afl-tmin - Man Page


afl-tmin [ options ] -- /path/to/target_app [ ... ]


Required parameters:
  -i file       - input test case to be shrunk by the tool
  -o file       - final output location for the minimized data

Execution control settings:
  -f file       - input file read by the tested program (stdin)
  -t msec       - timeout for each run (1000 ms)
  -m megs       - memory limit for child process (0 MB)
  -O            - use binary-only instrumentation (FRIDA mode)
  -Q            - use binary-only instrumentation (QEMU mode)
  -U            - use unicorn-based instrumentation (Unicorn mode)
  -W            - use qemu-based instrumentation with Wine (Wine mode)
                  (Not necessary, here for consistency with other afl-* tools)

Minimization settings:
  -e            - solve for edge coverage only, ignore hit counts
  -x            - treat non-zero exit codes as crashes

  -H            - minimize a hang (hang mode)
For additional tips, please consult docs/

Environment variables used:
AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash
AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds)
AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL)
AFL_MAP_SIZE: the shared memory size for that target. must be >= the size
              the target was compiled for
AFL_TMIN_EXACT: require execution paths to match for crashing inputs
AFL_NO_FORKSRV: run target via execve instead of using the forkserver
ASAN_OPTIONS: custom settings for ASAN
              (must contain abort_on_error=1 and symbolize=0)
MSAN_OPTIONS: custom settings for MSAN
              (must contain exitcode=86 and symbolize=0)
TMPDIR: directory to use for temporary input files


afl++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse <>, Heiko "hexcoder-" Eissfeldt <>, Andrea Fioraldi <> and Dominik Maier <> The homepage of afl++ is:


Apache License Version 2.0, January 2004


2021-10-12 afl++