type":39,"tag":208,"props":2981,"children":2982},{},[2983],{"type":44,"value":2984},"    tuple_list!(edges_observer, time_observer, backtrace_observer),\n",{"type":39,"tag":208,"props":2986,"children":2987},{"class":210,"line":238},[2988],{"type":39,"tag":208,"props":2989,"children":2990},{},[2991],{"type":44,"value":2992},"    &mut fuzzer,\n",{"type":39,"tag":208,"props":2994,"children":2995},{"class":210,"line":247},[2996],{"type":39,"tag":208,"props":2997,"children":2998},{},[2999],{"type":44,"value":3000},"    &mut state,\n",{"type":39,"tag":208,"props":3002,"children":3003},{"class":210,"line":1344},[3004],{"type":39,"tag":208,"props":3005,"children":3006},{},[3007],{"type":44,"value":3008},"    &mut restarting_mgr,\n",{"type":39,"tag":208,"props":3010,"children":3011},{"class":210,"line":1353},[3012],{"type":39,"tag":208,"props":3013,"children":3014},{},[3015],{"type":44,"value":3016},"    timeout,\n",{"type":39,"tag":208,"props":3018,"children":3019},{"class":210,"line":1362},[3020],{"type":39,"tag":208,"props":3021,"children":3022},{},[3023],{"type":44,"value":3024},")?;\n",{"type":39,"tag":47,"props":3026,"children":3027},{},[3028],{"type":39,"tag":149,"props":3029,"children":3030},{},[3031],{"type":44,"value":3032},"Update objective with hash feedback:",{"type":39,"tag":196,"props":3034,"children":3036},{"className":1294,"code":3035,"language":1296,"meta":201,"style":201},"let mut objective = feedback_and!(\n    feedback_or_fast!(CrashFeedback::new(), TimeoutFeedback::new()),\n    NewHashFeedback::new(&backtrace_observer)\n);\n",[3037],{"type":39,"tag":204,"props":3038,"children":3039},{"__ignoreMap":201},[3040,3048,3056,3064],{"type":39,"tag":208,"props":3041,"children":3042},{"class":210,"line":211},[3043],{"type":39,"tag":208,"props":3044,"children":3045},{},[3046],{"type":44,"value":3047},"let mut objective = feedback_and!(\n",{"type":39,"tag":208,"props":3049,"children":3050},{"class":210,"line":220},[3051],{"type":39,"tag":208,"props":3052,"children":3053},{},[3054],{"type":44,"value":3055},"    feedback_or_fast!(CrashFeedback::new(), TimeoutFeedback::new()),\n",{"type":39,"tag":208,"props":3057,"children":3058},{"class":210,"line":229},[3059],{"type":39,"tag":208,"props":3060,"children":3061},{},[3062],{"type":44,"value":3063},"    NewHashFeedback::new(&backtrace_observer)\n",{"type":39,"tag":208,"props":3065,"children":3066},{"class":210,"line":238},[3067],{"type":39,"tag":208,"props":3068,"children":3069},{},[3070],{"type":44,"value":2945},{"type":39,"tag":47,"props":3072,"children":3073},{},[3074],{"type":44,"value":3075},"This ensures only crashes with unique backtraces are saved.",{"type":39,"tag":395,"props":3077,"children":3079},{"id":3078},"dictionary-fuzzing",[3080],{"type":44,"value":3081},"Dictionary Fuzzing",{"type":39,"tag":47,"props":3083,"children":3084},{},[3085],{"type":44,"value":3086},"Use dictionaries to guide fuzzing toward specific tokens:",{"type":39,"tag":47,"props":3088,"children":3089},{},[3090],{"type":39,"tag":149,"props":3091,"children":3092},{},[3093],{"type":44,"value":3094},"Add tokens from file:",{"type":39,"tag":196,"props":3096,"children":3098},{"className":1294,"code":3097,"language":1296,"meta":201,"style":201},"let mut tokens = Tokens::new();\nif let Some(tokenfile) = &tokenfile {\n    tokens.add_from_file(tokenfile)?;\n}\nstate.add_metadata(tokens);\n",[3099],{"type":39,"tag":204,"props":3100,"children":3101},{"__ignoreMap":201},[3102,3110,3118,3126,3133],{"type":39,"tag":208,"props":3103,"children":3104},{"class":210,"line":211},[3105],{"type":39,"tag":208,"props":3106,"children":3107},{},[3108],{"type":44,"value":3109},"let mut tokens = Tokens::new();\n",{"type":39,"tag":208,"props":3111,"children":3112},{"class":210,"line":220},[3113],{"type":39,"tag":208,"props":3114,"children":3115},{},[3116],{"type":44,"value":3117},"if let Some(tokenfile) = &tokenfile {\n",{"type":39,"tag":208,"props":3119,"children":3120},{"class":210,"line":229},[3121],{"type":39,"tag":208,"props":3122,"children":3123},{},[3124],{"type":44,"value":3125},"    tokens.add_from_file(tokenfile)?;\n",{"type":39,"tag":208,"props":3127,"children":3128},{"class":210,"line":238},[3129],{"type":39,"tag":208,"props":3130,"children":3131},{},[3132],{"type":44,"value":253},{"type":39,"tag":208,"props":3134,"children":3135},{"class":210,"line":247},[3136],{"type":39,"tag":208,"props":3137,"children":3138},{},[3139],{"type":44,"value":3140},"state.add_metadata(tokens);\n",{"type":39,"tag":47,"props":3142,"children":3143},{},[3144],{"type":39,"tag":149,"props":3145,"children":3146},{},[3147],{"type":44,"value":3148},"Update mutator:",{"type":39,"tag":196,"props":3150,"children":3152},{"className":1294,"code":3151,"language":1296,"meta":201,"style":201},"let mutator = StdScheduledMutator::new(\n    havoc_mutations().merge(tokens_mutations())\n);\n",[3153],{"type":39,"tag":204,"props":3154,"children":3155},{"__ignoreMap":201},[3156,3164,3172],{"type":39,"tag":208,"props":3157,"children":3158},{"class":210,"line":211},[3159],{"type":39,"tag":208,"props":3160,"children":3161},{},[3162],{"type":44,"value":3163},"let mutator = StdScheduledMutator::new(\n",{"type":39,"tag":208,"props":3165,"children":3166},{"class":210,"line":220},[3167],{"type":39,"tag":208,"props":3168,"children":3169},{},[3170],{"type":44,"value":3171},"    havoc_mutations().merge(tokens_mutations())\n",{"type":39,"tag":208,"props":3173,"children":3174},{"class":210,"line":229},[3175],{"type":39,"tag":208,"props":3176,"children":3177},{},[3178],{"type":44,"value":2945},{"type":39,"tag":47,"props":3180,"children":3181},{},[3182],{"type":39,"tag":149,"props":3183,"children":3184},{},[3185],{"type":44,"value":3186},"Hard-coded tokens example (PNG):",{"type":39,"tag":196,"props":3188,"children":3190},{"className":1294,"code":3189,"language":1296,"meta":201,"style":201},"state.add_metadata(Tokens::from([\n    vec![137, 80, 78, 71, 13, 10, 26, 10], \u002F\u002F PNG header\n    \"IHDR\".as_bytes().to_vec(),\n    \"IDAT\".as_bytes().to_vec(),\n    \"PLTE\".as_bytes().to_vec(),\n    \"IEND\".as_bytes().to_vec(),\n]));\n",[3191],{"type":39,"tag":204,"props":3192,"children":3193},{"__ignoreMap":201},[3194,3202,3210,3218,3226,3234,3242],{"type":39,"tag":208,"props":3195,"children":3196},{"class":210,"line":211},[3197],{"type":39,"tag":208,"props":3198,"children":3199},{},[3200],{"type":44,"value":3201},"state.add_metadata(Tokens::from([\n",{"type":39,"tag":208,"props":3203,"children":3204},{"class":210,"line":220},[3205],{"type":39,"tag":208,"props":3206,"children":3207},{},[3208],{"type":44,"value":3209},"    vec![137, 80, 78, 71, 13, 10, 26, 10], \u002F\u002F PNG header\n",{"type":39,"tag":208,"props":3211,"children":3212},{"class":210,"line":229},[3213],{"type":39,"tag":208,"props":3214,"children":3215},{},[3216],{"type":44,"value":3217},"    \"IHDR\".as_bytes().to_vec(),\n",{"type":39,"tag":208,"props":3219,"children":3220},{"class":210,"line":238},[3221],{"type":39,"tag":208,"props":3222,"children":3223},{},[3224],{"type":44,"value":3225},"    \"IDAT\".as_bytes().to_vec(),\n",{"type":39,"tag":208,"props":3227,"children":3228},{"class":210,"line":247},[3229],{"type":39,"tag":208,"props":3230,"children":3231},{},[3232],{"type":44,"value":3233},"    \"PLTE\".as_bytes().to_vec(),\n",{"type":39,"tag":208,"props":3235,"children":3236},{"class":210,"line":1344},[3237],{"type":39,"tag":208,"props":3238,"children":3239},{},[3240],{"type":44,"value":3241},"    \"IEND\".as_bytes().to_vec(),\n",{"type":39,"tag":208,"props":3243,"children":3244},{"class":210,"line":1353},[3245],{"type":39,"tag":208,"props":3246,"children":3247},{},[3248],{"type":44,"value":3249},"]));\n",{"type":39,"tag":863,"props":3251,"children":3252},{},[3253],{"type":39,"tag":47,"props":3254,"children":3255},{},[3256,3260,3262,3267],{"type":39,"tag":149,"props":3257,"children":3258},{},[3259],{"type":44,"value":873},{"type":44,"value":3261}," For detailed dictionary creation strategies and format-specific dictionaries,\nsee the ",{"type":39,"tag":149,"props":3263,"children":3264},{},[3265],{"type":44,"value":3266},"fuzzing-dictionaries",{"type":44,"value":882},{"type":39,"tag":395,"props":3269,"children":3271},{"id":3270},"auto-tokens",[3272],{"type":44,"value":3273},"Auto Tokens",{"type":39,"tag":47,"props":3275,"children":3276},{},[3277],{"type":44,"value":3278},"Automatically extract magic values and checksums from the program:",{"type":39,"tag":47,"props":3280,"children":3281},{},[3282],{"type":39,"tag":149,"props":3283,"children":3284},{},[3285],{"type":44,"value":3286},"Enable in compiler wrapper:",{"type":39,"tag":196,"props":3288,"children":3290},{"className":1294,"code":3289,"language":1296,"meta":201,"style":201},"cc.add_pass(LLVMPasses::AutoTokens)\n",[3291],{"type":39,"tag":204,"props":3292,"children":3293},{"__ignoreMap":201},[3294],{"type":39,"tag":208,"props":3295,"children":3296},{"class":210,"line":211},[3297],{"type":39,"tag":208,"props":3298,"children":3299},{},[3300],{"type":44,"value":3289},{"type":39,"tag":47,"props":3302,"children":3303},{},[3304],{"type":39,"tag":149,"props":3305,"children":3306},{},[3307],{"type":44,"value":3308},"Load auto tokens in fuzzer:",{"type":39,"tag":196,"props":3310,"children":3312},{"className":1294,"code":3311,"language":1296,"meta":201,"style":201},"tokens += libafl_targets::autotokens()?;\n",[3313],{"type":39,"tag":204,"props":3314,"children":3315},{"__ignoreMap":201},[3316],{"type":39,"tag":208,"props":3317,"children":3318},{"class":210,"line":211},[3319],{"type":39,"tag":208,"props":3320,"children":3321},{},[3322],{"type":44,"value":3311},{"type":39,"tag":47,"props":3324,"children":3325},{},[3326],{"type":39,"tag":149,"props":3327,"children":3328},{},[3329],{"type":44,"value":3330},"Verify tokens section:",{"type":39,"tag":196,"props":3332,"children":3334},{"className":261,"code":3333,"language":263,"meta":201,"style":201},"echo \"p (uint8_t *)__token_start\" | gdb fuzz\n",[3335],{"type":39,"tag":204,"props":3336,"children":3337},{"__ignoreMap":201},[3338],{"type":39,"tag":208,"props":3339,"children":3340},{"class":210,"line":211},[3341,3346,3350,3355,3359,3363,3368],{"type":39,"tag":208,"props":3342,"children":3343},{"style":293},[3344],{"type":44,"value":3345},"echo",{"type":39,"tag":208,"props":3347,"children":3348},{"style":546},[3349],{"type":44,"value":1134},{"type":39,"tag":208,"props":3351,"children":3352},{"style":279},[3353],{"type":44,"value":3354},"p (uint8_t *)__token_start",{"type":39,"tag":208,"props":3356,"children":3357},{"style":546},[3358],{"type":44,"value":554},{"type":39,"tag":208,"props":3360,"children":3361},{"style":546},[3362],{"type":44,"value":682},{"type":39,"tag":208,"props":3364,"children":3365},{"style":273},[3366],{"type":44,"value":3367}," gdb",{"type":39,"tag":208,"props":3369,"children":3370},{"style":279},[3371],{"type":44,"value":374},{"type":39,"tag":395,"props":3373,"children":3375},{"id":3374},"performance-tuning",[3376],{"type":44,"value":3377},"Performance Tuning",{"type":39,"tag":60,"props":3379,"children":3380},{},[3381,3397],{"type":39,"tag":64,"props":3382,"children":3383},{},[3384],{"type":39,"tag":68,"props":3385,"children":3386},{},[3387,3392],{"type":39,"tag":72,"props":3388,"children":3389},{},[3390],{"type":44,"value":3391},"Setting",{"type":39,"tag":72,"props":3393,"children":3394},{},[3395],{"type":44,"value":3396},"Impact",{"type":39,"tag":88,"props":3398,"children":3399},{},[3400,3413,3430,3446,3459],{"type":39,"tag":68,"props":3401,"children":3402},{},[3403,3408],{"type":39,"tag":95,"props":3404,"children":3405},{},[3406],{"type":44,"value":3407},"Multi-core fuzzing",{"type":39,"tag":95,"props":3409,"children":3410},{},[3411],{"type":44,"value":3412},"Linear speedup with cores",{"type":39,"tag":68,"props":3414,"children":3415},{},[3416,3425],{"type":39,"tag":95,"props":3417,"children":3418},{},[3419],{"type":39,"tag":204,"props":3420,"children":3422},{"className":3421},[],[3423],{"type":44,"value":3424},"InMemoryCorpus",{"type":39,"tag":95,"props":3426,"children":3427},{},[3428],{"type":44,"value":3429},"Faster but non-persistent",{"type":39,"tag":68,"props":3431,"children":3432},{},[3433,3441],{"type":39,"tag":95,"props":3434,"children":3435},{},[3436],{"type":39,"tag":204,"props":3437,"children":3439},{"className":3438},[],[3440],{"type":44,"value":2829},{"type":39,"tag":95,"props":3442,"children":3443},{},[3444],{"type":44,"value":3445},"Balanced speed and persistence",{"type":39,"tag":68,"props":3447,"children":3448},{},[3449,3454],{"type":39,"tag":95,"props":3450,"children":3451},{},[3452],{"type":44,"value":3453},"Sanitizers",{"type":39,"tag":95,"props":3455,"children":3456},{},[3457],{"type":44,"value":3458},"2-5x slowdown, essential for bugs",{"type":39,"tag":68,"props":3460,"children":3461},{},[3462,3473],{"type":39,"tag":95,"props":3463,"children":3464},{},[3465,3467],{"type":44,"value":3466},"Optimization level ",{"type":39,"tag":204,"props":3468,"children":3470},{"className":3469},[],[3471],{"type":44,"value":3472},"-O2",{"type":39,"tag":95,"props":3474,"children":3475},{},[3476],{"type":44,"value":3477},"Balance between speed and coverage",{"type":39,"tag":395,"props":3479,"children":3481},{"id":3480},"debugging-fuzzer",[3482],{"type":44,"value":3483},"Debugging Fuzzer",{"type":39,"tag":47,"props":3485,"children":3486},{},[3487],{"type":44,"value":3488},"Run fuzzer in single-process mode for easier debugging:",{"type":39,"tag":196,"props":3490,"children":3492},{"className":1294,"code":3491,"language":1296,"meta":201,"style":201},"\u002F\u002F Replace launcher with direct call\nrun_client(None, SimpleEventManager::new(monitor), 0).unwrap();\n\n\u002F\u002F Comment out:\n\u002F\u002F Launcher::builder()\n\u002F\u002F     .run_client(&mut run_client)\n\u002F\u002F     ...