ns-slapd

title: ns-slapd(8)

summary: The main Directory Server daemon

text:
# ns-slapd(8)

## NAME
ns‐slapd - The main Directory Server daemon

## SYNOPSIS
ns-slapd -D configdir [-d debuglevel] [-i pidlogfile] [-v] [-V]

## DESCRIPTION
ns‐slapd launches the LDAP Directory Server

## OPTIONS
A summary of options is included below:

-v

Show version of program.

-D configdir

Specifies the configuration directory pointing at the instance to be started (e.g. /etc/dirsrv/slapd‐localhost)

-d debuglevel

Specifies the debuglevel to be used

-i pidlogfile

Specifies file where the pid of the process will be stored

## AUTHOR
ns-slapd was written by the 389 Project.

## REPORTING BUGS
Report bugs to https://github.com/389ds/389-ds-base/issues/new

## COPYRIGHT
Copyright © 2001 Sun Microsystems, Inc. Used by permission.

Copyright © 2017 Red Hat, Inc.

This manual page was written by Michele Baldessari <michele@pupazzo.org>, for the Debian project (but may be used by others).

This is free software. You may redistribute copies of it under the terms of the Directory Server license found in the LICENSE file of this software distribution. This license is essentially the GNU General Public License version 2 with an exception for plug‐in distribution.


title: openldap_to_ds(8)

text:
# openldap_to_ds(8)

## NAME
openldap_to_ds

## SYNOPSIS
openldap_to_ds [-h] [-v] [--confirm] [--ignore-overlay [IGNORE_OVERLAY ...]] [--ignore-schema-oid [IGNORE_SCHEMA_OID ...]] [--ignore-attribute [IGNORE_ATTRIBUTE ...]] [-D BINDDN] [-w BINDPW] [-W] [-y PWDFILE] [-Z] instance slapd_config [slapd_ldif ...]

## DESCRIPTION
Migrate from OpenLDAP to 389 Directory Server.

This command automates the process of converting an OpenLDAP server to a 389 Directory Server instance. This is a "best effort" as OpenLDAP and 389 Directory Server are not identical, so some features still may require hand migration, or can not be migrated at all. This tool intends to migrate the majority of major content such as database data, index configuration, schema and some overlays (plugins).

Content we can migrate:

* Schema * Database content (from ldif backup) * Database indexes * MemberOf Overlay (memberof) * Referential Integrity Overlay (refint) * Attribute Unique Overlay (unique)

Some content that can *not* be migrated include some overlays (plugins), access controls and replication configuration. Examples of plugins that can not be migrated:

* Access/Audit logging (built into 389-ds by default) * Chaining (Requires manual migration, may not be equivalent) * Constraints (No equivalent plugin) * Dynamic Directory Services (Requires manual migration to Class of Service Plugin) * Dynamic Groups/Lists (Requires manual migration to Roles Plugin) * Proxy Cache (No equivalent plugin, 389-ds supports read-only replicas) * Password Policy (Built into 389-ds, requires manual migration) * Rewrite/Remap (No equivalent plugin) * Sync Provider (Requires manual migration to Replication OR Content Sync Plugin) * Value Sorting (No equivalent plugin)

This must be run on the server running the 389 Directory Instance as it requires filesystem access. You must run this tool as either root or dirsrv users.

The following is required from your openldap instance:

* slapd.d configuration directory in ldif/dynamic format

* (optional) ldif file backup of the database from slapcat

These can be created on the OpenLDAP host and copied to the 389 Directory Server host. No destructive actions are applied to the OpenLDAP instance.

If you are already using the ldif/dynamic format from /etc/openldap/slapd.d, you should take a copy of this to use in the migration.

cp -a /etc/openldap/slapd.d /root/slapd.d

If you are using the slapd.conf configuration file, you can convert this to the dynamic configuration without affecting your running instance with:

slaptest -f /etc/openldap/slapd.conf -F /root/slapd.d

To optionally allow your database content to be migrated you may create an ldif backup of the content that 389 Directory Server can import. You must run this for each backend (suffix) of your instance with the command:

\# If using slapd.conf config format

slapcat -f /etc/openldap/slapd.conf -b SUFFIX -l /root/suffix.ldif

\# If using slapd.d config format

slapcat -F /etc/openldap/slapd.d -b SUFFIX -l /root/suffix.ldif

You must already have a 389 Directory Server you want to import into. You can create this with the `dscreate` tool. Data and configuration in this instance WILL be modified or removed (ie potentially destructive actions).

It is strongly advised you test this tool on a non-production system first to be sure the process and changes are understood.

This only needs to be run on the first-instance in a 389 Directory Server topology. All other replicas should be configured from this instance post migration.

## OPTIONS
instance

The name of the 389-ds instance to have openldap data migrated into

slapd_config

The path to the openldap slapd.d configuration that will be migrated

slapd_ldif

The path to exported database ldifs to be imported.

-v, --verbose

Display verbose operation tracing during command execution

--confirm

Confirm that you want to apply these migration actions to the 389-ds instance. By default no actions are taken.

--ignore-overlay [IGNORE_OVERLAY ...]

Ignore the following openldap overlays from having their configuration migrated to equivalent 389-ds plugins. Valid options are memberof, refint, unique.

--ignore-schema-oid [IGNORE_SCHEMA_OID ...]

Ignore the following openldap schema attribute or class OIDS from being migrated to 389-ds. This *may* create inconsistent schema which could cause the migration to fail. Use with caution.

--ignore-attribute [IGNORE_ATTRIBUTE ...]

Ignore the following attributes from entries that are loaded from the ldif. For example, you may not want to import userPassword hashes.

