ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-14 02:58:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

code format

Browse Source
This commit is contained in:
Andrea Fioraldi
2020-04-14 12:42:38 +02:00
parent 2c87e68ad6
commit 92aaaef381
6 changed files with 101 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
include/afl-fuzz.h
View File

@ -341,7 +341,10 @@ typedef struct afl_env_vars {
} afl_env_vars_t; } afl_env_vars_t;
struct afl_pass_stat { struct afl_pass_stat {
u8 total; u8 faileds;
u8 total;
u8 faileds;
}; };
typedef struct afl_state { typedef struct afl_state {
@ -573,8 +576,8 @@ typedef struct afl_state {
s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd; s32 cmplog_fsrv_ctl_fd, cmplog_fsrv_st_fd;
u32 cmplog_prev_timed_out; u32 cmplog_prev_timed_out;
struct afl_pass_stat* pass_stats; struct afl_pass_stat *pass_stats;
struct cmp_map *orig_cmp_map; struct cmp_map * orig_cmp_map;
u8 describe_op_buf_256[256]; /* describe_op will use this to return a string u8 describe_op_buf_256[256]; /* describe_op will use this to return a string
up to 256 */ up to 256 */

4
llvm_mode/afl-clang-fast.c
View File

@ -549,8 +549,8 @@ int main(int argc, char **argv, char **envp) {
if ((ptr = getenv("AFL_LLVM_INSTRUMENT")) != NULL) { if ((ptr = getenv("AFL_LLVM_INSTRUMENT")) != NULL) {
if (strncasecmp(ptr, "default", strlen("default")) == 0 || if (strncasecmp(ptr, "default", strlen("default")) == 0 ||
strncasecmp(ptr, "afl", strlen("afl")) == 0 || strncasecmp(ptr, "afl", strlen("afl")) == 0 ||
strncasecmp(ptr, "classic", strlen("classic")) == 0 ) strncasecmp(ptr, "classic", strlen("classic")) == 0)
instrument_mode = INSTRUMENT_DEFAULT; instrument_mode = INSTRUMENT_DEFAULT;
if (strncasecmp(ptr, "cfg", strlen("cfg")) == 0 || if (strncasecmp(ptr, "cfg", strlen("cfg")) == 0 ||
strncasecmp(ptr, "instrim", strlen("instrim")) == 0) strncasecmp(ptr, "instrim", strlen("instrim")) == 0)

3
src/afl-fuzz-one.c
View File

@ -2543,7 +2543,7 @@ u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
goto pacemaker_fuzzing; goto pacemaker_fuzzing;
} }
/* Skip right away if -d is given, if we have done deterministic fuzzing on /* Skip right away if -d is given, if we have done deterministic fuzzing on
this entry ourselves (was_fuzzed), or if it has gone through deterministic this entry ourselves (was_fuzzed), or if it has gone through deterministic
testing in earlier, resumed runs (passed_det). */ testing in earlier, resumed runs (passed_det). */
@ -2559,7 +2559,6 @@ u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
(afl->queue_cur->exec_cksum % afl->master_max) != afl->master_id - 1) (afl->queue_cur->exec_cksum % afl->master_max) != afl->master_id - 1)
goto havoc_stage; goto havoc_stage;
doing_det = 1; doing_det = 1;
/********************************************* /*********************************************