\n\u002F\u002F     .launch()\n",[3493],{"type":39,"tag":204,"props":3494,"children":3495},{"__ignoreMap":201},[3496,3504,3512,3519,3527,3535,3543,3551],{"type":39,"tag":208,"props":3497,"children":3498},{"class":210,"line":211},[3499],{"type":39,"tag":208,"props":3500,"children":3501},{},[3502],{"type":44,"value":3503},"\u002F\u002F Replace launcher with direct call\n",{"type":39,"tag":208,"props":3505,"children":3506},{"class":210,"line":220},[3507],{"type":39,"tag":208,"props":3508,"children":3509},{},[3510],{"type":44,"value":3511},"run_client(None, SimpleEventManager::new(monitor), 0).unwrap();\n",{"type":39,"tag":208,"props":3513,"children":3514},{"class":210,"line":229},[3515],{"type":39,"tag":208,"props":3516,"children":3517},{"emptyLinePlaceholder":1330},[3518],{"type":44,"value":1333},{"type":39,"tag":208,"props":3520,"children":3521},{"class":210,"line":238},[3522],{"type":39,"tag":208,"props":3523,"children":3524},{},[3525],{"type":44,"value":3526},"\u002F\u002F Comment out:\n",{"type":39,"tag":208,"props":3528,"children":3529},{"class":210,"line":247},[3530],{"type":39,"tag":208,"props":3531,"children":3532},{},[3533],{"type":44,"value":3534},"\u002F\u002F Launcher::builder()\n",{"type":39,"tag":208,"props":3536,"children":3537},{"class":210,"line":1344},[3538],{"type":39,"tag":208,"props":3539,"children":3540},{},[3541],{"type":44,"value":3542},"\u002F\u002F     .run_client(&mut run_client)\n",{"type":39,"tag":208,"props":3544,"children":3545},{"class":210,"line":1353},[3546],{"type":39,"tag":208,"props":3547,"children":3548},{},[3549],{"type":44,"value":3550},"\u002F\u002F     ...\n",{"type":39,"tag":208,"props":3552,"children":3553},{"class":210,"line":1362},[3554],{"type":39,"tag":208,"props":3555,"children":3556},{},[3557],{"type":44,"value":3558},"\u002F\u002F     .launch()\n",{"type":39,"tag":47,"props":3560,"children":3561},{},[3562],{"type":44,"value":3563},"Then debug with GDB:",{"type":39,"tag":196,"props":3565,"children":3567},{"className":261,"code":3566,"language":263,"meta":201,"style":201},"gdb --args .\u002Ffuzz --cores 0 --input corpus\u002F\n",[3568],{"type":39,"tag":204,"props":3569,"children":3570},{"__ignoreMap":201},[3571],{"type":39,"tag":208,"props":3572,"children":3573},{"class":210,"line":211},[3574,3579,3584,3589,3593,3597,3601],{"type":39,"tag":208,"props":3575,"children":3576},{"style":273},[3577],{"type":44,"value":3578},"gdb",{"type":39,"tag":208,"props":3580,"children":3581},{"style":279},[3582],{"type":44,"value":3583}," --args",{"type":39,"tag":208,"props":3585,"children":3586},{"style":279},[3587],{"type":44,"value":3588}," .\u002Ffuzz",{"type":39,"tag":208,"props":3590,"children":3591},{"style":279},[3592],{"type":44,"value":2457},{"type":39,"tag":208,"props":3594,"children":3595},{"style":513},[3596],{"type":44,"value":2462},{"type":39,"tag":208,"props":3598,"children":3599},{"style":279},[3600],{"type":44,"value":2467},{"type":39,"tag":208,"props":3602,"children":3603},{"style":279},[3604],{"type":44,"value":387},{"type":39,"tag":53,"props":3606,"children":3608},{"id":3607},"real-world-examples",[3609],{"type":44,"value":3610},"Real-World Examples",{"type":39,"tag":395,"props":3612,"children":3614},{"id":3613},"example-libpng",[3615],{"type":44,"value":3616},"Example: libpng",{"type":39,"tag":47,"props":3618,"children":3619},{},[3620],{"type":44,"value":3621},"Fuzzing libpng using LibAFL:",{"type":39,"tag":47,"props":3623,"children":3624},{},[3625],{"type":39,"tag":149,"props":3626,"children":3627},{},[3628],{"type":44,"value":3629},"1. Get source code:",{"type":39,"tag":196,"props":3631,"children":3633},{"className":261,"code":3632,"language":263,"meta":201,"style":201},"curl -L -O https:\u002F\u002Fdownloads.sourceforge.net\u002Fproject\u002Flibpng\u002Flibpng16\u002F1.6.37\u002Flibpng-1.6.37.tar.xz\ntar xf libpng-1.6.37.tar.xz\ncd libpng-1.6.37\u002F\napt install zlib1g-dev\n",[3634],{"type":39,"tag":204,"props":3635,"children":3636},{"__ignoreMap":201},[3637,3659,3677,3689],{"type":39,"tag":208,"props":3638,"children":3639},{"class":210,"line":211},[3640,3644,3649,3654],{"type":39,"tag":208,"props":3641,"children":3642},{"style":273},[3643],{"type":44,"value":642},{"type":39,"tag":208,"props":3645,"children":3646},{"style":279},[3647],{"type":44,"value":3648}," -L",{"type":39,"tag":208,"props":3650,"children":3651},{"style":279},[3652],{"type":44,"value":3653}," -O",{"type":39,"tag":208,"props":3655,"children":3656},{"style":279},[3657],{"type":44,"value":3658}," https:\u002F\u002Fdownloads.sourceforge.net\u002Fproject\u002Flibpng\u002Flibpng16\u002F1.6.37\u002Flibpng-1.6.37.tar.xz\n",{"type":39,"tag":208,"props":3660,"children":3661},{"class":210,"line":220},[3662,3667,3672],{"type":39,"tag":208,"props":3663,"children":3664},{"style":273},[3665],{"type":44,"value":3666},"tar",{"type":39,"tag":208,"props":3668,"children":3669},{"style":279},[3670],{"type":44,"value":3671}," xf",{"type":39,"tag":208,"props":3673,"children":3674},{"style":279},[3675],{"type":44,"value":3676}," libpng-1.6.37.tar.xz\n",{"type":39,"tag":208,"props":3678,"children":3679},{"class":210,"line":229},[3680,3684],{"type":39,"tag":208,"props":3681,"children":3682},{"style":293},[3683],{"type":44,"value":296},{"type":39,"tag":208,"props":3685,"children":3686},{"style":279},[3687],{"type":44,"value":3688}," libpng-1.6.37\u002F\n",{"type":39,"tag":208,"props":3690,"children":3691},{"class":210,"line":238},[3692,3696,3700],{"type":39,"tag":208,"props":3693,"children":3694},{"style":273},[3695],{"type":44,"value":444},{"type":39,"tag":208,"props":3697,"children":3698},{"style":279},[3699],{"type":44,"value":449},{"type":39,"tag":208,"props":3701,"children":3702},{"style":279},[3703],{"type":44,"value":3704}," zlib1g-dev\n",{"type":39,"tag":47,"props":3706,"children":3707},{},[3708],{"type":39,"tag":149,"props":3709,"children":3710},{},[3711],{"type":44,"value":3712},"2. Set compiler wrapper:",{"type":39,"tag":196,"props":3714,"children":3716},{"className":261,"code":3715,"language":263,"meta":201,"style":201},"export FUZZER_CARGO_DIR=\"\u002Fpath\u002Fto\u002Flibafl\u002Fproject\"\nexport CC=$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cc\nexport