afl-analyze(8)

💅 afl-analyze — the manual, but make it cute

okay so bestie, you're looking at the afl-analyze(8) page from the System Manager's Manual — yes, that's the one. this is the whole thing, rewritten with ✨love✨ so you actually get it. no cap, every flag is staying. let's go 🎀

🌸 NAME 🌸

afl-analyze

✨ SYNOPSIS ✨

afl-analyze [ options ] -- /path/to/target_app [ ... ]

literally just the tool, then your options, then --, then the target app, then whatever args you wanna feed it. slay. 🫶

---

🦋 OPTIONS 🦋

👑 Required parameters (like, actually required, bestie)

• -i file — the input test case that this tool is gonna analyze. this one's mandatory, don't skip it 💀

🔥 Execution control settings

• -f file — the input file that the tested program reads (this is the stdin one)
• -t msec — timeout for each run (default: 1000 ms)
• -m megs — memory limit for the child process (default: 0 MB)
• -O — use binary-only instrumentation, aka FRIDA mode 🧚
• -Q — use binary-only instrumentation, aka QEMU mode 🦋
• -U — use unicorn-based instrumentation, aka Unicorn mode 🦄
• -W — use qemu-based instrumentation with Wine, aka Wine mode 🍷
• -X — use Nyx mode ⭐

🎀 Analysis settings

• -e — look for edge coverage only, ignore hit counts. periodt.

for additional tips, please consult docs/README.md. it's giving "read the docs" energy but fr fr it's useful 📖

---

🌈 Environment variables used 🌈

these are the env vars, and yeah, they all matter:

• TMPDIR — directory to use for temporary input files
• ASAN_OPTIONS — custom settings for ASAN (must contain abort_on_error=1 and symbolize=0)
• MSAN_OPTIONS — custom settings for MSAN (must contain exitcode=86 and symbolize=0)
• AFL_ANALYZE_HEX — print file offsets in hexadecimal instead of decimal
• AFL_KILL_SIGNAL — Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)
• AFL_FORK_SERVER_KILL_SIGNAL — Kill signal for the fork server on termination (default: SIGTERM). If unset and AFL_KILL_SIGNAL is set, that value will be used.
• AFL_MAP_SIZE — the shared memory size for that target. must be >= the size the target was compiled for
• AFL_PRELOAD — LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target
• AFL_INPUT_PLACEHOLDER — custom placeholder for input file (default: @@)
• AFL_SKIP_BIN_CHECK — skip checking the location of and the target

ngl that AFL_SKIP_BIN_CHECK description is worded kinda wild, but that's literally what it says, so i'm keeping it exactly like that 💜

---

💖 AUTHOR 💖

AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de>. The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus — icons only, the whole squad 👑👑

🍓 LICENSE 🍓

AFL++ is licensed under AGPL-3.0-or-later, with original components under Apache-2.0; an optional commercial license is available. See https://github.com/AFLplusplus/AFLplusplus/blob/stable/LICENSING.md for the full tea ☕

---

that's the whole page, bestie — you ate that 💅✨

and for the cute sign-off: this lil masterpiece comes from AFL++, dated 2026-06-05, and yes it's the afl-analyze(8) page. go forth and analyze, icon 🌟🫶