# AFL Context Sensitive Branch Coverage

## What is this?

This is an LLVM-based implementation of the context sensitive branch coverage.

Basically every function gets its own ID and that ID is combined with the
edges of the called functions.

So if both function A and function B call a function C, the coverage
collected in C will be different.

In math the coverage is collected as follows:
`map[current_location_ID ^ previous_location_ID >> 1 ^ previous_callee_ID] += 1`

## Usage

Set the `AFL_LLVM_INSTRUMENT=CTX` or `AFL_LLVM_CTX=1` environment variable.

It is highly recommended to increase the MAP_SIZE_POW2 definition in
config.h to at least 18 and maybe up to 20 for this as otherwise too
many map collisions occur.