138
src/afl-fuzz-redqueen.c
View File

@ -234,15 +234,18 @@ static u8 its_fuzz(afl_state_t *afl, u8 *buf, u32 len, u8 *status) {
} }
static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, u64 pattern, u64 repl, u64 o_pattern, u32 idx, u8 *orig_buf, u8 *buf, u32 len, u8 do_reverse, u8 *status) { static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h,
u64 pattern, u64 repl, u64 o_pattern, u32 idx,
u8 *orig_buf, u8 *buf, u32 len, u8 do_reverse,
u8 *status) {
u64 *buf_64 = (u64 *)&buf[idx]; u64 *buf_64 = (u64 *)&buf[idx];
u32 *buf_32 = (u32 *)&buf[idx]; u32 *buf_32 = (u32 *)&buf[idx];
u16 *buf_16 = (u16 *)&buf[idx]; u16 *buf_16 = (u16 *)&buf[idx];
// u8* buf_8 = &buf[idx]; // u8* buf_8 = &buf[idx];
u64* o_buf_64 = (u64*)&orig_buf[idx]; u64 *o_buf_64 = (u64 *)&orig_buf[idx];
u32* o_buf_32 = (u32*)&orig_buf[idx]; u32 *o_buf_32 = (u32 *)&orig_buf[idx];
u16* o_buf_16 = (u16*)&orig_buf[idx]; u16 *o_buf_16 = (u16 *)&orig_buf[idx];
// u8* o_buf_8 = &orig_buf[idx]; // u8* o_buf_8 = &orig_buf[idx];
u32 its_len = len - idx; u32 its_len = len - idx;
@ -260,15 +263,17 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, u64 patter
// reverse encoding // reverse encoding
if (do_reverse) if (do_reverse)
if (unlikely(cmp_extend_encoding(afl, h, SWAP64(pattern), SWAP64(repl), SWAP64(o_pattern), idx, orig_buf, buf, len, 0, status))) if (unlikely(cmp_extend_encoding(afl, h, SWAP64(pattern), SWAP64(repl),
SWAP64(o_pattern), idx, orig_buf, buf,
len, 0, status)))
return 1; return 1;
} }
if (SHAPE_BYTES(h->shape) == 4 || *status == 2) { if (SHAPE_BYTES(h->shape) == 4 || *status == 2) {
if (its_len >= 4 && if (its_len >= 4 && *buf_32 == (u32)pattern &&
*buf_32 == (u32)pattern && *o_buf_32 == (u32)o_pattern) { *o_buf_32 == (u32)o_pattern) {
*buf_32 = (u32)repl; *buf_32 = (u32)repl;
if (unlikely(its_fuzz(afl, buf, len, status))) return 1; if (unlikely(its_fuzz(afl, buf, len, status))) return 1;
@ -278,15 +283,17 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, u64 patter
// reverse encoding // reverse encoding
if (do_reverse) if (do_reverse)
if (unlikely(cmp_extend_encoding(afl, h, SWAP32(pattern), SWAP32(repl), SWAP32(o_pattern), idx, orig_buf, buf, len, 0, status))) if (unlikely(cmp_extend_encoding(afl, h, SWAP32(pattern), SWAP32(repl),
SWAP32(o_pattern), idx, orig_buf, buf,
len, 0, status)))
return 1; return 1;
} }
if (SHAPE_BYTES(h->shape) == 2 || *status == 2) { if (SHAPE_BYTES(h->shape) == 2 || *status == 2) {
if (its_len >= 2 && if (its_len >= 2 && *buf_16 == (u16)pattern &&
*buf_16 == (u16)pattern && *o_buf_16 == (u16)o_pattern) { *o_buf_16 == (u16)o_pattern) {
*buf_16 = (u16)repl; *buf_16 = (u16)repl;
if (unlikely(its_fuzz(afl, buf, len, status))) return 1; if (unlikely(its_fuzz(afl, buf, len, status))) return 1;
@ -296,7 +303,9 @@ static u8 cmp_extend_encoding(afl_state_t *afl, struct cmp_header *h, u64 patter
// reverse encoding // reverse encoding
if (do_reverse) if (do_reverse)
if (unlikely(cmp_extend_encoding(afl, h, SWAP16(pattern), SWAP16(repl), SWAP16(o_pattern), idx, orig_buf, buf, len, 0, status))) if (unlikely(cmp_extend_encoding(afl, h, SWAP16(pattern), SWAP16(repl),
SWAP16(o_pattern), idx, orig_buf, buf,
len, 0, status)))
return 1; return 1;
} }
@ -371,35 +380,39 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
u8 status; u8 status;
