.TH afl-analyze 8 2023-08-18 AFL++ .SH NAME .B afl-analyze .SH SYNOPSIS afl-analyze [ options ] -- /path/to/target_app [ ... ] .SH OPTIONS .nf Required parameters: -i file - input test case to be analyzed by the tool Execution control settings: -f file - input file read by the tested program (stdin) -t msec - timeout for each run (1000 ms) -m megs - memory limit for child process (0 MB) -O - use binary-only instrumentation (FRIDA mode) -Q - use binary-only instrumentation (QEMU mode) -U - use unicorn-based instrumentation (Unicorn mode) -W - use qemu-based instrumentation with Wine (Wine mode) -X - use Nyx mode Analysis settings: -e - look for edge coverage only, ignore hit counts For additional tips, please consult docs/README.md. Environment variables used: TMPDIR: directory to use for temporary input files ASAN_OPTIONS: custom settings for ASAN (must contain abort_on_error=1 and symbolize=0) MSAN_OPTIONS: custom settings for MSAN (must contain exitcode=86 and symbolize=0) AFL_ANALYZE_HEX: print file offsets in hexadecimal instead of decimal AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL) AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server on termination (default: SIGTERM). If unset and AFL_KILL_SIGNAL is set, that value will be used. AFL_MAP_SIZE: the shared memory size for that target. must be >= the size the target was compiled for AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target AFL_SKIP_BIN_CHECK: skip checking the location of and the target .SH AUTHOR AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse , Dominik Maier , Andrea Fioraldi and Heiko "hexcoder-" Eissfeldt The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus .SH LICENSE Apache License Version 2.0, January 2004