afl-cmin.bash(8)

📦
version 5.00c · 14 versions
, in arch rolling

💅 afl-cmin.bash(8) — like, the group chat version

okay so real quick: this is a page from the System Manager's Manual, and it's about afl-cmin.bash — the corpus minimizer bestie. she takes your giant messy pile of seed files and slims it down to only the ones that actually do something. honestly iconic behavior. 🎀

✨ NAME ✨

afl-cmin.bash — bestie, that's literally the whole name, no extra lore 💖

🦋 SYNOPSIS 🦋

Usage: ./afl-cmin.bash [ options ] -- /path/to/target_app [ ... ]

so you run the script, you throw your options at it, then --, then the path to the target app, then whatever extra args the target wants. the -- is the vibe check divider between "my settings" and "the app's settings". periodt. ✨

🌸 OPTIONS 🌸

💜 Required parameters (yes, these are non-negotiable, no cap)

  • -i dir — the input directory holding your starting corpus. your big pile of seeds goes here. 🍓
  • -o dir — the output directory where the minimized files get dropped. this is where the magic lands, bestie. ✨

🔥 Execution control settings (how she actually runs the thing)

  • -T tasks — how many parallel processes to create (default=1, "all"=nproc). more tasks = more girlies working at once. 👑
  • -f file — the location read by the fuzzed program (default: stdin). lowkey important if your target doesn't just eat stdin. 🙈
  • -m megs — memory limit for child process (default=none MB). be nice to your RAM, she's trying her best. 💀
  • -t msec — run time limit for child process (default: 5000ms). five whole seconds by default, generous queen.
  • -O — use binary-only instrumentation (FRIDA mode). no source? no problem. 🧚
  • -Q — use binary-only instrumentation (QEMU mode). the classic binary-only road. 🌈
  • -U — use unicorn-based instrumentation (Unicorn mode). sparkly. ⭐
  • -X — use Nyx mode. the fancy one. 👑

🎀 Minimization settings (the actual "make it smaller" section)

  • -A — allow crashing and timeout inputs. yes, the messy ones get to stay. 💅
  • -C — keep crashing inputs, reject everything else. very picky, very main character energy. 😭
  • -e — solve for edge coverage only, ignore hit counts. vibes only, no numbers. ✨

🫶 the little notes at the bottom of that section 🫶

  • For additional tips, please consult README.md. fr fr, it's right there. 📖
  • This script cannot read filenames that end with a space ' '. that's just how it is, ngl — rename the file or accept your fate. 💀

🌟 Environment variables used (yes she reads the vibe of your shell) 🌟

  • AFL_KEEP_TRACES — leave the temporary <out_dir>.traces directory. it's giving "i'm not throwing that away". 🎀
  • AFL_NO_FORKSRV — run target via execve instead of using the forkserver. old school. 🦋
  • AFL_PATH — last resort location to find the afl-showmap binary. she'll go looking, but only as a last resort. 🙈
  • AFL_SKIP_BIN_CHECK — skip check for target binary. yeet the safety rail. 🔥
  • AFL_CUSTOM_MUTATOR_LIBRARY — custom mutator library (post_process and send). 🧚
  • AFL_PYTHON_MODULE — custom mutator library (post_process and send). yes, same description, that's literally what the page says, don't come for me. 💜

👑 AUTHOR 👑

AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

like, a whole squad of maintainers. respect. 🫶

🌈 LICENSE 🌈

AFL++ is licensed under AGPL-3.0-or-later, with original components under Apache-2.0; an optional commercial license is available. See https://github.com/AFLplusplus/AFLplusplus/blob/stable/LICENSING.md

okay that's the whole page, you ate that. mwah. 💖✨

this masterpiece brought to you by AFL++, dated 2026-06-05 — afl-cmin.bash(8), signing off 🎀🦋💅
📦 where this page comes from