Lotus Logo

User Guide

  • Architecture & Major Components
  • Getting Started
  • Major Components Overview
  • Installation Guide
  • Tutorials and Examples
  • Bug Detection with Lotus
  • PDG Query Language (Cypher)
  • Property-Based Slicing
  • Verification Driver Abstraction
  • Instrumentation Passes
  • Troubleshooting and FAQ
  • Command-Line Tools Reference

Core Components

  • Alias Analysis
  • Analysis Framework
  • Annotations
  • Applications
    • Components
      • Fuzzing Support
      • Directed Fuzzing Analyses
      • AFLGo Compiler Plugin
      • AFLGo Link-Time Instrumentation
        • Operational notes
  • Context-Free Language Analysis
  • Concurrency Analysis
  • Data Flow Analysis Frameworks
  • Intermediate Representations
  • Machine Learning Features (CanaryML)
  • Optimization
  • Security Components
  • Solvers
  • Symbolic Execution
  • Transforms
  • Utilities
  • Verification
  • Checker Framework

Developer Documentation

  • API Reference
  • Developer Guide
Lotus
  • Applications
  • AFLGo Link-Time Instrumentation
  • View page source

AFLGo Link-Time Instrumentation

include/Fuzzing/AFLGoLinker/ and lib/Fuzzing/AFLGoLinker/ implement the link-time instrumentation passes for AFLGo-style directed fuzzing.

Location: include/Fuzzing/AFLGoLinker/, lib/Fuzzing/AFLGoLinker/

Build Status: Source retained; the subdirectory is commented out as TBD in lib/Fuzzing/CMakeLists.txt and not included in default builds.

Main passes:

  • AFLGoDistanceInstrumentationPass instruments distance feedback.

  • FunctionDistancePass injects function-level distance data.

  • DAFLInstrumentationPass adds DAFL-specific instrumentation.

  • DuplicateTargetRemovalPass and AFLGoTargetInjectionFixupPass clean up target metadata before final code generation.

Role in the pipeline:

  • consume the analyses from Directed Fuzzing Analyses

  • insert profile-guiding feedback at LTO time

  • finalize target handling for directed greybox fuzzers

Operational notes

Use the linker passes with the distance and target facts generated for the same program revision. The cleanup passes run before final code generation so instrumentation observes a consistent set of target annotations. Validate the resulting bitcode or executable with a small corpus before interpreting distance feedback as a fuzzing-quality signal.

See also Fuzzing Support.

Previous Next

© Copyright 2024-2026, ZJU Programming Languages and Automated Reasoning Group.

Built with Sphinx using a theme provided by Read the Docs.