FRfrewsxcv·Jun 20, 2016
Author here.
AFL is coverage-guided fuzz testing (fuzz testing that relies on code coverage).
Someone (not me) wrote an "LLVM pass" that loops through the generated LLVM IR for any LLVM-compiled program and injects the necessary AFL instrumentation such that AFL can work on it:
https://github.com/mirrorer/afl/blob/master/llvm_mode/afl-ll...
Since Rust uses LLVM when compiling a binary, all afl.rs does is incorporate this instrumentation and AFL just needs to be run on the resulting binary.
There are multiple versions of LLVM though. Rust is compiled using a specific version of LLVM. Since the LLVM pass above is reading the generated LLVM that Rust produces, the versions can't be too far off otherwise the LLVM pass might see some unrecognized symbols.
The README in the project suggests just compiling Rust which also compiles LLVM, then you
Read the rest
'll have a version of LLVM that is guaranteed to be the same when you setup the instrumentation.
I think it might be sufficient to update the documentation to suggest the user of afl.rs just download and use LLVM 3.8 since this is the major version that Rust uses internally. I need to do more testing to confirm this will work for everyone, then I can update (and greatly simplify) the README.