run AFL with dynamorio
afl-dyninst.sh -i program -o program_instrumented -D It is a good idea to add -e and -E with well selected function addresses to make the fuzzing faster NOTE: you can skip this step and use -forkserver option in the next step. But this is slower at the moment!
afl-fuzz-dynamorio.sh [normal afl-fuzz options] That's it! If you fuzzing does not run, afl-fuzz might need more memory, set AFL_MEM to a high value, e.g. 700 for 700MB
when normal afl-dyninst is crashing the binary and qemu mode -Q is not an option. Dynamorio is x10-50 slower than Qemu, 25x slower than dyninst - however 10x faster than Pintool, and works additionally on ARM and AARCH64. In memory fuzzing (function fuzzing) is a much faster option and implemented in a future release.
https://github.com/vanhauser-thc/afl-dynamorio
Marc "van Hauser" Heuse [email protected] || [email protected]