mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-11 01:31:37 +00:00
remove dead code, code-format
This commit is contained in:
van Hauser
parent
8e3ca8eaa9
commit
6cfa27d78a
@ -14,6 +14,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
- added -F option to allow -M main fuzzers to sync to foreign fuzzers,
|
||||
e.g. honggfuzz or libfuzzer
|
||||
- eliminated CPU affinity race condition for -S/-M runs
|
||||
- expanded havoc mode added, on no cycle finds add extra splicing and
|
||||
MOpt into the mix
|
||||
- llvm_mode:
|
||||
- now supports llvm 12!
|
||||
- fixes for laf-intel float splitting (thanks to mark-griffin for
|
||||
@ -21,7 +23,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
|
||||
- LTO: autodictionary mode is a default
|
||||
- LTO: instrim instrumentation disabled, only classic support used
|
||||
as it is always better
|
||||
- added honggfuzz mangle as a custom mutator in custom_mutators/honggfuzz :)
|
||||
- added honggfuzz mangle as a custom mutator in custom_mutators/honggfuzz
|
||||
- added afl-frida gum solution to examples/afl_frida (mostly imported
|
||||
from https://github.com/meme/hotwax/)
|
||||
- small fixes to afl-plot, afl-whatsup and man page creation
|
||||
|
||||
@ -27,10 +27,6 @@
|
||||
#include <string.h>
|
||||
#include <limits.h>
|
||||
|
||||
/* static u8 *strnstr(const u8 *s, const u8 *find, size_t slen);
|
||||
static u32 string_replace(u8 **out_buf, s32 *temp_len, u32 pos, u8 *from,
|
||||
u8 *to); */
|
||||
|
||||
/* MOpt */
|
||||
|
||||
static int select_algorithm(afl_state_t *afl) {
|
||||
@ -370,524 +366,6 @@ static void locate_diffs(u8 *ptr1, u8 *ptr2, u32 len, s32 *first, s32 *last) {
|
||||
|
||||
#define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size
|
||||
|
||||
#if 0
|
||||
/* search a string */
|
||||
|
||||
static u8 *strnstr(const u8 *s, const u8 *find, size_t slen) {
|
||||
|
||||
char c, sc;
|
||||
size_t len;
|
||||
|
||||
if ((c = *find++) != '\0') {
|
||||
|
||||
len = strlen(find);
|
||||
do {
|
||||
|
||||
do {
|
||||
|
||||
if (slen-- < 1 || (sc = *s++) == '\0') return (NULL);
|
||||
|
||||
} while (sc != c);
|
||||
|
||||
if (len > slen) return (NULL);
|
||||
|
||||
} while (strncmp(s, find, len) != 0);
|
||||
|
||||
s--;
|
||||
|
||||
}
|
||||
|
||||
return ((u8 *)s);
|
||||
|
||||
}
|
||||
|
||||
/* replace between deliminators, if rep == NULL, then we will duplicate the
|
||||
* target */
|
||||
|
||||
static u32 delim_replace(u8 **out_buf, s32 *temp_len, size_t pos,
|
||||
const u8 *ldelim, const u8 *rdelim, u8 *rep) {
|
||||
|
||||
u8 *end_buf = *out_buf + *temp_len;
|
||||
u8 *ldelim_start = strnstr(*out_buf + pos, ldelim, *temp_len - pos);
|
||||
|
||||
if (ldelim_start != NULL) {
|
||||
|
||||
u32 max = (end_buf - ldelim_start - 1 > AFL_TXT_STRING_MAX_LEN
|
||||
? AFL_TXT_STRING_MAX_LEN
|
||||
: end_buf - ldelim_start - 1);
|
||||
|
||||
if (max > 0) {
|
||||
|
||||
u8 *rdelim_end = strnstr(ldelim_start + 1, rdelim, max);
|
||||
|
||||
if (rdelim_end != NULL) {
|
||||
|
||||
u32 rep_len, delim_space_len = rdelim_end - ldelim_start - 1, xtra = 0;
|
||||
|
||||
if (rep != NULL) {
|
||||
|
||||
rep_len = (u32)strlen(rep);
|
||||
|
||||
} else { // NULL? then we copy the value in between the delimiters
