more stability

.custom-format.py

@@ -3,10 +3,10 @@
 # american fuzzy lop++ - custom code formatter
 # --------------------------------------------
 #
-# Written and maintained by Andrea Fioraldi <andreafioraldi@gmail.com>
+# Written and maintaned by Andrea Fioraldi <andreafioraldi@gmail.com>
 #
 # Copyright 2015, 2016, 2017 Google Inc. All rights reserved.
-# Copyright 2019-2023 AFLplusplus Project. All rights reserved.
+# Copyright 2019-2020 AFLplusplus Project. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -18,57 +18,41 @@
 import subprocess
 import sys
 import os
-# import re # TODO: for future use
-import shutil
-import importlib.metadata
-
-# string_re = re.compile('(\\"(\\\\.|[^"\\\\])*\\")') # TODO: for future use
-
-CURRENT_LLVM = os.getenv('LLVM_VERSION', 17)
-CLANG_FORMAT_BIN = os.getenv("CLANG_FORMAT_BIN", "")
-
-
-def check_clang_format_pip_version():
-    """
-    Check if the correct version of clang-format is installed via pip.
-
-    Returns:
-        bool: True if the correct version of clang-format is installed,
-        False otherwise.
-    """
-    # Check if clang-format is installed
-    if importlib.util.find_spec('clang_format'):
-        # Check if the installed version is the expected LLVM version
-        if importlib.metadata.version('clang-format')\
-                .startswith(str(CURRENT_LLVM)+'.'):
-            return True
-        else:
-            # Return False, because the clang-format version does not match
-            return False
-    else:
-        # If the 'clang_format' package isn't installed, return False
-        return False
+import re
 
+# string_re = re.compile('(\\"(\\\\.|[^"\\\\])*\\")') # future use
 
 with open(".clang-format") as f:
     fmt = f.read()
 
-
-CLANG_FORMAT_PIP = check_clang_format_pip_version()
-
-if shutil.which(CLANG_FORMAT_BIN) is None:
-    CLANG_FORMAT_BIN = f"clang-format-{CURRENT_LLVM}"
-
-if shutil.which(CLANG_FORMAT_BIN) is None \
-        and CLANG_FORMAT_PIP is False:
-    print(f"[!] clang-format-{CURRENT_LLVM} is needed. Aborted.")
-    print(f"Run `pip3 install \"clang-format=={CURRENT_LLVM}.*\"` \
-to install via pip.")
-    exit(1)
-
-if CLANG_FORMAT_PIP:
-    CLANG_FORMAT_BIN = shutil.which("clang-format")
-
+CLANG_FORMAT_BIN = os.getenv("CLANG_FORMAT_BIN")
+if CLANG_FORMAT_BIN is None:
+    o = 0
+    try:
+        p = subprocess.Popen(["clang-format-10", "--version"], stdout=subprocess.PIPE)
+        o, _ = p.communicate()
+        o = str(o, "utf-8")
+        o = o[len("clang-format version "):].strip()
+        o = o[:o.find(".")]
+        o = int(o)
+    except:
+        print ("clang-format-10 is needed. Aborted.")
+        exit(1)
+    #if o < 7:
+    #    if subprocess.call(['which', 'clang-format-7'], stdout=subprocess.PIPE) == 0:
+    #        CLANG_FORMAT_BIN = 'clang-format-7'
+    #    elif subprocess.call(['which', 'clang-format-8'], stdout=subprocess.PIPE) == 0:
+    #        CLANG_FORMAT_BIN = 'clang-format-8'
+    #    elif subprocess.call(['which', 'clang-format-9'], stdout=subprocess.PIPE) == 0:
+    #        CLANG_FORMAT_BIN = 'clang-format-9'
+    #    elif subprocess.call(['which', 'clang-format-10'], stdout=subprocess.PIPE) == 0:
+    #        CLANG_FORMAT_BIN = 'clang-format-10'
+    #    else:
+    #        print ("clang-format 7 or above is needed. Aborted.")
+    #        exit(1)
+    else:
+        CLANG_FORMAT_BIN = 'clang-format-10'
+            
 COLUMN_LIMIT = 80
 for line in fmt.split("\n"):
     line = line.split(":")
@@ -84,47 +68,26 @@ def custom_format(filename):
     in_define = False
     last_line = None
     out = ""
-
+    
     for line in src.split("\n"):
         if line.lstrip().startswith("#"):
-            if line[line.find("#") + 1:].lstrip().startswith("define"):
+            if line[line.find("#")+1:].lstrip().startswith("define"):
                 in_define = True
-
-        if (
-                "/*" in line
-                and not line.strip().startswith("/*")
-                and line.endswith("*/")
-                and len(line) < (COLUMN_LIMIT - 2)
-        ):
+        
+        if "/*" in line and not line.strip().startswith("/*") and line.endswith("*/") and len(line) < (COLUMN_LIMIT-2):
             cmt_start = line.rfind("/*")
-            line = (
-                    line[:cmt_start]
-                    + " " * (COLUMN_LIMIT - 2 - len(line))
-                    + line[cmt_start:]
-            )
+            line = line[:cmt_start] + " " * (COLUMN_LIMIT-2 - len(line)) + line[cmt_start:]
 
         define_padding = 0
         if last_line is not None and in_define and last_line.endswith("\\"):
             last_line = last_line[:-1]
-            define_padding = max(0, len(last_line[last_line.rfind("\n") + 1:]))
+            define_padding = max(0, len(last_line[last_line.rfind("\n")+1:]))
 
-        if (
-                last_line is not None
-                and last_line.strip().endswith("{")
-                and line.strip() != ""
-        ):
+        if last_line is not None and last_line.strip().endswith("{") and line.strip() != "":
             line = (" " * define_padding + "\\" if in_define else "") + "\n" + line
-        elif (
-                last_line is not None
-                and last_line.strip().startswith("}")
-                and line.strip() != ""
-        ):
+        elif last_line is not None and last_line.strip().startswith("}") and line.strip() != "":
             line = (" " * define_padding + "\\" if in_define else "") + "\n" + line
-        elif (
-                line.strip().startswith("}")
-                and last_line is not None
-                and last_line.strip() != ""
-        ):
+        elif line.strip().startswith("}") and last_line is not None and last_line.strip() != "":
             line = (" " * define_padding + "\\" if in_define else "") + "\n" + line
 
         if not line.endswith("\\"):
@@ -133,15 +96,14 @@ def custom_format(filename):
         out += line + "\n"
         last_line = line
 
-    return out
-
+    return (out)
 
 args = sys.argv[1:]
 if len(args) == 0:
-    print("Usage: ./format.py [-i] <filename>")
-    print()
-    print(" The -i option, if specified, let the script to modify in-place")
-    print(" the source files. By default the results are written to stdout.")
+    print ("Usage: ./format.py [-i] <filename>")
+    print ()
+    print (" The -i option, if specified, let the script to modify in-place")
+    print (" the source files. By default the results are written to stdout.")
     print()
     exit(1)
 
@@ -157,3 +119,4 @@ for filename in args:
             f.write(code)
     else:
         print(code)
+

.dockerignore

@@ -1,75 +0,0 @@
-!/coresight_mode
-*.dSYM
-*.o
-*.pyc
-*.so
-.sync_tmp
-.test
-.test2
-.git
-.dockerignore
-.github
-CITATION.cff
-CONTRIBUTING.md
-Changelog.md
-Dockerfile
-LICENSE
-TODO.md
-afl-analyze
-afl-analyze.8
-afl-as
-afl-as.8
-afl-clang
-afl-clang-fast
-afl-clang-fast.8
-afl-clang-fast\+\+
-afl-clang-fast\+\+.8
-afl-clang-lto
-afl-clang-lto.8
-afl-clang-lto\+\+
-afl-clang-lto\+\+.8
-afl-clang\+\+
-afl-cmin.8
-afl-cmin.bash.8
-afl-fuzz
-afl-fuzz.8
-afl-g\+\+
-afl-g\+\+-fast
-afl-g\+\+-fast.8
-afl-gcc
-afl-gcc-fast
-afl-gcc-fast.8
-afl-gcc.8
-afl-gotcpu
-afl-gotcpu.8
-afl-ld
-afl-ld-lto
-afl-plot.8
-afl-qemu-trace
-afl-showmap
-afl-showmap.8
-afl-system-config.8
-afl-tmin
-afl-tmin.8
-afl-whatsup.8
-as
-core*
-examples/afl_frida/afl-frida
-examples/afl_frida/frida-gum-example.c
-examples/afl_frida/frida-gum.h
-examples/afl_frida/libtestinstr.so
-examples/afl_network_proxy/afl-network-client
-examples/afl_network_proxy/afl-network-server
-in
-ld
-out
-qemu_mode/libcompcov/compcovtest
-qemu_mode/qemu-*
-test/unittests/unit_hash
-test/unittests/unit_list
-test/unittests/unit_maybe_alloc
-test/unittests/unit_preallocable
-test/unittests/unit_rand
-unicorn_mode/samples/*/\.test-*
-unicorn_mode/samples/*/output
-unicorn_mode/unicornafl

.github/FUNDING.yml

@@ -1,13 +0,0 @@
-# These are supported funding model platforms
-
-# Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-github: AFLplusplus
-patreon: # Replace with a single Patreon username
-open_collective: AFLplusplusEU
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,32 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**IMPORTANT**
-1. You have verified that the issue to be present in the current `dev` branch.
-2. Please supply the command line options and relevant environment variables,
-   e.g., a copy-paste of the contents of `out/default/fuzzer_setup`.
-
-Thank you for making AFL++ better!
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-1. ...
-2. ...
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screen output/Screenshots**
-If applicable, add copy-paste of the screen output or screenshot that shows the issue. Please ensure the output is in **English** and not in Chinese, Russian, German, etc.
-
-**Additional context**
-Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,20 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.

.github/workflows/ci.yml

@@ -1,56 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - stable
-      - dev
-  pull_request:
-    branches:
-      - dev # No need for stable-pull-request, as that equals dev-push
-
-jobs:
-  linux:
-    runs-on: "${{ matrix.os }}"
-    strategy:
-      matrix:
-        os: [ubuntu-22.04, ubuntu-20.04]
-    env:
-      AFL_SKIP_CPUFREQ: 1
-      AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: 1
-    steps:
-      - uses: actions/checkout@v3
-      - name: update
-        run: sudo apt-get update && sudo apt-get upgrade -y
-      - name: debug
-        run: apt-cache search plugin-dev | grep gcc-; echo; apt-cache search clang-format- | grep clang-format-
-      - name: install packages
-        run: sudo apt-get install -y -m -f build-essential gcc-10 g++-10 git libtool libtool-bin automake flex bison libglib2.0-0 clang-12 llvm-12-dev libc++-dev findutils libcmocka-dev python3-dev python3-setuptools ninja-build python3-pip gcc-10-plugin-dev
-      - name: compiler installed
-        run: gcc -v; echo; clang -v
-      - name: install gcc plugin
-        run: sudo apt-get install -y -m -f --install-suggests $(readlink /usr/bin/gcc)-plugin-dev
-      - name: build afl++
-        run: export NO_NYX=1; export ASAN_BUILD=1; export LLVM_CONFIG=llvm-config-12; make ASAN_BUILD=1 NO_NYX=1 LLVM_CONFIG=llvm-config-12 distrib
-      - name: run tests
-        run: sudo -E ./afl-system-config; make tests
- # macos:
- #   runs-on: macOS-latest
- #   env:
- #     AFL_MAP_SIZE: 65536
- #     AFL_SKIP_CPUFREQ: 1
- #     AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES: 1
- #   steps:
- #     - uses: actions/checkout@v3
- #     - name: install
- #       run: brew install make gcc llvm
- #     - name: fix install
- #       run: cd /usr/local/bin; ln -s gcc-11 gcc; ln -s g++-11 g++; which gcc; gcc -v
- #     - name: build
- #       run: export PATH=/usr/local/Cellar/llvm/*/":$PATH"; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; sudo -E ./afl-system-config; gmake ASAN_BUILD=1
- #     - name: frida
- #       run: export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; cd frida_mode; gmake
- #     - name: run tests
- #       run: sudo -E ./afl-system-config; export CC=/usr/local/Cellar/llvm/*/bin/clang; export CXX="$CC"++; export PATH=/usr/local/Cellar/llvm/*/":/usr/local/bin:$PATH"; export LLVM_CONFIG=/usr/local/Cellar/llvm/*/bin/llvm-config; gmake tests
- #     - name: force frida test for MacOS
- #       run: export AFL_PATH=`pwd`; /usr/local/bin/gcc -o test-instr test-instr.c; mkdir in; echo > in/in; AFL_NO_UI=1 ./afl-fuzz -O -i in -o out -V 5 -- ./test-instr

.github/workflows/code-format.yml

@@ -1,33 +0,0 @@
-name: Formatting
-
-on:
-  push:
-    branches:
-      - stable
-      - dev
-  pull_request:
-    branches:
-      - dev # No need for stable-pull-request, as that equals dev-push
-
-jobs:
-  code-format-check:
-    name: Check code format
-    if: ${{ 'false' == 'true' }} # Disable the job
-    runs-on: ubuntu-22.04
-    container: docker.io/aflplusplus/aflplusplus:dev
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Format
-        run: |
-          git config --global --add safe.directory /__w/AFLplusplus/AFLplusplus
-          apt-get update
-          apt-get install -y clang-format-${LLVM_VERSION}
-          make code-format
-      - name: Check if code needed formatting
-        run: |
-          git --no-pager -c color.ui=always diff HEAD
-          if ! git diff HEAD --quiet; then
-            echo "[!] Please run 'make code-format' and push its changes."
-            exit 1
-          fi

.github/workflows/codeql-analysis.yml

@@ -1,33 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches:
-      - stable
-      - dev
-  pull_request:
-    branches:
-      - dev # No need for stable-pull-request, as that equals dev-push
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    container: # We use a previous image as it's expected to have all the dependencies
-      image: docker.io/aflplusplus/aflplusplus:dev
-    steps:
-      - name: Fix for using external repo in container build # https://github.com/actions/checkout/issues/760
-        run: git config --global --add safe.directory /__w/AFLplusplus/AFLplusplus
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
-        with:
-          languages: cpp, python
-      - name: Build AFLplusplus # Rebuild because CodeQL needs to monitor the build process
-        env:
-          CC: gcc # These are symlinked to the version used in the container build
-          CXX: g++
-        run: make -i all # Best effort using -i
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2

.github/workflows/container.yml

@@ -1,75 +0,0 @@
-name: Container
-on:
-  push:
-    branches:
-      - stable
-      - dev
-    tags:
-      - "*"
-  pull_request:
-    branches:
-      - dev # No need for stable-pull-request, as that equals dev-push
-
-jobs:
-  build-and-test-amd64:
-    name: Test amd64 image
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: Build amd64
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          tags: aflplusplus:test-amd64
-          load: true
-          cache-to: type=gha,mode=max
-          build-args: |
-            TEST_BUILD=1
-      - name: Test amd64
-        run: >
-          docker run --rm aflplusplus:test-amd64 bash -c "
-          apt-get update && 
-          apt-get install -y libcmocka-dev && 
-          make -i tests
-          "
-
-  push:
-    name: Push amd64 and arm64 images
-    runs-on: ubuntu-latest
-    needs:
-      - build-and-test-amd64
-    if: ${{ github.event_name == 'push' && github.repository == 'AFLplusplus/AFLplusplus' }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-        with:
-          platforms: arm64
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: Login to docker.io
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Set tags to push
-        id: push-tags
-        run: |
-          PUSH_TAGS=docker.io/aflplusplus/aflplusplus:${GITHUB_REF_NAME}
-          if [ "${GITHUB_REF_NAME}" = "stable" ]; then
-            PUSH_TAGS=${PUSH_TAGS},docker.io/aflplusplus/aflplusplus:latest
-          fi
-          export PUSH_TAGS
-          echo "::set-output name=PUSH_TAGS::${PUSH_TAGS}"
-      - name: Push to docker.io registry
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.push-tags.outputs.PUSH_TAGS }}
-          cache-from: type=gha

.github/workflows/rust_custom_mutator.yml

@@ -1,33 +0,0 @@
-name: Rust Custom Mutators
-
-on:
-  push:
-    branches:
-      - stable
-      - dev
-  pull_request:
-    branches:
-      - dev # No need for stable-pull-request, as that equals dev-push
-
-jobs:
-  test:
-    name: Test Rust Custom Mutator Support
-    runs-on: '${{ matrix.os }}'
-    defaults:
-      run:
-        working-directory: custom_mutators/rust
-    strategy:
-      matrix:
-        os: [ubuntu-22.04, ubuntu-20.04]
-    steps:
-      - uses: actions/checkout@v3
-      - name: Install Rust Toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-      - name: Check Code Compiles
-        run: cargo check
-      - name: Run General Tests
-        run: cargo test
-      - name: Run Tests for afl_internals feature flag
-        run: cd custom_mutator && cargo test --features=afl_internals

