diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h index 59d938de..2380b289 100644 --- a/include/afl-fuzz.h +++ b/include/afl-fuzz.h @@ -200,6 +200,7 @@ struct queue_entry { u8 *fname; /* File name for the test case */ u32 len; /* Input length */ u32 id; /* entry number in queue_buf */ + u32 found; u8 colorized, /* Do not run redqueen stage again */ cal_failed; /* Calibration failed? */ @@ -252,6 +253,7 @@ struct queue_entry { struct skipdet_entry *skipdet_e; u32 score; /* complexity/vulnerability score */ + u64 total_execs; /* total executes of this item */ }; diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c index f4e81019..da23bb1e 100644 --- a/src/afl-fuzz.c +++ b/src/afl-fuzz.c @@ -2868,7 +2868,9 @@ int main(int argc, char **argv_orig, char **envp) { } + u64 execs_before = afl->fsrv.total_execs; skipped_fuzz = fuzz_one(afl); + afl->queue_cur->total_execs += afl->fsrv.total_execs - execs_before; #ifdef INTROSPECTION ++afl->queue_cur->stats_selected; @@ -3069,7 +3071,7 @@ stop_fuzzing: if (getenv("AFL_DUMP_QUEUE_ON_EXIT")) { - for (u32 mode = 0; mode < 2; mode++) { + for (u32 mode = 0; mode < 2; mode++) { // explore + exploit mode data afl->fuzz_mode = mode; create_alias_table(afl); @@ -3079,16 +3081,16 @@ stop_fuzzing: struct queue_entry *q = afl->queue_buf[k]; fprintf(stderr, - "item=%u fname=%s len=%u exec_us=%llu has_new_cov=%u " + "item=%u fname=%s len=%u exec_us=%llu total_execs=%llu " + "has_new_cov=%u " "var_behavior=%u favored=%u fs_redundant=%u disabled=%u " - "bitmap_size=%u " - "fuzz_level=%u was_fuzzed=%u mother=%d perf_score=%.2f " - "weight=%.2f score=%u\n", - k, q->fname, q->len, q->exec_us, q->has_new_cov, + "bitmap_size=%u tc_ref=%u fuzz_level=%u was_fuzzed=%u " + "mother=%d found=%u perf_score=%.2f weight=%.2f score=%u\n", + k, q->fname, q->len, q->exec_us, q->total_execs, q->has_new_cov, q->var_behavior, q->favored, q->fs_redundant, q->disabled, - q->bitmap_size, q->fuzz_level, q->was_fuzzed, - q->mother == NULL ? -1 : (int)q->mother->id, q->perf_score, - q->weight, q->score); + q->bitmap_size, q->tc_ref, q->fuzz_level, q->was_fuzzed, + q->mother == NULL ? -1 : (int)q->mother->id, q->found, + q->perf_score, q->weight, q->score); }