AFL模糊测试工具安装与使用指南<\/h1>

一、AFL简介<\/h2>

AFL (American Fuzzy Lop) 是一款基于覆盖引导(Coverage-guided)的模糊测试工具，通过记录输入样本的代码覆盖率来调整输入样本以提高覆盖率，增加发现漏洞的概率。其主要特点包括：<\/p>

低性能消耗<\/li>
高效的fuzzing策略<\/li>
支持有源码和无源码两种测试模式<\/li>

自动化的测试用例生成和优化<\/li> <\/ul>

二、AFL安装<\/h2>

1. Release版安装<\/h3>

wget http:\/\/lcamtuf.coredump.cx\/afl\/releases\/afl-latest.tgz
<\/span><\/span>tar xvf afl-latest.tgz
<\/span><\/span>cd afl-2.52b
<\/span><\/span>sudo make &&<\/span> sudo make install
<\/span><\/span>cd qemu_mode
<\/span><\/span>.\/build_qemu_support.sh
<\/span><\/span><\/code><\/pre>2. 手动安装<\/h3>
基本安装<\/h4>
git clone https:\/\/github.com\/google\/AFL.git
<\/span><\/span>make
<\/span><\/span>sudo make install
<\/span><\/span><\/code><\/pre>QEMU模式安装（用于无源码fuzz）<\/h4>
先安装必要环境：<\/p>
sudo apt-get install libtool-bin libtool wget python automake autoconf sha384sum bison iconv
<\/span><\/span><\/code><\/pre>然后进行以下操作：<\/p>


进入qemu_mode文件夹，修改build_qemu_support.sh<\/code>中的QEMU_URL<\/code>为：<\/p>
https:\/\/download.qemu.org\/qemu-${VERSION}.tar.xz
<\/code><\/pre>
<\/li>

进入patches文件夹，在syscall.diff<\/code>文件的第三行开始插入以下内容：<\/p>
@@ -34,6 +34,7 @@
<\/span><\/span><\/span><\/span> #include <sys\/resource.h>
<\/span><\/span> #include <sys\/swap.h>
<\/span><\/span> #include <linux\/capability.h>
<\/span><\/span>+#include <linux\/sockios.h>
<\/span><\/span><\/span><\/span> #include <sched.h>
<\/span><\/span> #include <sys\/timex.h>
<\/span><\/span> #include <sys\/socket.h>
<\/span><\/span><\/code><\/pre><\/li>

在patches文件夹下创建gettid.diff<\/code>文件，内容如下：<\/p>
--- qemu-2.10.0-rc3-clean\/linux-user\/syscall.c 2020-11-06 22:14:34.218924847 -0500
<\/span><\/span><\/span><\/span>+++ qemu-2.10.0-rc3\/linux-user\/syscall.c 2020-11-06 22:17:09.722926317 -0500
<\/span><\/span><\/span><\/span>@@ -258,7 +258,8 @@
<\/span><\/span><\/span><\/span> #endif
<\/span><\/span> #ifdef __NR_gettid
<\/span><\/span>-_syscall0(int, gettid)
<\/span><\/span><\/span><\/span>+#define __NR_sys_gettid __NR_gettid
<\/span><\/span><\/span>+_syscall0(int, sys_gettid)
<\/span><\/span><\/span><\/span> #else
<\/span><\/span> \/* This is a replacement for the host gettid() and must return a host errno. *\/
<\/span><\/span>@@ -6221,7 +6222,7 @@
<\/span><\/span><\/span><\/span> cpu = ENV_GET_CPU(env);
<\/span><\/span> thread_cpu = cpu;
<\/span><\/span> ts = (TaskState *)cpu->opaque;
<\/span><\/span>- info->tid = gettid();
<\/span><\/span><\/span><\/span>+ info->tid = sys_gettid();
<\/span><\/span><\/span><\/span> task_settid(ts);
<\/span><\/span> if (info->child_tidptr)
<\/span><\/span> put_user_u32(info->tid, info->child_tidptr);
<\/span><\/span>@@ -6365,9 +6366,9 @@
<\/span><\/span><\/span><\/span> mapping. We can't repeat the spinlock hack used above because the child process gets its own copy of the lock. *\/
<\/span><\/span> if (flags & CLONE_CHILD_SETTID)
<\/span><\/span>- put_user_u32(gettid(), child_tidptr);
<\/span><\/span><\/span><\/span>+ put_user_u32(sys_gettid(), child_tidptr);
<\/span><\/span><\/span><\/span> if (flags & CLONE_PARENT_SETTID)
<\/span><\/span>- put_user_u32(gettid(), parent_tidptr);
<\/span><\/span><\/span><\/span>+ put_user_u32(sys_gettid(), parent_tidptr);
<\/span><\/span><\/span><\/span> ts = (TaskState *)cpu->opaque;
<\/span><\/span> if (flags & CLONE_SETTLS)
<\/span><\/span> cpu_set_tls (env, newtls);
<\/span><\/span>@@ -11404,7 +11405,7 @@
<\/span><\/span><\/span><\/span> break;
<\/span><\/span> #endif
<\/span><\/span> case TARGET_NR_gettid:
<\/span><\/span>- ret = get_errno(gettid());
<\/span><\/span><\/span><\/span>+ ret = get_errno(sys_gettid());
<\/span><\/span><\/span><\/span> break;
<\/span><\/span> #ifdef TARGET_NR_readahead
<\/span><\/span> case TARGET_NR_readahead:
<\/span><\/span><\/code><\/pre><\/li>