CXX=$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cxx\n",[3717],{"type":39,"tag":204,"props":3718,"children":3719},{"__ignoreMap":201},[3720,3749,3769],{"type":39,"tag":208,"props":3721,"children":3722},{"class":210,"line":211},[3723,3727,3732,3736,3740,3745],{"type":39,"tag":208,"props":3724,"children":3725},{"style":534},[3726],{"type":44,"value":537},{"type":39,"tag":208,"props":3728,"children":3729},{"style":540},[3730],{"type":44,"value":3731}," FUZZER_CARGO_DIR",{"type":39,"tag":208,"props":3733,"children":3734},{"style":546},[3735],{"type":44,"value":549},{"type":39,"tag":208,"props":3737,"children":3738},{"style":546},[3739],{"type":44,"value":554},{"type":39,"tag":208,"props":3741,"children":3742},{"style":279},[3743],{"type":44,"value":3744},"\u002Fpath\u002Fto\u002Flibafl\u002Fproject",{"type":39,"tag":208,"props":3746,"children":3747},{"style":546},[3748],{"type":44,"value":564},{"type":39,"tag":208,"props":3750,"children":3751},{"class":210,"line":220},[3752,3756,3760,3764],{"type":39,"tag":208,"props":3753,"children":3754},{"style":534},[3755],{"type":44,"value":537},{"type":39,"tag":208,"props":3757,"children":3758},{"style":540},[3759],{"type":44,"value":576},{"type":39,"tag":208,"props":3761,"children":3762},{"style":546},[3763],{"type":44,"value":549},{"type":39,"tag":208,"props":3765,"children":3766},{"style":540},[3767],{"type":44,"value":3768},"$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cc\n",{"type":39,"tag":208,"props":3770,"children":3771},{"class":210,"line":229},[3772,3776,3780,3784],{"type":39,"tag":208,"props":3773,"children":3774},{"style":534},[3775],{"type":44,"value":537},{"type":39,"tag":208,"props":3777,"children":3778},{"style":540},[3779],{"type":44,"value":605},{"type":39,"tag":208,"props":3781,"children":3782},{"style":546},[3783],{"type":44,"value":549},{"type":39,"tag":208,"props":3785,"children":3786},{"style":540},[3787],{"type":44,"value":3788},"$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cxx\n",{"type":39,"tag":47,"props":3790,"children":3791},{},[3792],{"type":39,"tag":149,"props":3793,"children":3794},{},[3795],{"type":44,"value":3796},"3. Build static library:",{"type":39,"tag":196,"props":3798,"children":3800},{"className":261,"code":3799,"language":263,"meta":201,"style":201},".\u002Fconfigure --enable-shared=no\nmake\n",[3801],{"type":39,"tag":204,"props":3802,"children":3803},{"__ignoreMap":201},[3804,3817],{"type":39,"tag":208,"props":3805,"children":3806},{"class":210,"line":211},[3807,3812],{"type":39,"tag":208,"props":3808,"children":3809},{"style":273},[3810],{"type":44,"value":3811},".\u002Fconfigure",{"type":39,"tag":208,"props":3813,"children":3814},{"style":279},[3815],{"type":44,"value":3816}," --enable-shared=no\n",{"type":39,"tag":208,"props":3818,"children":3819},{"class":210,"line":220},[3820],{"type":39,"tag":208,"props":3821,"children":3822},{"style":273},[3823],{"type":44,"value":3824},"make\n",{"type":39,"tag":47,"props":3826,"children":3827},{},[3828],{"type":39,"tag":149,"props":3829,"children":3830},{},[3831],{"type":44,"value":3832},"4. Get harness:",{"type":39,"tag":196,"props":3834,"children":3836},{"className":261,"code":3835,"language":263,"meta":201,"style":201},"curl -O https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Ff8e5fa92b0e37ab597616f554bee254157998227\u002Fcontrib\u002Foss-fuzz\u002Flibpng_read_fuzzer.cc\n",[3837],{"type":39,"tag":204,"props":3838,"children":3839},{"__ignoreMap":201},[3840],{"type":39,"tag":208,"props":3841,"children":3842},{"class":210,"line":211},[3843,3847,3851],{"type":39,"tag":208,"props":3844,"children":3845},{"style":273},[3846],{"type":44,"value":642},{"type":39,"tag":208,"props":3848,"children":3849},{"style":279},[3850],{"type":44,"value":3653},{"type":39,"tag":208,"props":3852,"children":3853},{"style":279},[3854],{"type":44,"value":3855}," https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Ff8e5fa92b0e37ab597616f554bee254157998227\u002Fcontrib\u002Foss-fuzz\u002Flibpng_read_fuzzer.cc\n",{"type":39,"tag":47,"props":3857,"children":3858},{},[3859],{"type":39,"tag":149,"props":3860,"children":3861},{},[3862],{"type":44,"value":3863},"5. Link fuzzer:",{"type":39,"tag":196,"props":3865,"children":3867},{"className":261,"code":3866,"language":263,"meta":201,"style":201},"$CXX libpng_read_fuzzer.cc .libs\u002Flibpng16.a -lz -o fuzz\n",[3868],{"type":39,"tag":204,"props":3869,"children":3870},{"__ignoreMap":201},[3871],{"type":39,"tag":208,"props":3872,"children":3873},{"class":210,"line":211},[3874],{"type":39,"tag":208,"props":3875,"children":3876},{"style":540},[3877],{"type":44,"value":3866},{"type":39,"tag":47,"props":3879,"children":3880},{},[3881],{"type":39,"tag":149,"props":3882,"children":3883},{},[3884],{"type":44,"value":3885},"6. Prepare seeds:",{"type":39,"tag":196,"props":3887,"children":3889},{"className":261,"code":3888,"language":263,"meta":201,"style":201},"mkdir seeds\u002F\ncurl -o seeds\u002Finput.png https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Facfd50ae0ba3198ad734e5d4dec2b05341e50924\u002Fcontrib\u002Fpngsuite\u002Fiftp1n3p08.png\n",[3890],{"type":39,"tag":204,"props":3891,"children":3892},{"__ignoreMap":201},[3893,3906],{"type":39,"tag":208,"props":3894,"children":3895},{"class":210,"line":211},[3896,3901],{"type":39,"tag":208,"props":3897,"children":3898},{"style":273},[3899],{"type":44,"value":3900},"mkdir",{"type":39,"tag":208,"props":3902,"children":3903},{"style":279},[3904],{"type":44,"value":3905}," seeds\u002F\n",{"type":39,"tag":208,"props":3907,"children":3908},{"class":210,"line":220},[3909,3913,3917,3922],{"type":39,"tag":208,"props":3910,"children":3911},{"style":273},[3912],{"type":44,"value":642},{"type":39,"tag":208,"props":3914,"children":3915},{"style":279},[3916],{"type":44,"value":369},{"type":39,"tag":208,"props":3918,"children":3919},{"style":279},[3920],{"type":44,"value":3921}," seeds\u002Finput.png",{"type":39,"tag":208,"props":3923,"children":3924},{"style":279},[3925],{"type":44,"value":3926}," https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002Facfd50ae0ba3198ad734e5d4dec2b05341e50924\u002Fcontrib\u002Fpngsuite\u002Fiftp1n3p08.png\n",{"type":39,"tag":47,"props":3928,"children":3929},{},[3930],{"type":39,"tag":149,"props":3931,"children":3932},{},[3933],{"type":44,"value":3934},"7. Get dictionary (optional):",{"type":39,"tag":196,"props":3936,"children":3938},{"className":261,"code":3937,"language":263,"meta":201,"style":201},"curl -O https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002F2fff013a6935967960a5ae626fc21432807933dd\u002Fcontrib\u002Foss-fuzz\u002Fpng.dict\n",[3939],{"type":39,"tag":204,"props":3940,"children":3941},{"__ignoreMap":201},[3942],{"type":39,"tag":208,"props":3943,"children":3944},{"class":210,"line":211},[3945,3949,3953],{"type":39,"tag":208,"props":3946,"children":3947},{"style":273},[3948],{"type":44,"value":642},{"type":39,"tag":208,"props":3950,"children":3951},{"style":279},[3952],{"type":44,"value":3653},{"type":39,"tag":208,"props":3954,"children":3955},{"style":279},[3956],{"type":44,"value":3957}," https:\u002F\u002Fraw.githubusercontent.com\u002Fglennrp\u002Flibpng\u002F2fff013a6935967960a5ae626fc21432807933dd\u002Fcontrib\u002Foss-fuzz\u002Fpng.dict\n",{"type":39,"tag":47,"props":3959,"children":3960},{},[3961],{"type":39,"tag":149,"props":3962,"children":3963},{},[3964],{"type":44,"value":3965},"8. Start fuzzing:",{"type":39,"tag":196,"props":3967,"children":3969},{"className":261,"code":3968,"language":263,"meta":201,"style":201},".