The issue you're encountering with LibAFL is due to how coverage initialization functions are handled differently between LibAFL and LLVM's libFuzzer. Specifically, LibAFL requires the presence of these initialization functions at startup, whereas libFuzzer allows them to be added lazily during runtime.
Understanding Coverage Initialization
Coverage initialization in SanitizerCoverage involves setting up mechanisms like pc-guard, 8bit-counters, etc., which are crucial for tracking code coverage. These mechanisms require specific initialization routines that are typically placed in the .init_array section of an ELF binary. When a fuzzing engine starts, it checks if these initialization functions exist and initializes them accordingly.
Differences Between LibAFL and libFuzzer
-
LibAFL:
- Calls
LLVMFuzzerRunDriver, which internally callsfuzz::fuzz. - Checks for the presence of coverage counters at startup.
- If no coverage counters are found, it raises an error: "No maps available; cannot fuzz!"
- Calls
-
libFuzzer:
- Calls
LLVMFuzzerRunDriveras well but does not check for coverage counters at startup. - Allows new coverage counter arrays to be included laz
- Calls
Read the full article at Malware Analysis, News and Indicators - Latest topics
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)



