Hi @zr950624 , a lot of fuzzing is based on the coverage achieved by afl, but afl does not implement the coverage calculation method. I used afl-cov and clang to calculate the coverage, but the calculation efficiency would be seriously reduced due to too many seeds. How can I dynamically obtain the coverage of the target program?

I followed your build instruction, an error occurs, any idea?

~/github/Polyglot$ make
cd grammar/js_grammar && ./replace.sh
python Generator.py -i grammar/js_grammar/replaced_grammar -t grammar/js_grammar/tokens -d data/destructor -D data/datatype -e data/extra_flex_rule_js -s grammar/js_grammar/semantic.json
cd parser && flex flex.l && bison bison.y --output=bison_parser.cpp --defines=bison_parser.h --verbose -Wconflicts-rr
cd AFL_replace_mutate && make

[*] Checking for the ability to compile x86 code...
[+] Everything seems to be working, ready to compile.
g++ -std=c++17 -O3 -funroll-loops -fpermissive -g -w -DAFL_PATH=\"/usr/local/lib/afl\" -DDOC_PATH=\"/usr/local/share/doc/afl\" -DBIN_PATH=\"/usr/local/bin\" afl-fuzz.c ../src/*.cpp  ../parser/bison_parser.cpp  ../parser/flex_lexer.cpp -o afl-fuzz -ldl
afl-fuzz.c: In function ‘u8 fuzz_one(char**)’:
afl-fuzz.c:5242:5: error: jump to label ‘abandon_entry’
 5242 |     abandon_entry:
      |     ^~~~~~~~~~~~~
afl-fuzz.c:5198:14: note:   from here
 5198 |         goto abandon_entry;
      |              ^~~~~~~~~~~~~
afl-fuzz.c:5205:11: note:   crosses initialization of ‘int skip_count’
 5205 |       int skip_count = 0;
      |           ^~~~~~~~~~
afl-fuzz.c:5242:5: error: jump to label ‘abandon_entry’
 5242 |     abandon_entry:
      |     ^~~~~~~~~~~~~
afl-fuzz.c:5188:14: note:   from here
 5188 |         goto abandon_entry;
      |              ^~~~~~~~~~~~~
afl-fuzz.c:5205:11: note:   crosses initialization of ‘int skip_count’
 5205 |       int skip_count = 0;
      |           ^~~~~~~~~~
afl-fuzz.c:5242:5: error: jump to label ‘abandon_entry’
 5242 |     abandon_entry:
      |     ^~~~~~~~~~~~~
afl-fuzz.c:5151:16: note:   from here
 5151 |           goto abandon_entry;
      |                ^~~~~~~~~~~~~
afl-fuzz.c:5205:11: note:   crosses initialization of ‘int skip_count’
 5205 |       int skip_count = 0;
      |           ^~~~~~~~~~
make[1]: *** [Makefile:77: afl-fuzz] Error 1
make: *** [Makefile:10: all] Error 2

I try polyglot to fuzz SQLite. However, I find there is no sql_grammar in grammar folder. I want to know how to use poly to do this, and how to write the semantic annotations for SQL language. Thanks.

Hi.

Can polyglot be used with AFL LLVM mode?

I tried using the make file but I get the following error.

Polyglot/AFL_replace_mutate/llvm_mode$ make
[*] Checking for working 'llvm-config'...
[*] Checking for working 'clang'...
[*] Checking for '../afl-showmap'...
[+] All set and ready to build.
[*] Building 32-bit variant of the runtime (-m32)... failed (that's fine)
[*] Testing the CC wrapper and instrumentation output...
unset AFL_USE_ASAN AFL_USE_MSAN AFL_INST_RATIO; AFL_QUIET=1 AFL_PATH=. AFL_CC=clang ../afl-clang-fast -O3 -funroll-loops -Wall -D_FORTIF
Y_SOURCE=2 -g -Wno-pointer-sign -DAFL_PATH=\"/usr/local/lib/afl\" -DBIN_PATH=\"/usr/local/bin\" -DVERSION=\"2.56b\"  ../test-instr.c -o
test-instr
../afl-showmap -m none -q -o .test-instr0 ./test-instr < /dev/null
echo 1 | ../afl-showmap -m none -q -o .test-instr1 ./test-instr

Oops, the instrumentation does not seem to be behaving correctly!

Please ping <[email protected]> to troubleshoot the issue.

Makefile:98: recipe for target 'test_build' failed
make: *** [test_build] Error 1

In the paper it is mentioned that the source code is publicly available. But in github only readme is present. It would be great if the source code was made public