\u002Ffuzz --input seeds\u002F --cores 0 -x png.dict\n",[3970],{"type":39,"tag":204,"props":3971,"children":3972},{"__ignoreMap":201},[3973],{"type":39,"tag":208,"props":3974,"children":3975},{"class":210,"line":211},[3976,3980,3984,3989,3993,3997,4002],{"type":39,"tag":208,"props":3977,"children":3978},{"style":273},[3979],{"type":44,"value":382},{"type":39,"tag":208,"props":3981,"children":3982},{"style":279},[3983],{"type":44,"value":2467},{"type":39,"tag":208,"props":3985,"children":3986},{"style":279},[3987],{"type":44,"value":3988}," seeds\u002F",{"type":39,"tag":208,"props":3990,"children":3991},{"style":279},[3992],{"type":44,"value":2457},{"type":39,"tag":208,"props":3994,"children":3995},{"style":513},[3996],{"type":44,"value":2462},{"type":39,"tag":208,"props":3998,"children":3999},{"style":279},[4000],{"type":44,"value":4001}," -x",{"type":39,"tag":208,"props":4003,"children":4004},{"style":279},[4005],{"type":44,"value":4006}," png.dict\n",{"type":39,"tag":395,"props":4008,"children":4010},{"id":4009},"example-cmake-project",[4011],{"type":44,"value":4012},"Example: CMake Project",{"type":39,"tag":47,"props":4014,"children":4015},{},[4016],{"type":44,"value":4017},"Integrate LibAFL with CMake build system:",{"type":39,"tag":47,"props":4019,"children":4020},{},[4021],{"type":39,"tag":149,"props":4022,"children":4023},{},[4024],{"type":44,"value":4025},"CMakeLists.txt:",{"type":39,"tag":196,"props":4027,"children":4031},{"className":4028,"code":4029,"language":4030,"meta":201,"style":201},"language-cmake shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","project(BuggyProgram)\ncmake_minimum_required(VERSION 3.0)\n\nadd_executable(buggy_program main.cc)\n\nadd_executable(fuzz main.cc harness.cc)\ntarget_compile_definitions(fuzz PRIVATE NO_MAIN=1)\ntarget_compile_options(fuzz PRIVATE -g -O2)\n","cmake",[4032],{"type":39,"tag":204,"props":4033,"children":4034},{"__ignoreMap":201},[4035,4043,4051,4058,4066,4073,4081,4089],{"type":39,"tag":208,"props":4036,"children":4037},{"class":210,"line":211},[4038],{"type":39,"tag":208,"props":4039,"children":4040},{},[4041],{"type":44,"value":4042},"project(BuggyProgram)\n",{"type":39,"tag":208,"props":4044,"children":4045},{"class":210,"line":220},[4046],{"type":39,"tag":208,"props":4047,"children":4048},{},[4049],{"type":44,"value":4050},"cmake_minimum_required(VERSION 3.0)\n",{"type":39,"tag":208,"props":4052,"children":4053},{"class":210,"line":229},[4054],{"type":39,"tag":208,"props":4055,"children":4056},{"emptyLinePlaceholder":1330},[4057],{"type":44,"value":1333},{"type":39,"tag":208,"props":4059,"children":4060},{"class":210,"line":238},[4061],{"type":39,"tag":208,"props":4062,"children":4063},{},[4064],{"type":44,"value":4065},"add_executable(buggy_program main.cc)\n",{"type":39,"tag":208,"props":4067,"children":4068},{"class":210,"line":247},[4069],{"type":39,"tag":208,"props":4070,"children":4071},{"emptyLinePlaceholder":1330},[4072],{"type":44,"value":1333},{"type":39,"tag":208,"props":4074,"children":4075},{"class":210,"line":1344},[4076],{"type":39,"tag":208,"props":4077,"children":4078},{},[4079],{"type":44,"value":4080},"add_executable(fuzz main.cc harness.cc)\n",{"type":39,"tag":208,"props":4082,"children":4083},{"class":210,"line":1353},[4084],{"type":39,"tag":208,"props":4085,"children":4086},{},[4087],{"type":44,"value":4088},"target_compile_definitions(fuzz PRIVATE NO_MAIN=1)\n",{"type":39,"tag":208,"props":4090,"children":4091},{"class":210,"line":1362},[4092],{"type":39,"tag":208,"props":4093,"children":4094},{},[4095],{"type":44,"value":4096},"target_compile_options(fuzz PRIVATE -g -O2)\n",{"type":39,"tag":47,"props":4098,"children":4099},{},[4100],{"type":39,"tag":149,"props":4101,"children":4102},{},[4103],{"type":44,"value":4104},"Build non-instrumented binary:",{"type":39,"tag":196,"props":4106,"children":4108},{"className":261,"code":4107,"language":263,"meta":201,"style":201},"cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ .\ncmake --build . --target buggy_program\n",[4109],{"type":39,"tag":204,"props":4110,"children":4111},{"__ignoreMap":201},[4112,4134],{"type":39,"tag":208,"props":4113,"children":4114},{"class":210,"line":211},[4115,4119,4124,4129],{"type":39,"tag":208,"props":4116,"children":4117},{"style":273},[4118],{"type":44,"value":4030},{"type":39,"tag":208,"props":4120,"children":4121},{"style":279},[4122],{"type":44,"value":4123}," -DCMAKE_C_COMPILER=clang",{"type":39,"tag":208,"props":4125,"children":4126},{"style":279},[4127],{"type":44,"value":4128}," -DCMAKE_CXX_COMPILER=clang++",{"type":39,"tag":208,"props":4130,"children":4131},{"style":279},[4132],{"type":44,"value":4133}," .\n",{"type":39,"tag":208,"props":4135,"children":4136},{"class":210,"line":220},[4137,4141,4146,4151,4156],{"type":39,"tag":208,"props":4138,"children":4139},{"style":273},[4140],{"type":44,"value":4030},{"type":39,"tag":208,"props":4142,"children":4143},{"style":279},[4144],{"type":44,"value":4145}," --build",{"type":39,"tag":208,"props":4147,"children":4148},{"style":279},[4149],{"type":44,"value":4150}," .",{"type":39,"tag":208,"props":4152,"children":4153},{"style":279},[4154],{"type":44,"value":4155}," --target",{"type":39,"tag":208,"props":4157,"children":4158},{"style":279},[4159],{"type":44,"value":4160}," buggy_program\n",{"type":39,"tag":47,"props":4162,"children":4163},{},[4164],{"type":39,"tag":149,"props":4165,"children":4166},{},[4167],{"type":44,"value":4168},"Build fuzzer:",{"type":39,"tag":196,"props":4170,"children":4172},{"className":261,"code":4171,"language":263,"meta":201,"style":201},"export FUZZER_CARGO_DIR=\"\u002Fpath\u002Fto\u002Flibafl\u002Fproject\"\ncmake -DCMAKE_C_COMPILER=$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cc \\\n      -DCMAKE_CXX_COMPILER=$FUZZER_CARGO_DIR\u002Ftarget\u002Frelease\u002Flibafl_cxx .\ncmake --build . --target fuzz\n",[4173],{"type":39,"tag":204,"props":4174,"children":4175},{"__ignoreMap":201},[4176,4203,4229,4250],{"type":39,"tag":208,"props":4177,"children":4178},{"class":210,"line":211},[4179,4183,4187,4191,4195,4199],{"type":39,"tag":208,"props":4180,"children":4181},{"style":534},[4182],{"type":44,"value":537},{"type":39,"tag":208,"props":4184,"children":4185},{"style":540},[4186],{"type":44,"value":3731},{"type":39,"tag":208,"props":4188,"children":4189},{"style":546},[4190],{"type":44,"value":549},{"type":39,"tag":208,"props":4192,"children":4193},{"style":546},[4194],{"type":44,"value":554},{"type":39,"tag":208,"props":4196,"children":4197},{"style":279},[4198],{"type":44,"value":3744},{"type":39,"tag":208,"props":4200,"children":4201},{"style":546},[4202],{"type":44,"value":564},{"type":39,"tag":208,"props":4204,"children":4205},{"class":210,"line":220},[4206,4210,4215,4220,4225],{"type":39,"tag":208,"props":4207,"children":4208},{"style":273},[4209],{"type":44,"value":4030},{"type":39,"tag":208,"props":4211,"children":4212},{"style":279},[4213],{"type":44,"value":4214}," -DCMAKE_C_COMPILER=",{"type":39,"tag":208,"props":4216,"children":4217},{"style":540},[4218],{"type":44,"value":4219},"$FUZZER_CARGO_DIR",{"type":39,"tag":208,"props":4221,"children":4222},{"style":279},[4223],{"type":44,"value":4224},"\u002Ftarget\u002Frelease\u002Flibafl_cc",{"type":39,"tag":208,"props":4226,"children":4227},{"style":540},[4228],{"type":44,"value":1121},{"type":39,"tag":208,"props":4230,"children":4231},{"class":210,"line":229},[4232,4237,4241,4246],{"type":39,"tag":208,"props":4233,"children":4234},{"style":279},[4235],{"type":44,"value":4236},"      -DCMAKE_CXX_COMPILER=",{"type":39,"tag":208,"props":4238,"children":4239},{"style":540},[4240],{"type":44,"value":4219},{"type":39,"tag":208,"props":4242,"children":4243},{"style":279},[4244],{"type":44,"value":4245},"\u002Ftarget\u002Frelease\u002Flibafl_cxx",{"type":39,"tag":208,"props":4247,"children":4248},{"style":279},[4249],{"type":44,"value":4133},{"type":39,"tag":208,"props":4251,"children":4252},{"class":210,"line":238},[4253,4257,4261,4265,4269],{"type":39,"tag":208,"props":4254,"children":4255},{"style":273},[4256],{"type":44,"value":4030},{"type":39,"tag":208,"props":4258,"children":4259},{"style":279},[4260],{"type":44,"value":4145},{"type":39,"tag":208,"props":4262,"children":4263},{"style":279},[4264],{"type":44,"value":4150},{"type":39,"tag":208,"props":4266,"children":4267},{"style":279},[4268],{"type":44,"value":4155},{"type":39,"tag":208,"props":4270,"children":4271},{"style":279},[4272],{"type":44,"value":374},{"type":39,"tag":47,"props":4274,"children":4275},{},[4276],{"type":39,"tag":149,"props":4277,"children":4278},{},[4279],{"type":44,"value":4280},"Run fuzzing:",{"type":39,"tag":196,"props":4282,"children":4284},{"className":261,"code":4283,"language":263,"meta":201,"style":201},".\u002Ffuzz --input seeds\u002F --cores 0\n",[4285],{"type":39,"tag":204,"props":4286,"children":4287},{"__ignoreMap":201},[4288],{"type":39,"tag":208,"props":4289,"children":4290},{"class":210,"line":211},[4291,4295,4299,4303,4307],{"type":39,"tag":208,"props":4292,"children":4293},{"style":273},[4294],{"type":44,"value":382},{"type":39,"tag":208,"props":4296,"children":4297},{"style":279},[4298],{"type":44,"value":2467},{"type":39,"tag":208,"props":4300,"children":4301},{"style":279},[4302],{"type":44,"value":3988},{"type":39,"tag":208,"props":4304,"children":4305},{"style":279},[4306],{"type":44,"value":2457},{"type":39,"tag":208,"props":4308,"children":4309},{"style":513},[4310],{"type":44,"value":4311}," 0\n",{"type":39,"tag":53,"props":4313,"children":4315},{"id":4314},"troubleshooting",[4316],{"type":44,"value":4317},"Troubleshooting",{"type":39,"tag":60,"props":4319,"children":4320},{},[4321,4342],{"type":39,"tag":64,"props":4322,"children":4323},{},[4324],{"type":39,"tag":68,"props":4325,"children":4326},{},[4327,4332,4337],{"type":39,"tag":72,"props":4328,"children":4329},{},[4330],{"type":44,"value":4331},"Problem",{"type":39,"tag":72,"props":4333,"children":4334},{},[4335],{"type":44,"value":4336},"Cause",{"type":39,"tag":72,"props":4338,"children":4339},{},[4340],{"type":44,"value":4341},"Solution",{"type":39,"tag":88,"props":4343,"children":4344},{},[4345,4369,4387,4424,4442,4466,4484,4522],{"type":39,"tag":68,"props":4346,"children":4347},{},[4348,4353,4358],{"type":39,"tag":95,"props":4349,"children":4350},{},[4351],{"type":44,"value":4352},"No coverage increases",{"type":39,"tag":95,"props":4354,"children":4355},{},[4356],{"type":44,"value":4357},"Instrumentation failed",{"type":39,"tag":95,"props":4359,"children":4360},{},[4361,4363],{"type":44,"value":4362},"Verify compiler wrapper used, check for ",{"type":39,"tag":204,"props":4364,"children":4366},{"className":4365},[],[4367],{"type":44,"value":4368},"-fsanitize-coverage",{"type":39,"tag":68,"props":4370,"children":4371},{},[4372,4377,4382],{"type":39,"tag":95,"props":4373,"children":4374},{},[4375],{"type":44,"value":4376},"Fuzzer won't start",{"type":39,"tag":95,"props":4378,"children":4379},{},[4380],{"type":44,"value":4381},"Empty corpus with no interesting inputs",{"type":39,"tag":95,"props":4383,"children":4384},{},[4385],{"type":44,"value":4386},"Provide seed inputs that trigger code paths",{"type":39,"tag":68,"props":4388,"children":4389},{},[4390,4401,4406],{"type":39,"tag":95,"props":4391,"children":4392},{},[4393,4395],{"type":44,"value":4394},"Linker errors with ",{"type":39,"tag":204,"props":4396,"children":4398},{"className":4397},[],[4399],{"type":44,"value":4400},"libafl_main",{"type":39,"tag":95,"props":4402,"children":4403},{},[4404],{"type":44,"value":4405},"Runtime not linked",{"type":39,"tag":95,"props":4407,"children":4408},{},[4409,4410,4416,4418],{"type":44,"value":2805},{"type":39,"tag":204,"props":4411,"children":4413},{"className":4412},[],[4414],{"type":44,"value":4415},"-Wl,--whole-archive",{"type":44,"value":4417}," or ",{"type":39,"tag":204,"props":4419,"children":4421},{"className":4420},[],[4422],{"type":44,"value":4423},"-u libafl_main",{"type":39,"tag":68,"props":4425,"children":4426},{},[4427,4432,4437],{"type":39,"tag":95,"props":4428,"children":4429},{},[4430],{"type":44,"value":4431},"LLVM version mismatch",{"type":39,"tag":95,"props":4433,"children":4434},{},[4435],{"type":44,"value":4436},"LibAFL requires LLVM 15-18",{"type":39,"tag":95,"props":4438,"children":4439},{},[4440],{"type":44,"value":4441},"Install compatible LLVM version, set environment variables",{"type":39,"tag":68,"props":4443,"children":4444},{},[4445,4450,4455],{"type":39,"tag":95,"props":4446,"children":4447},{},[4448],{"type":44,"value":4449},"Rust compilation fails",{"type":39,"tag":95,"props":4451,"children":4452},{},[4453],{"type":44,"value":4454},"Outdated Rust or Cargo",{"type":39,"tag":95,"props":4456,"children":4457},{},[4458,4460],{"type":44,"value":4459},"Update Rust with ",{"type":39,"tag":204,"props":4461,"children":4463},{"className":4462},[],[4464],{"type":44,"value":4465},"rustup update",{"type":39,"tag":68,"props":4467,"children":4468},{},[4469,4474,4479],{"type":39,"tag":95,"props":4470,"children":4471},{},[4472],{"type":44,"value":4473},"Slow fuzzing",{"type":39,"tag":95,"props":4475,"children":4476},{},[4477],{"type":44,"value":4478},"Sanitizers enabled",{"type":39,"tag":95,"props":4480,"children":4481},{},[4482],{"type":44,"value":4483},"Expected 2-5x slowdown, necessary for finding bugs",{"type":39,"tag":68,"props":4485,"children":4486},{},[4487,4492,4517],{"type":39,"tag":95,"props":4488,"children":4489},{},[4490],{"type":44,"value":4491},"Environment variable interference",{"type":39,"tag":95,"props":4493,"children":4494},{},[4495,4501,4503,4509,4510,4515],{"type":39,"tag":204,"props":4496,"children":4498},{"className":4497},[],[4499],{"type":44,"value":4500},"CC",{"type":44,"value":4502},", ",{"type":39,"tag":204,"props":4504,"children":4506},{"className":4505},[],[4507],{"type":44,"value":4508},"CXX",{"type":44,"value":4502},{"type":39,"tag":204,"props":4511,"children":4513},{"className":4512},[],[4514],{"type":44,"value":2880},{"type":44,"value":4516}," set",{"type":39,"tag":95,"props":4518,"children":4519},{},[4520],{"type":44,"value":4521},"Unset after building LibAFL project",{"type":39,"tag":68,"props":4523,"children":4524},{},[4525,4530,4535],{"type":39,"tag":95,"props":4526,"children":4527},{},[4528],{"type":44,"value":4529},"Cannot attach debugger",{"type":39,"tag":95,"props":4531,"children":4532},{},[4533],{"type":44,"value":4534},"Multi-process