.gitignore

@@ -1,113 +1,57 @@
-!coresight_mode
-!coresight_mode/coresight-trace
-*.dSYM
-*.o
-*.o.tmp
-*.pyc
-*.so
-*.swp
-.sync_tmp
 .test
 .test2
-.vscode
-afl-addseeds.8
+*.o
+*.so
+*.pyc
 afl-analyze
-afl-analyze.8
 afl-as
-afl-as.8
-afl-c++
-afl-c++.8
-afl-cc
-afl-cc.8
 afl-clang
 afl-clang++
 afl-clang-fast
 afl-clang-fast++
-afl-clang-fast++.8
-afl-clang-fast.8
 afl-clang-lto
 afl-clang-lto++
-afl-clang-lto++.8
-afl-clang-lto.8
-afl-cmin.8
-afl-cmin.bash.8
-afl-cs-proxy
-afl-frida-trace.so
 afl-fuzz
-afl-fuzz.8
 afl-g++
-afl-g++.8
 afl-gcc
-afl-gcc.8
 afl-gcc-fast
-afl-gcc-fast.8
 afl-g++-fast
-afl-g++-fast.8
 afl-gotcpu
-afl-gotcpu.8
 afl-ld
 afl-ld-lto
-afl-lto
-afl-lto++
-afl-lto++.8
-afl-lto.8
-afl-persistent-config.8
-afl-plot.8
 afl-qemu-trace
 afl-showmap
+afl-tmin
+afl-analyze.8
+afl-as.8
+afl-clang-fast++.8
+afl-clang-fast.8
+afl-clang-lto.8
+afl-clang-lto++.8
+afl-cmin.8
+afl-cmin.bash.8
+afl-fuzz.8
+afl-gcc.8
+afl-gcc-fast.8
+afl-g++-fast.8
+afl-gotcpu.8
+afl-plot.8
 afl-showmap.8
 afl-system-config.8
-afl-tmin
 afl-tmin.8
 afl-whatsup.8
-a.out
-as
-compile_commands.json
-core*
-examples/afl_frida/afl-frida
-examples/afl_frida/frida-gum-example.c
-examples/afl_frida/frida-gum.h
-examples/afl_frida/libtestinstr.so
-examples/afl_network_proxy/afl-network-client
-examples/afl_network_proxy/afl-network-server
-examples/aflpp_driver/libAFLDriver.a
-examples/aflpp_driver/libAFLQemuDriver.a
-gmon.out
-in
-ld
-libAFLDriver.a
-libAFLQemuDriver.a
-out
 qemu_mode/libcompcov/compcovtest
+as
+ld
 qemu_mode/qemu-*
-qemu_mode/qemuafl
-test/.afl_performance
-test-instr
-test/output
-test/test-c
-test/test-cmplog
-test/test-compcov
-test/test-instr.ts
-test/test-persistent
-test/unittests/unit_hash
-test/unittests/unit_list
+unicorn_mode/samples/*/\.test-*
+unicorn_mode/samples/*/output/
+unicorn_mode/unicornafl
+core\.*
 test/unittests/unit_maybe_alloc
 test/unittests/unit_preallocable
+test/unittests/unit_list
 test/unittests/unit_rand
-unicorn_mode/samples/*/output/
-unicorn_mode/samples/*/\.test-*
-utils/afl_network_proxy/afl-network-client
-utils/afl_network_proxy/afl-network-server
-utils/afl_proxy/afl-proxy
-utils/bench/hash
-utils/optimin/build
-utils/optimin/optimin
-utils/persistent_mode/persistent_demo
-utils/persistent_mode/persistent_demo_new
-utils/persistent_mode/persistent_demo_new_compat
-utils/persistent_mode/test-instr
-utils/replay_record/persistent_demo_replay
-utils/replay_record/persistent_demo_replay_compat
-utils/replay_record/persistent_demo_replay_argparse
-utils/plot_ui/afl-plot-ui
-vuln_prog
+test/unittests/unit_hash
+examples/afl_network_proxy/afl-network-server
+examples/afl_network_proxy/afl-network-client

.gitmodules

@@ -1,27 +1,3 @@
 [submodule "unicorn_mode/unicornafl"]
 	path = unicorn_mode/unicornafl
-	url = https://github.com/AFLplusplus/unicornafl
-[submodule "custom_mutators/grammar_mutator"]
-	path = custom_mutators/grammar_mutator/grammar_mutator
-	url = https://github.com/AFLplusplus/Grammar-Mutator
-[submodule "qemu_mode/qemuafl"]
-	path = qemu_mode/qemuafl
-	url = https://github.com/AFLplusplus/qemuafl
-[submodule "custom_mutators/gramatron/json-c"]
-	path = custom_mutators/gramatron/json-c
-	url = https://github.com/json-c/json-c
-[submodule "coresight_mode/patchelf"]
-	path = coresight_mode/patchelf
-	url = https://github.com/NixOS/patchelf.git
-[submodule "coresight_mode/coresight-trace"]
-	path = coresight_mode/coresight-trace
-	url = https://github.com/RICSecLab/coresight-trace.git
-[submodule "nyx_mode/libnyx"]
-	path = nyx_mode/libnyx
-	url = https://github.com/nyx-fuzz/libnyx.git
-[submodule "nyx_mode/packer"]
-	path = nyx_mode/packer
-	url = https://github.com/nyx-fuzz/packer.git
-[submodule "nyx_mode/QEMU-Nyx"]
-	path = nyx_mode/QEMU-Nyx
-	url = https://github.com/nyx-fuzz/QEMU-Nyx
+	url = https://github.com/AFLplusplus/unicornafl.git

.travis.yml

@@ -0,0 +1,58 @@
+language: c
+
+sudo: required
+
+branches:
+  only:
+    - master
+    - dev
+
+matrix:
+  include:
+#  - os: linux	# focal errors every run with a timeout while installing packages
+#    dist: focal
+#    env: NAME="focal-amd64" MODERN="yes" GCC="9"
+  - os: linux
+    dist: bionic
+    env: NAME="bionic-amd64" MODERN="yes" GCC="7"
+  - os: linux
+    dist: xenial
+    env: NAME="xenial-amd64" MODERN="no" GCC="5" EXTRA="libtool-bin clang-6.0"
+  - os: linux
+    dist: trusty
+    env: NAME="trusty-amd64" MODERN="no" GCC="4.8"
+#  - os: linux # until travis can fix this!
+#    dist: xenial
+#    arch: arm64
+#    env: NAME="xenial-arm64" MODERN="no" GCC="5" EXTRA="libtool-bin clang-6.0" AFL_NO_X86="1" CPU_TARGET="aarch64"
+#  - os: osx
+#    osx_image: xcode11.2
+#    env: NAME="osx" HOMEBREW_NO_ANALYTICS="1" LINK="http://releases.llvm.org/9.0.0/" NAME="clang+llvm-9.0.0-x86_64-darwin-apple"
+
+jobs:
+  allow_failures:
+    - os: osx
+    - arch: arm64
+
+env:
+  - AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1 AFL_NO_UI=1
+ # - AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1 AFL_NO_UI=1 AFL_EXIT_WHEN_DONE=1
+ # TODO: test AFL_BENCH_UNTIL_CRASH once we have a target that crashes
+ # - AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1 AFL_NO_UI=1 AFL_BENCH_JUST_ONE=1
+
+before_install:
+  # export LLVM_DIR=${TRAVIS_BUILD_DIR}/${LLVM_PACKAGE}
+  - echo Testing on $NAME
+  - if [ "$TRAVIS_OS_NAME" = "osx" ]; then wget "$LINK""$NAME".tar.xz ; export LLVM_CONFIG=`pwd`/"$NAME" ; tar xJf "$NAME".tar.xz ; fi
+  - if [ "$MODERN" = "yes" ]; then sudo apt update ; sudo apt upgrade ; sudo apt install -y git libtool libtool-bin automake bison libglib2.0-0 build-essential clang gcc-"$GCC" gcc-"$GCC"-plugin-dev libc++-"$GCC"-dev findutils libcmocka-dev python3-setuptools ; fi
+  - if [ "$MODERN" = "no" ]; then sudo apt update ; sudo apt install -y git libtool $EXTRA libpixman-1-dev automake bison libglib2.0 build-essential gcc-"$GCC" gcc-"$GCC"-plugin-dev libc++-dev findutils libcmocka-dev python3-setuptools ; fi
+
+script:
+  - gcc -v
+  - clang -v
+  - sudo -E ./afl-system-config
+  - if [ "$TRAVIS_OS_NAME" = "osx" ]; then export LLVM_CONFIG=`pwd`/"$NAME" ; make source-only ASAN_BUILD=1 ; fi
+  - if [ "$TRAVIS_OS_NAME" = "linux" -a "$TRAVIS_CPU_ARCH" = "amd64" ]; then make distrib ASAN_BUILD=1 ; fi
+  - if [ "$TRAVIS_CPU_ARCH" = "arm64" ] ; then echo DEBUG ; find / -name llvm-config.h 2>/dev/null; apt-cache search clang | grep clang- ; apt-cache search llvm | grep llvm- ; dpkg -l | egrep 'clang|llvm'; echo DEBUG ; export LLVM_CONFIG=llvm-config-6.0 ; make ASAN_BUILD=1 ; cd qemu_mode && sh ./build_qemu_support.sh ; cd .. ; fi
+  - make tests
+#  - travis_terminate 0

Android.bp

@@ -1,21 +1,7 @@
-//
-// NOTE: This file is outdated. None of the AFL++ team uses Android hence
-//       we need users to keep this updated.
-//       In the current state it will likely fail, please send fixes!
-//       Also, this should build frida_mode.
-//
-
-
 cc_defaults {
   name: "afl-defaults",
 
-  local_include_dirs: [
-    "include",
-    "instrumentation",
-  ],
-
   cflags: [
-    "-flto=full",
     "-funroll-loops",
     "-Wno-pointer-sign",
     "-Wno-pointer-arith",
@@ -24,62 +10,24 @@ cc_defaults {
     "-Wno-unused-function",
     "-Wno-format",
     "-Wno-user-defined-warnings",
-    "-DAFL_LLVM_USE_TRACE_PC=1",
+    "-DUSE_TRACE_PC=1",
     "-DBIN_PATH=\"out/host/linux-x86/bin\"",
     "-DDOC_PATH=\"out/host/linux-x86/shared/doc/afl\"",
     "-D__USE_GNU",
-    "-DDEBUG_BUILD",
-    "-U_FORTIFY_SOURCE",
-    "-ggdb3",
-    "-g",
-    "-O0",
-    "-fno-omit-frame-pointer",
-    "-fPIC",
   ],
-
-  target: {
-    android_arm64: {
-      cflags: [
-        "-D__ANDROID__",
-      ],
-    },
-    android_arm: {
-      cflags: [
-        "-D__ANDROID__",
-      ],
-    },
-    android_x86_64: {
-      cflags: [
-        "-D__ANDROID__",
-      ],
-    },
-    android_x86: {
-      cflags: [
-        "-D__ANDROID__",
-      ],
-    },
-  },
 }
 
 cc_binary {
   name: "afl-fuzz",
-  sanitize: {
-    never: true,
-  },
+  static_executable: true,
   host_supported: true,
-  compile_multilib: "64",
 
   defaults: [
     "afl-defaults",
   ],
 
   srcs: [
-    "src/afl-fuzz*.c",
-    "src/afl-common.c",
-    "src/afl-forkserver.c",
-    "src/afl-sharedmem.c",
-    "src/afl-forkserver.c",
-    "src/afl-performance.c",
+    "afl-fuzz.c",
   ],
 }
 
@@ -93,11 +41,7 @@ cc_binary {
   ],
 
   srcs: [
-    "src/afl-showmap.c",
-    "src/afl-common.c",
-    "src/afl-sharedmem.c",
-    "src/afl-forkserver.c",
-    "src/afl-performance.c",
+    "afl-showmap.c",
   ],
 }
 
@@ -111,11 +55,7 @@ cc_binary {
   ],
 
   srcs: [
-    "src/afl-tmin.c",
-    "src/afl-common.c",
-    "src/afl-sharedmem.c",
-    "src/afl-forkserver.c",
-    "src/afl-performance.c",
+    "afl-tmin.c",
   ],
 }
 
@@ -129,10 +69,7 @@ cc_binary {
   ],
 
   srcs: [
-    "src/afl-analyze.c",
-    "src/afl-common.c",
-    "src/afl-sharedmem.c",
-    "src/afl-performance.c",
+    "afl-analyze.c",
   ],
 }
 
@@ -146,13 +83,12 @@ cc_binary {
   ],
 
   srcs: [
-    "src/afl-gotcpu.c",
-    "src/afl-common.c",
+    "afl-gotcpu.c",
   ],
 }
 
 cc_binary_host {
-  name: "afl-cc",
+  name: "afl-clang-fast",
   static_executable: true,
 
   defaults: [
@@ -160,172 +96,17 @@ cc_binary_host {
   ],
 
   cflags: [
+    "-D__ANDROID__",
     "-DAFL_PATH=\"out/host/linux-x86/lib64\"",
-    "-DAFL_CLANG_FLTO=\"-flto=full\"",
-    "-DUSE_BINDIR=1",
-    "-DLLVM_BINDIR=\"prebuilts/clang/host/linux-x86/clang-r383902b/bin\"",
-    "-DLLVM_LIBDIR=\"prebuilts/clang/host/linux-x86/clang-r383902b/lib64\"",
-    "-DCLANGPP_BIN=\"prebuilts/clang/host/linux-x86/clang-r383902b/bin/clang++\"",
-    "-DAFL_REAL_LD=\"prebuilts/clang/host/linux-x86/clang-r383902b/bin/ld.lld\"",
-    "-DLLVM_LTO=1",
-    "-DLLVM_MAJOR=11",
-    "-DLLVM_MINOR=2",
   ],
 
   srcs: [
-    "src/afl-cc.c",
-    "src/afl-common.c",
-  ],
-
-  symlinks: [
-    "afl-clang-fast",
-    "afl-clang-fast++",
-  ],
-}
-
-cc_library_static {
-  name: "afl-compiler-rt",
-  compile_multilib: "64",
-  vendor_available: true,
-  host_supported: true,
-  recovery_available: true,
-  sdk_version: "9",
-
-  apex_available: [
-    "com.android.adbd",
-    "com.android.appsearch",
-    "com.android.art",
-    "com.android.bluetooth.updatable",
-    "com.android.cellbroadcast",
-    "com.android.conscrypt",
-    "com.android.extservices",
-    "com.android.cronet",
-    "com.android.neuralnetworks",
-    "com.android.media",
-    "com.android.media.swcodec",
-    "com.android.mediaprovider",
-    "com.android.permission",
-    "com.android.runtime",
-    "com.android.resolv",
-    "com.android.tethering",
-    "com.android.wifi",
-    "com.android.sdkext",
-    "com.android.os.statsd",
-    "//any",
-  ],
-
-  defaults: [
-    "afl-defaults",
-  ],
-
-  srcs: [
-    "instrumentation/afl-compiler-rt.o.c",
-  ],
-}
-
-cc_library_headers {
-  name: "libafl_headers",
-  vendor_available: true,
-  host_supported: true,
-
-  export_include_dirs: [
-    "include",
-    "instrumentation",
-  ],
-}
-
-/*
-cc_prebuilt_library_static {
-  name: "libfrida-gum",
-  compile_multilib: "64",
-  strip: {
-    none: true,
-  },
-
-  srcs: [
-    "utils/afl_frida/android/libfrida-gum.a",
-  ],
-
-  export_include_dirs: [
-    "utils/afl_frida/android",
-  ],
-}
-
-cc_library_shared {
-  name: "libtestinstr",
-
-  srcs: [
-    "utils/afl_frida/libtestinstr.c",
-  ],
-
-  cflags: [
-    "-O0",
-    "-fPIC",
-  ],
-}
-
-cc_binary {
-  name: "afl-frida",
-  compile_multilib: "64",
-
-  defaults: [
-    "afl-defaults",
-  ],
-
-  cflags: [
-    "-g",
-    "-O0",
-    "-Wno-format",
-    "-Wno-pointer-sign",
-    "-fpermissive",
-    "-fPIC",
-  ],
-
-  static_libs: [
-    "afl-compiler-rt",
-    "libfrida-gum",
-  ],
-
-  shared_libs: [
-    "libdl",
-    "liblog",
-  ],
-
-  srcs: [
-    "utils/afl_frida/afl-frida.c",
-  ],
-
-  local_include_dirs: [
-    "utils/afl_frida",
-    "utils/afl_frida/android",
-  ],
-}
-*/
-
-cc_binary {
-  name: "afl-fuzz-32",
-  sanitize: {
-    never: true,
-  },
-  host_supported: true,
-  compile_multilib: "32",
-
-  defaults: [
-    "afl-defaults",
-  ],
-
-  srcs: [
-    "src/afl-fuzz*.c",
-    "src/afl-common.c",
-    "src/afl-sharedmem.c",
-    "src/afl-forkserver.c",
-    "src/afl-performance.c",
+    "llvm_mode/afl-clang-fast.c",
   ],
 }
 
 cc_binary_host {
-  name: "afl-cc-32",
-  compile_multilib: "32",
+  name: "afl-clang-fast++",
   static_executable: true,
 
   defaults: [
@@ -333,87 +114,28 @@ cc_binary_host {
   ],
 
   cflags: [
+    "-D__ANDROID__",
     "-DAFL_PATH=\"out/host/linux-x86/lib64\"",
-    "-DAFL_CLANG_FLTO=\"-flto=full\"",
-    "-DUSE_BINDIR=1",
-    "-DLLVM_BINDIR=\"prebuilts/clang/host/linux-x86/clang-r383902b/bin\"",
-    "-DLLVM_LIBDIR=\"prebuilts/clang/host/linux-x86/clang-r383902b/lib64\"",
-    "-DCLANGPP_BIN=\"prebuilts/clang/host/linux-x86/clang-r383902b/bin/clang++\"",
-    "-DAFL_REAL_LD=\"prebuilts/clang/host/linux-x86/clang-r383902b/bin/ld.lld\"",
-    "-DLLVM_LTO=1",
-    "-DLLVM_MAJOR=11",
-    "-DLLVM_MINOR=2",
   ],
 
   srcs: [
-    "src/afl-cc.c",
-    "src/afl-common.c",
-  ],
-
-  symlinks: [
-    "afl-clang-fast-32",
-    "afl-clang-fast++-32",
+    "llvm_mode/afl-clang-fast.c",
   ],
 }
 
 cc_library_static {
-  name: "afl-compiler-rt-32",
-  compile_multilib: "32",
+  name: "afl-llvm-rt",
+  compile_multilib: "both",
   vendor_available: true,
   host_supported: true,
   recovery_available: true,
   sdk_version: "9",
 
