{"id":51122506,"url":"https://github.com/aflplusplus/cov-analysis","last_synced_at":"2026-06-25T04:00:57.556Z","repository":{"id":351513097,"uuid":"1210710244","full_name":"AFLplusplus/cov-analysis","owner":"AFLplusplus","description":"afl-cov successor - simpler and using modern llvm tools","archived":false,"fork":false,"pushed_at":"2026-06-20T17:58:33.000Z","size":686,"stargazers_count":22,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-06-20T19:21:41.403Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AFLplusplus.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-14T17:21:12.000Z","updated_at":"2026-06-20T17:58:37.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/AFLplusplus/cov-analysis","commit_stats":null,"previous_names":["vanhauser-thc/cov-analysis"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/AFLplusplus/cov-analysis","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFLplusplus%2Fcov-analysis","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFLplusplus%2Fcov-analysis/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFLplusplus%2Fcov-analysis/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFLplusplus%2Fcov-analysis/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AFLplusplus","download_url":"https://codeload.github.com/AFLplusplus/cov-analysis/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AFLplusplus%2Fcov-analysis/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34758776,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-25T02:00:05.521Z","response_time":101,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-25T04:00:56.864Z","updated_at":"2026-06-25T04:00:57.548Z","avatar_url":"https://github.com/AFLplusplus.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cov-analysis - Fuzzing Code Coverage for AFL++, libFuzzer, libafl, and honggfuzz\n\nReplacing `afl-cov` and `libfuzzer-cov` with modern coverage gathering and great features!\n\nVersion: 1.0.0\n\n- [Introduction](#introduction)\n- [Prerequisites](#prerequisites)\n- [Supported Fuzzers](#supported-fuzzers)\n- [Workflow](#workflow)\n  - [Step 1: Build a Coverage Binary](#step-1-build-a-coverage-binary)\n  - [Step 2: Generate Coverage Report](#step-2-generate-coverage-report)\n  - [Step 3: Diff Two Coverage Reports](#step-3-diff-two-coverage-reports)\n  - [Step 4: Identifying unstable code lines](#step-4-identifying-unstable-code-lines)\n  - [Step 5: Search which inputs reach a line](#step-5-search-which-inputs-reach-a-line)\n  - [Parallelized AFL Execution](#parallelized-afl-execution)\n- [Usage Information](#usage-information)\n  - [cov-analysis report (default)](#cov-analysis-report-default)\n  - [cov-analysis build](#cov-analysis-build)\n  - [cov-analysis driver](#cov-analysis-driver)\n  - [cov-analysis diff](#cov-analysis-diff)\n  - [cov-analysis stability](#cov-analysis-stability)\n  - [cov-analysis search](#cov-analysis-search)\n- [License](#license)\n\n## Introduction\n\n`cov-analysis` generates **LLVM source-based code coverage** reports from a fuzzing corpus. It auto-detects the on-disk layout used by [AFL++](https://github.com/AFLplusplus/AFLplusplus) (queue/crashes/timeouts directories, single or parallel), libFuzzer and libafl (flat corpus dir plus `crash-*`/`leak-*`/`oom-*` artifacts), and honggfuzz (flat corpus plus `SIG*.fuzz` crash files). It replays each input through a coverage-instrumented binary, merges the raw profiles, and produces HTML, text, and JSON reports via `llvm-profdata` and `llvm-cov`.