-D BINDDN, --binddn BINDDN

The 389 Directory Server account to bind as for executing migration operations

-w BINDPW, --bindpw BINDPW

Password for binddn

-W, --prompt

Prompt for password for the bind DN

-y PWDFILE, --pwdfile PWDFILE

Specifies a file containing the password for the binddn

-Z, --starttls

Connect to 389 Directory Server with StartTLS

## AUTHORS
lib389 was written by Red Hat, Inc., and William Brown <389-devel@lists.fedoraproject.org>.

## DISTRIBUTION
The latest version of lib389 may be downloaded from http://www.port389.org/docs/389ds/FAQ/upstream-test-framework.html


title: 3proxy(8)

text:
# 3proxy(8)

## NAME
3proxy - 3[APA3A] tiny proxy server, or trivial proxy server, or free proxy server

## SYNOPSIS
3proxy [config_file]

3proxy [--install]

3proxy [--remove]

## DESCRIPTION
3proxy is universal proxy server. It can be used to provide internal users wuth fully controllable access to external resources or to provide external users with access to internal resources. 3proxy is not developed to replace squid(8), but it can extend functionality of existing cashing proxy. It can be used to route requests between different types of clients and proxy servers. Think about it as application level gateway with configuration like hardware router has for network layer. It can establish multiple gateways with HTTP and HTTPS proxy with FTP over HTTP support, SOCKS v4, v4.5 and v5, POP3 proxy, UDP and TCP portmappers. Each gateway is started from configuration file like independant service proxy(8) socks(8) pop3p(8) tcppm(8) udppm(8) ftppr(8) dnspr but 3proxy is not a kind of wrapper or superserver for this daemons. It just has same code compiled in, but provides much more functionality. SOCKSv5 implementatation allows to use 3proxy with any UDP or TCP based client applications designed without proxy support (with SocksCAP, FreeCAP or another client-side redirector under Windows of with socksification library under Unix). So you can play your favourite games, listen music, exchange files and messages and even accept incoming connections behind proxy server.

dnspr does not exist as independant service. It´ DNS caching proxy (it requires nscache and nserver to be set in configuration. Only A-records are cached. Please note, the this caching is mostly a 'hack' and has nothing to do with real DNS server, but it works perfectly for SOHO networks.

3proxy supports access control lists (ACL) like network router. Source and destination networks and destination port can be specified. In addition, usernames and gateway action (for example GET or POST) can be used in ACLs. In order to filter request on username basis user must be authenticated somehow. There are few authentication types including password authentication and authentication by NetBIOS name for Windows clients (it´s very like ident authentication). Depending on ACL action request can be allowed, denied or redirected to another host or to another proxy server or even to a chain of proxy servers.

It supports different types of logging: to logfiles, syslog(3) (only under Unix) or to ODBC database. Logging format is turnable to provide compatibility with existing log file parsers. It makes it possible to use 3proxy with IIS, ISA, Apache or Squid log parsers.

## OPTIONS
config_file

Name of config file. See 3proxy.cfg(3) for configuration file format. Under Windows, if config_file is not specified, 3proxy looks for file named 3proxy.cfg in the default location (in same directory with executable file and in current directory). Under Unix, if no config file is specified, 3proxy reads configuration from stdin. It makes it possible to use 3proxy.cfg file as executable script just by setting +x mode and adding

\#!/usr/local/3proxy/3proxy

as a first line in 3proxy.cfg

--install

(Windows NT family only) install 3proxy as a system service

--remove

(Windows NT family only) remove 3proxy from system services

## SIGNALS
Under Unix there are few signals 3proxy catches. See kill(1).

SIGTERM

cleanup connections and exit

SIGPAUSE

stop to accept new connections, on second signal - start and re-read configuration

SIGCONT

start to accept new conenctions

SIGUSR1

reload configuration

Under Windows, if 3proxy is installed as service you can standard service management to start, stop, pause and continue 3proxy service, for example:

net start 3proxy

net stop 3proxy

net pause 3proxy

net continue 3proxy

Web admin service can also be used to reload configuration. Use wget to automate this task.

## FILES
/usr/local/3proxy/3proxy.cfg (3proxy.cfg)

3proxy configuration file

## BUGS
Report all bugs to 3proxy@security.nnov.ru

## SEE ALSO
3proxy.cfg(3), proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), kill(1), syslogd(8),

http://3proxy.ru/

## TRIVIA
3APA3A is pronounced as ``zaraza´´.

## AUTHORS
3proxy is designed by 3APA3A (3APA3A@security.nnov.ru), Vladimir Dubrovin (vlad@sandy.ru)


ftppr

title: ftppr(8)

summary: FTP proxy gateway service

text:
# ftppr(8)

## NAME
ftppr - FTP proxy gateway service

## SYNOPSIS
ftppr [-d] [-l[[@]logfile]] [-pport] [-iinternal_ip] [-eexternal_ip] [-hdefault_ip[:port]]

## DESCRIPTION
ftppr is FTP gateway service to allow internal users to access external FTP servers.

## OPTIONS
-I

Inetd mode. Standalone service only.

-d

Daemonise. Detach service from console and run in the background.

-t

Be silenT. Do not log start/stop/accept error records.

-u

Never look for username authentication.

-e

External address. IP address of interface proxy should initiate connections from. By default system will deside which address to use in accordance with routing table.

-i

Internal address. IP address proxy accepts connections to. By default connection to any interface is accepted. It´s usually unsafe.

-h

Default destination. It's used if targed address is not specified by user.

-p

Port. Port proxy listens for incoming connections. Default is 21.

-l

Log. By default logging is to stdout. If logfile is specified logging is to file. Under Unix, if ´@´ preceeds logfile, syslog is used for logging.

## CLIENTS
You can use any FTP client, regardless of FTP proxy support. For client with FTP proxy support configure internal_ip and port in FTP proxy parameters. For clients without FTP proxy support use internal_ip and port as FTP server. Address of real FTP server must be configured as a part of FTP username. Format for username is username@server, where server is address of FTP server and username is user´s login on this FTP server. Login itself may contain ´@´ sign. Only cleartext authentication is currently supported.

## BUGS
Report all bugs to 3proxy@security.nnov.ru

## SEE ALSO
3proxy(8), proxy(8), pop3p(8), socks(8), tcppm(8), udppm(8), syslogd(8),

http://3proxy.ru/

## AUTHORS
3proxy is designed by 3APA3A (3APA3A@security.nnov.ru), Vladimir Dubrovin (vlad@sandy.ru)


icqpr

title: icqpr(8)

summary: ICQ (AOL OSCAR) proxy

text:
# icqpr(8)

## NAME
icqpr - ICQ (AOL OSCAR) proxy

## SYNOPSIS
icqpr [-d] [-l[[@]logfile]] [-iinternal_ip] [-eexternal_ip] local_port remote_host remote_port

## DESCRIPTION
icqpr forwards ICQ connections from local to remote ICQ host. Most usual is icqpr 5190 login.icq.com 5190

## OPTIONS
-I

Inetd mode. Standalone service only.

-d

Daemonise. Detach service from console and run in the background.

-t

Be silenT. Do not log start/stop/accept error records.

-e

External address. IP address of interface proxy should initiate connections from. By default system will deside which address to use in accordance with routing table.

-i

Internal address. IP address proxy accepts connections to. By default connection to any interface is accepted. It´s usually unsafe.

