afl-showmap(8) System Manager's Manual afl-showmap(8) NAME afl-showmap SYNOPSIS afl-showmap [ options ] -- /path/to/target_app [ ... ] OPTIONS Required parameters: -o file - file to write the trace data to (not required with -S) Execution control settings: -t msec - timeout for each run (default: 1000ms) -m megs - memory limit for child process (default: none) -O - use binary-only instrumentation (FRIDA mode) -Q - use binary-only instrumentation (QEMU mode) -U - use Unicorn-based instrumentation (Unicorn mode) -W - use qemu-based instrumentation with Wine (Wine mode) (Not necessary, here for consistency with other afl-* tools) -X - use Nyx mode Other settings: -f file - input file read by the tested program -S - streaming mode: read test cases from stdin, write coverage to stdout using a length-value protocol. Allows using afl-showmap as a coverage proxy to leverage the AFL++ forkserver without implementing it. Protocol: Input [u32 len][data] Output [u16 status][u32 edges][(u32,u8)*] [u32 stdout_len][stdout_data*] [u32 stderr_len][stderr_data*] Status: bits [0:1] = exit (0=ok, 1=timeout, 2=crash), bits [2:7] = reserved (0), bits [8:15] = exit code (ok) or signal (crash) Note: stdout_len/stderr_len are currently always 0 (output capture not yet implemented) -i dir - process all files below this directory, must be combined with -o. With -C, -o is a file, without -C it must be a directory and each bitmap will be written there individually. -I filelist - alternatively to -i, -I is a list of files -C - collect coverage, writes all edges to -o and gives a summary Must be combined with -i. -q - sink program's output and don't show messages -e - show edge coverage only, ignore hit counts -r - show real tuple values instead of AFL filter values -s - do not classify the map -c - allow core dumps This tool displays raw tuple data captured by AFL instrumentation. For additional help, consult docs/README.md. If you use -i/-I mode, then custom mutator post_process send send functionality is supported. Environment variables used: LD_BIND_LAZY: do not set LD_BIND_NOW env var for target AFL_CMIN_CRASHES_ONLY: (cmin_mode) only write tuples for crashing inputs AFL_CMIN_ALLOW_ANY: (cmin_mode) write tuples for crashing and timeout inputs also AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash AFL_DEBUG: enable extra developer output AFL_FORKSRV_INIT_TMOUT: time spent waiting for forkserver during startup (in milliseconds) AFL_KILL_SIGNAL: Signal ID delivered to child processes on timeout, etc. (default: SIGKILL) AFL_FORK_SERVER_KILL_SIGNAL: Kill signal for the fork server on termination (default: SIGTERM). If unset and AFL_KILL_SIGNAL is set, that value will be used. AFL_MAP_SIZE: the shared memory size for that target. must be >= the size the target was compiled for AFL_PRELOAD: LD_PRELOAD / DYLD_INSERT_LIBRARIES settings for target AFL_INPUT_PLACEHOLDER: custom placeholder for input file (default: @@) AFL_PRINT_FILENAMES: Print the queue entry currently processed will to stdout AFL_QUIET: do not print extra informational output AFL_NO_FORKSRV: run target via execve instead of using the forkserver AUTHOR AFL++ was written by Michal "lcamtuf" Zalewski and is maintained by Marc "van Hauser" Heuse , Dominik Maier , Andrea Fioraldi and Heiko "hexcoder-" Eissfeldt The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus LICENSE AFL++ is licensed under AGPL-3.0-or-later, with original components under Apache-2.0; an optional commercial license is available. See https://github.com/AFLplusplus/AFLplusplus/blob/stable/LICENSING.md AFL++ 2026-06-05 afl-showmap(8)