afl-fuzz(8)

NAME
afl-fuzz

SYNOPSIS
afl-fuzz [ options ] -- /path/to/fuzzed_app [ ... ]

OPTIONS
Required parameters:
  -i dir        - input directory with test cases
  -o dir        - output directory for fuzzer findings
Execution control settings:
  -p schedule   - power schedules recompute a seed's performance score.
                  <explore (default), fast, coe, lin, quad, or exploit>
                  see docs/power_schedules.md
  -f file       - location read by the fuzzed program (stdin)
  -t msec       - timeout for each run (auto-scaled, 50-1000 ms)
  -m megs       - memory limit for child process (200 MB)
  -Q            - use binary-only instrumentation (QEMU mode)
  -U            - use unicorn-based instrumentation (Unicorn mode)
  -W            - use qemu-based instrumentation with Wine (Wine mode)
Mutator settings:
  -R[R]         - add Radamsa as mutator, add another -R to exclusivly run it
  -L minutes    - use MOpt(imize) mode and set the limit time for entering the
                  pacemaker mode (minutes of no new paths, 0 = immediately).
                  a recommended value is 10-60. see docs/README.MOpt.md
  -c program    - enable CmpLog by specifying a binary compiled for it.
                  if using QEMU, just use -c 0.
Fuzzing behavior settings:
  -N            - do not unlink the fuzzing input file
  -d            - quick & dirty mode (skips deterministic steps)
  -n            - fuzz without instrumentation (dumb mode)
  -x dir        - optional fuzzer dictionary (see README.md, its really good!)
Testing settings:
  -s seed       - use a fixed seed for the RNG
  -V seconds    - fuzz for a maximum total time of seconds then terminate
  -E execs      - fuzz for a maximum number of total executions then terminate
  Note: -V/-E are not precise, they are checked after a queue entry is done
  which can be many minutes/execs later
Other stuff:
  -T text       - text banner to show on the screen
  -M / -S id    - distributed mode (see parallel_fuzzing.md)
  -I command    - execute this command/script when a new crash is found
  -B bitmap.txt - mutate a specific test case, use the out/fuzz_bitmap file
  -C            - crash exploration mode (the peruvian rabbit thing)
  -e ext        - File extension for the temporarily generated test case
Compiled with  module support, see docs/python_mutators.md
For additional help please consult /usr/pkg/share/doc/afl/README.md

AUTHOR
afl++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> and Andrea Fioraldi <andreafioraldi@gmail.com> The homepage of afl++ is: https://github.com/vanhauser-thc/AFLplusplus

LICENSE
Apache License Version 2.0, January 2004