// opt not in the paper // opt not in the paper
u32 fails; u32 fails;
u8 found_one = 0; u8 found_one = 0;
/* loop cmps are useless, detect and blacklist them */ /* loop cmps are useless, detect and blacklist them */
u64 s_v0, s_v1; u64 s_v0, s_v1;
u8 s_v0_fixed = 1, s_v1_fixed = 1; u8 s_v0_fixed = 1, s_v1_fixed = 1;
u8 s_v0_inc = 1, s_v1_inc = 1; u8 s_v0_inc = 1, s_v1_inc = 1;
u8 s_v0_dec = 1, s_v1_dec = 1; u8 s_v0_dec = 1, s_v1_dec = 1;
for (i = 0; i < loggeds; ++i) { for (i = 0; i < loggeds; ++i) {
fails = 0; fails = 0;
struct cmp_operands *o = &afl->shm.cmp_map->log[key][i]; struct cmp_operands *o = &afl->shm.cmp_map->log[key][i];
// loop detection code // loop detection code
if (i == 0) { if (i == 0) {
s_v0 = o->v0; s_v0 = o->v0;
s_v1 = o->v1; s_v1 = o->v1;
} else { } else {
if (s_v0 != o->v0) s_v0_fixed = 0; if (s_v0 != o->v0) s_v0_fixed = 0;
if (s_v1 != o->v1) s_v1_fixed = 0; if (s_v1 != o->v1) s_v1_fixed = 0;
if (s_v0 +1 != o->v0) s_v0_inc = 0; if (s_v0 + 1 != o->v0) s_v0_inc = 0;
if (s_v1 +1 != o->v1) s_v1_inc = 0; if (s_v1 + 1 != o->v1) s_v1_inc = 0;
if (s_v0 -1 != o->v0) s_v0_dec = 0; if (s_v0 - 1 != o->v0) s_v0_dec = 0;
if (s_v1 -1 != o->v1) s_v1_dec = 0; if (s_v1 - 1 != o->v1) s_v1_dec = 0;
s_v0 = o->v0; s_v0 = o->v0;
s_v1 = o->v1; s_v1 = o->v1;
} }
struct cmp_operands *orig_o = &afl->orig_cmp_map->log[key][i]; struct cmp_operands *orig_o = &afl->orig_cmp_map->log[key][i];
// opt not in the paper // opt not in the paper
@ -410,14 +423,16 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
for (idx = 0; idx < len && fails < 8; ++idx) { for (idx = 0; idx < len && fails < 8; ++idx) {
if (unlikely(cmp_extend_encoding(afl, h, o->v0, o->v1, orig_o->v0, idx, orig_buf, buf, len, 1, &status))) if (unlikely(cmp_extend_encoding(afl, h, o->v0, o->v1, orig_o->v0, idx,
orig_buf, buf, len, 1, &status)))
return 1; return 1;
if (status == 2) if (status == 2)
++fails; ++fails;
else if (status == 1) else if (status == 1)
break; break;
if (unlikely(cmp_extend_encoding(afl, h, o->v1, o->v0, orig_o->v1, idx, orig_buf, buf, len, 1, &status))) if (unlikely(cmp_extend_encoding(afl, h, o->v1, o->v0, orig_o->v1, idx,
orig_buf, buf, len, 1, &status)))
return 1; return 1;
if (status == 2) if (status == 2)
++fails; ++fails;
@ -425,16 +440,17 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
break; break;
} }
if (status == 1) if (status == 1) found_one = 1;
found_one = 1;
// If failed, add to dictionary // If failed, add to dictionary
if (fails == 8) { if (fails == 8) {
if (afl->pass_stats[key].total == 0) { if (afl->pass_stats[key].total == 0) {
try_to_add_to_dict(afl, o->v0, SHAPE_BYTES(h->shape)); try_to_add_to_dict(afl, o->v0, SHAPE_BYTES(h->shape));
try_to_add_to_dict(afl, o->v1, SHAPE_BYTES(h->shape)); try_to_add_to_dict(afl, o->v1, SHAPE_BYTES(h->shape));
} }
} }
@ -443,22 +459,29 @@ static u8 cmp_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
afl->stage_cur++; afl->stage_cur++;
} }
if (loggeds > 3 && ((s_v0_fixed && s_v1_inc) || (s_v1_fixed && s_v0_inc) || if (loggeds > 3 && ((s_v0_fixed && s_v1_inc) || (s_v1_fixed && s_v0_inc) ||
(s_v0_fixed && s_v1_dec) || (s_v1_fixed && s_v0_dec))) { (s_v0_fixed && s_v1_dec) || (s_v1_fixed && s_v0_dec))) {
afl->pass_stats[key].total = afl->pass_stats[key].faileds = 0xff; afl->pass_stats[key].total = afl->pass_stats[key].faileds = 0xff;
} }
