diff --git a/README.md b/README.md index 89bcbd5..e59e6fa 100644 --- a/README.md +++ b/README.md @@ -65,6 +65,7 @@ printf '\x00' > /tmp/smite-seeds/empty # Start fuzzing with the custom mutator AFL_CUSTOM_MUTATOR_LIBRARY=target/release/libsmite_ir_mutator.so \ AFL_CUSTOM_MUTATOR_ONLY=1 \ +AFL_FRAMESHIFT_DISABLE=1 \ AFL_DISABLE_TRIM=1 \ ~/AFLplusplus/afl-fuzz -X -i /tmp/smite-seeds -o /tmp/smite-out -- /tmp/smite-nyx ``` diff --git a/smite-ir-mutator/src/lib.rs b/smite-ir-mutator/src/lib.rs index 0903ee2..870ec2e 100644 --- a/smite-ir-mutator/src/lib.rs +++ b/smite-ir-mutator/src/lib.rs @@ -13,6 +13,8 @@ //! - `AFL_CUSTOM_MUTATOR_ONLY=1` -- disable AFL++'s byte mutators. This also //! disables the havoc stage entirely, so we deliberately do not implement //! `afl_custom_havoc_mutation`. +//! - `AFL_FRAMESHIFT_DISABLE=1` -- disable AFL++'s `FrameShift` analysis that +//! bypasses our custom mutators. //! - `AFL_DISABLE_TRIM=1` -- this library does not implement custom trim and //! AFL++'s default byte-level trim would corrupt our structured programs. //!