qemu_mode block coverage

vanhauser-thc · vanhauser-thc · commit 900b801a46ef · 2025-06-23T22:21:43.000+02:00
diff --git a/docs/Changelog.md b/docs/Changelog.md
@@ -25,6 +25,7 @@
   - qemuafl:
     - Better MIPS persistent mode support
     - `AFL_EXITPOINT` support added
+    - `AFL_QEMU_BLOCK_COV` block coverage support added
   - afl-cmin:
     - New afl-cmin.py which is much faster, will be executed by default via
       afl-cmin if it executes successfully (thanks to @kcwu!)
diff --git a/docs/env_variables.md b/docs/env_variables.md
@@ -741,6 +741,10 @@ The QEMU wrapper used to instrument binary-only code supports several settings:
     of the basic blocks, which can be useful when dealing with very complex
     binaries.
 
+  - You can switch to block coverage that has less chances of colliding (but
+    on the other hand coverage is on blocks, not edges) with
+    `AFL_QEMU_BLOCK_COV`.
+
   - Setting `AFL_QEMU_COMPCOV` enables the CompareCoverage tracing of all cmp
     and sub in x86 and x86_64. This is an alias of `AFL_COMPCOV_LEVEL=1` when
     `AFL_COMPCOV_LEVEL` is not specified.
diff --git a/include/envs.h b/include/envs.h
@@ -103,8 +103,8 @@ static char *afl_environment_variables[] = {
     "AFL_PERSISTENT_RECORD", "AFL_POST_PROCESS_KEEP_ORIGINAL", "AFL_PRELOAD",
     "AFL_TARGET_ENV", "AFL_PYTHON_MODULE", "AFL_QEMU_CUSTOM_BIN",
     "AFL_QEMU_COMPCOV", "AFL_QEMU_COMPCOV_DEBUG", "AFL_QEMU_DEBUG_MAPS",
-    "AFL_QEMU_DISABLE_CACHE", "AFL_QEMU_DRIVER_NO_HOOK", "AFL_QEMU_FORCE_DFL",
-    "AFL_QEMU_PERSISTENT_ADDR", "AFL_QEMU_PERSISTENT_CNT",
+    "AFL_QEMU_BLOCK_COV", "AFL_QEMU_DISABLE_CACHE", "AFL_QEMU_DRIVER_NO_HOOK",
+    "AFL_QEMU_FORCE_DFL", "AFL_QEMU_PERSISTENT_ADDR", "AFL_QEMU_PERSISTENT_CNT",
     "AFL_QEMU_PERSISTENT_GPR", "AFL_QEMU_PERSISTENT_HOOK",
     "AFL_QEMU_PERSISTENT_MEM", "AFL_QEMU_PERSISTENT_RET",
     "AFL_QEMU_PERSISTENT_RETADDR_OFFSET", "AFL_QEMU_PERSISTENT_EXITS",
diff --git a/qemu_mode/QEMUAFL_VERSION b/qemu_mode/QEMUAFL_VERSION
@@ -1 +1 @@
-0d45c0b84a
+8c7f180c5a
diff --git a/qemu_mode/qemuafl b/qemu_mode/qemuafl
@@ -1 +1 @@
-Subproject commit 0d45c0b84a42dc40e764ad4e01b748e92e58108d
+Subproject commit 8c7f180c5a1e3c6ecf7a2136c3dda22cf4b64881
