Skip to content

Latest commit

 

History

History
20 lines (15 loc) · 754 Bytes

README.ngram.md

File metadata and controls

20 lines (15 loc) · 754 Bytes

AFL N-Gram Branch Coverage

Source

This is an LLVM-based implementation of the n-gram branch coverage proposed in the paper "Be Sensitive and Collaborative: Analzying Impact of Coverage Metrics in Greybox Fuzzing", by Jinghan Wang, et. al.

Note that the original implementation (available here) is built on top of AFL's QEMU mode. This is essentially a port that uses LLVM vectorized instructions to achieve the same results when compiling source code.

Usage

The size of n (i.e., the number of branches to remember) is an option that is specified in the AFL_LLVM_NGRAM_SIZE environment variable. Good values are 2, 4 or 8.