> For the complete documentation index, see [llms.txt](https://sansong.gitbook.io/cyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sansong.gitbook.io/cyber/pwn/fuzzing/qiling-+-afl.md).

# Qiling + AFL

### Installation

Installer [<mark style="color:purple;">AFL++</mark>](https://github.com/AFLplusplus/AFLplusplus)

```bash
git clone https://github.com/AFLplusplus/AFLplusplus.git -b dev
make -C AFLplusplus
cd AFLplusplus/unicorn_mode
./build_unicorn_support.sh
```

### Fuzzing

####

#### Snapshot

Sauvegarder les registres, la mémoire et le contexte du CPU dans le fichier <mark style="color:purple;">`snapshot`</mark>

```python
def take_snapshot(ql : Qiling) :
    ql.save(reg=True, mem=True, cpu_context=True, snapshot="./snapshot")
    
def setup_hooks(ql: Qiling):
    ql.hook_address(callback=take_snapshot, address=0x113c0)
    
if __name__ == "__main__":
    path = ["chemin/vers/le/binaire"]
    rootfs = "chemin/vers/rootfs/archi_os"
    ql = Qiling( path,
        rootfs,
        verbose=QL_VERBOSE.OFF,
        console=True
    )
    setup_hooks()
    ql.run()

```

#### Coverage

Pour générer un fichier de couverture [<mark style="color:purple;">Lighthouse</mark>](https://github.com/gaasedelen/lighthouse)

```python
from qiling import *
from qiling.extensions.coverage import utils as cov_utils

with cov_utils.collect_coverage(ql, 'drcov', 'output.cov'):
   ql.run()
```