在qemu_mode目录下运行：<\/p>
.\/build_qemu_support.sh
<\/span><\/span><\/code><\/pre><\/li>

回到AFL目录执行：<\/p>
sudo make install
<\/span><\/span>sudo cp .\/afl-qemu-trace \/usr\/local\/bin
<\/span><\/span><\/code><\/pre><\/li>
<\/ol>
3. 安装后生成的主要工具<\/h3>
make<\/code>之后生成的程序会被保存在\/usr\/local\/bin<\/code>中，可以直接调用：<\/p>



程序<\/th>
功能<\/th>
<\/tr>
<\/thead>


afl-gcc \/ afl-g++<\/td>
gcc \/ g++ 的封装，可以编译文件并在源文件中添加特殊指令编译插桩<\/td>
<\/tr>

afl-clang \/ afl-clang++<\/td>
clang \/ clang++ 的封装<\/td>
<\/tr>

afl-fuzz<\/td>
对目标程序进行fuzz<\/td>
<\/tr>

afl-analyze<\/td>
对用例进行分析，寻找有意义的字段<\/td>
<\/tr>

afl-qemu-trace<\/td>
用于qemu-mode在无源码的条件下进行fuzz<\/td>
<\/tr>

afl-plot<\/td>
生成测试任务的状态图<\/td>
<\/tr>

afl-tmin \/ afl-cmin<\/td>
对用例进行简化<\/td>
<\/tr>

afl-whatsup<\/td>
查看fuzz任务状态<\/td>
<\/tr>

afl-gotcpu<\/td>
查看cpu状态<\/td>
<\/tr>

afl-showmap<\/td>
对单个用例进行执行路径跟踪<\/td>
<\/tr>
<\/tbody>
<\/table>
三、AFL使用<\/h2>
1. 有源码测试<\/h3>
编写测试程序<\/h4>
\/\/ test.c
<\/span><\/span><\/span><\/span>#include<\/span> "stdio.h"<\/span>
<\/span><\/span><\/span>#include<\/span> "stdlib.h"<\/span>
<\/span><\/span><\/span>#include<\/span> "unistd.h"<\/span>
<\/span><\/span><\/span>#include<\/span> "string.h"<\/span>
<\/span><\/span><\/span>#include<\/span> "signal.h"<\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>int<\/span> vuln<\/span>(char<\/span> *<\/span>str) {
<\/span><\/span>    int<\/span> len =<\/span> strlen(str);
<\/span><\/span>    if<\/span> (str[0<\/span>] ==<\/span> 'A'<\/span> &&<\/span> len ==<\/span> 66<\/span>) {  \/\/ 如果输入的字符串的首字符为A并且长度为66，则异常退出
<\/span><\/span><\/span><\/span>        raise(SIGSEGV);
<\/span><\/span>    } else<\/span> if<\/span> (str[0<\/span>] ==<\/span> 'F'<\/span> &&<\/span> len ==<\/span> 6<\/span>) {  \/\/ 如果输入的字符串的首字符为F并且长度为6，则异常退出
<\/span><\/span><\/span><\/span>        raise(SIGSEGV);
<\/span><\/span>    } else<\/span> {
<\/span><\/span>        printf("it is good!<\/span>\n<\/span>"<\/span>);
<\/span><\/span>    }
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>int<\/span> main<\/span>(int<\/span> argc, char<\/span> *<\/span>argv[]) {
<\/span><\/span>    char<\/span> buf[100<\/span>] =<\/span> {0<\/span>};
<\/span><\/span>    gets(buf);  \/\/ 存在栈溢出漏洞
<\/span><\/span><\/span><\/span>    printf(buf);  \/\/ 存在格式化字符串漏洞
<\/span><\/span><\/span><\/span>    vuln(buf);
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>使用afl-gcc编译插桩<\/h4>
afl-gcc test.c -o afl_test
<\/span><\/span><\/code><\/pre>创建测试环境<\/h4>