-l

Log. By default logging is to stdout. If logfile is specified logging is to file. Under Unix, if ´@´ preceeds logfile, syslog is used for logging.

## ARGUMENTS
local_port

- port icqpr accepts connection

remote_host

- IP address of the host connection is forwarded to

remote_port

- remote port connection is forwarded to

## CLIENTS
You can use any ICQ/AOL client where server address configuration is supported or spoof login server name (e.g. login.icq.com) with IP address of proxy server via DNS record or hosts file. Use internal_ip and local_port as a destination in client application. Connection is forwarded to remote_host:remote_port

## BUGS
Report all bugs to 3proxy@security.nnov.ru

## SEE ALSO
3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8), syslogd(8),

http://3proxy.ru/

## AUTHORS
3proxy is designed by 3APA3A (3APA3A@security.nnov.ru), Vladimir Dubrovin (vlad@sandy.ru)


title: pop3p(8)

summary: POP3 proxy gateway service

text:
# pop3p(8)

## NAME
pop3p - POP3 proxy gateway service

## SYNOPSIS
pop3p [-d] [-l[[@]logfile]] [-pport] [-iinternal_ip] [-eexternal_ip] [-hdefault_ip[:port]]

## DESCRIPTION
pop3p is POP3 gateway service to allow internal users to access external POP3 servers.

## OPTIONS
-I

Inetd mode. Standalone service only.

-d

Daemonise. Detach service from console and run in the background.

-t

Be silenT. Do not log start/stop/accept error records.

-u

Never look for username authentication.

-e

External address. IP address of interface proxy should initiate connections from. By default system will deside which address to use in accordance with routing table.

-i

Internal address. IP address proxy accepts connections to. By default connection to any interface is accepted. It´s usually unsafe.

-p

Port. Port proxy listens for incoming connections. Default is 110.

-h

Default destination. It's used if targed address is not specified by user.

-l

Log. By default logging is to stdout. If logfile is specified logging is to file. Under Unix, if ´@´ preceeds logfile, syslog is used for logging.

## CLIENTS
You can use any MUA (Mail User Agent) with POP3 support. Set client to use internal_ip and port as a POP3 server. Address of real POP3 server must be configured as a part of POP3 username. Format for username is username@server, where server is address of POP3 server and username is user´s login on this POP3 server. Login itself may contain ´@´ sign. Only cleartext authentication is supported, because challenge-response authentication (APOP, CRAM-MD5, etc) requires challenge from server before we know which server to connect.

## BUGS
Report all bugs to 3proxy@security.nnov.ru

## SEE ALSO
3proxy(8), ftppr(8), proxy(8), socks(8), tcppm(8), udppm(8), syslogd(8),

http://3proxy.ru/

## AUTHORS
3proxy is designed by 3APA3A (3APA3A@security.nnov.ru), Vladimir Dubrovin (vlad@sandy.ru)


proxy

title: proxy(8)

summary: HTTP proxy gateway service

text:
# proxy(8)

## NAME
proxy - HTTP proxy gateway service

## SYNOPSIS
proxy [-d][-a] [-l[[@]logfile]] [-pport] [-iinternal_ip] [-eexternal_ip]

## DESCRIPTION
proxy is HTTP gateway service with HTTPS and FTP over HTTPS support.

## OPTIONS
-I

Inetd mode. Standalone service only.

-d

Daemonise. Detach service from console and run in the background.

-t

Be silenT. Do not log start/stop/accept error records.

-u

Never ask for username authentication

-e

External address. IP address of interface proxy should initiate connections from. By default system will deside which address to use in accordance with routing table.

-i

Internal address. IP address proxy accepts connections to. By default connection to any interface is accepted. It´s usually unsafe.

-a

Anonymous. Hide information about client.

-a1

Anonymous. Show fake information about client.

-p

Port. Port proxy listens for incoming connections. Default is 3128.

-l

Log. By default logging is to stdout. If logfile is specified logging is to file. Under Unix, if ´@´ preceeds logfile, syslog is used for logging.

## CLIENTS
You should use client with HTTP proxy support or configure router to redirect HTTP traffic to proxy (transparent proxy). Configure client to connect to internal_ip and port. HTTPS support allows to use almost any TCP based protocol. If you need to limit clients, use 3proxy(8) instead.

## BUGS
Report all bugs to 3proxy@security.nnov.ru

## SEE ALSO
3proxy(8), ftppr(8), socks(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),

http://3proxy.ru/

## AUTHORS
3proxy is designed by 3APA3A (3APA3A@security.nnov.ru), Vladimir Dubrovin (vlad@sandy.ru)


smtpp

title: smtpp(8)

summary: SMTP proxy gateway service

text:
# smtpp(8)

## NAME
smtpp - SMTP proxy gateway service

## SYNOPSIS
smtpp [-d] [-l[[@]logfile]] [-pport] [-iinternal_ip] [-eexternal_ip] [-hdefault_ip[:port]]

## DESCRIPTION
smtpp is SMTP gateway service to allow internal users to access external SMTP servers.

## OPTIONS
-I

Inetd mode. Standalone service only.

-d

Daemonise. Detach service from console and run in the background.

-t

Be silenT. Do not log start/stop/accept error records.

-u

Never look for username authentication.

-e

External address. IP address of interface proxy should initiate connections from. By default system will deside which address to use in accordance with routing table.

-i

Internal address. IP address proxy accepts connections to. By default connection to any interface is accepted. It´s usually unsafe.

-p

Port. Port proxy listens for incoming connections. Default is 25.

-h

Default destination. It's used if targed address is not specified by user.

-l

Log. By default logging is to stdout. If logfile is specified logging is to file. Under Unix, if ´@´ preceeds logfile, syslog is used for logging.

## CLIENTS
You can use any MUA (Mail User Agent) with SMTP authentication support. Set client to use internal_ip and port as a SMTP server. Address of real SMTP server must be configured as a part of SMTP username. Format for username is username@server, where server is address of SMTP server and username is user´s login on this SMTP server. Login itself may contain ´@´ sign. Only cleartext authentication is supported, because challenge-response authentication (CRAM-MD5, SPA, etc) requires challenge from server before we know which server to connect.