if (!found_one && afl->pass_stats[key].faileds < 0xff) { if (!found_one && afl->pass_stats[key].faileds < 0xff) {
afl->pass_stats[key].faileds++; afl->pass_stats[key].faileds++;
} }
if (afl->pass_stats[key].total < 0xff) afl->pass_stats[key].total++; if (afl->pass_stats[key].total < 0xff) afl->pass_stats[key].total++;
return 0; return 0;
} }
static u8 rtn_extend_encoding(afl_state_t *afl, struct cmp_header *h, u8 *pattern, u8 *repl, u8* o_pattern, u32 idx, u8 *orig_buf, u8 *buf, u32 len, u8 *status) { static u8 rtn_extend_encoding(afl_state_t *afl, struct cmp_header *h,
u8 *pattern, u8 *repl, u8 *o_pattern, u32 idx,
u8 *orig_buf, u8 *buf, u32 len, u8 *status) {
u32 i; u32 i;
u32 its_len = MIN(32, len - idx); u32 its_len = MIN(32, len - idx);
@ -470,7 +493,9 @@ static u8 rtn_extend_encoding(afl_state_t *afl, struct cmp_header *h, u8 *patter
for (i = 0; i < its_len; ++i) { for (i = 0; i < its_len; ++i) {
if (pattern[idx + i] != buf[idx + i] || o_pattern[idx + i] != orig_buf[idx + i] || *status == 1) break; if (pattern[idx + i] != buf[idx + i] ||
o_pattern[idx + i] != orig_buf[idx + i] || *status == 1)
break;
buf[idx + i] = repl[idx + i]; buf[idx + i] = repl[idx + i];
if (unlikely(its_fuzz(afl, buf, len, status))) return 1; if (unlikely(its_fuzz(afl, buf, len, status))) return 1;
@ -493,15 +518,15 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
u8 status = 0; u8 status = 0;
// opt not in the paper // opt not in the paper
u32 fails = 0; u32 fails = 0;
u8 found_one = 0; u8 found_one = 0;
for (i = 0; i < loggeds; ++i) { for (i = 0; i < loggeds; ++i) {
fails = 0; fails = 0;
struct cmpfn_operands *o = struct cmpfn_operands *o =
&((struct cmpfn_operands *)afl->shm.cmp_map->log[key])[i]; &((struct cmpfn_operands *)afl->shm.cmp_map->log[key])[i];
struct cmpfn_operands *orig_o = struct cmpfn_operands *orig_o =
&((struct cmpfn_operands *)afl->orig_cmp_map->log[key])[i]; &((struct cmpfn_operands *)afl->orig_cmp_map->log[key])[i];
@ -513,14 +538,16 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
for (idx = 0; idx < len && fails < 8; ++idx) { for (idx = 0; idx < len && fails < 8; ++idx) {
if (unlikely(rtn_extend_encoding(afl, h, o->v0, o->v1, orig_o->v0, idx, orig_buf, buf, len, &status))) if (unlikely(rtn_extend_encoding(afl, h, o->v0, o->v1, orig_o->v0, idx,
orig_buf, buf, len, &status)))
return 1; return 1;
if (status == 2) if (status == 2)
++fails; ++fails;
else if (status == 1) else if (status == 1)
break; break;
if (unlikely(rtn_extend_encoding(afl, h, o->v1, o->v0, orig_o->v1, idx, orig_buf, buf, len, &status))) if (unlikely(rtn_extend_encoding(afl, h, o->v1, o->v0, orig_o->v1, idx,
orig_buf, buf, len, &status)))
return 1; return 1;
if (status == 2) if (status == 2)
++fails; ++fails;
@ -528,16 +555,17 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
break; break;
} }
if (status == 1) if (status == 1) found_one = 1;
found_one = 1;
// If failed, add to dictionary // If failed, add to dictionary
if (fails == 8) { if (fails == 8) {
if (afl->pass_stats[key].total == 0) { if (afl->pass_stats[key].total == 0) {
maybe_add_auto((u8 *)afl, o->v0, SHAPE_BYTES(h->shape)); maybe_add_auto((u8 *)afl, o->v0, SHAPE_BYTES(h->shape));
maybe_add_auto((u8 *)afl, o->v1, SHAPE_BYTES(h->shape)); maybe_add_auto((u8 *)afl, o->v1, SHAPE_BYTES(h->shape));
} }
} }
