afl-merge - Man Page

afl-merge [ options ] -- /path/to/target_app [ ... ]

Merge inputs that add new coverage into an output corpus, similar to
libFuzzer's -merge=1. Only inputs whose coverage is not already present
in the output corpus are added; existing output files are never changed
or removed.

Usage (any of):
  ./afl-merge -o out_dir -i in_dir [-i in_dir ...] -- /path/to/target [ ... ]
  ./afl-merge -o out_dir in_dir [in_dir ...]       -- /path/to/target [ ... ]
  ./afl-merge out_dir in_dir [in_dir ...]          -- /path/to/target [ ... ]

In the last form the first directory is the output corpus and -i must not
be used. -o may be given at the beginning or the end.

Execution control settings:
  -f file     - location read by the fuzzed program (stdin)
  -m megs     - memory limit for child process (default: none)
  -t msec     - timeout for each run (default: 5000ms)
  -O          - use binary-only instrumentation (FRIDA mode)
  -Q          - use binary-only instrumentation (QEMU mode)
  -W          - use binary-only instrumentation (WINE mode)
  -U          - use unicorn-based instrumentation (Unicorn mode)
  -X          - use Nyx mode

Input selection settings:
  --crash-dir=dir - move crashes to a separate dir, always deduplicated
  -A          - allow crashes and timeouts (not recommended)
  -C          - only add crashing inputs, reject everything else
  -e          - solve for edge coverage only, ignore hit counts
  --no-dedup  - skip deduplication step for the input files

Misc:
  -T workers  - number of execution and of update workers, or
                exec:update for both counts separately, or 'all'
                (default: 1)
  --as_queue  - name added files "id:000000,orig:filename", or
                "id:000000,hash:sha1" with AFL_SHA1_FILENAMES; the
                numbering restarts with every run
  --debug     - debug mode

Only the first 1048576 bytes of an input are given to the target.
The exit status is 0 on success and 1 on any error, including a run
in which no input matched the requested crash/timeout policy.

afl-merge honors 'AFL_MAP_SIZE' and 'AFL_SHA1_FILENAMES'.

For additional help, consult /usr/share/doc/american-fuzzy-lop/README.md.

AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de> The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus

AFL++ is licensed under AGPL-3.0-or-later, with original components under Apache-2.0; an optional commercial license is available. See https://github.com/AFLplusplus/AFLplusplus/blob/stable/LICENSING.md