## BUGS
Report all bugs to 3proxy@security.nnov.ru

## SEE ALSO
3proxy(8), ftppr(8), proxy(8), socks(8), tcppm(8), udppm(8), syslogd(8),

http://3proxy.ru/

## AUTHORS
3proxy is designed by 3APA3A (3APA3A@security.nnov.ru), Vladimir Dubrovin (vlad@sandy.ru)


socks

title: socks(8)

summary: SOCKS 4/4.5/5 gateway service

text:
# socks(8)

## NAME
socks - SOCKS 4/4.5/5 gateway service

## SYNOPSIS
socks [-d] [-l[[@]logfile]] [-pport] [-iinternal_ip] [-eexternal_ip]

## DESCRIPTION
socks is SOCKS server. It supports SOCKSv4, SOCKSv4.5 (extension to v4 for server side name resolution) and SOCKSv5. SOCKSv5 specification allows both outgoing and reverse TCP connections and UDP portmapping.

## OPTIONS
-I

Inetd mode. Standalone service only.

-d

Daemonise. Detach service from console and run in the background.

-t

Be silenT. Do not log start/stop/accept error records.

-u

Never ask for username authentication

-e

External address. IP address of interface proxy should initiate connections from. External IP must be specified if you need incoming connections. By default system will deside which address to use in accordance with routing table.

-i

Internal address. IP address proxy accepts connections to. By default connection to any interface is accepted. It´s usually unsafe.

-p

Port. Port proxy listens for incoming connections. Default is 1080.

-l

Log. By default logging is to stdout. If logfile is specified logging is to file. Under Unix, if ´@´ preceeds logfile, syslog is used for logging.

## CLIENTS
You should use client with SOCKS support or use some socksification support (for example SocksCAP or FreeCAP). Configure client to use internal_ip and port. SOCKS allows to use almost any application protocol without limitation. This implementation also allows to open priviledged port on server (if socks has sufficient privileges). If you need to control access use 3proxy(8) instead.

## BUGS
Report all bugs to 3proxy@security.nnov.ru

## SEE ALSO
3proxy(8), proxy(8), ftppr(8), pop3p(8), tcppm(8), udppm(8), syslogd(8),

http://3proxy.ru/

## AUTHORS
3proxy is designed by 3APA3A (3APA3A@security.nnov.ru), Vladimir Dubrovin (vlad@sandy.ru)


tcppm

title: tcppm(8)

summary: TCP port mapper

text:
# tcppm(8)

## NAME
tcppm - TCP port mapper

## SYNOPSIS
tcppm [-d] [-l[[@]logfile]] [-iinternal_ip] [-eexternal_ip] local_port remote_host remote_port

## DESCRIPTION
tcppm forwards connections from local to remote TCP port

## OPTIONS
-I

Inetd mode. Standalone service only.

-d

Daemonise. Detach service from console and run in the background.

-t

Be silenT. Do not log start/stop/accept error records.

-e

External address. IP address of interface proxy should initiate connections from. By default system will deside which address to use in accordance with routing table.

-i

Internal address. IP address proxy accepts connections to. By default connection to any interface is accepted. It´s usually unsafe.

-l

Log. By default logging is to stdout. If logfile is specified logging is to file. Under Unix, if ´@´ preceeds logfile, syslog is used for logging.

## ARGUMENTS
local_port

- port tcppm accepts connection

remote_host

- IP address of the host connection is forwarded to

remote_port

- remote port connection is forwarded to

## CLIENTS
Any TCP based application can be used as a client. Use internal_ip and local_port as a destination in client application. Connection is forwarded to remote_host:remote_port

## BUGS
Report all bugs to 3proxy@security.nnov.ru

## SEE ALSO
3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8), syslogd(8),

http://3proxy.ru/

## AUTHORS
3proxy is designed by 3APA3A (3APA3A@security.nnov.ru), Vladimir Dubrovin (vlad@sandy.ru)


udppm

title: udppm(8)

summary: UDP port mapper

text:
# udppm(8)

## NAME
udppm - UDP port mapper

## SYNOPSIS
pop3p [-ds] [-l[[@]logfile]] [-iinternal_ip] [-eexternal_ip] local_port remote_host remote_port

## DESCRIPTION
udppm forwards datagrams from local to remote UDP port

## OPTIONS
-I

Inetd mode. Standalone service only.

-d

Daemonise. Detach service from console and run in the background.

-t

Be silenT. Do not log start/stop/accept error records.

-e

External address. IP address of interface proxy should initiate datagrams from. By default system will deside which address to use in accordance with routing table.

-i

Internal address. IP address proxy accepts datagrams to. By default connection to any interface is accepted. It´s usually unsafe.

-l

Log. By default logging is to stdout. If logfile is specified logging is to file. Under Unix, if ´@´ preceeds logfile, syslog is used for logging.

-s

Single packet. By default only one client can use udppm service, but if -s is specified only one packet will be forwarded between client and server. It allows to share service between multiple clients for single packet services (for example name lookups).

## ARGUMENTS
local_port

- port udppm accepts datagrams

remote_host

- IP address of the host datagrams are forwarded to

remote_port

- remote port datagrams are forwarded to

## CLIENTS
Any UDP based application can be used as a client. Use internal_ip and local_port as a destination in client application. All datagrams are forwarded to remote_host:remote_port

## BUGS
Report all bugs to 3proxy@security.nnov.ru

## SEE ALSO
3proxy(8), proxy(8), ftppr(8), socks(8), pop3p(8), udppm(8), syslogd(8),

http://3proxy.ru/

## AUTHORS
3proxy is designed by 3APA3A (3APA3A@security.nnov.ru), Vladimir Dubrovin (vlad@sandy.ru)


afl-addseeds

package: AFLplusplus

title: afl-addseeds(8)

text:
# afl-addseeds(8)

## NAME
afl-addseeds

## SYNOPSIS
Options:

## OPTIONS

```

```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-analyze

title: afl-analyze(8)

text:
# afl-analyze(8)

## NAME
afl-analyze

## SYNOPSIS
afl-analyze [ options ] -- /path/to/target_app [ ... ]

## OPTIONS

```
Required parameters:

  -i file       - input test case to be analyzed by the tool
Execution control settings:

  -f file       - input file read by the tested program (stdin)

  -t msec       - timeout for each run (1000 ms)

  -m megs       - memory limit for child process (0 MB)

  -O            - use binary-only instrumentation (FRIDA mode)

  -Q            - use binary-only instrumentation (QEMU mode)

  -U            - use unicorn-based instrumentation (Unicorn mode)

  -W            - use qemu-based instrumentation with Wine (Wine mode)

  -X            - use Nyx mode
Analysis settings:

  -e            - look for edge coverage only, ignore hit counts
For additional tips, please consult docs/README.md.
Environment variables used:
TMPDIR: directory to use for temporary input files
ASAN_OPTIONS: custom settings for ASAN

              (must contain abort_on_error=1 and symbolize=0)
MSAN_OPTIONS: custom settings for MSAN

              (must contain exitcode=86 and symbolize=0)
AFL_ANALYZE_HEX: print file offsets in hexadecimal instead of decimal
AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc.

                 (default: SIGKILL)
AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server on termination

                             (default: SIGTERM). If unset and AFL_KILL_SIGNAL is

                             set, that value will be used.
AFL_MAP_SIZE: the shared memory size for that target. must be >= the size

              the target was compiled for
AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target
AFL_SKIP_BIN_CHECK: skip checking the location of and the target
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-as

title: afl-as(8)

text:
# afl-as(8)

## NAME
afl-as

## SYNOPSIS
afl-as [-h]

## OPTIONS