\n\nThis is a rewrite of the original cov-analysis. Key changes in 1.0.0:\n- New: diff reports comparing coverage between two runs\n- New: stability analysis identifying source lines with non-deterministic hit counts\n- Replaced gcov/lcov/genhtml with LLVM source-based coverage (`-fprofile-instr-generate`, `llvm-profdata`, `llvm-cov`) - faster, more accurate under optimization\n- `cov-analysis build` sets compiler flags and builds the target; `cov-analysis driver` emits a ready-to-use `coverage_driver.c` for `LLVMFuzzerTestOneInput` harnesses\n- `cov-analysis diff` generates an HTML diff report comparing coverage between two JSON exports\n- Rewritten in bash (was Python)\n\n## Prerequisites\n\n- `clang` (any version down to 11)\n- `llvm-profdata` and `llvm-cov` — auto-detected to match the selected clang\n  version. When a versioned compiler is chosen (e.g. `CC=clang-22`, or the\n  default `clang` reports version 22), the matching `llvm-profdata-22` /\n  `llvm-cov-22` are used so the raw profiles merge without a version mismatch.\n- AFL++ (`afl-fuzz`), libafl, libfuzzer, Honggfuzz, ... - only needed to produce the corpus, not to run `cov-analysis`\n\n## Supported Fuzzers\n\n| Fuzzer     | Detected by                                | Input files replayed                                                          |\n|------------|--------------------------------------------|-------------------------------------------------------------------------------|\n| AFL++      | `\u003cdir\u003e/queue/` or `\u003cdir\u003e/*/queue/` exists  | `queue/id:*`, `crashes/id:*`, `timeouts/id:*`                                 |\n| libFuzzer  | flat directory of files, no `queue/`       | all files except `crash-*`/`leak-*`/`oom-*`/`timeout-*`/`slow-unit-*`        |\n| libafl     | flat directory of files, no `queue/`       | all files except `crash-*`/`leak-*`/`oom-*`/`timeout-*`/`slow-unit-*`        |\n| honggfuzz  | flat directory of files, no `queue/`       | all files except `SIG*.fuzz` and `HONGGFUZZ.REPORT.TXT`                       |\n\nFor libFuzzer, libafl and honggfuzz, crash-like files (above) are still replayed, but under the `-T` timeout so a hanging input can't stall the run.\n\nOverride auto-detection with `--layout afl|flat`.\n\n## Workflow\n\nNote: `cov-analysis` uses the `TMPDIR` environment variable if present.\n\n### Step 1: Build a Coverage Binary\n\nUse `cov-analysis build` to set the correct compiler flags and build your target:\n\n```bash\n# Set up a coverage build (run once per build step)\ncd /path/to/project-cov/\ncov-analysis build ./configure --disable-shared\ncov-analysis build make -j$(nproc)\n```\n\n`cov-analysis build` sets:\n```\nCC=clang  CXX=clang++\nCFLAGS=\"-fprofile-instr-generate -fcoverage-mapping -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1\"\nLDFLAGS=\"-fprofile-instr-generate\"\n```\n\n**Important:** `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1` must match what was used during fuzzing - it disables the same checksums/HMACs that AFL++ bypassed.\n\n#### For `LLVMFuzzerTestOneInput` harnesses\n\nGenerate a replay driver and link it against your coverage-instrumented library:\n\n```bash\ncov-analysis driver -o coverage_driver.c\nclang -fprofile-instr-generate -fcoverage-mapping \\\n  -c coverage_driver.c -o coverage_driver.o\nclang -fprofile-instr-generate \\\n  coverage_driver.o -L./build -ltarget -o cov\n```\n\nThe driver loops over all file arguments, calls `LLVMFuzzerTestOneInput` for each, and installs a crash handler that flushes profiling data so crashing inputs still contribute to the report.