|
||||
|
||||
rep_len = delim_space_len;
|
||||
delim_space_len = 0;
|
||||
rep = ldelim_start + 1;
|
||||
xtra = rep_len;
|
||||
|
||||
}
|
||||
|
||||
if (rep_len != delim_space_len) {
|
||||
|
||||
memmove(ldelim_start + rep_len + xtra + 1, rdelim_end,
|
||||
*temp_len - (rdelim_end - *out_buf));
|
||||
|
||||
}
|
||||
|
||||
memcpy(ldelim_start + 1, rep, rep_len);
|
||||
*temp_len = (*temp_len - delim_space_len + rep_len);
|
||||
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
static u32 delim_swap(u8 **out_buf, s32 *temp_len, size_t pos, const u8 *ldelim,
|
||||
const u8 *mdelim, const u8 *rdelim) {
|
||||
|
||||
u8 *out_buf_end = *out_buf + *temp_len;
|
||||
u32 max = (*temp_len - pos > AFL_TXT_STRING_MAX_LEN ? AFL_TXT_STRING_MAX_LEN
|
||||
: *temp_len - pos);
|
||||
u8 *ldelim_start = strnstr(*out_buf + pos, ldelim, max);
|
||||
|
||||
if (ldelim_start != NULL) {
|
||||
|
||||
max = (out_buf_end - ldelim_start - 1 > AFL_TXT_STRING_MAX_LEN
|
||||
? AFL_TXT_STRING_MAX_LEN
|
||||
: out_buf_end - ldelim_start - 1);
|
||||
if (max > 1) {
|
||||
|
||||
u8 *mdelim_pos = strnstr(ldelim_start + 1, mdelim, max);
|
||||
|
||||
if (mdelim_pos != NULL) {
|
||||
|
||||
max = (out_buf_end - mdelim_pos - 1 > AFL_TXT_STRING_MAX_LEN
|
||||
? AFL_TXT_STRING_MAX_LEN
|
||||
: out_buf_end - mdelim_pos - 1);
|
||||
if (max > 0) {
|
||||
|
||||
u8 *rdelim_end = strnstr(mdelim + 1, rdelim, max);
|
||||
|
||||
if (rdelim_end != NULL) {
|
||||
|
||||
u32 first_len = mdelim_pos - ldelim_start - 1;
|
||||
u32 second_len = rdelim_end - mdelim_pos - 1;
|
||||
u8 scratch[AFL_TXT_STRING_MAX_LEN];
|
||||
|
||||
memcpy(scratch, ldelim_start + 1, first_len);
|
||||
|
||||
if (first_len != second_len) {
|
||||
|
||||
memmove(ldelim_start + second_len + 1, mdelim_pos,
|
||||
out_buf_end - mdelim_pos);
|
||||
|
||||
}
|
||||
|
||||
memcpy(ldelim_start + 1, mdelim_pos + 1, second_len);
|
||||
|
||||
if (first_len != second_len) {
|
||||
|
||||
memmove(mdelim_pos + first_len + 1, rdelim_end,
|
||||
out_buf_end - rdelim_end);
|
||||
|
||||
}
|
||||
|
||||
memcpy(mdelim_pos + 1, scratch, first_len);
|
||||
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
/* replace a string */
|
||||
|
||||
static u32 string_replace(u8 **out_buf, s32 *temp_len, u32 pos, u8 *from,
|
||||
u8 *to) {
|
||||
|
||||
u8 *start = strnstr(*out_buf + pos, from, *temp_len - pos);
|
||||
|
||||
if (start) {
|
||||
|
||||
u32 from_len = strlen(from);
|
||||
u32 to_len = strlen(to);
|
||||
|
||||
if (from_len != to_len) {
|
||||
|
||||
memmove(start + to_len, start + from_len,
|
||||
*temp_len - from_len - (start - *out_buf));
|
||||
|
||||
}
|
||||
|
||||
memcpy(start, to, to_len);
|
||||
*temp_len = (*temp_len - from_len + to_len);
|
||||
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
/* Returns 1 if a mutant was generated and placed in out_buf, 0 if none
|
||||
* generated. */
|
||||
|
||||
static const uint8_t text_mutation_special_chars[] = {
|
||||
|
||||
'\t', '\n', '\r', ' ', '!', '"', '$', '%', '&', '\'', '(', ')', '*',
|
||||
'+', ',', '-', '.', '/', ':', ';', '<', '=', '>', '?', '@', '[',
|
||||
'\\', ']', '^', '_', '`', '{', '|', '}', '~', ' ' // space is here twice
|
||||
|
||||
};
|
||||
|
||||
