custom mutator: symqemu

This uses the symcc to find new paths into the target.

How to build and use

To use this custom mutator follow the steps in the symqemu repository https://github.com/eurecom-s3/symqemu/ on how to build symqemu-x86_x64 and put it in your PATH.

Just type make to build this custom mutator.

AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/symqemu/symqemu-mutator.so AFL_DISABLE_TRIM=1 afl-fuzz ...

Options

SYMQEMU_ALL=1 - use concolic solving on all queue items, not only interesting/favorite ones.

SYMQEMU_LATE=1 - use concolic solving only after there have been no finds for 5 minutes.