-  apex_available: [
-    "com.android.adbd",
-    "com.android.appsearch",
-    "com.android.art",
-    "com.android.bluetooth.updatable",
-    "com.android.cellbroadcast",
-    "com.android.conscrypt",
-    "com.android.extservices",
-    "com.android.cronet",
-    "com.android.neuralnetworks",
-    "com.android.media",
-    "com.android.media.swcodec",
-    "com.android.mediaprovider",
-    "com.android.permission",
-    "com.android.runtime",
-    "com.android.resolv",
-    "com.android.tethering",
-    "com.android.wifi",
-    "com.android.sdkext",
-    "com.android.os.statsd",
-    "//any",
-  ],
-
   defaults: [
     "afl-defaults",
   ],
 
   srcs: [
-    "instrumentation/afl-compiler-rt.o.c",
+    "llvm_mode/afl-llvm-rt.o.c",
   ],
 }
-
-/*
-cc_prebuilt_library_static {
-  name: "libfrida-gum-32",
-  compile_multilib: "32",
-  strip: {
-    none: true,
-  },
-
-  srcs: [
-    "utils/afl_frida/android/arm/libfrida-gum.a",
-  ],
-
-  export_include_dirs: [
-    "utils/afl_frida/android/arm",
-  ],
-}
-*/
-
-subdirs = [
-  "custom_mutators",
-]

Android.mk

@@ -0,0 +1 @@
+Makefile

CITATION.cff

@@ -1,31 +0,0 @@
-cff-version: 1.2.0
-message: "If you use this software, please cite it as below."
-authors:
-  - given-names: Marc
-    family-names: Heuse
-    email: mh@mh-sec.de
-  - given-names: Heiko
-    family-names: Eißfeldt
-    email: heiko.eissfeldt@hexco.de
-  - given-names: Andrea
-    family-names: Fioraldi
-    email: andreafioraldi@gmail.com
-  - given-names: Dominik
-    family-names: Maier
-    email: mail@dmnk.co
-title: "AFL++"
-version: 4.00c
-type: software
-date-released: 2022-01-26
-url: "https://github.com/AFLplusplus/AFLplusplus"
-keywords:
-  - fuzzing
-  - fuzzer
-  - fuzz-testing
-  - instrumentation
-  - afl-fuzz
-  - qemu
-  - llvm
-  - unicorn-emulator
-  - security
-license: AGPL-3.0-or-later

CONTRIBUTING.md

@@ -1,8 +1,4 @@
-# Contributing to AFL++
-
-## How to submit a pull request
-
-All contributions (pull requests) must be made against our `dev` branch.
+# How to submit a Pull Request to AFLplusplus
 
 Each modified source file, before merging, must be formatted.
 