fuzzing",{"type":39,"tag":95,"props":4536,"children":4537},{},[4538],{"type":44,"value":4539},"Run in single-process mode (see Debugging section)",{"type":39,"tag":53,"props":4541,"children":4543},{"id":4542},"related-skills",[4544],{"type":44,"value":4545},"Related Skills",{"type":39,"tag":395,"props":4547,"children":4549},{"id":4548},"technique-skills",[4550],{"type":44,"value":4551},"Technique Skills",{"type":39,"tag":60,"props":4553,"children":4554},{},[4555,4571],{"type":39,"tag":64,"props":4556,"children":4557},{},[4558],{"type":39,"tag":68,"props":4559,"children":4560},{},[4561,4566],{"type":39,"tag":72,"props":4562,"children":4563},{},[4564],{"type":44,"value":4565},"Skill",{"type":39,"tag":72,"props":4567,"children":4568},{},[4569],{"type":44,"value":4570},"Use Case",{"type":39,"tag":88,"props":4572,"children":4573},{},[4574,4589,4604,4619,4635,4651],{"type":39,"tag":68,"props":4575,"children":4576},{},[4577,4584],{"type":39,"tag":95,"props":4578,"children":4579},{},[4580],{"type":39,"tag":149,"props":4581,"children":4582},{},[4583],{"type":44,"value":1199},{"type":39,"tag":95,"props":4585,"children":4586},{},[4587],{"type":44,"value":4588},"Detailed guidance on writing effective harnesses",{"type":39,"tag":68,"props":4590,"children":4591},{},[4592,4599],{"type":39,"tag":95,"props":4593,"children":4594},{},[4595],{"type":39,"tag":149,"props":4596,"children":4597},{},[4598],{"type":44,"value":2417},{"type":39,"tag":95,"props":4600,"children":4601},{},[4602],{"type":44,"value":4603},"Memory error detection during fuzzing",{"type":39,"tag":68,"props":4605,"children":4606},{},[4607,4614],{"type":39,"tag":95,"props":4608,"children":4609},{},[4610],{"type":39,"tag":149,"props":4611,"children":4612},{},[4613],{"type":44,"value":2424},{"type":39,"tag":95,"props":4615,"children":4616},{},[4617],{"type":44,"value":4618},"Undefined behavior detection",{"type":39,"tag":68,"props":4620,"children":4621},{},[4622,4630],{"type":39,"tag":95,"props":4623,"children":4624},{},[4625],{"type":39,"tag":149,"props":4626,"children":4627},{},[4628],{"type":44,"value":4629},"coverage-analysis",{"type":39,"tag":95,"props":4631,"children":4632},{},[4633],{"type":44,"value":4634},"Measuring and improving code coverage",{"type":39,"tag":68,"props":4636,"children":4637},{},[4638,4646],{"type":39,"tag":95,"props":4639,"children":4640},{},[4641],{"type":39,"tag":149,"props":4642,"children":4643},{},[4644],{"type":44,"value":4645},"fuzzing-corpus",{"type":39,"tag":95,"props":4647,"children":4648},{},[4649],{"type":44,"value":4650},"Building and managing seed corpora",{"type":39,"tag":68,"props":4652,"children":4653},{},[4654,4661],{"type":39,"tag":95,"props":4655,"children":4656},{},[4657],{"type":39,"tag":149,"props":4658,"children":4659},{},[4660],{"type":44,"value":3266},{"type":39,"tag":95,"props":4662,"children":4663},{},[4664],{"type":44,"value":4665},"Creating dictionaries for format-aware fuzzing",{"type":39,"tag":395,"props":4667,"children":4669},{"id":4668},"related-fuzzers",[4670],{"type":44,"value":4671},"Related Fuzzers",{"type":39,"tag":60,"props":4673,"children":4674},{},[4675,4690],{"type":39,"tag":64,"props":4676,"children":4677},{},[4678],{"type":39,"tag":68,"props":4679,"children":4680},{},[4681,4685],{"type":39,"tag":72,"props":4682,"children":4683},{},[4684],{"type":44,"value":4565},{"type":39,"tag":72,"props":4686,"children":4687},{},[4688],{"type":44,"value":4689},"When to Consider",{"type":39,"tag":88,"props":4691,"children":4692},{},[4693,4709,4725],{"type":39,"tag":68,"props":4694,"children":4695},{},[4696,4704],{"type":39,"tag":95,"props":4697,"children":4698},{},[4699],{"type":39,"tag":149,"props":4700,"children":4701},{},[4702],{"type":44,"value":4703},"libfuzzer",{"type":39,"tag":95,"props":4705,"children":4706},{},[4707],{"type":44,"value":4708},"Simpler setup, don't need LibAFL's advanced features",{"type":39,"tag":68,"props":4710,"children":4711},{},[4712,4720],{"type":39,"tag":95,"props":4713,"children":4714},{},[4715],{"type":39,"tag":149,"props":4716,"children":4717},{},[4718],{"type":44,"value":4719},"aflpp",{"type":39,"tag":95,"props":4721,"children":4722},{},[4723],{"type":44,"value":4724},"Multi-core fuzzing without custom fuzzer development",{"type":39,"tag":68,"props":4726,"children":4727},{},[4728,4736],{"type":39,"tag":95,"props":4729,"children":4730},{},[4731],{"type":39,"tag":149,"props":4732,"children":4733},{},[4734],{"type":44,"value":4735},"cargo-fuzz",{"type":39,"tag":95,"props":4737,"children":4738},{},[4739],{"type":44,"value":4740},"Fuzzing Rust projects with less setup",{"type":39,"tag":53,"props":4742,"children":4744},{"id":4743},"resources",[4745],{"type":44,"value":4746},"Resources",{"type":39,"tag":395,"props":4748,"children":4750},{"id":4749},"official-documentation",[4751],{"type":44,"value":4752},"Official Documentation",{"type":39,"tag":155,"props":4754,"children":4755},{},[4756,4770,4782],{"type":39,"tag":159,"props":4757,"children":4758},{},[4759,4768],{"type":39,"tag":4760,"props":4761,"children":4765},"a",{"href":4762,"rel":4763},"https:\u002F\u002Faflplus.plus\u002Flibafl-book\u002F",[4764],"nofollow",[4766],{"type":44,"value":4767},"LibAFL Book",{"type":44,"value":4769}," - Official handbook with comprehensive documentation",{"type":39,"tag":159,"props":4771,"children":4772},{},[4773,4780],{"type":39,"tag":4760,"props":4774,"children":4777},{"href":4775,"rel":4776},"https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FLibAFL",[4764],[4778],{"type":44,"value":4779},"LibAFL GitHub",{"type":44,"value":4781}," - Source code and examples",{"type":39,"tag":159,"props":4783,"children":4784},{},[4785,4792],{"type":39,"tag":4760,"props":4786,"children":4789},{"href":4787,"rel":4788},"https:\u002F\u002Fdocs.rs\u002Flibafl\u002Flatest\u002Flibafl\u002F",[4764],[4790],{"type":44,"value":4791},"LibAFL API Documentation",{"type":44,"value":4793}," - Rust API reference",{"type":39,"tag":395,"props":4795,"children":4797},{"id":4796},"examples-and-tutorials",[4798],{"type":44,"value":4799},"Examples and Tutorials",{"type":39,"tag":155,"props":4801,"children":4802},{},[4803,4815,4827],{"type":39,"tag":159,"props":4804,"children":4805},{},[4806,4813],{"type":39,"tag":4760,"props":4807,"children":4810},{"href":4808,"rel":4809},"https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FLibAFL\u002Ftree\u002Fmain\u002Ffuzzers",[4764],[4811],{"type":44,"value":4812},"LibAFL Examples",{"type":44,"value":4814}," - Collection of example fuzzers",{"type":39,"tag":159,"props":4816,"children":4817},{},[4818,4825],{"type":39,"tag":4760,"props":4819,"children":4822},{"href":4820,"rel":4821},"https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FLibAFL\u002Ftree\u002Fmain\u002Ffuzzers\u002Ffuzz_anything\u002Fcargo_fuzz",[4764],[4823],{"type":44,"value":4824},"cargo-fuzz with LibAFL",{"type":44,"value":4826}," - Using LibAFL as cargo-fuzz