update env_variables.txt with compcov levels
@@ -245,9 +245,19 @@ The QEMU wrapper used to instrument binary-only code supports several settings:
- Setting AFL_INST_LIBS causes the translator to also instrument the code
inside any dynamically linked libraries (notably including glibc).
+ - Setting AFL_COMPCOV_LEVEL enables the CompareCoverage tracing of all cmp
+ and sub in x86 and x86_64 and memory comparions functions (e.g. strcmp,
+ memcmp, ...) when libcompcov is preloaded using AFL_PRELOAD.
+ More info at qemu_mode/libcompcov/README.compcov.
+ There are two levels at the moment, AFL_COMPCOV_LEVEL=1 that instruments
+ only comparisons with immediate values / read-only memory and
+ AFL_COMPCOV_LEVEL=2 that instruments all the comparions. Level 2 is more
+ accurate but may need a larger shared memory.
+
- Setting AFL_QEMU_COMPCOV enables the CompareCoverage tracing of all
- cmp and sub in x86 and x86_64. Support for other architectures and
- comparison functions (mem/strcmp et al.) is planned.
+ cmp and sub in x86 and x86_64.
+ This is an alias of AFL_COMPCOV_LEVEL=1 when AFL_COMPCOV_LEVEL is
+ not specified.
- The underlying QEMU binary will recognize any standard "user space
emulation" variables (e.g., QEMU_STACK_SIZE), but there should be no
@@ -260,10 +270,7 @@ The QEMU wrapper used to instrument binary-only code supports several settings:
- AFL_ENTRYPOINT allows you to specify a specific entrypoint into the
binary (this can be very good for the performance!).
The entrypoint is specified as hex address, e.g. 0x4004110
-
- - AFL_QEMU_COMPCOV is for a sub-project in qemu_mode called ./libcompcov
- which implements laf-intel for qemu. It also needs AFL_PRELOAD and
- you can find more information in qemu_mode/libcompcov/README.compcov
+ Note that the address must be the address of a basic block.
5) Settings for afl-cmin
------------------------