\n\n### Step 2: Generate Coverage Report\n\nThis step produces an `llvm-cov` coverage report with regions and branches:\n\n\u003cimg align=\"left\" src=\"https://raw.githubusercontent.com/AFLplusplus/cov-analysis/main/report-overview.png\" alt=\"report overview\"\u003e\n\n\u003cimg align=\"left\" src=\"https://raw.githubusercontent.com/AFLplusplus/cov-analysis/main/report-detail.png\" alt=\"report detail\"\u003e\n\n```bash\ncd /path/to/project-cov/\ncov-analysis -d /path/to/afl-fuzz-output/ -e \"./cov @@\"\n```\n\nTo replay coverage with multiple workers, add `-t`:\n\n```bash\ncov-analysis -d /path/to/afl-fuzz-output/ -e \"./cov @@\" -t 8\n```\n\n`cov-analysis` will for AFL++:\n1. Replay all `queue/id:*` files in batch (fast)\n2. Replay `crashes/id:*` and `timeouts/id:*` one-by-one with a timeout\n3. Merge `.profraw` profiles with `llvm-profdata`\n4. Generate reports in `/path/to/afl-fuzz-output/cov/`\n\nFor libfuzzer/libafl/Honggfuzz `cov-analysis` will:\n1. Replay all files in the directory\n2. Crash files are replayed one-by-one with a timeout\n\nOutput:\n```\n/path/to/afl-fuzz-output/cov/\n  html/index.html     ← browse this for annotated source coverage\n  text/               ← text format, suitable for automated analysis\n  summary.txt         ← per-file line/branch/function percentages\n  coverage.json       ← machine-readable export\n  coverage.profdata   ← merged profile (baseline for iterative improvement)\n```\n\nFor stdin-based targets (binary reads from stdin, no file argument):\n\n```bash\ncov-analysis -d /path/to/afl-fuzz-output/ -e \"./target\"\n```\n\n#### libFuzzer corpus\n\n```bash\ncov-analysis -d /path/to/libfuzzer-corpus/ -e \"./cov @@\"\n```\n\nCorpus files are replayed in batch mode. If your libFuzzer run used `-artifact_prefix=./crashes/`, point a second run at that directory to cover crash inputs too — or move artifacts into the corpus dir beforehand.\n\n#### honggfuzz workspace\n\n```bash\ncov-analysis -d /path/to/hfuzz-workdir/ -e \"./cov @@\"\n```\n\n`SIG*.fuzz` crash files are replayed under the `-T` timeout. The `HONGGFUZZ.REPORT.TXT` metadata file is ignored automatically.\n\n#### Cross-referencing static reachability\n\nIf you have run the companion [fuzz-reachability](https://github.com/AFLplusplus/fuzz-reachability)\nanalyzer, pass its output with `--reachability` to tell apart coverage gaps that\nare worth chasing from dead weight you can safely ignore:\n\n```bash\ncov-analysis -d /path/to/afl-fuzz-output/ -e \"./cov @@\" \\\n  --reachability /path/to/reachability/test.json\n```\n\n`--reachability` accepts the analyzer's JSON report, its output directory\n(holding `reached.txt` / `not_reached.txt`), or a single SanitizerCoverage\nallow/ignore `.txt` list. The normal `llvm-cov` HTML and text reports are\nannotated **in place** (no separate report). In the HTML file view each\nfunction's lines are tinted:\n\n- **covered** — keeps `llvm-cov`'s usual coloring\n- **amber** — statically *reachable* but never reached (the actionable gap;\n  a lighter amber marks functions reachable only through over-approximated\n  indirect calls)\n- **dark grey** — statically *unreachable*, so it is expected to stay\n  uncovered — ignore it\n- **purple** — covered yet flagged unreachable (a static-analysis anomaly worth\n  a look, since the analyzer claims it never under-reports)\n\nThe HTML `index.html` gains a tally banner. The text source view (`text/`) gets\na per-line marker column (`U` unreachable, `R` reachable-but-unreached,\n`A` anomaly), and `summary.txt` gains a reachability tally plus the explicit\nlist of reachable-but-not-reached functions to go after.\n\n**The coverage numbers themselves are recomputed to exclude unreachable\nfunctions.