static int text_mutation(afl_state_t *afl, u8 **out_buf, s32 *orig_temp_len) {
|
||||
|
||||
if (*orig_temp_len < AFL_TXT_MIN_LEN) { return 0; }
|
||||
|
||||
s32 temp_len;
|
||||
u32 pos, yes = 0,
|
||||
mutations = rand_below(afl, AFL_TXT_STRING_MAX_MUTATIONS) + 16;
|
||||
u8 *new_buf =
|
||||
ck_maybe_grow(BUF_PARAMS(out_scratch),
|
||||
*orig_temp_len + AFL_TXT_STRING_MAX_MUTATIONS + 16);
|
||||
u8 fromc[2] = {0, 0}, toc[2] = {0, 0};
|
||||
temp_len = *orig_temp_len;
|
||||
memcpy(new_buf, *out_buf, temp_len);
|
||||
new_buf[temp_len] = 0;
|
||||
|
||||
for (u32 i = 0; i < mutations; i++) {
|
||||
|
||||
if (temp_len < AFL_TXT_MIN_LEN) { return 0; }
|
||||
|
||||
pos = rand_below(afl, temp_len - 1);
|
||||
int choice = rand_below(afl, 100);
|
||||
|
||||
switch (choice) {
|
||||
|
||||
/* 50% -> fixed replacements */
|
||||
|
||||
case 0: /* Semantic statement deletion */
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "\n", "#");
|
||||
break;
|
||||
case 1:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "(", "(!");
|
||||
break;
|
||||
case 2:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "==", "!=");
|
||||
break;
|
||||
case 3:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "!=", "==");
|
||||
break;
|
||||
case 4:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "==", "<");
|
||||
break;
|
||||
case 5:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "<", "==");
|
||||
break;
|
||||
case 6:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "==", ">");
|
||||
break;
|
||||
case 7:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, ">", "==");
|
||||
break;
|
||||
case 8:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "=", "<");
|
||||
break;
|
||||
case 9:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "=", ">");
|
||||
break;
|
||||
case 10:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "<", ">");
|
||||
break;
|
||||
case 11:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, ">", "<");
|
||||
break;
|
||||
case 12:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "++", "--");
|
||||
break;
|
||||
case 13:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "--", "++");
|
||||
break;
|
||||
case 14:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "+", "-");
|
||||
break;
|
||||
case 15:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "-", "+");
|
||||
break;
|
||||
case 16:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "0", "1");
|
||||
break;
|
||||
case 17:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "1", "0");
|
||||
break;
|
||||
case 18:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "&&", "||");
|
||||
break;
|
||||
case 19:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "||", "&&");
|
||||
break;
|
||||
case 20:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "!", "");
|
||||
break;
|
||||
case 21:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "==", "=");
|
||||
break;
|
||||
case 22:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "=", "==");
|
||||
break;
|
||||
case 23:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "--", "");
|
||||
break;
|
||||
case 24:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "<<", "<");
|
||||
break;
|
||||