创建fuzz_in和fuzz_out文件夹<\/li>
在fuzz_in中创建testcase输入样例，内容为abc<\/code><\/li>
<\/ol>

初始输入数据（也叫种子文件）作为Fuzzing的起点，这些输入甚至可以是毫无意义的数据，AFL可以通过启发式算法自动确定文件格式结构。输入数据需要是有效输入且体积尽量小。<\/p>
<\/blockquote>
执行fuzz<\/h4>
afl-fuzz -i fuzz_in -o fuzz_out .\/afl_test
<\/span><\/span><\/code><\/pre>2. 无源码测试<\/h3>
先把fuzz_out文件夹清空，然后执行以下指令（区别在于多了-Q）：<\/p>
afl-fuzz -i fuzz_in\/ -o fuzz_out\/ -Q .\/afl_test
<\/span><\/span><\/code><\/pre>3. 运行结果分析<\/h3>
AFL运行后会显示如下信息：<\/p>
american fuzzy lop 2.57b (afl_test)

处理时间总体结果
运行时间 : 0 days, 0 hrs, 10 min, 51 sec
完成循环 : 377
最后一条新路径 : 0 days, 0 hrs, 10 min, 51 sec
总路径数 : 3
最后一次崩溃 : 0 days, 0 hrs, 0 min, 51 sec
崩溃 : 6
最后一次挂起 : none seen yet
挂起 : 0

循环进度覆盖率当前处理 : 1 (33.33%)
密度 : 0.05% \/ 0.06%
路径超时 : 0 (0.00%)
计数覆盖率 : 1.00 bits\/tuple

阶段进度深入发现当前尝试 : havoc
首选路径 : 2 (66.67%)
阶段执行 : 160\/256 (62.50%)
新边 : 3 (100.00%)
全部执行 : 269k
总崩溃数 : 3140 (6 unique)
执行速度 : 403.6\/sec
总tmouts : 0 (0 unique)

模糊测试策略结果
执行路径信息
位翻转 : 1\/96, 0\/93, 0\/87
级别 : 2
字节翻转 : 0\/12, 0\/9, 0\/3
待处理 : 0
算术 : 1\/672, 0\/75, 0\/0
待处理收藏 : 0
已知整数 : 0\/58, 0\/252, 0\/132
自己的发现 : 2
字典 : 0\/0, 0\/0, 0\/0
导入 : n\/a
破坏 : 6\/267k, 0\/0
稳定性 : 100.00%
修剪 : n\/a, 0.00%
[cpu000: 8%]
<\/code><\/pre>
主要信息包括：<\/p>

Process timing<\/strong>: Fuzzer运行时长、以及距离最近发现的路径、崩溃和挂起经过了多长时间<\/li>
Overall results<\/strong>: Fuzzer当前状态的概述<\/li>
Cycle progress<\/strong>: 输入队列的距离<\/li>
Map coverage<\/strong>: 目标二进制文件中的插桩代码所观察到覆盖范围的细节<\/li>
Stage progress<\/strong>: Fuzzer现在正在执行的文件变异策略、执行次数和执行速度<\/li>
Findings in depth<\/strong>: 找到的执行路径，异常和挂起数量的信息<\/li>
Fuzzing strategy yields<\/strong>: 关于突变策略产生的最新行为和结果的详细信息<\/li>
Path geometry<\/strong>: 有关Fuzzer找到的执行路径的信息<\/li>
CPU load<\/strong>: CPU利用率<\/li>
<\/ul>
4. 测试结果分析<\/h3>
fuzz后会发现在fuzz_out目录下生成以下文件夹：<\/p>