@@ -17,43 +13,10 @@ project, or added a file in a directory we already format, otherwise run:
 ./.custom-format.py -i file-that-you-have-created.c
 ```
 
-Regarding the coding style, please follow the AFL style. No camel case at all
-and use AFL's macros wherever possible (e.g., WARNF, FATAL, MAP_SIZE, ...).
+Regarding the coding style, please follow the AFL style.
+No camel case at all and use the AFL's macros wherever possible 
+(e.g. WARNF, FATAL, MAP_SIZE, ...).
 
-Remember that AFL++ has to build and run on many platforms, so generalize your
-Makefiles/GNUmakefile (or your patches to our pre-existing Makefiles) to be as
-generic as possible.
-
-## How to contribute to the docs
-
-We welcome contributions to our docs.
-
-Before creating a new file, please check if your content matches an existing
-file in one the following folders:
-
-* [docs/](docs/) (this is where you can find most of our docs content)
-* [frida_mode/](frida_mode/)
-* [instrumentation/](instrumentation/)
-* [qemu_mode/](qemu_mode/)
-* [unicorn_mode/](unicorn_mode/)
-
-When working on the docs, please keep the following guidelines in mind:
-
-* Edit or create Markdown files and use Markdown markup.
-  * Do: fuzzing_gui_program.md
-  * Don't: fuzzing_gui_program.txt
-* Use underscore in file names.
-  * Do: fuzzing_network_service.md
-  * Don't: fuzzing-network-service.md
-* Use a maximum of 80 characters per line to make reading in a console easier.
-* Make all pull requests against `dev`, see
-  [#how-to-submit-a-pull-request-to-afl](#how-to-submit-a-pull-request-to-afl).
-
-And finally, here are some best practices for writing docs content:
-
-* Use clear and simple language.
-* Structure your content with headings and paragraphs.
-* Use bulleted lists to present similar content in a way that makes it easy to
-  scan.
-* Use numbered lists for procedures or prioritizing.
-* Link to related content, for example, prerequisites or in-depth discussions.
+Remember that AFLplusplus has to build and run on many platforms, so
+generalize your Makefiles (or your patches to our pre-existing Makefiles)
+to be as much generic as possible.

Dockerfile

@@ -1,97 +1,62 @@
 #
-# This Dockerfile for AFLplusplus uses Ubuntu 22.04 jammy and
-# installs LLVM 14 for afl-clang-lto support.
-#
-# GCC 11 is used instead of 12 because genhtml for afl-cov doesn't like it.
+# This Dockerfile for AFLplusplus uses Ubuntu 20.04 focal and
+# installs LLVM 11 from llvm.org for afl-clang-lto support :-)
+# It also installs gcc/g++ 10 from the Ubuntu development platform
+# has focal has gcc-10 but not g++-10 ...
 #
 
-FROM ubuntu:22.04 AS aflplusplus
-LABEL "maintainer"="AFL++ team <afl@aflplus.plus>"
-LABEL "about"="AFLplusplus container image"
-
-### Comment out to enable these features
-# Only available on specific ARM64 boards
-ENV NO_CORESIGHT=1
-# Possible but unlikely in a docker container
-ENV NO_NYX=1
-
-### Only change these if you know what you are doing:
-# Current recommended LLVM version is 16
-ENV LLVM_VERSION=16
-# GCC 12 is producing compile errors for some targets so we stay at GCC 11
-ENV GCC_VERSION=11
-
-### No changes beyond the point unless you know what you are doing :)
+FROM ubuntu:20.04
+MAINTAINER afl++ team <afl@aflplus.plus>
+LABEL "about"="AFLplusplus docker image"
 
 ARG DEBIAN_FRONTEND=noninteractive
 
-ENV NO_ARCH_OPT=1
-ENV IS_DOCKER=1
+RUN apt-get update && apt-get upgrade -y && \
+    apt-get -y install --no-install-suggests --no-install-recommends \
+    automake \
+    bison flex \
+    build-essential \
+    git \
+    python3 python3-dev python3-setuptools python-is-python3 \
+    libtool libtool-bin \
+    libglib2.0-dev \
+    wget vim jupp nano \
+    apt-utils apt-transport-https ca-certificates gnupg dialog \
+    libpixman-1-dev
 
-RUN apt-get update && apt-get full-upgrade -y && \
-    apt-get install -y --no-install-recommends wget ca-certificates apt-utils && \
-    rm -rf /var/lib/apt/lists/*
+RUN echo deb http://apt.llvm.org/focal/ llvm-toolchain-focal main >> /etc/apt/sources.list && \
+    wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | apt-key add - 
+  
+RUN echo deb http://ppa.launchpad.net/ubuntu-toolchain-r/test/ubuntu focal main >> /etc/apt/sources.list && \
+    apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 1E9377A2BA9EF27F
+    
+RUN apt-get update && apt-get upgrade -y
 
-RUN echo "deb [signed-by=/etc/apt/keyrings/llvm-snapshot.gpg.key] http://apt.llvm.org/jammy/ llvm-toolchain-jammy-${LLVM_VERSION} main" > /etc/apt/sources.list.d/llvm.list && \
-    wget -qO /etc/apt/keyrings/llvm-snapshot.gpg.key https://apt.llvm.org/llvm-snapshot.gpg.key
+RUN apt-get install -y gcc-10 g++-10 gcc-10-plugin-dev gcc-10-multilib \
+    libc++-10-dev gdb lcov
 
-RUN apt-get update && \
-    apt-get -y install --no-install-recommends \
-    make cmake automake meson ninja-build bison flex \
-    git xz-utils bzip2 wget jupp nano bash-completion less vim joe ssh psmisc \
-    python3 python3-dev python3-pip python-is-python3 \
-    libtool libtool-bin libglib2.0-dev \
-    apt-transport-https gnupg dialog \
-    gnuplot-nox libpixman-1-dev bc \
-    gcc-${GCC_VERSION} g++-${GCC_VERSION} gcc-${GCC_VERSION}-plugin-dev gdb lcov \
-    clang-${LLVM_VERSION} clang-tools-${LLVM_VERSION} libc++1-${LLVM_VERSION} \
-    libc++-${LLVM_VERSION}-dev libc++abi1-${LLVM_VERSION} libc++abi-${LLVM_VERSION}-dev \
-    libclang1-${LLVM_VERSION} libclang-${LLVM_VERSION}-dev \
-    libclang-common-${LLVM_VERSION}-dev libclang-rt-${LLVM_VERSION}-dev libclang-cpp${LLVM_VERSION} \
-    libclang-cpp${LLVM_VERSION}-dev liblld-${LLVM_VERSION} \
-    liblld-${LLVM_VERSION}-dev liblldb-${LLVM_VERSION} liblldb-${LLVM_VERSION}-dev \
-    libllvm${LLVM_VERSION} libomp-${LLVM_VERSION}-dev libomp5-${LLVM_VERSION} \
-    lld-${LLVM_VERSION} lldb-${LLVM_VERSION} llvm-${LLVM_VERSION} \
-    llvm-${LLVM_VERSION}-dev llvm-${LLVM_VERSION}-runtime llvm-${LLVM_VERSION}-tools \
-    $([ "$(dpkg --print-architecture)" = "amd64" ] && echo gcc-${GCC_VERSION}-multilib gcc-multilib) \
-    $([ "$(dpkg --print-architecture)" = "arm64" ] && echo libcapstone-dev) && \
-    rm -rf /var/lib/apt/lists/*
-    # gcc-multilib is only used for -m32 support on x86
-    # libcapstone-dev is used for coresight_mode on arm64
+RUN apt-get install -y clang-11 clang-tools-11 libc++1-11 libc++-11-dev \
+    libc++abi1-11 libc++abi-11-dev libclang1-11 libclang-11-dev \
+    libclang-common-11-dev libclang-cpp11 libclang-cpp11-dev liblld-11 \
+    liblld-11-dev liblldb-11 liblldb-11-dev libllvm11 libomp-11-dev \
+    libomp5-11 lld-11 lldb-11 llvm-11 llvm-11-dev llvm-11-runtime llvm-11-tools
 
-RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-${GCC_VERSION} 0 && \
-    update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-${GCC_VERSION} 0 && \
-    update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${LLVM_VERSION} 0 && \
-    update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-${LLVM_VERSION} 0
+RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-10 0
+RUN update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-10 0
 
-RUN wget -qO- https://sh.rustup.rs | CARGO_HOME=/etc/cargo sh -s -- -y -q --no-modify-path
-ENV PATH=$PATH:/etc/cargo/bin
+RUN rm -rf /var/cache/apt/archives/*
 
-RUN apt clean -y
+ARG CC=gcc-10
+ARG CXX=g++-10
+ARG LLVM_CONFIG=llvm-config-11
+
+RUN git clone https://github.com/AFLplusplus/AFLplusplus
+RUN cd AFLplusplus && export REAL_CXX=g++-10 && make distrib && \
+    make install && make clean
+
+RUN git clone https://github.com/vanhauser-thc/afl-cov afl-cov
+RUN cd afl-cov && make install
+
+RUN echo 'alias joe="jupp --wordwrap"' >> ~/.bashrc
 
-ENV LLVM_CONFIG=llvm-config-${LLVM_VERSION}
 ENV AFL_SKIP_CPUFREQ=1
-ENV AFL_TRY_AFFINITY=1
-ENV AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1
-
-RUN git clone --depth=1 https://github.com/vanhauser-thc/afl-cov && \
-    (cd afl-cov && make install) && rm -rf afl-cov
-
-WORKDIR /AFLplusplus
-COPY . .
-
-ARG CC=gcc-$GCC_VERSION
-ARG CXX=g++-$GCC_VERSION
-
-# Used in CI to prevent a 'make clean' which would remove the binaries to be tested
-ARG TEST_BUILD
-
-RUN sed -i.bak 's/^	-/	/g' GNUmakefile && \
-    make clean && make distrib && \
-    ([ "${TEST_BUILD}" ] || (make install)) && \
-    mv GNUmakefile.bak GNUmakefile
-
-RUN echo "set encoding=utf-8" > /root/.vimrc && \
-    echo ". /etc/bash_completion" >> ~/.bashrc && \
-    echo 'alias joe="joe --wordwrap --joe_state -nobackup"' >> ~/.bashrc && \
-    echo "export PS1='"'[AFL++ \h] \w \$ '"'" >> ~/.bashrc

GNUmakefile

@@ -10,7 +10,7 @@
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at:
 #
-#   https://www.apache.org/licenses/LICENSE-2.0
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
 
 # For Heiko:
@@ -24,52 +24,18 @@ BIN_PATH    = $(PREFIX)/bin
 HELPER_PATH = $(PREFIX)/lib/afl
 DOC_PATH    = $(PREFIX)/share/doc/afl
 MISC_PATH   = $(PREFIX)/share/afl
-MAN_PATH    = $(PREFIX)/share/man/man8
+MAN_PATH    = $(PREFIX)/man/man8
 
 PROGNAME    = afl
 VERSION     = $(shell grep '^$(HASH)define VERSION ' ../config.h | cut -d '"' -f2)
 
 # PROGS intentionally omit afl-as, which gets installed elsewhere.
 
-PROGS       = afl-fuzz afl-showmap afl-tmin afl-gotcpu afl-analyze
-SH_PROGS    = afl-plot afl-cmin afl-cmin.bash afl-whatsup afl-addseeds afl-system-config afl-persistent-config afl-cc
+PROGS       = afl-gcc afl-fuzz afl-showmap afl-tmin afl-gotcpu afl-analyze
+SH_PROGS    = afl-plot afl-cmin afl-cmin.bash afl-whatsup afl-system-config
 MANPAGES=$(foreach p, $(PROGS) $(SH_PROGS), $(p).8) afl-as.8
 ASAN_OPTIONS=detect_leaks=0
 
-SYS = $(shell uname -s)
-ARCH = $(shell uname -m)
-
-$(info [*] Compiling AFL++ for OS $(SYS) on ARCH $(ARCH))
-
-ifdef NO_SPLICING
-  override CFLAGS_OPT += -DNO_SPLICING
-endif
-
-ifdef NO_UTF
-  override CFLAGS_OPT += -DFANCY_BOXES_NO_UTF
-endif
-
-ifdef ASAN_BUILD
-  $(info Compiling ASAN version of binaries)
-  override CFLAGS += $(ASAN_CFLAGS)
-  override LDFLAGS += $(ASAN_LDFLAGS)
-endif
-ifdef UBSAN_BUILD
-  $(info Compiling UBSAN version of binaries)
-  override CFLAGS += -fsanitize=undefined -fno-omit-frame-pointer
-  override LDFLAGS += -fsanitize=undefined
-endif
-ifdef MSAN_BUILD
-  $(info Compiling MSAN version of binaries)
-  CC := clang
-  override CFLAGS += -fsanitize=memory -fno-omit-frame-pointer
-  override LDFLAGS += -fsanitize=memory
-endif
-
-ifdef CODE_COVERAGE
-  override CFLAGS += -D__AFL_CODE_COVERAGE=1
-endif
-
 ifeq "$(findstring android, $(shell $(CC) --version 2>/dev/null))" ""
 ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -flto=full -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
 	CFLAGS_FLTO ?= -flto=full
@@ -84,128 +50,94 @@ else
 endif
 endif
 
-ifdef PERFORMANCE
-  SPECIAL_PERFORMANCE := -D_AFL_SPECIAL_PERFORMANCE
-  ifeq "$(SYS)" "Linux"
-    ifeq "$(shell grep avx2 /proc/cpuinfo)" ""
-    else
-  	SPECIAL_PERFORMANCE += -mavx2 -D_HAVE_AVX2
-    endif
-  endif
-  ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -march=native -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
-	HAVE_MARCHNATIVE = 1
-	SPECIAL_PERFORMANCE += -march=native
-  endif
-  $(info SPECIAL_PERFORMANCE=$(SPECIAL_PERFORMANCE))
-else
-  SPECIAL_PERFORMANCE :=
+ifeq "$(shell echo 'int main() {return 0; }' | $(CC) -fno-move-loop-invariants -fdisable-tree-cunrolli -x c - -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
+	SPECIAL_PERFORMANCE += -fno-move-loop-invariants -fdisable-tree-cunrolli
 endif
 
-ifneq "$(SYS)" "Darwin"
- #ifeq "$(HAVE_MARCHNATIVE)" "1"
- #  SPECIAL_PERFORMANCE += -march=native
- #endif
- #ifndef DEBUG
- #  override CFLAGS_OPT += -D_FORTIFY_SOURCE=1
- #endif
-else
-  # On some odd MacOS system configurations, the Xcode sdk path is not set correctly
-  SDK_LD = -L$(shell xcrun --show-sdk-path)/usr/lib
-  override LDFLAGS += $(SDK_LD)
+ifneq "$(shell uname)" "Darwin"
+ ifeq "$(shell echo 'int main() {return 0; }' | $(CC) $(CFLAGS) -Werror -x c - -march=native -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
+ 	#CFLAGS_OPT += -march=native
+ 	SPECIAL_PERFORMANCE += -march=native
+ endif
+ # OS X does not like _FORTIFY_SOURCE=2
+ CFLAGS_OPT += -D_FORTIFY_SOURCE=2
 endif
 
-COMPILER_TYPE=$(shell $(CC) --version|grep "Free Software Foundation")
-ifneq "$(COMPILER_TYPE)" ""
-  #$(info gcc is being used)
-  override CFLAGS_OPT += -Wno-error=format-truncation -Wno-format-truncation
-endif
-
-ifeq "$(SYS)" "SunOS"
-  override LDFLAGS = -lkstat -lrt -lsocket -lnsl
+ifeq "$(shell uname)" "SunOS"
+ CFLAGS_OPT += -Wno-format-truncation
+ LDFLAGS=-lkstat
 endif
 
 ifdef STATIC
   $(info Compiling static version of binaries, disabling python though)
   # Disable python for static compilation to simplify things
-  PYTHON_OK = 0
+  PYTHON_OK=0
   PYFLAGS=
-  PYTHON_INCLUDE = /
+  PYTHON_INCLUDE=/
 
-  override CFLAGS_OPT += -static
-  override LDFLAGS += -lm -lpthread -lz -lutil
+  CFLAGS_OPT += -static
+  LDFLAGS += -lm -lpthread -lz -lutil
 endif
 
 ifdef PROFILING
   $(info Compiling with profiling information, for analysis: gprof ./afl-fuzz gmon.out > prof.txt)
-  override CFLAGS_OPT += -pg -DPROFILING=1
-  override LDFLAGS += -pg
+  CFLAGS_OPT += -pg -DPROFILING=1
+  LDFLAGS += -pg
 endif
 
-ifdef INTROSPECTION
-  $(info Compiling with introspection documentation)
-  override CFLAGS_OPT += -DINTROSPECTION=1
-endif
-
-ifneq "$(ARCH)" "x86_64"
- ifneq "$(patsubst i%86,i386,$(ARCH))" "i386"
-  ifneq "$(ARCH)" "amd64"
-   ifneq "$(ARCH)" "i86pc"
+ifneq "$(shell uname -m)" "x86_64"
+ ifneq "$(patsubst i%86,i386,$(shell uname -m))" "i386"
+  ifneq "$(shell uname -m)" "amd64"
+   ifneq "$(shell uname -m)" "i86pc"
 	AFL_NO_X86=1
    endif
   endif
  endif
 endif
 
-ifdef DEBUG
-  $(info Compiling DEBUG version of binaries)
-  override CFLAGS += -ggdb3 -O0 -Wall -Wextra -Werror $(CFLAGS_OPT)
-else
-  CFLAGS ?= -O2 $(CFLAGS_OPT) # -funroll-loops is slower on modern compilers
-endif
+CFLAGS     ?= -O3 -funroll-loops $(CFLAGS_OPT)
+override CFLAGS += -Wall -g -Wno-pointer-sign -Wmissing-declarations\
+			  -I include/ -DAFL_PATH=\"$(HELPER_PATH)\" \
+			  -DBIN_PATH=\"$(BIN_PATH)\" -DDOC_PATH=\"$(DOC_PATH)\"
 
-override CFLAGS += -g -Wno-pointer-sign -Wno-variadic-macros -Wall -Wextra -Wno-pointer-arith \
-			-fPIC -I include/ -DAFL_PATH=\"$(HELPER_PATH)\"  \
-			-DBIN_PATH=\"$(BIN_PATH)\" -DDOC_PATH=\"$(DOC_PATH)\"
-# -fstack-protector
-
-ifeq "$(SYS)" "FreeBSD"
+ifeq "$(shell uname -s)" "FreeBSD"
   override CFLAGS  += -I /usr/local/include/
-  override LDFLAGS += -L /usr/local/lib/
+  LDFLAGS += -L /usr/local/lib/
 endif
 
-ifeq "$(SYS)" "DragonFly"
+ifeq "$(shell uname -s)" "DragonFly"
   override CFLAGS  += -I /usr/local/include/
-  override LDFLAGS += -L /usr/local/lib/
+  LDFLAGS += -L /usr/local/lib/
 endif
 
-ifeq "$(SYS)" "OpenBSD"
+ifeq "$(shell uname -s)" "OpenBSD"
   override CFLAGS  += -I /usr/local/include/ -mno-retpoline
-  override LDFLAGS += -Wl,-z,notext -L /usr/local/lib/
+  LDFLAGS += -Wl,-z,notext -L /usr/local/lib/
 endif
 
-ifeq "$(SYS)" "NetBSD"
+ifeq "$(shell uname -s)" "NetBSD"
   override CFLAGS  += -I /usr/pkg/include/
-  override LDFLAGS += -L /usr/pkg/lib/
+  LDFLAGS += -L /usr/pkg/lib/
 endif
 
-ifeq "$(SYS)" "Haiku"
+ifeq "$(shell uname -s)" "Haiku"
   SHMAT_OK=0
-  override CFLAGS  += -DUSEMMAP=1 -Wno-error=format
-  override LDFLAGS += -Wno-deprecated-declarations -lgnu -lnetwork
-  #SPECIAL_PERFORMANCE += -DUSEMMAP=1
+  override CFLAGS  += -DUSEMMAP=1 -Wno-error=format -fPIC
+  LDFLAGS += -Wno-deprecated-declarations -lgnu
+  SPECIAL_PERFORMANCE += -DUSEMMAP=1
 endif
 
 AFL_FUZZ_FILES = $(wildcard src/afl-fuzz*.c)
 
 ifneq "$(shell command -v python3m 2>/dev/null)" ""
   ifneq "$(shell command -v python3m-config 2>/dev/null)" ""
