weight power

include/afl-fuzz.h

@@ -338,15 +338,16 @@ enum {
 
 enum {
 
-  /* 00 */ EXPLORE, /* AFL default, Exploration-based constant schedule */
-  /* 01 */ MMOPT,   /* Modified MOPT schedule           */
-  /* 02 */ EXPLOIT, /* AFL's exploitation-based const.  */
-  /* 03 */ FAST,    /* Exponential schedule             */
-  /* 04 */ COE,     /* Cut-Off Exponential schedule     */
-  /* 05 */ LIN,     /* Linear schedule                  */
-  /* 06 */ QUAD,    /* Quadratic schedule               */
-  /* 07 */ RARE,    /* Rare edges                       */
-  /* 08 */ SEEK,    /* EXPLORE that ignores timings     */
+  /* 00 */ EXPLORE, /* AFL default, exploration-based constant schedule */
+  /* 01 */ EXPLOIT, /* AFL's exploitation-based const.   */
+  /* 02 */ WEIGHT,  /* Based on seed weighting algorithm */
+  /* 03 */ MMOPT,   /* Modified MOPT schedule            */
+  /* 04 */ FAST,    /* Exponential schedule              */
+  /* 05 */ COE,     /* Cut-Off Exponential schedule      */
+  /* 06 */ LIN,     /* Linear schedule                   */
+  /* 07 */ QUAD,    /* Quadratic schedule                */
+  /* 08 */ RARE,    /* Rare edges                        */
+  /* 09 */ SEEK,    /* EXPLORE that ignores timings      */
 
   POWER_SCHEDULES_NUM
 

src/afl-fuzz-queue.c

@@ -1020,6 +1020,17 @@ void cull_queue(afl_state_t *afl) {
 
 u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
 
+  if (likely(afl->schedule == WEIGHT)) {
+
+    u32 val = 100;
+
+    if (unlikely(q->favored)) { val = val << 1; }
+    if (unlikely(!q->was_fuzzed)) { val = val << 1; }
+
+    return val * q->weight;
+
+  }
+
   u32 cal_cycles = afl->total_cal_cycles;
   u32 bitmap_entries = afl->total_bitmap_entries;
 

src/afl-fuzz.c

@@ -745,6 +745,10 @@ int main(int argc, char **argv_orig, char **envp) {
 
           afl->schedule = EXPLOIT;
 
+        } else if (!stricmp(optarg, "weight")) {
+
+          afl->schedule = WEIGHT;
+
         } else if (!stricmp(optarg, "lin")) {
 
           afl->schedule = LIN;