case 25:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, ">>", ">");
|
||||
break;
|
||||
case 26:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "<", "<<");
|
||||
break;
|
||||
case 27:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, ">", ">>");
|
||||
break;
|
||||
case 28:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "'", "\"");
|
||||
break;
|
||||
case 29:
|
||||
yes += string_replace(&new_buf, &temp_len, pos, "\"", "'");
|
||||
break;
|
||||
case 30: /* Remove a semicolon delimited statement after a semicolon */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, ";", ";", ";");
|
||||
break;
|
||||
case 31: /* Remove a semicolon delimited statement after a left curly
|
||||
brace */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, "}", ";", "}");
|
||||
break;
|
||||
case 32: /* Remove a curly brace construct */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, "{", "}", "");
|
||||
break;
|
||||
case 33: /* Replace a curly brace construct with an empty one */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, "{", "}", "{}");
|
||||
break;
|
||||
case 34:
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, ";", ";", ";");
|
||||
break;
|
||||
case 35:
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, "}", ";", ";");
|
||||
break;
|
||||
case 36: /* Swap comma delimited things case 1 */
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, "(", ",", ")");
|
||||
break;
|
||||
case 37: /* Swap comma delimited things case 2 */
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, "(", ",", ",");
|
||||
break;
|
||||
case 38: /* Swap comma delimited things case 3 */
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, ",", ",", ",");
|
||||
break;
|
||||
case 39: /* Swap comma delimited things case 4 */
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, ",", ",", ")");
|
||||
break;
|
||||
case 40: /* Just delete a line */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, "\n", "\n", "");
|
||||
break;
|
||||
case 41: /* Delete something like "const" case 1 */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, " ", " ", "");
|
||||
break;
|
||||
case 42: /* Delete something like "const" case 2 */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, "\n", " ", "");
|
||||
break;
|
||||
case 43: /* Delete something like "const" case 3 */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, "(", " ", "");
|
||||
break;
|
||||
case 44: /* Swap space delimited things case 1 */
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, " ", " ", " ");
|
||||
break;
|
||||
case 45: /* Swap space delimited things case 2 */
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, " ", " ", ")");
|
||||
break;
|
||||
case 46: /* Swap space delimited things case 3 */
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, "(", " ", " ");
|
||||
break;
|
||||
case 47: /* Swap space delimited things case 4 */
|
||||
yes += delim_swap(&new_buf, &temp_len, pos, "(", " ", ")");
|
||||
break;
|
||||
case 48: /* Duplicate a single line of code */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, "\n", "\n", NULL);
|
||||
break;
|
||||
case 49: /* Duplicate a construct (most often, a non-nested for loop */
|
||||
yes += delim_replace(&new_buf, &temp_len, pos, "\n", "}", NULL);