-    PYTHON_INCLUDE  := $(shell python3m-config --includes)
-    PYTHON_VERSION  := $(strip $(shell python3m --version 2>&1))
+    PYTHON_INCLUDE  ?= $(shell python3m-config --includes)
+    PYTHON_VERSION  ?= $(strip $(shell python3m --version 2>&1))
     # Starting with python3.8, we need to pass the `embed` flag. Earlier versions didn't know this flag.
     ifeq "$(shell python3m-config --embed --libs 2>/dev/null | grep -q lpython && echo 1 )" "1"
-      PYTHON_LIB      := $(shell python3m-config --libs --embed --ldflags)
+      PYTHON_LIB      ?= $(shell python3m-config --libs --embed --ldflags)
     else
-      PYTHON_LIB      := $(shell python3m-config --ldflags)
+      PYTHON_LIB      ?= $(shell python3m-config --ldflags)
     endif
   endif
 endif
@@ -213,13 +145,13 @@ endif
 ifeq "$(PYTHON_INCLUDE)" ""
   ifneq "$(shell command -v python3 2>/dev/null)" ""
     ifneq "$(shell command -v python3-config 2>/dev/null)" ""
-      PYTHON_INCLUDE  := $(shell python3-config --includes)
-      PYTHON_VERSION  := $(strip $(shell python3 --version 2>&1))
-      # Starting with python3.8, we need to pass the `embed` flag. Earlier versions didn't know this flag.
+      PYTHON_INCLUDE  ?= $(shell python3-config --includes)
+      PYTHON_VERSION  ?= $(strip $(shell python3 --version 2>&1))
+      # Starting with python3.8, we need to pass the `embed` flag. Earier versions didn't know this flag.
       ifeq "$(shell python3-config --embed --libs 2>/dev/null | grep -q lpython && echo 1 )" "1"
-        PYTHON_LIB      := $(shell python3-config --libs --embed --ldflags)
+        PYTHON_LIB      ?= $(shell python3-config --libs --embed --ldflags)
       else
-        PYTHON_LIB      := $(shell python3-config --ldflags)
+        PYTHON_LIB      ?= $(shell python3-config --ldflags)
       endif
     endif
   endif
@@ -228,9 +160,9 @@ endif
 ifeq "$(PYTHON_INCLUDE)" ""
   ifneq "$(shell command -v python 2>/dev/null)" ""
     ifneq "$(shell command -v python-config 2>/dev/null)" ""
-      PYTHON_INCLUDE  := $(shell python-config --includes)
-      PYTHON_LIB      := $(shell python-config --ldflags)
-      PYTHON_VERSION  := $(strip $(shell python --version 2>&1))
+      PYTHON_INCLUDE  ?= $(shell python-config --includes)
+      PYTHON_LIB      ?= $(shell python-config --ldflags)
+      PYTHON_VERSION  ?= $(strip $(shell python --version 2>&1))
     endif
   endif
 endif
@@ -239,9 +171,9 @@ endif
 ifeq "$(PYTHON_INCLUDE)" ""
   ifneq "$(shell command -v python3.7 2>/dev/null)" ""
     ifneq "$(shell command -v python3.7-config 2>/dev/null)" ""
-      PYTHON_INCLUDE  := $(shell python3.7-config --includes)
-      PYTHON_LIB      := $(shell python3.7-config --ldflags)
-      PYTHON_VERSION  := $(strip $(shell python3.7 --version 2>&1))
+      PYTHON_INCLUDE  ?= $(shell python3.7-config --includes)
+      PYTHON_LIB      ?= $(shell python3.7-config --ldflags)
+      PYTHON_VERSION  ?= $(strip $(shell python3.7 --version 2>&1))
     endif
   endif
 endif
@@ -250,9 +182,9 @@ endif
 ifeq "$(PYTHON_INCLUDE)" ""
   ifneq "$(shell command -v python2.7 2>/dev/null)" ""
     ifneq "$(shell command -v python2.7-config 2>/dev/null)" ""
-      PYTHON_INCLUDE  := $(shell python2.7-config --includes)
-      PYTHON_LIB      := $(shell python2.7-config --ldflags)
-      PYTHON_VERSION  := $(strip $(shell python2.7 --version 2>&1))
+      PYTHON_INCLUDE  ?= $(shell python2.7-config --includes)
+      PYTHON_LIB      ?= $(shell python2.7-config --ldflags)
+      PYTHON_VERSION  ?= $(strip $(shell python2.7 --version 2>&1))
     endif
   endif
 endif
@@ -263,23 +195,24 @@ else
     BUILD_DATE ?= $(shell date "+%Y-%m-%d")
 endif
 
-ifneq "$(filter Linux GNU%,$(SYS))" ""
-  override LDFLAGS += -ldl -lrt -lm
+ifneq "$(filter Linux GNU%,$(shell uname))" ""
+  LDFLAGS += -ldl
 endif
 
-ifneq "$(findstring FreeBSD, $(SYS))" ""
+ifneq "$(findstring FreeBSD, $(shell uname))" ""
   override CFLAGS  += -pthread
-  override LDFLAGS += -lpthread -lm
+  LDFLAGS += -lpthread
 endif
 
-ifneq "$(findstring NetBSD, $(SYS))" ""
+ifneq "$(findstring NetBSD, $(shell uname))" ""
   override CFLAGS  += -pthread
-  override LDFLAGS += -lpthread -lm
+  LDFLAGS += -lpthread
 endif
 
-ifneq "$(findstring OpenBSD, $(SYS))" ""
-  override CFLAGS  += -pthread
-  override LDFLAGS += -lpthread -lm
+ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" ""
+  TEST_CC  = afl-gcc
+else
+  TEST_CC  = afl-clang
 endif
 
 COMM_HDR    = include/alloc-inl.h include/config.h include/debug.h include/types.h
@@ -306,85 +239,57 @@ ifeq "$(shell command -v svn >/dev/null && svn proplist . 2>/dev/null && echo 1
 endif
 
 ifeq "$(shell echo 'int main() { return 0;}' | $(CC) $(CFLAGS) -fsanitize=address -x c - -o .test2 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
-	ASAN_CFLAGS=-fsanitize=address -fstack-protector-all -fno-omit-frame-pointer -DASAN_BUILD
+	ASAN_CFLAGS=-fsanitize=address -fstack-protector-all -fno-omit-frame-pointer
 	ASAN_LDFLAGS=-fsanitize=address -fstack-protector-all -fno-omit-frame-pointer
 endif
 
+ifdef ASAN_BUILD
+  $(info Compiling ASAN version of binaries)
+  override CFLAGS+=$(ASAN_CFLAGS)
+  LDFLAGS+=$(ASAN_LDFLAGS)
+endif
+
 ifeq "$(shell echo '$(HASH)include <sys/ipc.h>@$(HASH)include <sys/shm.h>@int main() { int _id = shmget(IPC_PRIVATE, 65536, IPC_CREAT | IPC_EXCL | 0600); shmctl(_id, IPC_RMID, 0); return 0;}' | tr @ '\n' | $(CC) $(CFLAGS) -x c - -o .test2 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
 	SHMAT_OK=1
 else
 	SHMAT_OK=0
 	override CFLAGS+=-DUSEMMAP=1
-	LDFLAGS += -Wno-deprecated-declarations
+	LDFLAGS += -Wno-deprecated-declarations -lrt
 endif
 
 ifdef TEST_MMAP
 	SHMAT_OK=0
 	override CFLAGS += -DUSEMMAP=1
-	LDFLAGS += -Wno-deprecated-declarations
+	LDFLAGS += -Wno-deprecated-declarations -lrt
 endif
 
-.PHONY: all
-all:	test_x86 test_shm test_python ready $(PROGS) afl-as llvm gcc_plugin test_build all_done
-	-$(MAKE) -C utils/aflpp_driver
-	@echo
-	@echo
-	@echo Build Summary:
-	@test -e afl-fuzz && echo "[+] afl-fuzz and supporting tools successfully built" || echo "[-] afl-fuzz could not be built, please set CC to a working compiler"
-	@test -e afl-llvm-pass.so && echo "[+] LLVM basic mode successfully built" || echo "[-] LLVM mode could not be built, please install at least llvm-11 and clang-11 or newer, see docs/INSTALL.md"
-	@test -e SanitizerCoveragePCGUARD.so && echo "[+] LLVM mode successfully built" || echo "[-] LLVM mode could not be built, please install at least llvm-13 and clang-13 or newer, see docs/INSTALL.md"
-	@test -e SanitizerCoverageLTO.so && echo "[+] LLVM LTO mode successfully built" || echo "[-] LLVM LTO mode could not be built, it is optional, if you want it, please install LLVM and LLD 11+. More information at instrumentation/README.lto.md on how to build it"
-ifneq "$(SYS)" "Darwin"
-	@test -e afl-gcc-pass.so && echo "[+] gcc_mode successfully built" || echo "[-] gcc_mode could not be built, it is optional, install gcc-VERSION-plugin-dev to enable this"
-endif
-	@echo
+all:	test_x86 test_shm test_python ready $(PROGS) afl-as test_build all_done
 
-.PHONY: llvm
-llvm:
-	-$(MAKE) -j$(nproc) -f GNUmakefile.llvm
-	@test -e afl-cc || { echo "[-] Compiling afl-cc failed. You seem not to have a working compiler." ; exit 1; }
-
-.PHONY: gcc_plugin
-gcc_plugin:
-ifneq "$(SYS)" "Darwin"
-	-$(MAKE) -f GNUmakefile.gcc_plugin
-endif
-
-.PHONY: man
 man:    $(MANPAGES)
 
-.PHONY: test
-test:	tests
-
-.PHONY: tests
 tests:	source-only
-	@cd test ; ./test-all.sh
+	@cd test ; ./test.sh
 	@rm -f test/errors
 
-.PHONY: performance-tests
 performance-tests:	performance-test
-.PHONY: test-performance
 test-performance:	performance-test
 
-.PHONY: performance-test
 performance-test:	source-only
 	@cd test ; ./test-performance.sh
 
 
 # hint: make targets are also listed in the top level README.md
-.PHONY: help
 help:
 	@echo "HELP --- the following make targets exist:"
 	@echo "=========================================="
-	@echo "all: the main AFL++ binaries and llvm/gcc instrumentation"
-	@echo "binary-only: everything for binary-only fuzzing: frida_mode, nyx_mode, qemu_mode, frida_mode, unicorn_mode, coresight_mode, libdislocator, libtokencap"
-	@echo "source-only: everything for source code fuzzing: nyx_mode, libdislocator, libtokencap"
+	@echo "all: just the main afl++ binaries"
+	@echo "binary-only: everything for binary-only fuzzing: qemu_mode, unicorn_mode, libdislocator, libtokencap"
+	@echo "source-only: everything for source code fuzzing: llvm_mode, gcc_plugin, libdislocator, libtokencap"
 	@echo "distrib: everything (for both binary-only and source code fuzzing)"
 	@echo "man: creates simple man pages from the help option of the programs"
 	@echo "install: installs everything you have compiled with the build option above"
 	@echo "clean: cleans everything compiled (not downloads when on a checkout)"
 	@echo "deepclean: cleans everything including downloads"
-	@echo "uninstall: uninstall AFL++ from the system"
 	@echo "code-format: format the code, do this before you commit and send a PR please!"
 	@echo "tests: this runs the test framework. It is more catered for the developers, but if you run into problems this helps pinpointing the problem"
 	@echo "unit: perform unit tests (based on cmocka and GNU linker)"
@@ -395,102 +300,101 @@ help:
 	@echo
 	@echo Known build environment options:
 	@echo "=========================================="
-	@echo "PERFORMANCE - compile with performance options that make the binary not transferable to other systems. Recommended!"
 	@echo STATIC - compile AFL++ static
-	@echo "CODE_COVERAGE - compile the target for code coverage (see docs/instrumentation/README.llvm.md)"
-	@echo ASAN_BUILD - compiles AFL++ with memory sanitizer for debug purposes
-	@echo UBSAN_BUILD - compiles AFL++ tools with undefined behaviour sanitizer for debug purposes
-	@echo DEBUG - no optimization, -ggdb3, all warnings and -Werror
-	@echo LLVM_DEBUG - shows llvm deprecation warnings
+	@echo ASAN_BUILD - compiles with memory sanitizer for debug purposes
 	@echo PROFILING - compile afl-fuzz with profiling information
-	@echo INTROSPECTION - compile afl-fuzz with mutation introspection
-	@echo NO_PYTHON - disable python support
-	@echo NO_SPLICING - disables splicing mutation in afl-fuzz, not recommended for normal fuzzing
-	@echo "NO_UTF - do not use UTF-8 for line rendering in status screen (fallback to G1 box drawing, of vanilla AFL)"
-	@echo NO_NYX - disable building nyx mode dependencies
-	@echo "NO_CORESIGHT - disable building coresight (arm64 only)"
-	@echo NO_UNICORN_ARM64 - disable building unicorn on arm64
-	@echo "WAFL_MODE - enable for WASM fuzzing with https://github.com/fgsect/WAFL"
 	@echo AFL_NO_X86 - if compiling on non-intel/amd platforms
-	@echo "LLVM_CONFIG - if your distro doesn't use the standard name for llvm-config (e.g., Debian)"
 	@echo "=========================================="
-	@echo e.g.: make LLVM_CONFIG=llvm-config-16
+	@echo e.g.: make ASAN_BUILD=1
 
-.PHONY: test_x86
 ifndef AFL_NO_X86
+
 test_x86:
 	@echo "[*] Checking for the default compiler cc..."
 	@type $(CC) >/dev/null || ( echo; echo "Oops, looks like there is no compiler '"$(CC)"' in your path."; echo; echo "Don't panic! You can restart with '"$(_)" CC=<yourCcompiler>'."; echo; exit 1 )
 	@echo "[*] Testing the PATH environment variable..."
 	@test "$${PATH}" != "$${PATH#.:}" && { echo "Please remove current directory '.' from PATH to avoid recursion of 'as', thanks!"; echo; exit 1; } || :
 	@echo "[*] Checking for the ability to compile x86 code..."
-	@echo 'int main() { __asm__("xorb %al, %al"); }' | $(CC) $(CFLAGS) $(LDFLAGS) -w -x c - -o .test1 || ( echo; echo "Oops, looks like your compiler can't generate x86 code."; echo; echo "Don't panic! You can use the LLVM or QEMU mode, but see docs/INSTALL first."; echo "(To ignore this error, set AFL_NO_X86=1 and try again.)"; echo; exit 1 )
+	@echo 'main() { __asm__("xorb %al, %al"); }' | $(CC) $(CFLAGS) -w -x c - -o .test1 || ( echo; echo "Oops, looks like your compiler can't generate x86 code."; echo; echo "Don't panic! You can use the LLVM or QEMU mode, but see docs/INSTALL first."; echo "(To ignore this error, set AFL_NO_X86=1 and try again.)"; echo; exit 1 )
 	@rm -f .test1
+
 else
+
 test_x86:
 	@echo "[!] Note: skipping x86 compilation checks (AFL_NO_X86 set)."
+
 endif
 
-.PHONY: test_shm
+
 ifeq "$(SHMAT_OK)" "1"
+
 test_shm:
 	@echo "[+] shmat seems to be working."
 	@rm -f .test2
+
 else
+
 test_shm:
 	@echo "[-] shmat seems not to be working, switching to mmap implementation"
+
 endif
 
-.PHONY: test_python
+
 ifeq "$(PYTHON_OK)" "1"
+
 test_python:
 	@rm -f .test 2> /dev/null
 	@echo "[+] $(PYTHON_VERSION) support seems to be working."
+
 else
+
 test_python:
-	@echo "[-] You seem to need to install the package python3-dev or python-dev (and perhaps python[3]-apt), but it is optional so we continue"
+	@echo "[-] You seem to need to install the package python3-dev, python2-dev or python-dev (and perhaps python[23]-apt), but it is optional so we continue"
+
 endif
 
-.PHONY: ready
+
 ready:
-	@echo "[+] Everything seems to be working, ready to compile. ($(shell $(CC) --version 2>&1|head -n 1))"
+	@echo "[+] Everything seems to be working, ready to compile."
+
+afl-gcc: src/afl-gcc.c $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) src/$@.c -o $@ $(LDFLAGS)
+	set -e; for i in afl-g++ afl-clang afl-clang++; do ln -sf afl-gcc $$i; done
 
 afl-as: src/afl-as.c include/afl-as.h $(COMM_HDR) | test_x86
 	$(CC) $(CFLAGS) src/$@.c -o $@ $(LDFLAGS)
-	@ln -sf afl-as as
+	ln -sf afl-as as
 
 src/afl-performance.o : $(COMM_HDR) src/afl-performance.c include/hash.h
-	$(CC) $(CFLAGS) $(CFLAGS_OPT) $(SPECIAL_PERFORMANCE) -Iinclude -c src/afl-performance.c -o src/afl-performance.o
+	$(CC) -Iinclude $(SPECIAL_PERFORMANCE) -O3 -fno-unroll-loops -c src/afl-performance.c -o src/afl-performance.o
 
 src/afl-common.o : $(COMM_HDR) src/afl-common.c include/common.h
-	$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) -c src/afl-common.c -o src/afl-common.o
+	$(CC) $(CFLAGS) $(CFLAGS_FLTO) -c src/afl-common.c -o src/afl-common.o
 
 src/afl-forkserver.o : $(COMM_HDR) src/afl-forkserver.c include/forkserver.h
-	$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) -c src/afl-forkserver.c -o src/afl-forkserver.o
+	$(CC) $(CFLAGS) $(CFLAGS_FLTO) -c src/afl-forkserver.c -o src/afl-forkserver.o
 
 src/afl-sharedmem.o : $(COMM_HDR) src/afl-sharedmem.c include/sharedmem.h
-	$(CC) $(CFLAGS) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) -c src/afl-sharedmem.c -o src/afl-sharedmem.o
+	$(CC) $(CFLAGS) $(CFLAGS_FLTO) -c src/afl-sharedmem.c -o src/afl-sharedmem.o
 
-afl-fuzz: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o src/hashmap.c | test_x86
-	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) -Wno-shift-count-overflow $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o src/hashmap.c -o $@ $(PYFLAGS) $(LDFLAGS) -lm
+afl-fuzz: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o | test_x86
+	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(PYFLAGS) $(LDFLAGS)
 
-afl-showmap: src/afl-showmap.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) src/$@.c src/afl-fuzz-mutators.c src/afl-fuzz-python.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(PYFLAGS) $(LDFLAGS)
+afl-showmap: src/afl-showmap.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o -o $@ $(LDFLAGS)
 
 afl-tmin: src/afl-tmin.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(LDFLAGS)
+	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.o src/afl-performance.o -o $@ $(LDFLAGS)
 