crashes<\/strong>: 产生crash的测试用例<\/li>
hangs<\/strong>: 产生超时的测试用例<\/li>
queue<\/strong>: 每个不同执行路径的测试用例<\/li>
<\/ul>
可以查看造成crash的用例：<\/p>
xxd id:000000,sig:06,src:000000,op:havoc,rep:64
<\/span><\/span>xxd id:000001,sig:11,src:000002,op:havoc,rep:2
<\/span><\/span>xxd id:000002,sig:06,src:000001,op:havoc,rep:16
<\/span><\/span>xxd id:000003,sig:06,src:000002,op:havoc,rep:64
<\/span><\/span>xxd id:000004,sig:11,src:000002,op:havoc,rep:4
<\/span><\/span>xxd id:000005,sig:11,src:000001,op:havoc,rep:128
<\/span><\/span><\/code><\/pre>也可以测试crash用例：<\/p>
cat id:000000,sig:06,src:000000,op:havoc,rep:64 | .\/afl_test
<\/span><\/span>cat id:000001,sig:11,src:000002,op:havoc,rep:2 | .\/afl_test
<\/span><\/span>cat id:000002,sig:06,src:000001,op:havoc,rep:16 | .\/afl_test
<\/span><\/span>cat id:000003,sig:06,src:000002,op:havoc,rep:64 | .\/afl_test
<\/span><\/span>cat id:000004,sig:11,src:000002,op:havoc,rep:4 | .\/afl_test
<\/span><\/span>cat id:000005,sig:11,src:000001,op:havoc,rep:128 | .\/afl_test
<\/span><\/span><\/code><\/pre>四、常见问题解决<\/h2>
1. Pipe at the beginning of 'core_pattern'错误<\/h3>
执行fuzz的时候可能出现如下报错：<\/p>
[-] PROGRAM ABORT : Pipe at the beginning of 'core_pattern'
<\/code><\/pre>
解决方法：<\/p>
sudo echo core > \/proc\/sys\/kernel\/core_pattern
<\/span><\/span><\/code><\/pre>五、AFL算法原理<\/h2>
模糊测试的基本思想是通过输入大量非法或意外的数据来测试程序的健壮性和安全性。AFL算法流程如下：<\/p>

把用户提供的初始测试用例加载到队列(queue)中<\/li>
从队列中获取下一个测试输入文件<\/li>
在保持程序行为的前提下，尝试修剪(trim)测试用例(体积)到最小<\/li>
使用传统的模糊测试策略中的各种已有的研究方法，重复变异文件<\/li>
如果生成的变异结果能够驱动新的状态转换(通过插桩记录)，则把这一测试用例加入到队列中<\/li>
重复到第2步<\/li>
<\/ol>
AFL通过记录输入样本的代码覆盖率来调整输入样本以提高覆盖率，增加发现漏洞的概率。它使用高效的变异策略和启发式算法来自动确定文件格式结构，从而有效地发现程序中的潜在漏洞。<\/p>
六、参考资源<\/h2>