|
||||
break;
|
||||
default: {
|
||||
|
||||
/* 5% is transforming ascii numbers */
|
||||
|
||||
if (choice < 55) {
|
||||
|
||||
for (u32 j = pos; j < temp_len; ++j) {
|
||||
|
||||
if (isdigit(new_buf[j])) {
|
||||
|
||||
new_buf[temp_len] =
|
||||
0; // should be safe thanks to the initial grow
|
||||
|
||||
u8 * endptr;
|
||||
unsigned long long num =
|
||||
strtoull(new_buf + j, (char **)&endptr, 0);
|
||||
|
||||
switch (rand_below(afl, 8)) {
|
||||
|
||||
case 0:
|
||||
num = rand_below(afl, INT_MAX);
|
||||
break;
|
||||
case 1:
|
||||
num = rand_next(afl);
|
||||
break;
|
||||
case 2:
|
||||
num += 1 + rand_below(afl, 255);
|
||||
break;
|
||||
case 3:
|
||||
num -= 1 + rand_below(afl, 255);
|
||||
break;
|
||||
case 4:
|
||||
num *= 1 + rand_below(afl, 255);
|
||||
break;
|
||||
case 5:
|
||||
num /= 1 + rand_below(afl, 255);
|
||||
break;
|
||||
case 6:
|
||||
num /= 1 + rand_below(afl, 255);
|
||||
break;
|
||||
case 7:
|
||||
num = ~num;
|
||||
break;
|
||||
|
||||
}
|
||||
|
||||
const char *fmt = "%llu";
|
||||
if (rand_below(afl, 5) == 0) // add - sign with 1/5 probability
|
||||
fmt = "-%llu";
|
||||
|
||||
size_t num_len = snprintf(NULL, 0, fmt, num);
|
||||
size_t old_len = endptr - (new_buf + j);
|
||||
if (num_len < old_len) {
|
||||
|
||||
memmove(new_buf + j + num_len, new_buf + j + old_len,
|
||||
temp_len - (j + old_len));
|
||||
snprintf(new_buf + j, num_len, fmt, num);
|
||||
temp_len -= old_len - num_len;
|
||||
|
||||
} else if (num_len == old_len) {
|
||||
|
||||
snprintf(new_buf + j, num_len, fmt, num);
|
||||
|
||||
} else {
|
||||
|
||||
new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
|
||||
temp_len + (num_len - old_len) +
|
||||
AFL_TXT_STRING_MAX_MUTATIONS + 1);
|
||||
memmove(new_buf + j + num_len, new_buf + j + old_len,
|
||||
temp_len - (j + old_len));
|
||||
snprintf(new_buf + j, num_len, fmt, num);
|
||||
temp_len += num_len - old_len;
|
||||
|
||||
}
|
||||
|
||||
yes += 1;
|
||||
break;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
} else if (choice < 85) {
|
||||
|
||||
/* 30% is special character transform */
|
||||
|
||||
fromc[0] = text_mutation_special_chars[rand_below(
|
||||
afl, sizeof(text_mutation_special_chars))];
|
||||
|
||||
do {
|
||||
|
||||
toc[0] = text_mutation_special_chars[rand_below(
|
||||
afl, sizeof(text_mutation_special_chars))];
|
||||
|
||||
} while (toc[0] == fromc[0]);
|
||||
|
||||
yes += string_replace(&new_buf, &temp_len, pos, fromc, toc);
|
||||
break;
|
||||
|
||||
} else {
|
||||
|
||||
/* 15% is random text character transform */
|
||||
|
||||
u32 iter, cnt, loc, prev_loc = temp_len;
|
||||
if (temp_len > 32) {
|
||||
|
||||
cnt = 1 + rand_below(afl, 5);
|
||||
|
||||
} else {
|
||||
|
||||
cnt = rand_below(afl, 2);
|
||||
|
||||
}
|
||||
|
||||
for (iter = 0; iter <= cnt; iter++) {
|
||||
|
||||
while ((loc = rand_below(afl, temp_len)) == prev_loc)
|
||||
;
|
||||
new_buf[loc] = 32 + rand_below(afl, 'z' - ' ' + 1);
|
||||
prev_loc = loc;
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
if (yes == 0 || temp_len <= 0) { return 0; }
|
||||
|
||||
swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
|
||||
*out_buf = new_buf;
|
||||
*orig_temp_len = temp_len;
|
||||