```

```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-c++

title: afl-c++(8)

text:
# afl-c++(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-cc

title: afl-cc(8)

text:
# afl-cc(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-clang-fast

title: afl-clang-fast(8)

text:
# afl-clang-fast(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-clang-fast++

title: afl-clang-fast++(8)

text:
# afl-clang-fast++(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-clang-lto

title: afl-clang-lto(8)

text:
# afl-clang-lto(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-clang-lto++

title: afl-clang-lto++(8)

text:
# afl-clang-lto++(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-cmin

title: afl-cmin(8)

text:
# afl-cmin(8)

## NAME
afl-cmin

## SYNOPSIS
afl-cmin [ options ] -- /path/to/target_app [ ... ]

## OPTIONS

```
Required parameters:

  -i dir        - input directory with starting corpus

  -o dir        - output directory for minimized files
Execution control settings:

  -T tasks      - how many parallel tasks to run (default: 1, all=nproc)

  -f file       - location read by the fuzzed program (default: stdin)

  -m megs       - memory limit for child process ( MB)

  -t msec       - run time limit for child process (default: 5000)

  -O            - use binary-only instrumentation (FRIDA mode)

  -Q            - use binary-only instrumentation (QEMU mode)

  -U            - use unicorn-based instrumentation (unicorn mode)

  -X            - use Nyx mode
Minimization settings:

  -A            - allow crashes and timeouts (not recommended)

  -C            - keep crashing inputs, reject everything else

  -e            - solve for edge coverage only, ignore hit counts
For additional tips, please consult README.md
Environment variables used:
AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash
AFL_FORKSRV_INIT_TMOUT: time the fuzzer waits for the forkserver to come up
AFL_KEEP_TRACES: leave the temporary <out_dir>/.traces directory
AFL_KILL_SIGNAL: Signal delivered to child processes on timeout (default: SIGKILL)
AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on

   termination (default: SIGTERM). If this is not set and AFL_KILL_SIGNAL is

   set, this will be set to the same value as AFL_KILL_SIGNAL.
AFL_NO_FORKSRV: run target via execve instead of using the forkserver
AFL_CMIN_ALLOW_ANY: write tuples for crashing inputs also
AFL_PATH: path for the afl-showmap binary if not found anywhere in PATH
AFL_PRINT_FILENAMES: If set, the filename currently processed will be printed to stdout
AFL_SKIP_BIN_CHECK: skip afl instrumentation checks for target binary
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-cmin.bash

title: afl-cmin.bash(8)

text:
# afl-cmin.bash(8)

## NAME
afl-cmin.bash

## SYNOPSIS
Usage: ./afl-cmin.bash [ options ] -- /path/to/target_app [ ... ]

## OPTIONS

```
Required parameters:

  -i dir        - input directory with the starting corpus

  -o dir        - output directory for minimized files
Execution control settings:

  -T tasks      - how many parallel processes to create (default=1, "all"=nproc)

  -f file       - location read by the fuzzed program (default: stdin)

  -m megs       - memory limit for child process (default=none MB)

  -t msec       - run time limit for child process (default: 5000ms)

  -O            - use binary-only instrumentation (FRIDA mode)

  -Q            - use binary-only instrumentation (QEMU mode)

  -U            - use unicorn-based instrumentation (Unicorn mode)

  -X            - use Nyx mode

Minimization settings:

  -A            - allow crashing and timeout inputs

  -C            - keep crashing inputs, reject everything else

  -e            - solve for edge coverage only, ignore hit counts
For additional tips, please consult README.md.
Environment variables used:
AFL_KEEP_TRACES: leave the temporary <out_dir>.traces directory
AFL_NO_FORKSRV: run target via execve instead of using the forkserver
AFL_PATH: last resort location to find the afl-showmap binary
AFL_SKIP_BIN_CHECK: skip check for target binary
AFL_CUSTOM_MUTATOR_LIBRARY: custom mutator library (post_process and send)
AFL_PYTHON_MODULE: custom mutator library (post_process and send)
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-fuzz

title: afl-fuzz(8)

text:
# afl-fuzz(8)

## NAME
afl-fuzz

## SYNOPSIS
afl-fuzz [ options ] -- /path/to/fuzzed_app [ ... ]

## OPTIONS

```
Required parameters:

  -i dir        - input directory with test cases (or '-' to resume, also see

                  AFL_AUTORESUME)

  -o dir        - output directory for fuzzer findings
Execution control settings:

  -P strategy   - set fix mutation strategy: explore (focus on new coverage),

                  exploit (focus on triggering crashes). You can also set a

                  number of seconds after without any finds it switches to

                  exploit mode, and back on new coverage (default: 1000)

  -p schedule   - power schedules compute a seed's performance score:

                  explore(default), fast, exploit, seek, rare, mmopt, coe, lin

                  quad -- see docs/FAQ.md for more information

  -f file       - location read by the fuzzed program (default: stdin or @@)

  -t msec       - timeout for each run (auto-scaled, default 1000 ms). Add a '+'

                  to auto-calculate the timeout, the value being the maximum.

  -m megs       - memory limit for child process (0 MB, 0 = no limit [default])

  -O            - use binary-only instrumentation (FRIDA mode)

  -Q            - use binary-only instrumentation (QEMU mode)

  -U            - use unicorn-based instrumentation (Unicorn mode)

  -W            - use qemu-based instrumentation with Wine (Wine mode)

  -X            - use VM fuzzing (NYX mode - standalone mode)

  -Y            - use VM fuzzing (NYX mode - multiple instances mode)
Mutator settings:

  -a type       - target input format, "text" or "binary" (default: generic)

  -g minlength  - set min length of generated fuzz input (default: 1)

  -G maxlength  - set max length of generated fuzz input (default: 1048576)

  -L minutes    - use MOpt(imize) mode and set the time limit for entering the

                  pacemaker mode (minutes of no new finds). 0 = immediately,

                  -1 = immediately and together with normal mutation.

