afl-showmap(8)

📦
version 5.00c · 15 versions
, in arch rolling

💅 afl-showmap(8) — System Manager's Manual 🎀

okay so bestie, welcome to afl-showmap from the AFL++ family — this is the little tool that shows you the raw tuple data your target's AFL instrumentation captured. think of it as a vibe check for your coverage map 💖

✨ NAME ✨

afl-showmap — the icon of showing you what edges your program actually hit, no cap 👑

🌸 SYNOPSIS 🌸

afl-showmap [ options ] -- /path/to/target_app [ ... ]

yep that's the whole shape of it: your options first, then --, then the target and whatever args you wanna feed it 🫶

💅 OPTIONS 💅

🎀 Required parameters 🎀

  • -o file — the file where the trace data gets written. lowkey required — except when you're using -S, then it's not needed at all.

🔥 Execution control settings 🔥

  • -t msec — timeout for each run, in milliseconds (default: 1000ms)
  • -m megs — memory limit for the child process (default: none)
  • -O — use binary-only instrumentation, aka FRIDA mode
  • -Q — use binary-only instrumentation, aka QEMU mode
  • -U — use Unicorn-based instrumentation, aka Unicorn mode
  • -W — use qemu-based instrumentation with Wine, aka Wine mode (not necessary, it's here for consistency with the other afl-* tools — cute of them honestly)
  • -X — use Nyx mode 🌈

⭐ Other settings ⭐

  • -f file — the input file read by the tested program
  • -S — streaming mode: reads test cases from stdin and writes coverage to stdout using a length-value protocol. this is the slay part that lets you use afl-showmap as a coverage proxy so you can leverage the AFL++ forkserver without implementing it yourself, iykyk 💫

Protocol — input side:

[u32 len][data]

Protocol — output side:

[u16 status][u32 edges][(u32,u8)*]
[u32 stdout_len][stdout_data*]
[u32 stderr_len][stderr_data*]

Status bits explained:

bits [0:1]  = exit (0=ok, 1=timeout, 2=crash)
bits [2:7]  = reserved (0)
bits [8:15] = exit code (ok) or signal (crash)
heads up bestie 🫶 stdout_len/stderr_len are currently always 0 — output capture is not yet implemented. don't come for me, it's on the way 💀
  • -i dir — process all files below this directory. must be combined with -o. with -C, -o is a file; without -C it must be a directory, and each bitmap gets written there individually 🎀
  • -I filelist — instead of -i, you hand it a list of files
  • -C — collect coverage, writes all edges to -o and gives you a summary. must be combined with -i.
  • -q — sink the program's output and don't show messages (silence is golden ✨)
  • -e — show edge coverage only, ignore hit counts
  • -r — show real tuple values instead of AFL filter values
  • -s — do not classify the map
  • -c — allow core dumps

🦋 the whole point 🦋

this tool displays the raw tuple data captured by AFL instrumentation. for additional help, consult docs/README.md 🧚

if you're using -i/-I mode, then custom mutator post_process send/send functionality is supported. literally built for the group chat 💌

🌈 Environment variables used 🌈

  • LD_BIND_LAZY — do not set the LD_BIND_NOW env var for the target
  • AFL_CMIN_CRASHES_ONLY — (cmin_mode) only write tuples for crashing inputs
  • AFL_CMIN_ALLOW_ANY — (cmin_mode) write tuples for crashing and timeout inputs too
  • AFL_CRASH_EXITCODE — optional child exit code to be interpreted as a crash
  • AFL_DEBUG — enable extra developer output 👩‍💻
  • AFL_FORKSRV_INIT_TMOUT — time spent waiting for the forkserver during startup (in milliseconds)
  • AFL_KILL_SIGNAL — signal ID delivered to child processes on timeout, etc. (default: SIGKILL)
  • AFL_FORK_SERVER_KILL_SIGNAL — kill signal for the fork server on termination (default: SIGTERM). if unset and AFL_KILL_SIGNAL is set, that value will be used.
  • AFL_MAP_SIZE — the shared memory size for that target. must be >= the size the target was compiled for 🚨
  • AFL_PRELOAD — LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for the target
  • AFL_INPUT_PLACEHOLDER — custom placeholder for the input file (default: @@)
  • AFL_PRINT_FILENAMES — print the queue entry currently processed to stdout
  • AFL_QUIET — do not print extra informational output 🤫
  • AFL_NO_FORKSRV — run the target via execve instead of using the forkserver

👑 AUTHOR 👑

AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de>. the homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus — go follow the icons 💖

📜 LICENSE 📜

AFL++ is licensed under AGPL-3.0-or-later, with original components under Apache-2.0; an optional commercial license is available. see https://github.com/AFLplusplus/AFLplusplus/blob/stable/LICENSING.md 🫶

and that's the whole page, bestie ✨ — this edition of <pink>AFL++</pink> dropped on 2026-06-05 and honestly?? ate. no notes. bye babes 💅🎀🦋

📦 where this page comes from