NAME

afl-merge

SYNOPSIS

afl-merge [ options ] -- /path/to/target_app [ ... ]

OPTIONS

Merge inputs that add new coverage into an output corpus, similar to
libFuzzer's -merge=1. Only inputs whose coverage is not already present
in the output corpus are added; existing output files are never changed
or removed.
Usage (any of):


  ./afl-merge -o out_dir -i in_dir [-i in_dir ...] -- /path/to/target [ ... ]


  ./afl-merge -o out_dir in_dir [in_dir ...]       -- /path/to/target [ ... ]


  ./afl-merge out_dir in_dir [in_dir ...]          -- /path/to/target [ ... ]
In the last form the first directory is the output corpus and -i must not
be used. -o may be given at the beginning or the end.
Execution control settings:


  -f file     - location read by the fuzzed program (stdin)


  -m megs     - memory limit for child process (default: none)


  -t msec     - timeout for each run (default: 5000ms)


  -O          - use binary-only instrumentation (FRIDA mode)


  -Q          - use binary-only instrumentation (QEMU mode)


  -W          - use binary-only instrumentation (WINE mode)


  -U          - use unicorn-based instrumentation (Unicorn mode)


  -X          - use Nyx mode
Input selection settings:


  --crash-dir=dir - move crashes to a separate dir, always deduplicated


  -A          - allow crashes and timeouts (not recommended)


  -C          - only add crashing inputs, reject everything else


  -e          - solve for edge coverage only, ignore hit counts


  --no-dedup  - skip deduplication step for the input files
Misc:


  -T workers  - number of execution and of update workers, or


                exec:update for both counts separately, or 'all'


                (default: 1)


  --as_queue  - name added files "id:000000,orig:filename", or


                "id:000000,hash:sha1" with AFL_SHA1_FILENAMES; the


                numbering restarts with every run


  --debug     - debug mode
Only the first 1048576 bytes of an input are given to the target.
The exit status is 0 on success and 1 on any error, including a run
in which no input matched the requested crash/timeout policy.
afl-merge honors 'AFL_MAP_SIZE' and 'AFL_SHA1_FILENAMES'.
For additional help, consult /usr/share/doc/afl/README.md.

AUTHOR

AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

LICENSE

AFL++ is licensed under AGPL-3.0-or-later, with original components under Apache-2.0; an optional commercial license is available. See https://github.com/AFLplusplus/AFLplusplus/blob/stable/LICENSING.md