                  Note: this option is usually not very effective

  -c program    - enable CmpLog by specifying a binary compiled for it.

                  if using QEMU/FRIDA or the fuzzing target is compiled

                  for CmpLog then use '-c 0'. To disable Cmplog use '-c -'.

  -l cmplog_opts - CmpLog configuration values (e.g. "2ATR"):

                  1=small files, 2=larger files (default), 3=all files,

                  A=arithmetic solving, T=transformational solving,

                  X=extreme transform solving, R=random colorization bytes.
Fuzzing behavior settings:

  -Z            - sequential queue selection instead of weighted random

  -N            - do not unlink the fuzzing input file (for devices etc.)

  -n            - fuzz without instrumentation (non-instrumented mode)

  -x dict_file  - fuzzer dictionary (see README.md, specify up to 4 times)
Test settings:

  -s seed       - use a fixed seed for the RNG

  -V seconds    - fuzz for a specified time then terminate (fuzz time only!)

  -E execs      - fuzz for an approx. no. of total executions then terminate

                  Note: not precise and can have several more executions.
Other stuff:

  -M/-S id      - distributed mode (-M sets -Z and disables trimming)

                  see docs/fuzzing_in_depth.md#c-using-multiple-cores

                  for effective recommendations for parallel fuzzing.

  -F path       - sync to a foreign fuzzer queue directory (requires -M, can

                  be specified up to 32 times)

  -z            - skip the enhanced deterministic fuzzing

                  (note that the old -d and -D flags are ignored.)

  -T text       - text banner to show on the screen

  -I command    - execute this command/script when a new crash is found

  -C            - crash exploration mode (the peruvian rabbit thing)

  -b cpu_id     - bind the fuzzing process to the specified CPU core (0-...)

  -e ext        - file extension for the fuzz test input file (if needed)
Environment variables used:
LD_BIND_LAZY: do not set LD_BIND_NOW env var for target
ASAN_OPTIONS: custom settings for ASAN

              (must contain abort_on_error=1 and symbolize=0)
MSAN_OPTIONS: custom settings for MSAN

              (must contain exitcode=86 and symbolize=0)
AFL_AUTORESUME: resume fuzzing if directory specified by -o already exists
AFL_BENCH_JUST_ONE: run the target just once
AFL_BENCH_UNTIL_CRASH: exit soon when the first crashing input has been found
AFL_CMPLOG_ONLY_NEW: do not run cmplog on initial testcases (good for resumes!)
AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash
AFL_CUSTOM_MUTATOR_LIBRARY: lib with afl_custom_fuzz() to mutate inputs
AFL_CUSTOM_MUTATOR_ONLY: avoid AFL++'s internal mutators
AFL_CYCLE_SCHEDULES: after completing a cycle, switch to a different -p schedule
AFL_DEBUG: extra debugging output for Python mode trimming
AFL_DEBUG_CHILD: do not suppress stdout/stderr from target
AFL_DISABLE_TRIM: disable the trimming of test cases
AFL_DUMB_FORKSRV: use fork server without feedback from target
AFL_EXIT_WHEN_DONE: exit when all inputs are run and no new finds are found
AFL_EXIT_ON_TIME: exit when no new coverage is found within the specified time
AFL_EXIT_ON_SEED_ISSUES: exit on any kind of seed issues
AFL_EXPAND_HAVOC_NOW: immediately enable expand havoc mode (default: after 60

                      minutes and a cycle without finds)
AFL_FAST_CAL: limit the calibration stage to three cycles for speedup
AFL_FORCE_UI: force showing the status screen (for virtual consoles)
AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in ms)
AFL_HANG_TMOUT: override timeout value (in milliseconds)
AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: don't warn about core dump handlers
AFL_IGNORE_PROBLEMS: do not abort fuzzing if an incorrect setup is detected
AFL_IGNORE_PROBLEMS_COVERAGE: if set in addition to AFL_IGNORE_PROBLEMS - also

                              ignore those libs for coverage
AFL_IGNORE_SEED_PROBLEMS: skip over crashes and timeouts in the seeds instead of

                          exiting
AFL_IGNORE_TIMEOUTS: do not process or save any timeouts
AFL_IGNORE_UNKNOWN_ENVS: don't warn on unknown env vars
AFL_IMPORT_FIRST: sync and import test cases from other fuzzer instances first
AFL_INPUT_LEN_MIN/AFL_INPUT_LEN_MAX: like -g/-G set min/max fuzz length produced
AFL_PIZZA_MODE: 1 - enforce pizza mode, -1 - disable for April 1st,

                0 (default) - activate on April 1st
AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc.

                 (default: SIGKILL)
AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server on termination

                             (default: SIGTERM). If unset and AFL_KILL_SIGNAL is

                             set, that value will be used.
AFL_MAP_SIZE: the shared memory size for that target. must be >= the size

              the target was compiled for
AFL_MAX_DET_EXTRAS: if more entries are in the dictionary list than this value

                    then they are randomly selected instead all of them being

                    used. Defaults to 200.
AFL_NO_AFFINITY: do not check for an unused cpu core to use for fuzzing
AFL_TRY_AFFINITY: try to bind to an unused core, but don't fail if unsuccessful
AFL_NO_ARITH: skip arithmetic mutations in deterministic stage
AFL_NO_AUTODICT: do not load an offered auto dictionary compiled into a target
AFL_NO_CPU_RED: avoid red color for showing very high cpu usage
AFL_NO_FORKSRV: run target via execve instead of using the forkserver
AFL_NO_SNAPSHOT: do not use the snapshot feature (if the snapshot lkm is loaded)
AFL_NO_STARTUP_CALIBRATION: no initial seed calibration, start fuzzing at once
AFL_NO_WARN_INSTABILITY: no warn about instability issues on startup calibration
AFL_NO_UI: switch status screen off
AFL_NYX_AUX_SIZE: size of the Nyx auxiliary buffer. Must be a multiple of 4096.

                  Increase this value in case the crash reports are truncated.

