# Compare coverage for AFL++ QEMU

DevFeed: [Compare coverage for AFL++ QEMU](<https://devfeed.tech/articles/compare-coverage-for-afl-qemu-41515.md>)

Original publisher: [Read original article](<https://andreafioraldi.github.io/articles/2019/07/20/aflpp-qemu-compcov.html>)

Author: malweisse's corruptions

Published: 2019-07-20T00:00:00Z

Content type: article

Language: en

Sources: [The blog of malweisse's corruptions](<https://devfeed.tech/sources/the-blog-of-malweisse-s-corruptions.md>)

Topics: [Fuzzing/Fuzz testing](<https://devfeed.tech/topics/fuzzing.md>), [qemu](<https://devfeed.tech/topics/qemu.md>), [Instrumentation](<https://devfeed.tech/topics/instrumentation.md>), [LLVM](<https://devfeed.tech/topics/llvm.md>)

Tags: [bug](<https://devfeed.tech/tags/bug.md>), [fuzzing](<https://devfeed.tech/tags/fuzzing.md>), [instrumentation](<https://devfeed.tech/tags/instrumentation.md>), [llvm](<https://devfeed.tech/tags/llvm.md>), [qemu](<https://devfeed.tech/tags/qemu.md>)

## AI overview

The article describes AFL++ QEMU instrumentation for binary-only fuzzing, focusing on CompareCoverage. It explains how instrumentation can help fuzzers overcome hard comparisons and discusses thread-safety issues involving QEMU TCG block chaining and per-thread variables.

## Source excerpt

Recently, my AFL QEMU instrumentation based on QEMU 3.1 and TCG chaining was merged in the AFLplusplus project and I accepted to become a contributor and maintainer together with van Hauser and hexcoder. AFLplusplus is the son of the American Fuzzy Lop fuzzer and was created initially to incorporate all the best features developed in the years for the fuzzers in the AFL family and not merged in AFL cause it is not updated since November 2017. All the best features are there, you can check the full list in the PATCHES file. Introduction AFL is a battle-tested fuzzer but it can get easily stuck with hard comparison, as described here. In a program like the following the probabilities to trigger the bug are less than the probability that our universe is ruled by Ralph Wiggum. if (input == 0xabad1dea) { /* terribly buggy code */ } else { /* secure code */ } The laf-intel LLVM pass was introduced to address this problem splitting the comparison into many branches, assuming that the fuzzer can easily bypass a comparison of one byte. if (input >> 24 == 0xab){ if ((input & 0xff0000) >> 16 == 0xad) { if ((input & 0xff00) >> 8 == 0x1d) { if ((input & 0xff) == 0xea) { /* terrible code */ goto end; } } } } /* good code */ end: A similar approach was developed by j00ru for Project Zero in his CompareCoverage LLVM pass not splitting the branches this time but instrumenting at a sub-instruction level as described here. This approach was later implemented in a real fuzzer always by Google, honggfuzz but always at the source level. AFLplusplus already support the laf-intel instrumentation in LLVM mode but when comes to fuzz binaries this issue is stronger than ever (almost for public fuzzers). So, why not develop an almost equivalent technique for binary-only fuzzing? It's time to use my QEMU TCG patching skillz. AFLplusplus QEMU instrumentation Before diving in QEMU CompareCoverage, let's understand how I implemented the AFL instrumentation in QEMU 3.1.0 with TCG block chaining in