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
#endif /* if 0 */
|
||||
|
||||
/* Take the current entry from the queue, fuzz it for a while. This
|
||||
function is a tad too long... returns 0 if fuzzed successfully, 1 if
|
||||
skipped or bailed out. */
|
||||
@ -2926,15 +2404,7 @@ havoc_stage:
|
||||
|
||||
}
|
||||
|
||||
/* default:
|
||||
|
||||
// perform ascii mutations
|
||||
if (text_mutation(afl, &out_buf, &temp_len) == 0)
|
||||
goto retry_havoc;
|
||||
|
||||
} // end default: switch(r)
|
||||
|
||||
*/
|
||||
// end of default:
|
||||
|
||||
}
|
||||
|
||||
|
||||
@ -82,60 +82,59 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
|
||||
if (getrusage(RUSAGE_CHILDREN, &rus)) { rus.ru_maxrss = 0; }
|
||||
#endif
|
||||
|
||||
fprintf(
|
||||
f,
|
||||
"start_time : %llu\n"
|
||||
"last_update : %llu\n"
|
||||
"run_time : %llu\n"
|
||||
"fuzzer_pid : %u\n"
|
||||
"cycles_done : %llu\n"
|
||||
"cycles_wo_finds : %llu\n"
|
||||
"execs_done : %llu\n"
|
||||
"execs_per_sec : %0.02f\n"
|
||||
"execs_ps_last_min : %0.02f\n"
|
||||
"paths_total : %u\n"
|
||||
"paths_favored : %u\n"
|
||||
"paths_found : %u\n"
|
||||
"paths_imported : %u\n"
|
||||
"max_depth : %u\n"
|
||||
"cur_path : %u\n" /* Must match find_start_position() */
|
||||
"pending_favs : %u\n"
|
||||
"pending_total : %u\n"
|
||||
"variable_paths : %u\n"
|
||||
"stability : %0.02f%%\n"
|
||||
"bitmap_cvg : %0.02f%%\n"
|
||||
"unique_crashes : %llu\n"
|
||||
"unique_hangs : %llu\n"
|
||||
"last_path : %llu\n"
|
||||
"last_crash : %llu\n"
|
||||
"last_hang : %llu\n"
|
||||
"execs_since_crash : %llu\n"
|
||||
"exec_timeout : %u\n"
|
||||
"slowest_exec_ms : %u\n"
|
||||
"peak_rss_mb : %lu\n"
|
||||
"cpu_affinity : %d\n"
|
||||
"edges_found : %u\n"
|
||||
"var_byte_count : %u\n"
|
||||
"havoc_expansion : %u\n"
|
||||
"afl_banner : %s\n"
|
||||
"afl_version : " VERSION
|
||||
"\n"
|
||||
"target_mode : %s%s%s%s%s%s%s%s%s\n"
|
||||
"command_line : %s\n",
|
||||
afl->start_time / 1000, cur_time / 1000,
|
||||
(cur_time - afl->start_time) / 1000, (u32)getpid(),
|
||||
afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->cycles_wo_finds,
|
||||
afl->fsrv.total_execs,
|
||||
afl->fsrv.total_execs /
|
||||
((double)(get_cur_time() - afl->start_time) / 1000),
|
||||
afl->last_avg_execs_saved,
|
||||
afl->queued_paths, afl->queued_favored, afl->queued_discovered,
|
||||
afl->queued_imported, afl->max_depth, afl->current_entry,
|
||||
afl->pending_favored, afl->pending_not_fuzzed, afl->queued_variable,
|
||||
stability, bitmap_cvg, afl->unique_crashes, afl->unique_hangs,
|
||||
afl->last_path_time / 1000, afl->last_crash_time / 1000,
|
||||
afl->last_hang_time / 1000, afl->fsrv.total_execs - afl->last_crash_execs,
|
||||
afl->fsrv.exec_tmout, afl->slowest_exec_ms,
|
||||
fprintf(f,
|
||||
"start_time : %llu\n"
|
||||
"last_update : %llu\n"
|
||||
"run_time : %llu\n"
|
||||
"fuzzer_pid : %u\n"
|
||||
"cycles_done : %llu\n"
|
||||
"cycles_wo_finds : %llu\n"
|
||||
"execs_done : %llu\n"
|
||||
"execs_per_sec : %0.02f\n"
|
||||
"execs_ps_last_min : %0.02f\n"
|
||||
"paths_total : %u\n"
|
||||
"paths_favored : %u\n"
|
||||
"paths_found : %u\n"
|
||||
"paths_imported : %u\n"
|
||||
"max_depth : %u\n"
|
||||