                  Default value is 4096.
AFL_NYX_DISABLE_SNAPSHOT_MODE: disable snapshot mode (must be supported by the agent)
AFL_NYX_LOG: output NYX hprintf messages to another file
AFL_NYX_REUSE_SNAPSHOT: reuse an existing Nyx root snapshot
AFL_PATH: path to AFL support binaries
AFL_PYTHON_MODULE: mutate and trim inputs with the specified Python module
AFL_QUIET: suppress forkserver status messages
AFL_PERSISTENT_RECORD: record the last X inputs to every crash in out/crashes
AFL_POST_PROCESS_KEEP_ORIGINAL: save the file as it was prior post-processing to

                                the queue, but execute the post-processed one
AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target
AFL_TARGET_ENV: pass extra environment variables to target
AFL_SHUFFLE_QUEUE: reorder the input queue randomly on startup
AFL_SKIP_BIN_CHECK: skip afl compatibility checks, also disables auto map size
AFL_SKIP_CPUFREQ: do not warn about variable cpu clocking
AFL_STATSD: enables StatsD metrics collection
AFL_STATSD_HOST: change default statsd host (default 127.0.0.1)
AFL_STATSD_PORT: change default statsd port (default: 8125)
AFL_STATSD_TAGS_FLAVOR: set statsd tags format (default: disable tags)

                        suported formats: dogstatsd, librato, signalfx, influxdb
AFL_SYNC_TIME: sync time between fuzzing instances (in minutes)
AFL_FINAL_SYNC: sync a final time when exiting (will delay the exit!)
AFL_NO_CRASH_README: do not create a README in the crashes directory
AFL_TESTCACHE_SIZE: use a cache for testcases, improves performance (in MB)
AFL_TMPDIR: directory to use for input file generation (ramdisk recommended)
AFL_EARLY_FORKSERVER: force an early forkserver in an afl-clang-fast/

                      afl-clang-lto/afl-gcc-fast target
AFL_PERSISTENT: enforce persistent mode (if __AFL_LOOP is in a shared lib)
AFL_DEFER_FORKSRV: enforced deferred forkserver (__AFL_INIT is in a shared lib)
AFL_FUZZER_STATS_UPDATE_INTERVAL: interval to update fuzzer_stats file in

                                  seconds (default: 60, minimum: 1)
Compiled with Python 3.9.18 module support, see docs/custom_mutators.md
Compiled with AFL_PERSISTENT_RECORD support.
Compiled with shmat support.
For additional help please consult docs/README.md :)
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-g++-fast

title: afl-g++-fast(8)

text:
# afl-g++-fast(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-gcc-fast

title: afl-gcc-fast(8)

text:
# afl-gcc-fast(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-gotcpu

title: afl-gotcpu(8)

text:
# afl-gotcpu(8)

## NAME
afl-gotcpu

## SYNOPSIS
afl-gotcpu

## OPTIONS

```
afl-gotcpu does not have command line options
afl-gotcpu prints out which CPUs are available
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-lto

title: afl-lto(8)

text:
# afl-lto(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-lto++

title: afl-lto++(8)

text:
# afl-lto++(8)

## NAME
afl-cc - afl-cc++4.20c by Michal Zalewski, Laszlo Szekeres, Marc Heuse afl-cc

## SYNOPSIS
afl-cc/afl-c++ [options]

## OPTIONS

```
This is a helper application for afl-fuzz. It serves as a drop-in replacement
for gcc and clang, letting you recompile third-party code with the required
runtime instrumentation. A common use pattern would be one of the following:

  CC=afl-cc CXX=afl-c++ ./configure --disable-shared

  cmake -DCMAKE_C_COMPILERC=afl-cc -DCMAKE_CXX_COMPILER=afl-c++ .

  CC=afl-cc CXX=afl-c++ meson

                                       |------------- FEATURES -------------|
MODES:                                  NCC PERSIST DICT   LAF CMPLOG SELECT

  [LLVM] LLVM:             AVAILABLE [SELECTED]

      PCGUARD              AVAILABLE    yes yes     module yes yes    yes

      NATIVE               AVAILABLE    no  yes     no     no  part.  yes

      CLASSIC              AVAILABLE    no  yes     module yes yes    yes

        - NORMAL

        - CALLER

        - CTX

        - NGRAM-{2-16}

  [LTO] LLVM LTO:          AVAILABLE

      PCGUARD              DEFAULT      yes yes     yes    yes yes    yes

      CLASSIC                           yes yes     yes    yes yes    yes

  [GCC_PLUGIN] gcc plugin: unavailable!

      CLASSIC              DEFAULT      no  yes     no     no  no     yes

  [GCC/CLANG] simple gcc/clang: AVAILABLE

      CLASSIC              DEFAULT      no  no      no     no  no     no
Modes:

  To select the compiler mode use a symlink version (e.g. afl-clang-fast), set

  the environment variable AFL_CC_COMPILER to a mode (e.g. LLVM) or use the

  command line parameter --afl-MODE (e.g. --afl-llvm). If none is selected,

  afl-cc will select the best available (LLVM -> GCC_PLUGIN -> GCC).

  The best is LTO but it often needs RANLIB and AR settings outside of afl-cc.
Sub-Modes: (set via env AFL_LLVM_INSTRUMENT, afl-cc selects the best available)

  PCGUARD: Dominator tree instrumentation (best!) (README.llvm.md)

  LLVM-NATIVE:  use llvm's native PCGUARD instrumentation (less performant)

  CLASSIC: decision target instrumentation (README.llvm.md)

  CALLER:  CLASSIC + single callee context (instrumentation/README.ctx.md)

  CTX:     CLASSIC + full callee context (instrumentation/README.ctx.md)

  NGRAM-x: CLASSIC + previous path ((instrumentation/README.ngram.md)
Features: (see documentation links)

  NCC:    non-colliding coverage [automatic] (that is an amazing thing!)

          (instrumentation/README.lto.md)

  PERSIST: persistent mode support [code] (huge speed increase!)