backend",{"type":39,"tag":159,"props":4828,"children":4829},{},[4830,4837],{"type":39,"tag":4760,"props":4831,"children":4834},{"href":4832,"rel":4833},"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Ftesting-handbook\u002Ftree\u002Fmain\u002Fmaterials\u002Ffuzzing\u002Flibafl",[4764],[4835],{"type":44,"value":4836},"Testing Handbook LibAFL Examples",{"type":44,"value":4838}," - Complete working examples from this handbook",{"type":39,"tag":4840,"props":4841,"children":4842},"style",{},[4843],{"type":44,"value":4844},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4846,"total":4998},[4847,4861,4870,4890,4905,4918,4930,4940,4953,4964,4976,4987],{"slug":2417,"name":2417,"fn":4848,"description":4849,"org":4850,"tags":4851,"stars":20,"repoUrl":21,"updatedAt":4860},"detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4852,4855,4858,4859],{"name":4853,"slug":4854,"type":16},"C#","c",{"name":4856,"slug":4857,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":18,"slug":19,"type":16},"2026-07-17T06:05:14.925095",{"slug":4719,"name":4719,"fn":4862,"description":4863,"org":4864,"tags":4865,"stars":20,"repoUrl":21,"updatedAt":4869},"perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4866,4867,4868],{"name":4853,"slug":4854,"type":16},{"name":14,"slug":15,"type":16},{"name":18,"slug":19,"type":16},"2026-07-17T06:05:12.433192",{"slug":4871,"name":4871,"fn":4872,"description":4873,"org":4874,"tags":4875,"stars":20,"repoUrl":21,"updatedAt":4889},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4876,4879,4882,4885,4888],{"name":4877,"slug":4878,"type":16},"Agents","agents",{"name":4880,"slug":4881,"type":16},"CI\u002FCD","ci-cd",{"name":4883,"slug":4884,"type":16},"Code Analysis","code-analysis",{"name":4886,"slug":4887,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":4891,"name":4891,"fn":4892,"description":4893,"org":4894,"tags":4895,"stars":20,"repoUrl":21,"updatedAt":4904},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4896,4899,4900,4901],{"name":4897,"slug":4898,"type":16},"Audit","audit",{"name":4883,"slug":4884,"type":16},{"name":14,"slug":15,"type":16},{"name":4902,"slug":4903,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":4906,"name":4906,"fn":4907,"description":4908,"org":4909,"tags":4910,"stars":20,"repoUrl":21,"updatedAt":4917},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4911,4914],{"name":4912,"slug":4913,"type":16},"Engineering","engineering",{"name":4915,"slug":4916,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":4919,"name":4919,"fn":4920,"description":4921,"org":4922,"tags":4923,"stars":20,"repoUrl":21,"updatedAt":4929},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4924,4927,4928],{"name":4925,"slug":4926,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":18,"slug":19,"type":16},"2026-07-17T06:05:14.575191",{"slug":4931,"name":4931,"fn":4932,"description":4933,"org":4934,"tags":4935,"stars":20,"repoUrl":21,"updatedAt":4939},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4936,4937,4938],{"name":4897,"slug":4898,"type":16},{"name":4883,"slug":4884,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":4941,"name":4941,"fn":4942,"description":4943,"org":4944,"tags":4945,"stars":20,"repoUrl":21,"updatedAt":4952},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4946,4949,4950,4951],{"name":4947,"slug":4948,"type":16},"Architecture","architecture",{"name":4897,"slug":4898,"type":16},{"name":4883,"slug":4884,"type":16},{"name":4912,"slug":4913,"type":16},"2026-07-18T05:47:40.122449",{"slug":4954,"name":4954,"fn":4955,"description":4956,"org":4957,"tags":4958,"stars":20,"repoUrl":21,"updatedAt":4963},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4959,4960,4961,4962],{"name":4897,"slug":4898,"type":16},{"name":4883,"slug":4884,"type":16},{"name":4912,"slug":4913,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":4965,"name":4965,"fn":4966,"description":4967,"org":4968,"tags":4969,"stars":20,"repoUrl":21,"updatedAt":4975},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4970,4971,4974],{"name":4897,"slug":4898,"type":16},{"name":4972,"slug":4973,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":4977,"name":4977,"fn":4978,"description":4979,"org":4980,"tags":4981,"stars":20,"repoUrl":21,"updatedAt":4986},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4982,4983,4984,4985],{"name":4897,"slug":4898,"type":16},{"name":4853,"slug":4854,"type":16},{"name":4883,"slug":4884,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":4988,"name":4988,"fn":4989,"description":4990,"org":4991,"tags":4992,"stars":20,"repoUrl":21,"updatedAt":4997},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4993,4994,4995,4996],{"name":4897,"slug":4898,"type":16},{"name":4883,"slug":4884,"type":16},{"name":14,"slug":15,"type":16},{"name":4902,"slug":4903,"type":16},"2026-07-18T05:47:42.84568",111,{"items":5000,"total":1971},[5001,5008,5014,5022,5029,5034,5040],{"slug":2417,"name":2417,"fn":4848,"description":4849,"org":5002,"tags":5003,"stars":20,"repoUrl":21,"updatedAt":4860},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5004,5005,5006,5007],{"name":4853,"slug":4854,"type":16},{"name":4856,"slug":4857,"type":16},{"name":14,"slug":15,"type":16},{"name":18,"slug":19,"type":16},{"slug":4719,"name":4719,"fn":4862,"description":4863,"org":5009,"tags":5010,"stars":20,"repoUrl":21,"updatedAt":4869},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5011,5012,5013],{"name":4853,"slug":4854,"type":16},{"name":14,"slug":15,"type":16},{"name":18,"slug":19,"type":16},{"slug":4871,"name":4871,"fn":4872,"description":4873,"org":5015,"tags":5016,"stars":20,"repoUrl":21,"updatedAt":4889},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5017,5018,5019,5020,5021],{"name":4877,"slug":4878,"type":16},{"name":4880,"slug":4881,"type":16},{"name":4883,"slug":4884,"type":16},{"name":4886,"slug":4887,"type":16},{"name":14,"slug":15,"type":16},{"slug":4891,"name":4891,"fn":4892,"description":4893,"org":5023,"tags":5024,"stars":20,"repoUrl":21,"updatedAt":4904},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5025,5026,5027,5028],{"name":4897,"slug":4898,"type":16},{"name":4883,"slug":4884,"type":16},{"name":14,"slug":15,"type":16},{"name":4902,"slug":4903,"type":16},{"slug":4906,"name":4906,"fn":4907,"description":4908,"org":5030,"tags":5031,"stars":20,"repoUrl":21,"updatedAt":4917},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5032,5033],{"name":4912,"slug":4913,"type":16},{"name":4915,"slug":4916,"type":16},{"slug":4919,"name":4919,"fn":4920,"description":4921,"org":5035,"tags":5036,"stars":20,"repoUrl":21,"updatedAt":4929},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5037,5038,5039],{"name":4925,"slug":4926,"type":16},{"name":14,"slug":15,"type":16},{"name":18,"slug":19,"type":16},{"slug":4931,"name":4931,"fn":4932,"description":4933,"org":5041,"tags":5042,"stars":20,"repoUrl":21,"updatedAt":4939},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[5043,5044,5045],{"name":4897,"slug":4898,"type":16},{"name":4883,"slug":4884,"type":16},{"name":14,"slug":15,"type":16}]