** Normally a function coverage of `5/6` counts a statically-dead\nfunction in the denominator even though the harness can never reach it. With\n`--reachability`, the Function / Line / Region / Branch numbers in both\n`index.html` and `summary.txt` drop every statically-unreachable function from\nthe denominators (and numerators), so the percentages reflect only code the\nharness can actually reach — e.g. that `5/6` becomes `5/5`. The numbers come\nstraight from `llvm-cov report -show-functions` (so they match llvm-cov's own\nmath exactly), re-summed over the reachable set; the unmodified figures remain\nin `coverage.json`. With `--reachability` the HTML index is rendered flat\n(directory grouping disabled) so its cells can be rewritten reliably.\n\n`cov-analysis diff` accepts the same `--reachability` flag; it splits the\n\"still uncovered functions\" list in the diff report into reachable (amber,\nactionable) and unreachable (grey, expected dead).\n\n### Step 3: Diff Two Coverage Reports\n\nCompare coverage between two `llvm-cov` JSON exports and generate an HTML diff report:\n\n```bash\ncov-analysis diff coverage_old.json coverage_new.json\n```\n\nIf you use the same output directory for a subsequent run, `cov-analysis` renames the existing `coverage.json` to `coverage_old.json` automatically, so `cov-analysis diff` works with no arguments.\n\nThe report is written to `\u003creport-dir\u003e/coverage_diff.html` and shows:\n- Newly covered and no-longer-covered lines per file\n- Newly covered and lost functions\n- Source code snippets annotated with coverage change\n\nIf the JSON paths are omitted, `cov-analysis diff` defaults to `\u003creport-dir\u003e/coverage_old.json` and `\u003creport-dir\u003e/coverage.json`. Run with no arguments and neither default report present in the current directory, it prints the help instead of an error.\n\nThe HTML diff report looks like this:\n\n\u003cimg align=\"left\" src=\"https://raw.githubusercontent.com/AFLplusplus/cov-analysis/main/diff-overview.png\" alt=\"diff overview\"\u003e\n\u003cimg align=\"left\" src=\"https://raw.githubusercontent.com/AFLplusplus/cov-analysis/main/diff-detail.png\" alt=\"diff detail\"\u003e\n\n### Step 4: Identifying unstable code lines\n\nEver wondered which source lines cause AFL++ or libafl to report instability in a fuzz target?\nThe `stability` command identifies them.\n\n```bash\ncov-analysis stability -d ../afl/out -e \"./cov @@\"\n```\n\nThis will give you the exact lines that are problematic, e.g.:\n```\nStability Report\n--------------------------------------------------------\nCorpus size : 2 inputs\nRuns        : 8\nStability   : 74.0% (91/123 executed lines stable)\n\n~~ Variable-count lines (32 lines):\n   Lines with varying hit counts:\n\n  /prg/cov-analysis/tests/unstable.c:35-37\n  /prg/cov-analysis/tests/unstable.c:43\n  /prg/cov-analysis/tests/unstable.c:46-48\n  /prg/cov-analysis/tests/unstable.c:51-52\n  /prg/cov-analysis/tests/unstable.c:55-61\n  /prg/cov-analysis/tests/unstable.c:64-66\n  /prg/cov-analysis/tests/unstable.c:69-70\n  /prg/cov-analysis/tests/unstable.c:75-85\n\n[!] Unstable coverage detected.\n```\n\n### Step 5: Search which inputs reach a line\n\nWonder which corpus entries actually exercise a particular source line? The\n`search` command replays each input in isolation and reports the ones that\nreach `FILE:LINE`:\n\n```bash\ncov-analysis search src/parser.c:142 -d ../afl/out -e \"./cov @@\"\n```\n\nMatching input paths are printed to stdout (one per line, sorted) so the result\npipes cleanly; progress and the summary go to stderr:\n\n```\nsrc/parser.c:142 is reachable; scanning...\nout/queue/id:000017,...\nout/queue/id:000094,...\n[+] 2 of 142 inputs reach src/parser.c:142\n```\n\nBy default only queue/corpus entries are scanned. Add `--crashes` to also scan\ncrash and timeout inputs, and `-t N` to parallelize:\n\n```bash\ncov-analysis search src/parser.c:142 -d ../afl/out -e \"./cov @@\" --crashes -t 8\n```\n\nA fast union pre-check replays the whole corpus once first; if no input reaches\nthe line, `search` reports `0 of N` immediately (and tells you whether the line\nis merely unreached or not present in the coverage data at all) without the full\nper-input scan.