"cur_path : %u\n" /* Must match find_start_position() */
|
||||
"pending_favs : %u\n"
|
||||
"pending_total : %u\n"
|
||||
"variable_paths : %u\n"
|
||||
"stability : %0.02f%%\n"
|
||||
"bitmap_cvg : %0.02f%%\n"
|
||||
"unique_crashes : %llu\n"
|
||||
"unique_hangs : %llu\n"
|
||||
"last_path : %llu\n"
|
||||
"last_crash : %llu\n"
|
||||
"last_hang : %llu\n"
|
||||
"execs_since_crash : %llu\n"
|
||||
"exec_timeout : %u\n"
|
||||
"slowest_exec_ms : %u\n"
|
||||
"peak_rss_mb : %lu\n"
|
||||
"cpu_affinity : %d\n"
|
||||
"edges_found : %u\n"
|
||||
"var_byte_count : %u\n"
|
||||
"havoc_expansion : %u\n"
|
||||
"afl_banner : %s\n"
|
||||
"afl_version : " VERSION
|
||||
"\n"
|
||||
"target_mode : %s%s%s%s%s%s%s%s%s\n"
|
||||
"command_line : %s\n",
|
||||
afl->start_time / 1000, cur_time / 1000,
|
||||
(cur_time - afl->start_time) / 1000, (u32)getpid(),
|
||||
afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->cycles_wo_finds,
|
||||
afl->fsrv.total_execs,
|
||||
afl->fsrv.total_execs /
|
||||
((double)(get_cur_time() - afl->start_time) / 1000),
|
||||
afl->last_avg_execs_saved, afl->queued_paths, afl->queued_favored,
|
||||
afl->queued_discovered, afl->queued_imported, afl->max_depth,
|
||||
afl->current_entry, afl->pending_favored, afl->pending_not_fuzzed,
|
||||
afl->queued_variable, stability, bitmap_cvg, afl->unique_crashes,
|
||||
afl->unique_hangs, afl->last_path_time / 1000,
|
||||
afl->last_crash_time / 1000, afl->last_hang_time / 1000,
|
||||
afl->fsrv.total_execs - afl->last_crash_execs, afl->fsrv.exec_tmout,
|
||||
afl->slowest_exec_ms,
|
||||
#ifndef __HAIKU__
|
||||
#ifdef __APPLE__
|
||||
(unsigned long int)(rus.ru_maxrss >> 20),
|
||||
@ -150,19 +149,20 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
|
||||
#else
|
||||
-1,
|
||||
#endif
|
||||
t_bytes, afl->var_byte_count, afl->expand_havoc, afl->use_banner,
|
||||
afl->unicorn_mode ? "unicorn" : "", afl->fsrv.qemu_mode ? "qemu " : "",
|
||||
afl->non_instrumented_mode ? " non_instrumented " : "",
|
||||
afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
|
||||
afl->persistent_mode ? "persistent " : "",
|
||||
afl->shmem_testcase_mode ? "shmem_testcase " : "",
|
||||
afl->deferred_mode ? "deferred " : "",
|
||||
(afl->unicorn_mode || afl->fsrv.qemu_mode || afl->non_instrumented_mode ||
|
||||
afl->no_forkserver || afl->crash_mode || afl->persistent_mode ||
|
||||
afl->deferred_mode)
|
||||
? ""
|
||||
: "default",
|
||||
afl->orig_cmdline);
|
||||
t_bytes, afl->var_byte_count, afl->expand_havoc, afl->use_banner,
|
||||
afl->unicorn_mode ? "unicorn" : "",
|
||||
afl->fsrv.qemu_mode ? "qemu " : "",
|
||||
afl->non_instrumented_mode ? " non_instrumented " : "",
|
||||
afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
|
||||
afl->persistent_mode ? "persistent " : "",
|
||||
afl->shmem_testcase_mode ? "shmem_testcase " : "",
|
||||
afl->deferred_mode ? "deferred " : "",
|
||||
(afl->unicorn_mode || afl->fsrv.qemu_mode ||
|
||||
afl->non_instrumented_mode || afl->no_forkserver ||
|
||||
afl->crash_mode || afl->persistent_mode || afl->deferred_mode)
|
||||
? ""
|
||||
: "default",
|
||||
afl->orig_cmdline);
|
||||
/* ignore errors */
|
||||
|
||||
if (afl->debug) {
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user