@ -546,10 +574,13 @@ static u8 rtn_fuzz(afl_state_t *afl, u32 key, u8 *orig_buf, u8 *buf, u32 len) {
afl->stage_cur++; afl->stage_cur++;
} }
if (!found_one && afl->pass_stats[key].faileds < 0xff) { if (!found_one && afl->pass_stats[key].faileds < 0xff) {
afl->pass_stats[key].faileds++; afl->pass_stats[key].faileds++;
} }
if (afl->pass_stats[key].total < 0xff) afl->pass_stats[key].total++; if (afl->pass_stats[key].total < 0xff) afl->pass_stats[key].total++;
return 0; return 0;
@ -565,13 +596,13 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
u8 r = 1; u8 r = 1;
if (afl->orig_cmp_map == NULL) if (afl->orig_cmp_map == NULL)
afl->orig_cmp_map = ck_alloc_nozero(sizeof(struct cmp_map)); afl->orig_cmp_map = ck_alloc_nozero(sizeof(struct cmp_map));
if (afl->pass_stats == NULL) if (afl->pass_stats == NULL)
afl->pass_stats = ck_alloc(sizeof(struct afl_pass_stat) * CMP_MAP_W); afl->pass_stats = ck_alloc(sizeof(struct afl_pass_stat) * CMP_MAP_W);
// do it manually, forkserver clear only afl->fsrv.trace_bits // do it manually, forkserver clear only afl->fsrv.trace_bits
memset(afl->shm.cmp_map->headers, 0, sizeof(afl->shm.cmp_map->headers)); memset(afl->shm.cmp_map->headers, 0, sizeof(afl->shm.cmp_map->headers));
if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) return 1; if (unlikely(common_fuzz_cmplog_stuff(afl, buf, len))) return 1;
memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map)); memcpy(afl->orig_cmp_map, afl->shm.cmp_map, sizeof(struct cmp_map));
@ -596,12 +627,13 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
for (k = 0; k < CMP_MAP_W; ++k) { for (k = 0; k < CMP_MAP_W; ++k) {
if (!afl->shm.cmp_map->headers[k].hits) continue; if (!afl->shm.cmp_map->headers[k].hits) continue;
if (afl->pass_stats[k].total && if (afl->pass_stats[k].total &&
(rand_below(afl, afl->pass_stats[k].total) >= afl->pass_stats[k].faileds (rand_below(afl, afl->pass_stats[k].total) >=
|| afl->pass_stats[k].total == 0xff)) afl->pass_stats[k].faileds ||
afl->shm.cmp_map->headers[k].hits = 0; // blacklist this cmp afl->pass_stats[k].total == 0xff))
afl->shm.cmp_map->headers[k].hits = 0; // blacklist this cmp
if (afl->shm.cmp_map->headers[k].type == CMP_TYPE_INS) if (afl->shm.cmp_map->headers[k].type == CMP_TYPE_INS)
afl->stage_max += MIN((u32)afl->shm.cmp_map->headers[k].hits, CMP_MAP_H); afl->stage_max += MIN((u32)afl->shm.cmp_map->headers[k].hits, CMP_MAP_H);
else else
@ -616,13 +648,11 @@ u8 input_to_state_stage(afl_state_t *afl, u8 *orig_buf, u8 *buf, u32 len,
if (afl->shm.cmp_map->headers[k].type == CMP_TYPE_INS) { if (afl->shm.cmp_map->headers[k].type == CMP_TYPE_INS) {
if (unlikely(cmp_fuzz(afl, k, orig_buf, buf, len))) if (unlikely(cmp_fuzz(afl, k, orig_buf, buf, len))) goto exit_its;
goto exit_its;
} else { } else {
if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, len))) if (unlikely(rtn_fuzz(afl, k, orig_buf, buf, len))) goto exit_its;
goto exit_its;
} }
@ -634,7 +664,7 @@ exit_its:
new_hit_cnt = afl->queued_paths + afl->unique_crashes; new_hit_cnt = afl->queued_paths + afl->unique_crashes;
afl->stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt; afl->stage_finds[STAGE_ITS] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_ITS] += afl->total_execs - orig_execs; afl->stage_cycles[STAGE_ITS] += afl->total_execs - orig_execs;
memcpy(orig_buf, buf, len); memcpy(orig_buf, buf, len);
return r; return r;