AFL环境搭建<\/a><\/li>
AFL使用学习<\/a><\/li>
<\/ol>

程序<\/th>	功能<\/th> <\/tr> <\/thead>
afl-gcc \/ afl-g++<\/td>	gcc \/ g++ 的封装，可以编译文件并在源文件中添加特殊指令编译插桩<\/td> <\/tr>
afl-clang \/ afl-clang++<\/td>	clang \/ clang++ 的封装<\/td> <\/tr>
afl-fuzz<\/td>	对目标程序进行fuzz<\/td> <\/tr>
afl-analyze<\/td>	对用例进行分析，寻找有意义的字段<\/td> <\/tr>
afl-qemu-trace<\/td>	用于qemu-mode在无源码的条件下进行fuzz<\/td> <\/tr>
afl-plot<\/td>	生成测试任务的状态图<\/td> <\/tr>
afl-tmin \/ afl-cmin<\/td>	对用例进行简化<\/td> <\/tr>
afl-whatsup<\/td>	查看fuzz任务状态<\/td> <\/tr>
afl-gotcpu<\/td>	查看cpu状态<\/td> <\/tr>
afl-showmap<\/td>	对单个用例进行执行路径跟踪<\/td> <\/tr> <\/tbody> <\/table> 三、AFL使用<\/h2> 1. 有源码测试<\/h3> 编写测试程序<\/h4> \/\/ test.c <\/span><\/span><\/span><\/span>#include<\/span> "stdio.h"<\/span> <\/span><\/span><\/span>#include<\/span> "stdlib.h"<\/span> <\/span><\/span><\/span>#include<\/span> "unistd.h"<\/span> <\/span><\/span><\/span>#include<\/span> "string.h"<\/span> <\/span><\/span><\/span>#include<\/span> "signal.h"<\/span> <\/span><\/span><\/span><\/span> <\/span><\/span>int<\/span> vuln<\/span>(char<\/span> <\/span>str) { <\/span><\/span> int<\/span> len =<\/span> strlen(str); <\/span><\/span> if<\/span> (str[0<\/span>] ==<\/span> 'A'<\/span> &&<\/span> len ==<\/span> 66<\/span>) { \/\/ 如果输入的字符串的首字符为A并且长度为66，则异常退出 <\/span><\/span><\/span><\/span> raise(SIGSEGV); <\/span><\/span> } else<\/span> if<\/span> (str[0<\/span>] ==<\/span> 'F'<\/span> &&<\/span> len ==<\/span> 6<\/span>) { \/\/ 如果输入的字符串的首字符为F并且长度为6，则异常退出 <\/span><\/span><\/span><\/span> raise(SIGSEGV); <\/span><\/span> } else<\/span> { <\/span><\/span> printf("it is good!<\/span>\n<\/span>"<\/span>); <\/span><\/span> } <\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span> <\/span><\/span>int<\/span> main<\/span>(int<\/span> argc, char<\/span> <\/span>argv[]) { <\/span><\/span> char<\/span> buf[100<\/span>] =<\/span> {0<\/span>}; <\/span><\/span> gets(buf); \/\/ 存在栈溢出漏洞 <\/span><\/span><\/span><\/span> printf(buf); \/\/ 存在格式化字符串漏洞 <\/span><\/span><\/span><\/span> vuln(buf); <\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>使用afl-gcc编译插桩<\/h4> afl-gcc test.c -o afl_test <\/span><\/span><\/code><\/pre>创建测试环境<\/h4> 创建fuzz_in和fuzz_out文件夹<\/li> 在fuzz_in中创建testcase输入样例，内容为abc<\/code><\/li> <\/ol> 初始输入数据（也叫种子文件）作为Fuzzing的起点，这些输入甚至可以是毫无意义的数据，AFL可以通过启发式算法自动确定文件格式结构。输入数据需要是有效输入且体积尽量小。<\/p> <\/blockquote> 执行fuzz<\/h4> afl-fuzz -i fuzz_in -o fuzz_out .\/afl_test <\/span><\/span><\/code><\/pre>2. 无源码测试<\/h3> 先把fuzz_out文件夹清空，然后执行以下指令（区别在于多了-Q）：<\/p> afl-fuzz -i fuzz_in\/ -o fuzz_out\/ -Q .\/afl_test <\/span><\/span><\/code><\/pre>3. 