-afl-analyze: src/afl-analyze.c src/afl-common.o src/afl-sharedmem.o src/afl-performance.o src/afl-forkserver.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-performance.o src/afl-forkserver.o -o $@ $(LDFLAGS)
+afl-analyze: src/afl-analyze.c src/afl-common.o src/afl-sharedmem.o src/afl-performance.o $(COMM_HDR) | test_x86
+	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o src/afl-sharedmem.o src/afl-performance.o -o $@ $(LDFLAGS)
 
 afl-gotcpu: src/afl-gotcpu.c src/afl-common.o $(COMM_HDR) | test_x86
-	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) $(SPECIAL_PERFORMANCE) src/$@.c src/afl-common.o -o $@ $(LDFLAGS)
+	$(CC) $(CFLAGS) $(COMPILE_STATIC) $(CFLAGS_FLTO) src/$@.c src/afl-common.o -o $@ $(LDFLAGS)
 
-.PHONY: document
-document:	afl-fuzz-document
 
 # document all mutations and only do one run (use with only one input file!)
-afl-fuzz-document: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-performance.o | test_x86
+document: $(COMM_HDR) include/afl-fuzz.h $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-performance.o | test_x86
 	$(CC) -D_DEBUG=\"1\" -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS) $(CFLAGS_FLTO) $(AFL_FUZZ_FILES) src/afl-common.o src/afl-sharedmem.o src/afl-forkserver.c src/afl-performance.o -o afl-fuzz-document $(PYFLAGS) $(LDFLAGS)
 
 test/unittests/unit_maybe_alloc.o : $(COMM_HDR) include/alloc-inl.h test/unittests/unit_maybe_alloc.c $(AFL_FUZZ_FILES)
@@ -501,17 +405,17 @@ unit_maybe_alloc: test/unittests/unit_maybe_alloc.o
 	./test/unittests/unit_maybe_alloc
 
 test/unittests/unit_hash.o : $(COMM_HDR) include/alloc-inl.h test/unittests/unit_hash.c $(AFL_FUZZ_FILES) src/afl-performance.o
-	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) $(SPECIAL_PERFORMANCE) -c test/unittests/unit_hash.c -o test/unittests/unit_hash.o
+	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -c test/unittests/unit_hash.c -o test/unittests/unit_hash.o
 
 unit_hash: test/unittests/unit_hash.o src/afl-performance.o
-	@$(CC) $(CFLAGS) $(SPECIAL_PERFORMANCE) -Wl,--wrap=exit -Wl,--wrap=printf $^ -o test/unittests/unit_hash $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
+	@$(CC) $(CFLAGS) -Wl,--wrap=exit -Wl,--wrap=printf $^ -o test/unittests/unit_hash $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
 	./test/unittests/unit_hash
 
 test/unittests/unit_rand.o : $(COMM_HDR) include/alloc-inl.h test/unittests/unit_rand.c $(AFL_FUZZ_FILES) src/afl-performance.o
-	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) $(SPECIAL_PERFORMANCE) -c test/unittests/unit_rand.c -o test/unittests/unit_rand.o
+	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -c test/unittests/unit_rand.c -o test/unittests/unit_rand.o
 
 unit_rand: test/unittests/unit_rand.o src/afl-common.o src/afl-performance.o
-	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) $(SPECIAL_PERFORMANCE) -Wl,--wrap=exit -Wl,--wrap=printf $^ -o test/unittests/unit_rand  $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
+	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -Wl,--wrap=exit -Wl,--wrap=printf $^ -o test/unittests/unit_rand  $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
 	./test/unittests/unit_rand
 
 test/unittests/unit_list.o : $(COMM_HDR) include/list.h test/unittests/unit_list.c $(AFL_FUZZ_FILES)
@@ -528,248 +432,129 @@ unit_preallocable: test/unittests/unit_preallocable.o
 	@$(CC) $(CFLAGS) $(ASAN_CFLAGS) -Wl,--wrap=exit -Wl,--wrap=printf test/unittests/unit_preallocable.o -o test/unittests/unit_preallocable $(LDFLAGS) $(ASAN_LDFLAGS) -lcmocka
 	./test/unittests/unit_preallocable
 
-.PHONY: unit_clean
 unit_clean:
 	@rm -f ./test/unittests/unit_preallocable ./test/unittests/unit_list ./test/unittests/unit_maybe_alloc test/unittests/*.o
 
-.PHONY: unit
-ifneq "$(SYS)" "Darwin"
-unit:	unit_maybe_alloc unit_preallocable unit_list unit_clean unit_rand unit_hash
+ifneq "$(shell uname)" "Darwin"
+
+unit: unit_maybe_alloc unit_preallocable unit_list unit_clean unit_rand unit_hash
+
 else
+
 unit:
 	@echo [-] unit tests are skipped on Darwin \(lacks GNU linker feature --wrap\)
+
 endif
 
-.PHONY: code-format
 code-format:
 	./.custom-format.py -i src/*.c
 	./.custom-format.py -i include/*.h
-	./.custom-format.py -i instrumentation/*.h
-	./.custom-format.py -i instrumentation/*.cc
-	./.custom-format.py -i instrumentation/*.c
-	./.custom-format.py -i *.h
-	./.custom-format.py -i *.c
-	@#./.custom-format.py -i custom_mutators/*/*.c* # destroys libfuzzer :-(
-	@#./.custom-format.py -i custom_mutators/*/*.h # destroys honggfuzz :-(
-	./.custom-format.py -i utils/*/*.c*
-	./.custom-format.py -i utils/*/*.h
+	./.custom-format.py -i libdislocator/*.c
+	./.custom-format.py -i libtokencap/*.c
+	./.custom-format.py -i llvm_mode/*.c
+	./.custom-format.py -i llvm_mode/*.h
+	./.custom-format.py -i llvm_mode/*.cc
+	./.custom-format.py -i gcc_plugin/*.c
+	#./.custom-format.py -i gcc_plugin/*.h
+	./.custom-format.py -i gcc_plugin/*.cc
+	./.custom-format.py -i custom_mutators/*/*.c
+	./.custom-format.py -i custom_mutators/*/*.h
+	./.custom-format.py -i examples/*/*.c
+	./.custom-format.py -i examples/*/*.h
 	./.custom-format.py -i test/*.c
-	./.custom-format.py -i frida_mode/src/*.c
-	./.custom-format.py -i frida_mode/include/*.h
-	-./.custom-format.py -i frida_mode/src/*/*.c
+	./.custom-format.py -i qemu_mode/patches/*.h
 	./.custom-format.py -i qemu_mode/libcompcov/*.c
 	./.custom-format.py -i qemu_mode/libcompcov/*.cc
 	./.custom-format.py -i qemu_mode/libcompcov/*.h
-	./.custom-format.py -i qemu_mode/libqasan/*.c
-	./.custom-format.py -i qemu_mode/libqasan/*.h
+	./.custom-format.py -i qbdi_mode/*.c
+	./.custom-format.py -i qbdi_mode/*.cpp
+	./.custom-format.py -i *.h
+	./.custom-format.py -i *.c
 
 
-.PHONY: test_build
 ifndef AFL_NO_X86
-test_build: afl-cc afl-gcc afl-as afl-showmap
-	@echo "[*] Testing the CC wrapper afl-cc and its instrumentation output..."
-	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_LSAN AFL_USE_ASAN AFL_USE_MSAN; ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-cc test-instr.c $(LDFLAGS) -o test-instr 2>&1 || (echo "Oops, afl-cc failed"; exit 1 )
-	-ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -q -m none -o .test-instr0 ./test-instr < /dev/null
-	-echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
+
+test_build: afl-gcc afl-as afl-showmap
+	@echo "[*] Testing the CC wrapper and instrumentation output..."
+	@unset AFL_USE_ASAN AFL_USE_MSAN AFL_CC; AFL_DEBUG=1 AFL_INST_RATIO=100 AFL_PATH=. ./$(TEST_CC) $(CFLAGS) test-instr.c -o test-instr $(LDFLAGS) 2>&1 | grep 'afl-as' >/dev/null || (echo "Oops, afl-as did not get called from "$(TEST_CC)". This is normally achieved by "$(CC)" honoring the -B option."; exit 1 )
+	ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr0 ./test-instr < /dev/null
+	echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
 	@rm -f test-instr
-	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation of afl-cc does not seem to be behaving correctly!"; echo; echo "Please post to https://github.com/AFLplusplus/AFLplusplus/issues to troubleshoot the issue."; echo; exit 1; fi
-	@echo
-	@echo "[+] All right, the instrumentation of afl-cc seems to be working!"
-#	@echo "[*] Testing the CC wrapper afl-gcc and its instrumentation output..."
-#	@unset AFL_MAP_SIZE AFL_USE_UBSAN AFL_USE_CFISAN AFL_USE_LSAN AFL_USE_ASAN AFL_USE_MSAN; AFL_CC=$(CC) ASAN_OPTIONS=detect_leaks=0 AFL_INST_RATIO=100 AFL_PATH=. ./afl-gcc test-instr.c -o test-instr 2>&1 || (echo "Oops, afl-gcc failed"; exit 1 )
-#	ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr0 ./test-instr < /dev/null
-#	echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
-#	@rm -f test-instr
-#	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation of afl-gcc does not seem to be behaving correctly!"; \
-#		gcc -v 2>&1 | grep -q -- --with-as= && ( echo; echo "Gcc is configured not to use an external assembler with the -B option." ) || \
-#		( echo; echo "Please post to https://github.com/AFLplusplus/AFLplusplus/issues to troubleshoot the issue." ); echo; exit 0; fi
-#	@echo
-#	@echo "[+] All right, the instrumentation of afl-gcc seems to be working!"
+	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation does not seem to be behaving correctly!"; echo; echo "Please post to https://github.com/AFLplusplus/AFLplusplus/issues to troubleshoot the issue."; echo; exit 1; fi
+	@echo "[+] All right, the instrumentation seems to be working!"
+
 else
-test_build: afl-cc afl-as afl-showmap
+
+test_build: afl-gcc afl-as afl-showmap
 	@echo "[!] Note: skipping build tests (you may need to use LLVM or QEMU mode)."
+
 endif
 
-.PHONY: all_done
+
 all_done: test_build
-	@test -e afl-cc && echo "[+] Main compiler 'afl-cc' successfully built!" || { echo "[-] Main compiler 'afl-cc' failed to build, set up a working build environment first!" ; exit 1 ; }
-	@test -e cmplog-instructions-pass.so && echo "[+] LLVM mode for 'afl-cc' successfully built!" || echo "[-] LLVM mode for 'afl-cc'  failed to build, likely you either don't have llvm installed, or you need to set LLVM_CONFIG, to point to e.g. llvm-config-11. See instrumentation/README.llvm.md how to do this. Highly recommended!"
-	@test -e SanitizerCoverageLTO.so && echo "[+] LLVM LTO mode for 'afl-cc' successfully built!" || echo "[-] LLVM LTO mode for 'afl-cc'  failed to build, this would need LLVM 11+, see instrumentation/README.lto.md how to build it"
-	@test -e afl-gcc-pass.so && echo "[+] gcc_plugin for 'afl-cc' successfully built!" || echo "[-] gcc_plugin for 'afl-cc'  failed to build, unless you really need it that is fine - or read instrumentation/README.gcc_plugin.md how to build it"
+	@if [ ! "`type clang 2>/dev/null`" = "" ]; then echo "[+] LLVM users: see llvm_mode/README.md for a faster alternative to afl-gcc."; fi
 	@echo "[+] All done! Be sure to review the README.md - it's pretty short and useful."
-	@if [ "$(SYS)" = "Darwin" ]; then printf "\nWARNING: Fuzzing on MacOS X is slow because of the unusually high overhead of\nfork() on this OS. Consider using Linux or *BSD for fuzzing software not\nspecifically for MacOS.\n\n"; fi
+	@if [ "`uname`" = "Darwin" ]; then printf "\nWARNING: Fuzzing on MacOS X is slow because of the unusually high overhead of\nfork() on this OS. Consider using Linux or *BSD. You can also use VirtualBox\n(virtualbox.org) to put AFL inside a Linux or *BSD VM.\n\n"; fi
 	@! tty <&1 >/dev/null || printf "\033[0;30mNOTE: If you can read this, your terminal probably uses white background.\nThis will make the UI hard to read. See docs/status_screen.md for advice.\033[0m\n" 2>/dev/null
 
 .NOTPARALLEL: clean all
 
-.PHONY: clean
 clean:
-	rm -rf $(PROGS) afl-fuzz-document afl-as as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump .test .test1 .test2 test-instr .test-instr0 .test-instr1 afl-cs-proxy afl-qemu-trace afl-gcc-fast afl-g++-fast ld *.so *.8 test/unittests/*.o test/unittests/unit_maybe_alloc test/unittests/preallocable .afl-* afl-gcc afl-g++ afl-clang afl-clang++ test/unittests/unit_hash test/unittests/unit_rand *.dSYM lib*.a
-	-$(MAKE) -f GNUmakefile.llvm clean
-	-$(MAKE) -f GNUmakefile.gcc_plugin clean
-	-$(MAKE) -C utils/libdislocator clean
-	-$(MAKE) -C utils/libtokencap clean
-	-$(MAKE) -C utils/aflpp_driver clean
-	-$(MAKE) -C utils/afl_network_proxy clean
-	-$(MAKE) -C utils/socket_fuzzing clean
-	-$(MAKE) -C utils/argv_fuzzing clean
-	-$(MAKE) -C utils/plot_ui clean
-	-$(MAKE) -C qemu_mode/unsigaction clean
-	-$(MAKE) -C qemu_mode/fastexit clean
-	-$(MAKE) -C qemu_mode/libcompcov clean
-	-$(MAKE) -C qemu_mode/libqasan clean
-	-$(MAKE) -C frida_mode clean
-	rm -rf nyx_mode/packer/linux_initramfs/init.cpio.gz nyx_mode/libnyx/libnyx/target/release/* nyx_mode/QEMU-Nyx/x86_64-softmmu/qemu-system-x86_64
+	rm -f $(PROGS) libradamsa.so afl-fuzz-document afl-as as afl-g++ afl-clang afl-clang++ *.o src/*.o *~ a.out core core.[1-9][0-9]* *.stackdump .test .test1 .test2 test-instr .test-instr0 .test-instr1 afl-qemu-trace afl-gcc-fast afl-gcc-pass.so afl-gcc-rt.o afl-g++-fast ld *.so *.8 test/unittests/*.o test/unittests/unit_maybe_alloc test/unittests/preallocable .afl-*
+	rm -rf out_dir qemu_mode/qemu-3.1.1 *.dSYM */*.dSYM
+	-$(MAKE) -C llvm_mode clean
+	-$(MAKE) -C gcc_plugin clean
+	$(MAKE) -C libdislocator clean
+	$(MAKE) -C libtokencap clean
+	$(MAKE) -C examples/afl_network_proxy clean
+	$(MAKE) -C examples/socket_fuzzing clean
+	$(MAKE) -C examples/argv_fuzzing clean
+	$(MAKE) -C qemu_mode/unsigaction clean
+	$(MAKE) -C qemu_mode/libcompcov clean
+	rm -rf qemu_mode/qemu-3.1.1
 ifeq "$(IN_REPO)" "1"
-	-test -e coresight_mode/coresight-trace/Makefile && $(MAKE) -C coresight_mode/coresight-trace clean || true
-	-test -e qemu_mode/qemuafl/Makefile && $(MAKE) -C qemu_mode/qemuafl clean || true
-	-test -e unicorn_mode/unicornafl/Makefile && $(MAKE) -C unicorn_mode/unicornafl clean || true
-	-test -e nyx_mode/QEMU-Nyx/Makefile && $(MAKE) -C nyx_mode/QEMU-Nyx clean || true
+	test -d unicorn_mode/unicornafl && $(MAKE) -C unicorn_mode/unicornafl clean || true
 else
-	rm -rf coresight_mode/coresight_trace
-	rm -rf qemu_mode/qemuafl
+	rm -rf qemu_mode/qemu-3.1.1.tar.xz
 	rm -rf unicorn_mode/unicornafl
 endif
 
-.PHONY: deepclean
 deepclean:	clean
-	rm -rf coresight_mode/coresight-trace
+	rm -rf qemu_mode/qemu-3.1.1.tar.xz
 	rm -rf unicorn_mode/unicornafl
-	rm -rf qemu_mode/qemuafl
-	rm -rf nyx_mode/libnyx nyx_mode/packer nyx_mode/QEMU-Nyx
-ifeq "$(IN_REPO)" "1"
-	git checkout coresight_mode/coresight-trace
-	git checkout unicorn_mode/unicornafl
-	git checkout qemu_mode/qemuafl
-	git checkout nyx_mode/libnyx
-	git checkout nyx_mode/packer
-	git checkout nyx_mode/QEMU-Nyx
-endif
+	git reset --hard >/dev/null 2>&1 || true
 
-.PHONY: distrib
 distrib: all
-	-$(MAKE) -j$(nproc) -f GNUmakefile.llvm
-ifneq "$(SYS)" "Darwin"
-	-$(MAKE) -f GNUmakefile.gcc_plugin
-	-$(MAKE) -C utils/libdislocator
-	-$(MAKE) -C utils/libtokencap
-endif
-	-$(MAKE) -C utils/afl_network_proxy
-	-$(MAKE) -C utils/socket_fuzzing
-	-$(MAKE) -C utils/argv_fuzzing
-	# -$(MAKE) -C utils/plot_ui
-	-$(MAKE) -C frida_mode
-ifneq "$(SYS)" "Darwin"
-ifeq "$(ARCH)" "aarch64"
-  ifndef NO_CORESIGHT
-	-$(MAKE) -C coresight_mode
-  endif
-endif
-ifeq "$(SYS)" "Linux"
-ifndef NO_NYX
-	-cd nyx_mode && ./build_nyx_support.sh
-endif
-endif
+	-$(MAKE) -C llvm_mode
+	-$(MAKE) -C gcc_plugin
+	$(MAKE) -C libdislocator
+	$(MAKE) -C libtokencap
+	$(MAKE) -C examples/afl_network_proxy
+	$(MAKE) -C examples/socket_fuzzing
+	$(MAKE) -C examples/argv_fuzzing
 	-cd qemu_mode && sh ./build_qemu_support.sh
-  ifeq "$(ARCH)" "aarch64"
-    ifndef NO_UNICORN_ARM64
-	-cd unicorn_mode && unset CFLAGS && sh ./build_unicorn_support.sh
-    endif
-  else
-	-cd unicorn_mode && unset CFLAGS && sh ./build_unicorn_support.sh
-  endif
-endif
+	cd unicorn_mode && unset CFLAGS && sh ./build_unicorn_support.sh
 
-.PHONY: binary-only
-binary-only: test_shm test_python ready $(PROGS)
-ifneq "$(SYS)" "Darwin"
-	-$(MAKE) -C utils/libdislocator
-	-$(MAKE) -C utils/libtokencap
-endif
-	-$(MAKE) -C utils/afl_network_proxy
-	-$(MAKE) -C utils/socket_fuzzing
-	-$(MAKE) -C utils/argv_fuzzing
-	# -$(MAKE) -C utils/plot_ui
-	-$(MAKE) -C frida_mode
-ifneq "$(SYS)" "Darwin"
-ifeq "$(ARCH)" "aarch64"
-  ifndef NO_CORESIGHT
-	-$(MAKE) -C coresight_mode
-  endif
-endif
-ifeq "$(SYS)" "Linux"
-ifndef NO_NYX
-	-cd nyx_mode && ./build_nyx_support.sh
-endif
-endif
+binary-only: all
+	$(MAKE) -C libdislocator
+	$(MAKE) -C libtokencap
+	$(MAKE) -C examples/afl_network_proxy
+	$(MAKE) -C examples/socket_fuzzing
+	$(MAKE) -C examples/argv_fuzzing
 	-cd qemu_mode && sh ./build_qemu_support.sh
-  ifeq "$(ARCH)" "aarch64"
-    ifndef NO_UNICORN_ARM64
-	-cd unicorn_mode && unset CFLAGS && sh ./build_unicorn_support.sh
-    endif
