afl-tmin(8)

📦
version 5.00c · 15 versions
, in arch rolling

💅 afl-tmin — the glow-up your test case deserves 💅

okay so picture this: afl-tmin is a page from the AFL++ manual (section 8, System Manager's Manual — very official, very demure), and it's basically the makeover episode of your fuzzing journey. bestie, it takes your chonky lil input file and shrinks it down while keeping the same behavior. slay.

✨ NAME ✨

afl-tmin — no cap, that's the whole name. icon behavior honestly.

🦋 SYNOPSIS 🦋

afl-tmin [ options ] -- /path/to/target_app [ ... ]

so it's afl-tmin, then whatever options you want, then a --, then the path to your target app, then any extra args the target needs. the -- is the vibe check that says "everything after this is the program, not my flags" 🫶

🎀 OPTIONS 🎀

💖 Required parameters 💖 (yes, these two are non-negotiables)

  • -i file — the input test case that's about to be shrunk by the tool. this is your before pic 💅
  • -o file — where the minimized data goes when it's all done. your after pic ✨

🔥 Execution control settings 🔥

  • -f file — the input file that the tested program reads (stdin). yep, this is the file-instead-of-stdin situation, iykyk.
  • -t msec — timeout for each run. default is 1000 ms. patience is a virtue but like, a bounded one.
  • -m megs — memory limit for the child process. default is 0 MB. keep your kid on a budget 💀
  • -O — use binary-only instrumentation, aka FRIDA mode.
  • -Q — use binary-only instrumentation, aka QEMU mode.
  • -U — use unicorn-based instrumentation, aka Unicorn mode 🦄
  • -W — use qemu-based instrumentation with Wine, aka Wine mode 🍷 (not necessary — it's literally here for consistency with the other afl-* tools, so it's giving tag-along little sibling energy)
  • -X — use Nyx mode.
  • -K dir — use a python script to interact with the GUI, aka GUI mode.

🌸 Minimization settings 🌸 (the actual glow-up dials)

  • -e — solve for edge coverage only, ignore hit counts. less is more, bestie.
  • -l bytes — set the minimum block deletion length, which speeds up the minimization. going fast is a flex 🔥
  • -x — treat non-zero exit codes as crashes. dramatic? yes. accurate? also yes.
  • -H — minimize a hang, aka hang mode. the "why is it just sitting there" scenario, but make it productive 😭
for additional tips, please consult docs/README.md — genuinely, go read it, it's giving lore 📖

🧚 Environment variables used 🧚

  • AFL_CRASH_EXITCODE — optional child exit code to be interpreted as a crash.
  • AFL_FORKSRV_INIT_TMOUT — time spent waiting for the forkserver during startup, in ms.
  • AFL_KILL_SIGNAL — the Signal ID delivered to child processes on timeout, etc. (default: SIGKILL).
  • AFL_FORK_SERVER_KILL_SIGNAL — the kill signal for the fork server on termination (default: SIGTERM). if it's unset and AFL_KILL_SIGNAL is set, that value will be used.
  • AFL_MAP_SIZE — the shared memory size for that target. must be >= the size the target was compiled for.
  • AFL_PRELOAD — LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for the target.
  • AFL_INPUT_PLACEHOLDER — custom placeholder for the input file (default: @@).
  • AFL_TMIN_EXACT — require execution paths to match for crashing inputs.
  • AFL_NO_FORKSRV — run the target via execve instead of using the forkserver.
  • ASAN_OPTIONS — custom settings for ASAN. it must contain abort_on_error=1 and symbolize=0, no exceptions 💀
  • MSAN_OPTIONS — custom settings for MSAN. it must contain exitcode=86 and symbolize=0, same deal.
  • TMPDIR — the directory to use for temporary input files.

👑 AUTHOR 👑

AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de>. the homepage of AFL++ is literally right here: https://github.com/AFLplusplus/AFLplusplus — go follow the main characters ⭐

🌈 LICENSE 🌈

AFL++ is licensed under AGPL-3.0-or-later, with original components under Apache-2.0; an optional commercial license is available. full deets: https://github.com/AFLplusplus/AFLplusplus/blob/stable/LICENSING.md 📜

💜 and that's the whole page, bestie. this lil manual moment was brought to you by AFL++, dated 2026-06-05, living in section 8 of the System Manager's Manual — signing off, mwah 🫶✨
📦 where this page comes from