\n\nPipe the reaching inputs straight into another tool:\n\n```bash\ncov-analysis search src/parser.c:142 -d ../afl/out -e \"./cov @@\" | xargs -I{} cp {} ./hits/\n```\n\n### Parallelized AFL Execution\n\nFor parallel AFL runs (`afl-fuzz -o sync_dir`), point `-d` at the top-level sync directory. `cov-analysis` automatically discovers all fuzzer instance subdirectories:\n\n```bash\ncov-analysis -d /path/to/sync_dir/ -e \"./cov @@\"\n```\n\n## Usage Information\n\n### cov-analysis report (default)\n\n```\nUsage: cov-analysis [report] [options]\n\nRequired:\n  -d \u003cdir\u003e    Fuzzing output directory (AFL++, libFuzzer, libafl, or honggfuzz)\n  -e \u003ccmd\u003e    Coverage command. Use @@ as input file placeholder.\n              Omit @@ to feed input via stdin instead. For a cov-analysis\n              driver binary (which reads files, not stdin), @@ is appended\n              automatically when omitted.\n\nOptional:\n  -o \u003cdir\u003e           Report output directory (default: \u003cafl-dir\u003e/cov)\n  -t \u003cnum\u003e           Parallel replay workers/forks (default: 1)\n  -T \u003csecs\u003e          Timeout for crash/timeout replay (default: 5)\n  --layout \u003ckind\u003e    Force layout: 'afl' or 'flat' (default: auto-detect)\n  --ignore-regex \u003cr\u003e Filename regex to exclude from llvm-cov reports\n                     (default: /usr/include/)\n  --reachability \u003cp\u003e Cross-reference fuzz-reachability output (its JSON report,\n                     output directory, or a sancov allow/ignore .txt list) and\n                     annotate the HTML + text reports in place: functions tinted\n                     amber=reachable but not reached, dark grey=unreachable,\n                     purple=covered yet flagged unreachable; text gets a U/R/A\n                     marker column and summary.txt a reachability tally.\n  -v                 Verbose output\n  -q                 Quiet mode\n  -V                 Print version and exit\n  -h, --help         Print this help and exit\n```\n\n### cov-analysis build\n\n```\nUsage: cov-analysis build \u003cbuild-command\u003e [args...]\n\n  Sets CC/CXX/CFLAGS/CXXFLAGS/LDFLAGS for LLVM source-based coverage and\n  runs the given build command.\n```\n\n### cov-analysis driver\n\n```\nUsage: cov-analysis driver [-o output.c]\n\n  Emits coverage_driver.c source to stdout (or to -o FILE).\n  Use this for LLVMFuzzerTestOneInput harnesses to replay corpus files.\n\n  The driver loops over all file arguments, calls LLVMFuzzerTestOneInput\n  for each, and installs a crash handler that flushes profiling data so\n  crashing inputs still contribute to the coverage report.\n\nOptions:\n  -o \u003cfile\u003e     Write driver source to FILE instead of stdout\n```\n\n### cov-analysis diff\n\n```\nUsage: cov-analysis diff [-o \u003cdir\u003e] [--reachability \u003cp\u003e] [\u003cOLD_JSON\u003e \u003cNEW_JSON\u003e]\n\n  Compare coverage between two llvm-cov JSON exports and generate an\n  HTML diff report showing newly covered, lost, and still-uncovered\n  lines and functions.\n\n  Defaults to \u003creport-dir\u003e/coverage_old.json and \u003creport-dir\u003e/coverage.json.\n\n  --reachability \u003cp\u003e cross-references fuzz-reachability output (JSON, output\n  directory, or a sancov .txt list) and splits the still-uncovered functions\n  into reachable (amber, actionable) vs unreachable (grey, expected dead).