-  else
-	-cd unicorn_mode && unset CFLAGS && sh ./build_unicorn_support.sh
-  endif
-endif
-	@echo
-	@echo
-	@echo Build Summary:
-	@test -e afl-fuzz && echo "[+] afl-fuzz and supporting tools successfully built" || echo "[-] afl-fuzz could not be built, please set CC to a working compiler"
-ifneq "$(SYS)" "Darwin"
-ifeq "$(ARCH)" "aarch64"
-  ifndef NO_CORESIGHT
-	@test -e afl-cs-proxy && echo "[+] coresight_mode successfully built" || echo "[-] coresight_mode could not be built, it is optional and experimental, see coresight_mode/README.md for what is needed"
-  endif
-endif
-ifeq "$(SYS)" "Linux"
-ifndef NO_NYX
-	@test -e libnyx.so && echo "[+] nyx_mode successfully built" || echo "[-] nyx_mode could not be built, it is optional, see nyx_mode/README.md for what is needed"
-endif
-endif
-	@test -e afl-qemu-trace && echo "[+] qemu_mode successfully built" || echo "[-] qemu_mode could not be built, see docs/INSTALL.md for what is needed"
-  ifeq "$(ARCH)" "aarch64"
-    ifndef NO_UNICORN_ARM64
-	@test -e unicorn_mode/unicornafl/build_python/libunicornafl.so && echo "[+] unicorn_mode successfully built" || echo "[-] unicorn_mode could not be built, it is optional, see unicorn_mode/README.md for what is needed"
-    endif
-  else
-	@test -e unicorn_mode/unicornafl/build_python/libunicornafl.so && echo "[+] unicorn_mode successfully built" || echo "[-] unicorn_mode could not be built, it is optional, see unicorn_mode/README.md for what is needed"
-  endif
-endif
-	@echo
+	cd unicorn_mode && unset CFLAGS && sh ./build_unicorn_support.sh
 
-.PHONY: source-only
 source-only: all
-	-$(MAKE) -j$(nproc) -f GNUmakefile.llvm
-ifneq "$(SYS)" "Darwin"
-	-$(MAKE) -f GNUmakefile.gcc_plugin
-	-$(MAKE) -C utils/libdislocator
-	-$(MAKE) -C utils/libtokencap
-endif
-	# -$(MAKE) -C utils/plot_ui
-ifeq "$(SYS)" "Linux"
-ifndef NO_NYX
-	-cd nyx_mode && ./build_nyx_support.sh
-endif
-endif
-	@echo
-	@echo
-	@echo Build Summary:
-	@test -e afl-fuzz && echo "[+] afl-fuzz and supporting tools successfully built" || echo "[-] afl-fuzz could not be built, please set CC to a working compiler"
-	@test -e afl-llvm-pass.so && echo "[+] LLVM basic mode successfully built" || echo "[-] LLVM mode could not be built, please install at least llvm-11 and clang-11 or newer, see docs/INSTALL.md"
-	@test -e SanitizerCoveragePCGUARD.so && echo "[+] LLVM mode successfully built" || echo "[-] LLVM mode could not be built, please install at least llvm-13 and clang-13 or newer, see docs/INSTALL.md"
-	@test -e SanitizerCoverageLTO.so && echo "[+] LLVM LTO mode successfully built" || echo "[-] LLVM LTO mode could not be built, it is optional, if you want it, please install LLVM 11-14. More information at instrumentation/README.lto.md on how to build it"
-ifneq "$(SYS)" "Darwin"
-	@test -e afl-gcc-pass.so && echo "[+] gcc_mode successfully built" || echo "[-] gcc_mode could not be built, it is optional, install gcc-VERSION-plugin-dev to enable this"
-endif
-ifeq "$(SYS)" "Linux"
-ifndef NO_NYX
-	@test -e libnyx.so && echo "[+] nyx_mode successfully built" || echo "[-] nyx_mode could not be built, it is optional, see nyx_mode/README.md for what is needed"
-endif
-endif
-	@echo
+	-$(MAKE) -C llvm_mode
+	-$(MAKE) -C gcc_plugin
+	$(MAKE) -C libdislocator
+	$(MAKE) -C libtokencap
+	#$(MAKE) -C examples/afl_network_proxy
+	#$(MAKE) -C examples/socket_fuzzing
+	#$(MAKE) -C examples/argv_fuzzing
 
 %.8:	%
-	@echo .TH $* 8 $(BUILD_DATE) "AFL++" > $@
+	@echo .TH $* 8 $(BUILD_DATE) "afl++" > $@
 	@echo .SH NAME >> $@
 	@echo .B $* >> $@
 	@echo >> $@
@@ -781,60 +566,36 @@ endif
 	@./$* -hh 2>&1 | tail -n +4 >> $@
 	@echo >> $@
 	@echo .SH AUTHOR >> $@
-	@echo "AFL++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko \"hexcoder-\" Eissfeldt <heiko.eissfeldt@hexco.de>" >> $@
-	@echo  The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus >> $@
+	@echo "afl++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <mh@mh-sec.de>, Heiko \"hexcoder-\" Eissfeldt <heiko.eissfeldt@hexco.de>, Andrea Fioraldi <andreafioraldi@gmail.com> and Dominik Maier <domenukk@gmail.com>" >> $@
+	@echo  The homepage of afl++ is: https://github.com/AFLplusplus/AFLplusplus >> $@
 	@echo >> $@
 	@echo .SH LICENSE >> $@
 	@echo Apache License Version 2.0, January 2004 >> $@
 
-.PHONY: install
 install: all $(MANPAGES)
-	@install -d -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(HELPER_PATH) $${DESTDIR}$(DOC_PATH) $${DESTDIR}$(MISC_PATH)
-	@rm -f $${DESTDIR}$(BIN_PATH)/afl-plot.sh
-	@rm -f $${DESTDIR}$(BIN_PATH)/afl-as
-	@rm -f $${DESTDIR}$(HELPER_PATH)/afl-llvm-rt.o $${DESTDIR}$(HELPER_PATH)/afl-llvm-rt-32.o $${DESTDIR}$(HELPER_PATH)/afl-llvm-rt-64.o $${DESTDIR}$(HELPER_PATH)/afl-gcc-rt.o
-	@for i in afl-llvm-dict2file.so afl-llvm-lto-instrumentlist.so afl-llvm-pass.so cmplog-instructions-pass.so cmplog-routines-pass.so cmplog-switches-pass.so compare-transform-pass.so libcompcov.so libdislocator.so libnyx.so libqasan.so libtokencap.so SanitizerCoverageLTO.so SanitizerCoveragePCGUARD.so split-compares-pass.so split-switches-pass.so injection-pass.so; do echo rm -fv $${DESTDIR}$(HELPER_PATH)/$${i}; done
+	install -d -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(HELPER_PATH) $${DESTDIR}$(DOC_PATH) $${DESTDIR}$(MISC_PATH)
+	rm -f $${DESTDIR}$(BIN_PATH)/afl-plot.sh
 	install -m 755 $(PROGS) $(SH_PROGS) $${DESTDIR}$(BIN_PATH)
-	@if [ -f afl-qemu-trace ]; then install -m 755 afl-qemu-trace $${DESTDIR}$(BIN_PATH); fi
-	@if [ -f utils/plot_ui/afl-plot-ui ]; then install -m 755 utils/plot_ui/afl-plot-ui $${DESTDIR}$(BIN_PATH); fi
-	@if [ -f libdislocator.so ]; then set -e; install -m 755 libdislocator.so $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f libtokencap.so ]; then set -e; install -m 755 libtokencap.so $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f libcompcov.so ]; then set -e; install -m 755 libcompcov.so $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f libqasan.so ]; then set -e; install -m 755 libqasan.so $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f afl-fuzz-document ]; then set -e; install -m 755 afl-fuzz-document $${DESTDIR}$(BIN_PATH); fi
-	@if [ -f socketfuzz32.so -o -f socketfuzz64.so ]; then $(MAKE) -C utils/socket_fuzzing install; fi
-	@if [ -f argvfuzz32.so -o -f argvfuzz64.so ]; then $(MAKE) -C utils/argv_fuzzing install; fi
-	@if [ -f afl-frida-trace.so ]; then install -m 755 afl-frida-trace.so $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f libnyx.so ]; then install -m 755 libnyx.so $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f utils/afl_network_proxy/afl-network-server ]; then $(MAKE) -C utils/afl_network_proxy install; fi
-	@if [ -f utils/aflpp_driver/libAFLDriver.a ]; then set -e; install -m 644 utils/aflpp_driver/libAFLDriver.a $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f utils/aflpp_driver/libAFLQemuDriver.a ]; then set -e; install -m 644 utils/aflpp_driver/libAFLQemuDriver.a $${DESTDIR}$(HELPER_PATH); fi
-	-$(MAKE) -f GNUmakefile.llvm install
-ifneq "$(SYS)" "Darwin"
-	-$(MAKE) -f GNUmakefile.gcc_plugin install
-endif
-	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-gcc
-	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-g++
-	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang
-	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang++
-	@mkdir -m 0755 -p ${DESTDIR}$(MAN_PATH)
+	rm -f $${DESTDIR}$(BIN_PATH)/afl-as
+	if [ -f afl-qemu-trace ]; then install -m 755 afl-qemu-trace $${DESTDIR}$(BIN_PATH); fi
+	if [ -f afl-gcc-fast ]; then set e; install -m 755 afl-gcc-fast $${DESTDIR}$(BIN_PATH); ln -sf afl-gcc-fast $${DESTDIR}$(BIN_PATH)/afl-g++-fast; install -m 755 afl-gcc-pass.so afl-gcc-rt.o $${DESTDIR}$(HELPER_PATH); fi
+	if [ -f afl-clang-fast ]; then $(MAKE) -C llvm_mode install; fi
+	if [ -f libdislocator.so ]; then set -e; install -m 755 libdislocator.so $${DESTDIR}$(HELPER_PATH); fi
+	if [ -f libtokencap.so ]; then set -e; install -m 755 libtokencap.so $${DESTDIR}$(HELPER_PATH); fi
+	if [ -f libcompcov.so ]; then set -e; install -m 755 libcompcov.so $${DESTDIR}$(HELPER_PATH); fi
+	if [ -f afl-fuzz-document ]; then set -e; install -m 755 afl-fuzz-document $${DESTDIR}$(BIN_PATH); fi
+	if [ -f socketfuzz32.so -o -f socketfuzz64.so ]; then $(MAKE) -C examples/socket_fuzzing install; fi
+	if [ -f argvfuzz32.so -o -f argvfuzz64.so ]; then $(MAKE) -C examples/argv_fuzzing install; fi
+	if [ -f examples/afl_network_proxy/afl-network-server ]; then $(MAKE) -C examples/afl_network_proxy install; fi
+
+	set -e; ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-g++
+	set -e; if [ -f afl-clang-fast ] ; then ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf afl-clang-fast $${DESTDIR}$(BIN_PATH)/afl-clang++ ; else ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/afl-clang++; fi
+
+	mkdir -m 0755 -p ${DESTDIR}$(MAN_PATH)
 	install -m0644 *.8 ${DESTDIR}$(MAN_PATH)
+
 	install -m 755 afl-as $${DESTDIR}$(HELPER_PATH)
 	ln -sf afl-as $${DESTDIR}$(HELPER_PATH)/as
 	install -m 644 docs/*.md $${DESTDIR}$(DOC_PATH)
 	cp -r testcases/ $${DESTDIR}$(MISC_PATH)
 	cp -r dictionaries/ $${DESTDIR}$(MISC_PATH)
-	cp injections.dic $${DESTDIR}$(MISC_PATH)
-
-.PHONY: uninstall
-uninstall:
-	-cd $${DESTDIR}$(BIN_PATH) && rm -f $(PROGS) $(SH_PROGS) afl-cs-proxy afl-qemu-trace afl-plot-ui afl-fuzz-document afl-network-client afl-network-server afl-g* afl-plot.sh afl-as afl-ld-lto afl-c* afl-lto*
-	-cd $${DESTDIR}$(HELPER_PATH) && rm -f afl-g*.*o afl-llvm-*.*o afl-compiler-*.*o libdislocator.so libtokencap.so libcompcov.so libqasan.so afl-frida-trace.so libnyx.so socketfuzz*.so argvfuzz*.so libAFLDriver.a libAFLQemuDriver.a as afl-as SanitizerCoverage*.so compare-transform-pass.so cmplog-*-pass.so split-*-pass.so dynamic_list.txt injections.dic
-	-rm -rf $${DESTDIR}$(MISC_PATH)/testcases $${DESTDIR}$(MISC_PATH)/dictionaries
-	-sh -c "ls docs/*.md | sed 's|^docs/|$${DESTDIR}$(DOC_PATH)/|' | xargs rm -f"
-	-cd $${DESTDIR}$(MAN_PATH) && rm -f $(MANPAGES)
-	-rmdir $${DESTDIR}$(BIN_PATH) 2>/dev/null
-	-rmdir $${DESTDIR}$(HELPER_PATH) 2>/dev/null
-	-rmdir $${DESTDIR}$(MISC_PATH) 2>/dev/null
-	-rmdir $${DESTDIR}$(DOC_PATH) 2>/dev/null
-	-rmdir $${DESTDIR}$(MAN_PATH) 2>/dev/null

GNUmakefile.gcc_plugin

@@ -1,212 +0,0 @@
-#
-# american fuzzy lop++ - GCC plugin instrumentation
-# -----------------------------------------------
-#
-# Written by Austin Seipp <aseipp@pobox.com> and
-#            Laszlo Szekeres <lszekeres@google.com> and
-#            Michal Zalewski and
-#            Heiko Eißfeldt  <heiko@hexco.de>
-#
-# GCC integration design is based on the LLVM design, which comes
-# from Laszlo Szekeres.
-#
-# Copyright 2015 Google Inc. All rights reserved.
-# Copyright 2019-2024 AFLplusplus Project. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   https://www.apache.org/licenses/LICENSE-2.0
-#
-#TEST_MMAP=1
-PREFIX      ?= /usr/local
-HELPER_PATH ?= $(PREFIX)/lib/afl
-BIN_PATH    ?= $(PREFIX)/bin
-DOC_PATH    ?= $(PREFIX)/share/doc/afl
-MAN_PATH    ?= $(PREFIX)/share/man/man8
-
-VERSION     = $(shell grep '^$(HASH)define VERSION ' ./config.h | cut -d '"' -f2)
-
-CFLAGS          ?= -O3 -g -funroll-loops
-# -D_FORTIFY_SOURCE=1
-CFLAGS_SAFE     := -Wall -Iinclude -Wno-pointer-sign \
-                   -DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \
-                   -DGCC_VERSION=\"$(GCCVER)\" -DGCC_BINDIR=\"$(GCCBINDIR)\" \
-                   -Wno-unused-function
-override CFLAGS += $(CFLAGS_SAFE)
-
-CXXFLAGS    ?= -O3 -g -funroll-loops
-# -D_FORTIFY_SOURCE=1
-CXXEFLAGS   := $(CXXFLAGS) $(CPPFLAGS) -Wall -std=c++11
-
-CC          ?= gcc
-CXX         ?= g++
-
-SYS = $(shell uname -s)
-
-ifeq "clang" "$(CC)"
-        CC  = gcc
-        CXX = g++
-endif
-
-ifeq "clang++" "$(CXX)"
-        CC  = gcc
-        CXX = g++
-endif
-
-ifeq "$(findstring Foundation,$(shell $(CC) --version))" ""
-        CC  = gcc
-        CXX = g++
-endif
-
-PLUGIN_BASE = "$(shell $(CC) -print-file-name=plugin)"
-PLUGIN_FLAGS = -fPIC -fno-rtti -fno-exceptions -I$(PLUGIN_BASE)/include -I$(PLUGIN_BASE)
-HASH=\#
-
-GCCVER    = $(shell $(CC) --version 2>/dev/null | awk 'NR == 1 {print $$NF}')
-GCCBINDIR = $(shell dirname `command -v $(CC)` 2>/dev/null )
-
-ifeq "$(shell echo '$(HASH)include <sys/ipc.h>@$(HASH)include <sys/shm.h>@int main() { int _id = shmget(IPC_PRIVATE, 65536, IPC_CREAT | IPC_EXCL | 0600); shmctl(_id, IPC_RMID, 0); return 0;}' | tr @ '\n' | $(CC) -x c - -o .test2 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
-	SHMAT_OK=1
-else
-	SHMAT_OK=0
-	override CFLAGS_SAFE += -DUSEMMAP=1
-endif
-
-ifeq "$(TEST_MMAP)" "1"
-	SHMAT_OK=0
-	override CFLAGS_SAFE += -DUSEMMAP=1
-endif
-
-ifneq "$(SYS)" "Haiku"
-ifneq "$(SYS)" "OpenBSD"
-  	LDFLAGS += -lrt
-endif
-else
-	CFLAGS_SAFE += -DUSEMMAP=1
-endif
-
-ifeq "$(SYS)" "OpenBSD"
-    CC  = egcc
-    CXX = eg++
-    PLUGIN_FLAGS += -I/usr/local/include
-endif
-
-ifeq "$(SYS)" "DragonFly"
-  	PLUGIN_FLAGS += -I/usr/local/include
-endif
-
-ifeq "$(SYS)" "SunOS"
-  	PLUGIN_FLAGS += -I/usr/include/gmp
-endif
-
-
-PASSES       = ./afl-gcc-pass.so ./afl-gcc-cmplog-pass.so ./afl-gcc-cmptrs-pass.so
-
-PROGS        = $(PASSES) ./afl-compiler-rt.o ./afl-compiler-rt-32.o ./afl-compiler-rt-64.o
-
-.PHONY: all
-all: test_shm test_deps $(PROGS) test_build all_done
-
-.PHONY: test_shm
-ifeq "$(SHMAT_OK)" "1"
-test_shm:
-	@echo "[+] shmat seems to be working."
-	@rm -f .test2
-else
-test_shm:
-	@echo "[-] shmat seems not to be working, switching to mmap implementation"
-endif
-
-.PHONY: test_deps
-test_deps:
-	@echo "[*] Checking for working '$(CC)'..."
-	@command -v $(CC) >/dev/null 2>&1 || ( echo "[-] Oops, can't find '$(CC)'. Make sure that it's in your \$$PATH (or set \$$CC and \$$CXX)."; exit 1 )
-#	@echo "[*] Checking for gcc for plugin support..."
-#	@$(CC) -v 2>&1 | grep -q -- --enable-plugin || ( echo "[-] Oops, this gcc has not been configured with plugin support."; exit 1 )
-	@echo "[*] Checking for gcc plugin development header files..."
-	@test -d `$(CC) -print-file-name=plugin`/include || ( echo "[-] Oops, can't find gcc header files. Be sure to install 'gcc-X-plugin-dev'."; exit 1 )
-	@echo "[*] Checking for './afl-showmap'..."
-	@test -f ./afl-showmap || ( echo "[-] Oops, can't find './afl-showmap'. Be sure to compile AFL first."; exit 1 )
-	@echo "[+] All set and ready to build."
-
-afl-common.o: ./src/afl-common.c
-	$(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@ $(LDFLAGS)
-
-./afl-compiler-rt.o: instrumentation/afl-compiler-rt.o.c
-	$(CC) $(CFLAGS_SAFE) $(CPPFLAGS) -O3 -Wno-unused-result -fPIC -c $< -o $@
-
-./afl-compiler-rt-32.o: instrumentation/afl-compiler-rt.o.c
-	@printf "[*] Building 32-bit variant of the runtime (-m32)... "
-	@$(CC) $(CFLAGS_SAFE) $(CPPFLAGS) -O3 -Wno-unused-result -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
-
-./afl-compiler-rt-64.o: instrumentation/afl-compiler-rt.o.c
-	@printf "[*] Building 64-bit variant of the runtime (-m64)... "
-	@$(CC) $(CFLAGS_SAFE) $(CPPFLAGS) -O3 -Wno-unused-result -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
-
-$(PASSES): instrumentation/afl-gcc-common.h
-
-./afl-gcc-pass.so: instrumentation/afl-gcc-pass.so.cc | test_deps
-	$(CXX) $(CXXEFLAGS) $(PLUGIN_FLAGS) -shared $< -o $@
-	ln -sf afl-cc afl-gcc-fast
-	ln -sf afl-cc afl-g++-fast
-	ln -sf afl-cc.8 afl-gcc-fast.8
-	ln -sf afl-cc.8 afl-g++-fast.8
-
-./afl-gcc-cmplog-pass.so: instrumentation/afl-gcc-cmplog-pass.so.cc | test_deps
-	$(CXX) $(CXXEFLAGS) $(PLUGIN_FLAGS) -shared $< -o $@
-
-./afl-gcc-cmptrs-pass.so: instrumentation/afl-gcc-cmptrs-pass.so.cc | test_deps
-	$(CXX) $(CXXEFLAGS) $(PLUGIN_FLAGS) -shared $< -o $@
-
-.PHONY: test_build
-test_build: $(PROGS)
-	@echo "[*] Testing the CC wrapper and instrumentation output..."