2
src/afl-fuzz-state.c
View File

@ -370,7 +370,7 @@ void afl_state_deinit(afl_state_t *afl) {
free(afl->in_buf); free(afl->in_buf);
free(afl->in_scratch_buf); free(afl->in_scratch_buf);
free(afl->ex_buf); free(afl->ex_buf);
list_remove(&afl_states, afl); list_remove(&afl_states, afl);
} }

14
src/afl-fuzz-stats.c
View File

@ -387,9 +387,9 @@ void show_stats(afl_state_t *afl) {
/* Lord, forgive me this. */ /* Lord, forgive me this. */
SAYF(SET_G1 bSTG bLT bH bSTOP cCYA SAYF(SET_G1 bSTG bLT bH bSTOP cCYA
" process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA " process timing " bSTG bH30 bH5 bH bHB bH bSTOP cCYA
" overall results " bSTG bH2 bH2 bRT "\n"); " overall results " bSTG bH2 bH2 bRT "\n");
if (afl->dumb_mode) { if (afl->dumb_mode) {
@ -471,9 +471,9 @@ void show_stats(afl_state_t *afl) {
" uniq hangs : " cRST "%-6s" bSTG bV "\n", " uniq hangs : " cRST "%-6s" bSTG bV "\n",
time_tmp, tmp); time_tmp, tmp);
SAYF(bVR bH bSTOP cCYA SAYF(bVR bH bSTOP cCYA
" cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA " cycle progress " bSTG bH10 bH5 bH2 bH2 bHB bH bSTOP cCYA
" map coverage " bSTG bH bHT bH20 bH2 bVL "\n"); " map coverage " bSTG bH bHT bH20 bH2 bVL "\n");
/* This gets funny because we want to print several variable-length variables /* This gets funny because we want to print several variable-length variables
together, but then cram them into a fixed-width field - so we need to together, but then cram them into a fixed-width field - so we need to
@ -503,9 +503,9 @@ void show_stats(afl_state_t *afl) {
SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp); SAYF(bSTOP " count coverage : " cRST "%-21s" bSTG bV "\n", tmp);
SAYF(bVR bH bSTOP cCYA SAYF(bVR bH bSTOP cCYA
" stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA " stage progress " bSTG bH10 bH5 bH2 bH2 bX bH bSTOP cCYA
" findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n"); " findings in depth " bSTG bH10 bH5 bH2 bH2 bVL "\n");
sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored), sprintf(tmp, "%s (%0.02f%%)", u_stringify_int(IB(0), afl->queued_favored),
((double)afl->queued_favored) * 100 / afl->queued_paths); ((double)afl->queued_favored) * 100 / afl->queued_paths);
@ -579,7 +579,7 @@ void show_stats(afl_state_t *afl) {
/* Aaaalmost there... hold on! */ /* Aaaalmost there... hold on! */
SAYF(bVR bH cCYA bSTOP SAYF(bVR bH cCYA bSTOP
" fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA " fuzzing strategy yields " bSTG bH10 bHT bH10 bH5 bHB bH bSTOP cCYA
" path geometry " bSTG bH5 bH2 bVL "\n"); " path geometry " bSTG bH5 bH2 bVL "\n");