\n```\n\n### cov-analysis stability\n\n```\nUsage: cov-analysis stability [options]\n\n  Run each corpus input N times with LLVM coverage, collect per-line hit\n  counts, and flag lines where counts vary across runs as \"unstable.\"\n  Reports a stability percentage. If instability is found with the default\n  4 runs, reruns for a total of 8 to confirm.\n\n  Resilient to flaky passes: a pass whose profiles cannot be collected or\n  merged (e.g. a crashing input that left a truncated .profraw behind) is\n  skipped and the run continues with the remaining passes, as long as at\n  least 2 passes succeed.\n\nRequired:\n  -d \u003cdir\u003e    Fuzzing output directory (AFL++, libFuzzer, libafl, or honggfuzz)\n  -e \u003ccmd\u003e    Coverage command. Use @@ as input file placeholder.\n              Omit @@ to feed input via stdin instead. For a cov-analysis\n              driver binary (which reads files, not stdin), @@ is appended\n              automatically when omitted.\n\nOptional:\n  -n \u003cnum\u003e           Number of runs per corpus pass (default: 4)\n  -s \u003cprefix\u003e        Only consider source lines whose file path contains\n                     this prefix (e.g. -s src/)\n  -t \u003cnum\u003e           Parallel replay workers (default: 1)\n  --layout \u003ckind\u003e    Force layout: 'afl' or 'flat' (default: auto-detect)\n  -v                 Verbose output\n  -q                 Quiet mode (suppress all [+] output)\n  -V                 Print version and exit\n  -h, --help         Print this help and exit\n```\n\nThe command outputs a **Stability Report** showing corpus size, number of runs, and the stability percentage (stable executed lines / total executed lines). If unstable lines are found, they are listed with file paths and line number ranges. If any pass failed to collect or merge its profiles, it is skipped and the report notes how many runs were actually analyzed.\n\nExamples:\n\n```bash\ncov-analysis stability -d out/ -e \"./cov @@\"\ncov-analysis stability -d out/ -e \"./cov @@\" -n 8 -s src/\ncov-analysis stability -d ./corpus -e \"./cov @@\" -t 4\n```\n\n### cov-analysis search\n\n```\nUsage: cov-analysis search FILE:LINE -d \u003cdir\u003e -e \"\u003ccmd\u003e\" [options]\n\n  Report which corpus entries reach a given source line. Each input is replayed\n  in isolation; an input \"reaches\" FILE:LINE when its line-execution count for\n  that line is \u003e 0. Matching input paths print to stdout (sorted, one per line);\n  progress and the summary go to stderr.\n\nRequired:\n  FILE:LINE   Source location, e.g. src/foo.c:123 (single line)\n  -d \u003cdir\u003e    Fuzzing output directory (AFL++, libFuzzer, libafl, or honggfuzz)\n  -e \u003ccmd\u003e    Coverage command. Use @@ as input file placeholder.\n              Omit @@ to feed input via stdin instead. For a cov-analysis\n              driver binary (which reads files, not stdin), @@ is appended\n              automatically when omitted.\n\nOptional:\n  --crashes          Also scan crash and timeout inputs (default: corpus only)\n  -t \u003cnum\u003e           Parallel workers for the per-input scan (default: 1)\n  -T \u003csecs\u003e          Per-input replay timeout in seconds (default: 5)\n  --layout \u003ckind\u003e    Force layout: 'afl' or 'flat' (default: auto-detect)\n  -v                 Verbose output\n  -q                 Quiet mode\n  -V                 Print version and exit\n  -h, --help         Print this help and exit\n```\n\n## License\n\n`cov-analysis` is released under the **GNU Affero General Public License 3**.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faflplusplus%2Fcov-analysis","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faflplusplus%2Fcov-analysis","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faflplusplus%2Fcov-analysis/lists"}