Q: Best way to approach manipulation of coverage instrumentation

[liona24]

Hey there, just started checking out the project more in depth.

What I want to do is start hacking on the coverage instrumentation code (mainly for research, trying things out, etc.).
If I were to do this in plain LLVM I would look at the BB instrumentation here and additionally modify the callbacks (__sanitizer_* in FuzzerTracePC). This would give me a modified fuzzer in no time.

What is the best approach here for AFL? I feel a little bit overwhelmed and figured fastest way to get going would be just asking.

There seem to be many places where coverage seems to be ejected but I am not sure what needs to be modified (i.e. minimal set)

[vanhauser-thc]

similar.
the sanitizer callback functions are in instrumentation/afl-compiler.rt.o.c and the main coverage instrumentation is in instrumentation/SanitizerCoveragePCGUARD.so.cc which is based on the SanitizerCoverage.cc llvm but being improved on.