1# CmpLog instrumentation 2 3The CmpLog instrumentation enables logging of comparison operands in a shared 4memory. 5 6These values can be used by various mutators built on top of it. At the moment, 7we support the Redqueen mutator (input-2-state instructions only), for details 8see [the Redqueen paper](https://github.com/RUB-SysSec/redqueen). 9 10## Build 11 12To use CmpLog, you have to build two versions of the instrumented target 13program: 14 15* The first version is built using the regular AFL++ instrumentation. 16* The second one, the CmpLog binary, is built with setting `AFL_LLVM_CMPLOG` 17 during the compilation. 18 19For example: 20 21``` 22./configure --cc=~/path/to/afl-clang-fast 23make 24cp ./program ./program.afl 25make clean 26export AFL_LLVM_CMPLOG=1 27./configure --cc=~/path/to/afl-clang-fast 28make 29cp ./program ./program.cmplog 30unset AFL_LLVM_CMPLOG 31``` 32 33## Use 34 35AFL++ has the new `-c` option that needs to be used to specify the CmpLog binary 36(the second build). 37 38For example: 39 40``` 41afl-fuzz -i input -o output -c ./program.cmplog -m none -- ./program.afl @@ 42``` 43 44Be careful with the usage of `-m` because CmpLog can map a lot of pages. 45