          (instrumentation/README.persistent_mode.md)

  DICT:   dictionary in the target [yes=automatic or LLVM module pass]

          (instrumentation/README.lto.md + instrumentation/README.llvm.md)

  LAF:    comparison splitting [env] (instrumentation/README.laf-intel.md)

  CMPLOG: input2state exploration [env] (instrumentation/README.cmplog.md)

  SELECT: selective instrumentation (allow/deny) on filename or function [env]

          (instrumentation/README.instrument_list.md)
To see all environment variables for the configuration of afl-cc use "-hh".
For any information on the available instrumentations and options please
consult the README.md, especially section 3.1 about instrumenting targets.
afl-cc LTO with ld=/usr/lib/llvm-15.0/bin/ld.lld -flto=full
afl-cc LLVM version 15 using the binary path "/usr/lib/llvm-15.0/bin".
Compiled with shmat support.
Do not be overwhelmed :) afl-cc uses good defaults if no options are selected.
Read the documentation for FEATURES though, all are good but few are defaults.
Recommended is afl-clang-lto with AFL_LLVM_CMPLOG or afl-clang-fast with
AFL_LLVM_CMPLOG and AFL_LLVM_DICT2FILE+AFL_LLVM_DICT2FILE_NO_MAIN.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-persistent-config

title: afl-persistent-config(8)

text:
# afl-persistent-config(8)

## NAME
afl-persistent-config

## SYNOPSIS
afl-persistent-config

## OPTIONS

```
afl-persistent-config has no command line options
afl-persistent-config permanently reconfigures the system to a high performance fuzzing state.
WARNING: this reduces the security of the system!
Note that there is also afl-system-config which sets additional runtime
configuration options.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-plot

title: afl-plot(8)

text:
# afl-plot(8)

## NAME
afl-plot

## SYNOPSIS
afl-plot [ -g | --graphical ] afl_state_dir graph_output_dir

## OPTIONS

```
This program generates gnuplot images from afl-fuzz output data.
Usage:

    afl_state_dir       should point to an existing state directory for any

                        active or stopped instance of afl-fuzz

    graph_output_dir    should point to an empty directory where this

                        tool can write the resulting plots to

    -g, --graphical     (optional) display the plots in a graphical window

                        (you should have built afl-plot-ui to use this option)
The program will put index.html and three PNG images in the output directory;
you should be able to view it with any web browser of your choice.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-showmap

title: afl-showmap(8)

text:
# afl-showmap(8)

## NAME
afl-showmap

## SYNOPSIS
afl-showmap [ options ] -- /path/to/target_app [ ... ]

## OPTIONS

```
Required parameters:

  -o file    - file to write the trace data to
Execution control settings:

  -t msec    - timeout for each run (default: 1000ms)

  -m megs    - memory limit for child process (default: none)

  -O         - use binary-only instrumentation (FRIDA mode)

  -Q         - use binary-only instrumentation (QEMU mode)

  -U         - use Unicorn-based instrumentation (Unicorn mode)

  -W         - use qemu-based instrumentation with Wine (Wine mode)

               (Not necessary, here for consistency with other afl-* tools)

  -X         - use Nyx mode
Other settings:

  -i dir     - process all files below this directory, must be combined with -o.

               With -C, -o is a file, without -C it must be a directory

               and each bitmap will be written there individually.

  -I filelist - alternatively to -i, -I is a list of files

  -C         - collect coverage, writes all edges to -o and gives a summary

               Must be combined with -i.

  -q         - sink program's output and don't show messages

  -e         - show edge coverage only, ignore hit counts

  -r         - show real tuple values instead of AFL filter values

  -s         - do not classify the map

  -c         - allow core dumps
This tool displays raw tuple data captured by AFL instrumentation.
For additional help, consult docs/README.md.
If you use -i/-I mode, then custom mutator post_process send send functionality
is supported.
Environment variables used:
LD_BIND_LAZY: do not set LD_BIND_NOW env var for target
AFL_CMIN_CRASHES_ONLY: (cmin_mode) only write tuples for crashing inputs
AFL_CMIN_ALLOW_ANY: (cmin_mode) write tuples for crashing inputs also
AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash
AFL_DEBUG: enable extra developer output
AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)
AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc.

                 (default: SIGKILL)
AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server on termination

                             (default: SIGTERM). If unset and AFL_KILL_SIGNAL is

                             set, that value will be used.
AFL_MAP_SIZE: the shared memory size for that target. must be >= the size the

              target was compiled for
AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target
AFL_PRINT_FILENAMES: Print the queue entry currently processed will to stdout
AFL_QUIET: do not print extra informational output
AFL_NO_FORKSRV: run target via execve instead of using the forkserver
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-system-config

title: afl-system-config(8)

text:
# afl-system-config(8)

## NAME
afl-system-config

## SYNOPSIS
afl-system-config

## OPTIONS

```
afl-system-config has no command line options
afl-system-config reconfigures the system to a high performance fuzzing state.
WARNING: this reduces the security of the system!
Note that there is also afl-persistent-config which sets additional permanent
configuration options.
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-tmin

title: afl-tmin(8)

text:
# afl-tmin(8)

## NAME
afl-tmin

## SYNOPSIS
afl-tmin [ options ] -- /path/to/target_app [ ... ]

## OPTIONS

```
Required parameters:

  -i file       - input test case to be shrunk by the tool

  -o file       - final output location for the minimized data
Execution control settings:

  -f file       - input file read by the tested program (stdin)

  -t msec       - timeout for each run (1000 ms)

  -m megs       - memory limit for child process (0 MB)

  -O            - use binary-only instrumentation (FRIDA mode)

  -Q            - use binary-only instrumentation (QEMU mode)

  -U            - use unicorn-based instrumentation (Unicorn mode)

  -W            - use qemu-based instrumentation with Wine (Wine mode)

                  (Not necessary, here for consistency with other afl-* tools)

  -X            - use Nyx mode
Minimization settings:

  -e            - solve for edge coverage only, ignore hit counts

  -l bytes      - set minimum block deletion length to speed up minimization

  -x            - treat non-zero exit codes as crashes

  -H            - minimize a hang (hang mode)
For additional tips, please consult docs/README.md.
Environment variables used:
AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash
AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in ms)
AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc.

                 (default: SIGKILL)
AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server on termination

                             (default: SIGTERM). If unset and AFL_KILL_SIGNAL is

                             set, that value will be used.
AFL_MAP_SIZE: the shared memory size for that target. must be >= the size

              the target was compiled for
AFL_PRELOAD:  LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target
AFL_TMIN_EXACT: require execution paths to match for crashing inputs
AFL_NO_FORKSRV: run target via execve instead of using the forkserver
ASAN_OPTIONS: custom settings for ASAN

              (must contain abort_on_error=1 and symbolize=0)
MSAN_OPTIONS: custom settings for MSAN

              (must contain exitcode=86 and symbolize=0)
TMPDIR: directory to use for temporary input files
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004


afl-whatsup

title: afl-whatsup(8)

text:
# afl-whatsup(8)

## NAME
afl-whatsup

## SYNOPSIS
Usage: ./afl-whatsup [-s] [-d] afl_output_directory

## OPTIONS

```
Options:

  -d  -  include dead fuzzer stats

  -m  -  just show minimal stats

  -n  -  no color output

  -s  -  skip details and output summary results only
```

## AUTHOR
AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

## LICENSE
Apache License Version 2.0, January 2004