运行结果分析<\/h3> AFL运行后会显示如下信息：<\/p> american fuzzy lop 2.57b (afl_test) 处理时间总体结果运行时间 : 0 days, 0 hrs, 10 min, 51 sec 完成循环 : 377 最后一条新路径 : 0 days, 0 hrs, 10 min, 51 sec 总路径数 : 3 最后一次崩溃 : 0 days, 0 hrs, 0 min, 51 sec 崩溃 : 6 最后一次挂起 : none seen yet 挂起 : 0 循环进度覆盖率当前处理 : 1 (33.33%) 密度 : 0.05% \/ 0.06% 路径超时 : 0 (0.00%) 计数覆盖率 : 1.00 bits\/tuple 阶段进度深入发现当前尝试 : havoc 首选路径 : 2 (66.67%) 阶段执行 : 160\/256 (62.50%) 新边 : 3 (100.00%) 全部执行 : 269k 总崩溃数 : 3140 (6 unique) 执行速度 : 403.6\/sec 总tmouts : 0 (0 unique) 模糊测试策略结果执行路径信息位翻转 : 1\/96, 0\/93, 0\/87 级别 : 2 字节翻转 : 0\/12, 0\/9, 0\/3 待处理 : 0 算术 : 1\/672, 0\/75, 0\/0 待处理收藏 : 0 已知整数 : 0\/58, 0\/252, 0\/132 自己的发现 : 2 字典 : 0\/0, 0\/0, 0\/0 导入 : n\/a 破坏 : 6\/267k, 0\/0 稳定性 : 100.00% 修剪 : n\/a, 0.00% [cpu000: 8%] <\/code><\/pre> 主要信息包括：<\/p> Process timing<\/strong>: Fuzzer运行时长、以及距离最近发现的路径、崩溃和挂起经过了多长时间<\/li> Overall results<\/strong>: Fuzzer当前状态的概述<\/li> Cycle progress<\/strong>: 输入队列的距离<\/li> Map coverage<\/strong>: 目标二进制文件中的插桩代码所观察到覆盖范围的细节<\/li> Stage progress<\/strong>: Fuzzer现在正在执行的文件变异策略、执行次数和执行速度<\/li> Findings in depth<\/strong>: 找到的执行路径，异常和挂起数量的信息<\/li> Fuzzing strategy yields<\/strong>: 关于突变策略产生的最新行为和结果的详细信息<\/li> Path geometry<\/strong>: 有关Fuzzer找到的执行路径的信息<\/li> CPU load<\/strong>: CPU利用率<\/li> <\/ul> 4. 测试结果分析<\/h3> fuzz后会发现在fuzz_out目录下生成以下文件夹：<\/p> crashes<\/strong>: 产生crash的测试用例<\/li> hangs<\/strong>: 产生超时的测试用例<\/li> queue<\/strong>: 每个不同执行路径的测试用例<\/li> <\/ul> 可以查看造成crash的用例：<\/p> xxd id:000000,sig:06,src:000000,op:havoc,rep:64 <\/span><\/span>xxd id:000001,sig:11,src:000002,op:havoc,rep:2 <\/span><\/span>xxd id:000002,sig:06,src:000001,op:havoc,rep:16 <\/span><\/span>xxd id:000003,sig:06,src:000002,op:havoc,rep:64 <\/span><\/span>xxd id:000004,sig:11,src:000002,op:havoc,rep:4 <\/span><\/span>xxd id:000005,sig:11,src:000001,op:havoc,rep:128 <\/span><\/span><\/code><\/pre>也可以测试crash用例：<\/p> cat id:000000,sig:06,src:000000,op:havoc,rep:64 \| .\/afl_test <\/span><\/span>cat id:000001,sig:11,src:000002,op:havoc,rep:2 \| .\/afl_test <\/span><\/span>cat id:000002,sig:06,src:000001,op:havoc,rep:16 \| .\/afl_test <\/span><\/span>cat id:000003,sig:06,src:000002,op:havoc,rep:64 \| .\/afl_test <\/span><\/span>cat id:000004,sig:11,src:000002,op:havoc,rep:4 \| .\/afl_test <\/span><\/span>cat id:000005,sig:11,src:000001,op:havoc,rep:128 \| .\/afl_test <\/span><\/span><\/code><\/pre>四、常见问题解决<\/h2> 1. Pipe at the beginning of 'core_pattern'错误<\/h3> 执行fuzz的时候可能出现如下报错：<\/p> [-] PROGRAM ABORT : Pipe at the beginning of 'core_pattern' <\/code><\/pre> 解决方法：<\/p> sudo echo core > \/proc\/sys\/kernel\/core_pattern <\/span><\/span><\/code><\/pre>五、AFL算法原理<\/h2> 模糊测试的基本思想是通过输入大量非法或意外的数据来测试程序的健壮性和安全性。AFL算法流程如下：<\/p> 把用户提供的初始测试用例加载到队列(queue)中<\/li> 从队列中获取下一个测试输入文件<\/li> 在保持程序行为的前提下，尝试修剪(trim)测试用例(体积)到最小<\/li> 使用传统的模糊测试策略中的各种已有的研究方法，重复变异文件<\/li> 如果生成的变异结果能够驱动新的状态转换(通过插桩记录)，则把这一测试用例加入到队列中<\/li> 重复到第2步<\/li> <\/ol> AFL通过记录输入样本的代码覆盖率来调整输入样本以提高覆盖率，增加发现漏洞的概率。它使用高效的变异策略和启发式算法来自动确定文件格式结构，从而有效地发现程序中的潜在漏洞。<\/p> 六、参考资源<\/h2> AFL环境搭建<\/a><\/li> AFL使用学习<\/a><\/li> <\/ol>

AFL模糊测试工具安装与使用指南<\/h1>

二、AFL安装<\/h2>

2. 手动安装<\/h3>

三、AFL使用<\/h2>

1. 有源码测试<\/h3>

四、常见问题解决<\/h2>

六、参考资源<\/h2> AFL环境搭建<\/a><\/li> AFL使用学习<\/a><\/li> <\/ol>

六、参考资源<\/h2>

AFL环境搭建<\/a><\/li>
AFL使用学习<\/a><\/li> <\/ol>