-	unset AFL_USE_ASAN AFL_USE_MSAN; ASAN_OPTIONS=detect_leaks=0 AFL_QUIET=1 AFL_INST_RATIO=100 AFL_PATH=. AFL_CC=$(CC) ./afl-gcc-fast $(CFLAGS) $(CPPFLAGS) ./test-instr.c -o test-instr $(LDFLAGS)
-	ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr0 ./test-instr </dev/null
-	echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
-	@rm -f test-instr
-	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation does not seem to be behaving correctly!"; echo; echo "Please post to https://github.com/AFLplusplus/AFLplusplus/issues to troubleshoot the issue."; echo; exit 1; fi
-	@echo "[+] All right, the instrumentation seems to be working!"
-
-.PHONY: all_done
-all_done: test_build
-	@echo "[+] All done! You can now use './afl-gcc-fast' to compile programs."
-
-.NOTPARALLEL: clean
-
-%.8: %
-	@echo .TH $* 8 `date "+%Y-%m-%d"` "AFL++" > ./$@
-	@echo .SH NAME >> ./$@
-	@echo .B $* >> ./$@
-	@echo >> ./$@
-	@echo .SH SYNOPSIS >> ./$@
-	@./$* -h 2>&1 | head -n 3 | tail -n 1 | sed 's/^\.\///' >> ./$@
-	@echo >> ./$@
-	@echo .SH OPTIONS >> ./$@
-	@echo .nf >> ./$@
-	@./$* -h 2>&1 | tail -n +4 >> ./$@
-	@echo >> ./$@
-	@echo .SH AUTHOR >> ./$@
-	@echo "AFL++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko \"hexcoder-\" Eissfeldt <heiko.eissfeldt@hexco.de>" >> ./$@
-	@echo  The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus >> ./$@
-	@echo >> ./$@
-	@echo .SH LICENSE >> ./$@
-	@echo Apache License Version 2.0, January 2004 >> ./$@
-	ln -sf afl-cc.8 ./afl-g++-fast.8
-
-.PHONY: install
-install: all
-	ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-gcc-fast
-	ln -sf afl-c++ $${DESTDIR}$(BIN_PATH)/afl-g++-fast
-	ln -sf afl-compiler-rt.o $${DESTDIR}$(HELPER_PATH)/afl-gcc-rt.o
-	install -m 755 ./afl-gcc-pass.so $${DESTDIR}$(HELPER_PATH)
-	install -m 755 ./afl-gcc-cmplog-pass.so $${DESTDIR}$(HELPER_PATH)
-	install -m 755 ./afl-gcc-cmptrs-pass.so $${DESTDIR}$(HELPER_PATH)
-	install -m 644 -T instrumentation/README.gcc_plugin.md $${DESTDIR}$(DOC_PATH)/README.gcc_plugin.md
-
-.PHONY: clean
-clean:
-	rm -f *.o *.so *~ a.out core core.[1-9][0-9]* test-instr .test-instr0 .test-instr1 .test2
-	rm -f $(PROGS) afl-common.o ./afl-g++-fast ./afl-g*-fast.8 instrumentation/*.o

GNUmakefile.llvm

@@ -1,559 +0,0 @@
-# american fuzzy lop++ - LLVM instrumentation
-# -----------------------------------------
-#
-# Written by Laszlo Szekeres <lszekeres@google.com> and
-#            Michal Zalewski
-#
-# LLVM integration design comes from Laszlo Szekeres.
-#
-# Copyright 2015, 2016 Google Inc. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   https://www.apache.org/licenses/LICENSE-2.0
-#
-
-# For Heiko:
-#TEST_MMAP=1
-HASH=\#
-
-PREFIX      ?= /usr/local
-HELPER_PATH ?= $(PREFIX)/lib/afl
-BIN_PATH    ?= $(PREFIX)/bin
-DOC_PATH    ?= $(PREFIX)/share/doc/afl
-MISC_PATH   ?= $(PREFIX)/share/afl
-MAN_PATH    ?= $(PREFIX)/share/man/man8
-
-BUILD_DATE  ?= $(shell date -u -d "@$(SOURCE_DATE_EPOCH)" "+%Y-%m-%d" 2>/dev/null || date -u -r "$(SOURCE_DATE_EPOCH)" "+%Y-%m-%d" 2>/dev/null || date -u "+%Y-%m-%d")
-
-VERSION     = $(shell grep '^$(HASH)define VERSION ' ./config.h | cut -d '"' -f2)
-
-SYS = $(shell uname -s)
-
-ifeq "$(SYS)" "OpenBSD"
-  LLVM_CONFIG ?= $(BIN_PATH)/llvm-config
-  HAS_OPT = $(shell test -x $(BIN_PATH)/opt && echo 0 || echo 1)
-  ifeq "$(HAS_OPT)" "1"
-    $(warning llvm_mode needs a complete llvm installation (versions 6.0 up to 13) -> e.g. "pkg_add llvm-7.0.1p9")
-  endif
-else
-  LLVM_CONFIG ?= llvm-config
-endif
-
-LLVMVER  = $(shell $(LLVM_CONFIG) --version 2>/dev/null | sed 's/git//' | sed 's/svn//' )
-LLVM_MAJOR = $(shell $(LLVM_CONFIG) --version 2>/dev/null | sed 's/\..*//' )
-LLVM_MINOR = $(shell $(LLVM_CONFIG) --version 2>/dev/null | sed 's/.*\.//' | sed 's/git//' | sed 's/svn//' | sed 's/ .*//' | sed 's/rc.*//' )
-LLVM_UNSUPPORTED = $(shell $(LLVM_CONFIG) --version 2>/dev/null | grep -E -q '^[0-2]\.|^3.[0-8]\.' && echo 1 || echo 0 )
-LLVM_TOO_NEW = $(shell $(LLVM_CONFIG) --version 2>/dev/null | grep -E -q '^19|^2[0-9]' && echo 1 || echo 0 )
-LLVM_TOO_OLD = $(shell $(LLVM_CONFIG) --version 2>/dev/null | grep -E -q '^[1-9]\.|^1[012]\.' && echo 1 || echo 0 )
-LLVM_NEW_API = $(shell $(LLVM_CONFIG) --version 2>/dev/null | grep -E -q '^1[0-9]' && echo 1 || echo 0 )
-LLVM_NEWER_API = $(shell $(LLVM_CONFIG) --version 2>/dev/null | grep -E -q '^1[6-9]' && echo 1 || echo 0 )
-LLVM_13_OK = $(shell $(LLVM_CONFIG) --version 2>/dev/null | grep -E -q '^1[3-9]' && echo 1 || echo 0 )
-LLVM_HAVE_LTO = $(shell $(LLVM_CONFIG) --version 2>/dev/null | grep -E -q '^1[2-9]' && echo 1 || echo 0 )
-LLVM_BINDIR = $(shell $(LLVM_CONFIG) --bindir 2>/dev/null)
-LLVM_LIBDIR = $(shell $(LLVM_CONFIG) --libdir 2>/dev/null)
-LLVM_STDCXX = gnu++11
-LLVM_APPLE_XCODE = $(shell $(CC) -v 2>&1 | grep -q Apple && echo 1 || echo 0)
-LLVM_LTO   = 0
-
-ifeq "$(LLVMVER)" ""
-  $(warning [!] llvm_mode needs llvm-config, which was not found. Set LLVM_CONFIG to its path and retry.)
-endif
-
-ifeq "$(LLVM_UNSUPPORTED)" "1"
-  $(error llvm_mode only supports llvm from version 3.8 onwards)
-endif
-
-ifeq "$(LLVM_TOO_NEW)" "1"
-  $(warning you are using an in-development llvm version - this might break llvm_mode!)
-endif
-
-ifeq "$(LLVM_TOO_OLD)" "1"
-  $(warning you are using an outdated LLVM version! Please use at least LLVM 13 or newer!)
-  $(shell sleep 2)
-endif
-
-# No switching the meaning of LLVM_TOO_OLD
-LLVM_TOO_OLD=1
-
-ifeq "$(LLVM_MAJOR)" "9"
-  $(info [+] llvm_mode detected llvm 9, enabling neverZero implementation)
-  LLVM_TOO_OLD=0
-endif
-
-ifeq "$(LLVM_NEW_API)" "1"
-  $(info [+] llvm_mode detected llvm 10+, enabling neverZero implementation and c++14)
-  LLVM_STDCXX = c++14
-  LLVM_TOO_OLD=0
-endif
-
-ifeq "$(LLVM_NEWER_API)" "1"
-  $(info [+] llvm_mode detected llvm 16+, enabling c++17)
-  LLVM_STDCXX = c++17
-endif
-
-ifeq "$(LLVM_HAVE_LTO)" "1"
-  $(info [+] llvm_mode detected llvm 12+, enabling afl-lto LTO implementation)
-  LLVM_LTO = 1
-endif
-
-ifeq "$(LLVM_LTO)" "0"
-  $(info [+] llvm_mode detected llvm < 12, afl-lto LTO will not be build.)
-endif
-
-ifeq "$(LLVM_APPLE_XCODE)" "1"
-  $(warning llvm_mode will not compile with Xcode clang...)
-endif
-
-# We were using llvm-config --bindir to get the location of clang, but
-# this seems to be busted on some distros, so using the one in $PATH is
-# probably better.
-
-CC         = $(LLVM_BINDIR)/clang
-CXX        = $(LLVM_BINDIR)/clang++
-
-# llvm-config --bindir may not providing a valid path, so ...
-ifeq "$(shell test -e $(CC) || echo 1 )" "1"
-  # however we must ensure that this is not a "CC=gcc make"
-  ifeq "$(shell command -v $(CC) 2> /dev/null)" ""
-    # we do not have a valid CC variable so we try alternatives
-    ifeq "$(shell test -e '$(BIN_DIR)/clang' && echo 1)" "1"
-      # we found one in the local install directory, lets use these
-      CC         = $(BIN_DIR)/clang
-    else
-      # hope for the best
-      $(warning we have trouble finding clang - llvm-config is not helping us)
-      CC         = clang
-    endif
-  endif
-endif
-# llvm-config --bindir may not providing a valid path, so ...
-ifeq "$(shell test -e $(CXX) || echo 1 )" "1"
-  # however we must ensure that this is not a "CXX=g++ make"
-  ifeq "$(shell command -v $(CXX) 2> /dev/null)" ""
-    # we do not have a valid CXX variable so we try alternatives
-    ifeq "$(shell test -e '$(BIN_DIR)/clang++' && echo 1)" "1"
-      # we found one in the local install directory, lets use these
-      CXX        = $(BIN_DIR)/clang++
-    else
-      # hope for the best
-      $(warning we have trouble finding clang++ - llvm-config is not helping us)
-      CXX        = clang++
-    endif
-  endif
-endif
-
-# sanity check.
-# Are versions of clang --version and llvm-config --version equal?
-CLANGVER = $(shell $(CC) --version | sed -E -ne '/^.*version\ (1?[0-9]\.[0-9]\.[0-9]).*/s//\1/p')
-
-# I disable this because it does not make sense with what we did before (marc)
-# We did exactly set these 26 lines above with these values, and it would break
-# "CC=gcc make" etc. usages
-ifeq "$(findstring clang, $(shell $(CC) --version 2>/dev/null))" ""
-  CC_SAVE := $(LLVM_BINDIR)/clang
-else
-  CC_SAVE := $(CC)
-endif
-ifeq "$(findstring clang, $(shell $(CXX) --version 2>/dev/null))" ""
-  CXX_SAVE := $(LLVM_BINDIR)/clang++
-else
-  CXX_SAVE := $(CXX)
-endif
-
-CLANG_BIN := $(CC_SAVE)
-CLANGPP_BIN := $(CXX_SAVE)
-
-ifeq "$(CC_SAVE)" "$(LLVM_BINDIR)/clang"
-  USE_BINDIR = 1
-else
-  ifeq "$(CXX_SAVE)" "$(LLVM_BINDIR)/clang++"
-    USE_BINDIR = 1
-  else
-    USE_BINDIR = 0
-  endif
-endif
-
-# On old platform we cannot compile with clang because std++ libraries are too
-# old. For these we need to use gcc/g++, so if we find REAL_CC and REAL_CXX
-# variable we override the compiler variables here
-ifneq "$(REAL_CC)" ""
-  CC  = $(REAL_CC)
-endif
-ifneq "$(REAL_CXX)" ""
-  CXX = $(REAL_CXX)
-endif
-
-#
-# Now it can happen that CC points to clang - but there is no clang on the
-# system. Then we fall back to cc
-#
-ifeq "$(shell command -v $(CC) 2>/dev/null)" ""
-  CC = cc
-endif
-ifeq "$(shell command -v $(CXX) 2>/dev/null)" ""
-  CXX = c++
-endif
-
-
-# After we set CC/CXX we can start makefile magic tests
-
-#ifeq "$(shell echo 'int main() {return 0; }' | $(CC) -x c - -march=native -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
-#	CFLAGS_OPT = -march=native
-#endif
-
-ifeq "$(shell echo 'int main() {return 0; }' | $(CLANG_BIN) -x c - -flto=full -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
-        AFL_CLANG_FLTO ?= -flto=full
-else
- ifeq "$(shell echo 'int main() {return 0; }' | $(CLANG_BIN) -x c - -flto=thin -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
-        AFL_CLANG_FLTO ?= -flto=thin
- else
-  ifeq "$(shell echo 'int main() {return 0; }' | $(CLANG_BIN) -x c - -flto -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
-        AFL_CLANG_FLTO ?= -flto
-  endif
- endif
-endif
-
-ifeq "$(LLVM_LTO)" "1"
-  ifneq "$(AFL_CLANG_FLTO)" ""
-    ifeq "$(AFL_REAL_LD)" ""
-      ifneq "$(shell readlink $(LLVM_BINDIR)/ld.lld 2>&1)" ""
-        AFL_REAL_LD = $(LLVM_BINDIR)/ld.lld
-      else ifneq "$(shell command -v ld.lld 2>/dev/null)" ""
-        AFL_REAL_LD = $(shell command -v ld.lld)
-        TMP_LDLDD_VERSION = $(shell $(AFL_REAL_LD) --version | awk '{ print $$2 }')
-        ifeq "$(LLVMVER)" "$(TMP_LDLDD_VERSION)"
-          $(warning ld.lld found in a weird location ($(AFL_REAL_LD)), but its the same version as LLVM so we will allow it)
-        else
-          $(warning ld.lld found in a weird location ($(AFL_REAL_LD)) and its of a different version than LLMV ($(TMP_LDLDD_VERSION) vs. $(LLVMVER)) - cannot enable LTO mode)
-          AFL_REAL_LD=
-          LLVM_LTO = 0
-        endif
-        undefine TMP_LDLDD_VERSION
-      else
-        $(warning ld.lld not found, cannot enable LTO mode)
-        LLVM_LTO = 0
-      endif
-    endif
-  else
-    $(warning clang option -flto is not working - maybe LLVMgold.so not found - cannot enable LTO mode)
-    LLVM_LTO = 0
-  endif
-endif
-
-AFL_CLANG_FUSELD=
-ifeq "$(LLVM_LTO)" "1"
-  ifeq "$(shell echo 'int main() {return 0; }' | $(CLANG_BIN) -x c - -fuse-ld=`command -v ld` -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
-    AFL_CLANG_FUSELD=1
-    ifeq "$(shell echo 'int main() {return 0; }' | $(CLANG_BIN) -x c - -fuse-ld=ld.lld --ld-path=$(AFL_REAL_LD) -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
-      AFL_CLANG_LDPATH=1
-    endif
-  else
-    $(warning -fuse-ld is not working, cannot enable LTO mode)
-    LLVM_LTO = 0
-  endif
-endif
-
-ifeq "$(shell echo 'int main() {return 0; }' | $(CLANG_BIN) -x c - -fdebug-prefix-map=$(CURDIR)=llvm_mode -o .test 2>/dev/null && echo 1 || echo 0 ; rm -f .test )" "1"
-        AFL_CLANG_DEBUG_PREFIX = -fdebug-prefix-map="$(CURDIR)=llvm_mode"
-else
-        AFL_CLANG_DEBUG_PREFIX =
-endif
-
-CFLAGS          ?= -O3 -funroll-loops -fPIC
-# -D_FORTIFY_SOURCE=1
-CFLAGS_SAFE     := -Wall -g -Wno-cast-qual -Wno-variadic-macros -Wno-pointer-sign \
-                   -I ./include/ -I ./instrumentation/ \
-                   -DAFL_PATH=\"$(HELPER_PATH)\" -DBIN_PATH=\"$(BIN_PATH)\" \
-                   -DLLVM_BINDIR=\"$(LLVM_BINDIR)\" -DVERSION=\"$(VERSION)\" \
-                   -DLLVM_LIBDIR=\"$(LLVM_LIBDIR)\" -DLLVM_VERSION=\"$(LLVMVER)\" \
-                   -DAFL_CLANG_FLTO=\"$(AFL_CLANG_FLTO)\" -DAFL_REAL_LD=\"$(AFL_REAL_LD)\" \
-                   -DAFL_CLANG_LDPATH=\"$(AFL_CLANG_LDPATH)\" -DAFL_CLANG_FUSELD=\"$(AFL_CLANG_FUSELD)\" \
-                   -DCLANG_BIN=\"$(CLANG_BIN)\" -DCLANGPP_BIN=\"$(CLANGPP_BIN)\" -DUSE_BINDIR=$(USE_BINDIR) \
-                   -Wno-unused-function $(AFL_CLANG_DEBUG_PREFIX)
-ifndef LLVM_DEBUG
-  CFLAGS_SAFE += -Wno-deprecated
-endif
-
-ifdef CODE_COVERAGE
-  override CFLAGS_SAFE += -D__AFL_CODE_COVERAGE=1
-  override LDFLAGS += -ldl
-endif
-
-override CFLAGS += $(CFLAGS_SAFE)
-
-ifdef AFL_TRACE_PC
-  $(info Compile option AFL_TRACE_PC is deprecated, just set AFL_LLVM_INSTRUMENT=PCGUARD to activate when compiling targets )
-endif
-
-CXXFLAGS          ?= -O3 -funroll-loops -fPIC
-# -D_FORTIFY_SOURCE=1
-override CXXFLAGS += -Wall -g -I ./include/ \
-                     -DVERSION=\"$(VERSION)\" -Wno-variadic-macros -Wno-deprecated-copy-with-dtor \
-                     -DLLVM_MINOR=$(LLVM_MINOR) -DLLVM_MAJOR=$(LLVM_MAJOR)
-
-ifneq "$(shell $(LLVM_CONFIG) --includedir) 2> /dev/null" ""
-  CLANG_CFL  = -I$(shell $(LLVM_CONFIG) --includedir)
-endif
-ifneq "$(LLVM_CONFIG)" ""
-  CLANG_CFL += -I$(shell dirname $(LLVM_CONFIG))/../include
-endif
-CLANG_CPPFL  = `$(LLVM_CONFIG) --cxxflags` -fno-rtti -fno-exceptions -fPIC $(CXXFLAGS) $(CPPFLAGS) -Wno-deprecated-declarations
-CLANG_LFL    = `$(LLVM_CONFIG) --ldflags` $(LDFLAGS)
-
-# wasm fuzzing: disable thread-local storage and unset LLVM debug flag
-ifdef WAFL_MODE
-  $(info Compiling libraries for use with WAVM)
-  CLANG_CPPFL += -DNDEBUG -DNO_TLS
-endif
-
-# User teor2345 reports that this is required to make things work on MacOS X.
-ifeq "$(SYS)" "Darwin"
-  CLANG_LFL += -Wl,-flat_namespace -Wl,-undefined,suppress
-  override LLVM_HAVE_LTO := 0
-  override LLVM_LTO := 0
-else
-  CLANG_CPPFL += -Wl,-znodelete
-endif
-
-ifeq "$(SYS)" "OpenBSD"
-  CLANG_LFL += `$(LLVM_CONFIG) --libdir`/libLLVM.so
-  CLANG_CPPFL += -mno-retpoline
-  CFLAGS += -mno-retpoline
-  # Needed for unwind symbols
-  LDFLAGS += -lc++abi -lpthread
-endif
-
-ifeq "$(shell echo '$(HASH)include <sys/ipc.h>@$(HASH)include <sys/shm.h>@int main() { int _id = shmget(IPC_PRIVATE, 65536, IPC_CREAT | IPC_EXCL | 0600); shmctl(_id, IPC_RMID, 0); return 0;}' | tr @ '\n' | $(CC) -x c - -o .test2 2>/dev/null && echo 1 || echo 0 ; rm -f .test2 )" "1"
-        SHMAT_OK=1
-else
-        SHMAT_OK=0
-        CFLAGS_SAFE += -DUSEMMAP=1
-        LDFLAGS += -Wno-deprecated-declarations
-endif
-
-ifeq "$(TEST_MMAP)" "1"
-        SHMAT_OK=0
-        CFLAGS_SAFE += -DUSEMMAP=1
-        LDFLAGS += -Wno-deprecated-declarations
-endif
-
-PROGS_ALWAYS = ./afl-cc ./afl-compiler-rt.o ./afl-compiler-rt-32.o ./afl-compiler-rt-64.o 
-PROGS        = $(PROGS_ALWAYS) ./afl-llvm-pass.so ./SanitizerCoveragePCGUARD.so ./split-compares-pass.so ./split-switches-pass.so ./cmplog-routines-pass.so ./cmplog-instructions-pass.so ./cmplog-switches-pass.so ./afl-llvm-dict2file.so ./compare-transform-pass.so ./afl-ld-lto ./afl-llvm-lto-instrumentlist.so ./SanitizerCoverageLTO.so ./injection-pass.so
-
-# If prerequisites are not given, warn, do not build anything, and exit with code 0
-ifeq "$(LLVMVER)" ""
-  NO_BUILD = 1
-endif
-
-ifneq "$(LLVM_UNSUPPORTED)$(LLVM_APPLE_XCODE)" "00"
-  NO_BUILD = 1
-endif
-
-ifeq "$(NO_BUILD)" "1"
-  TARGETS = test_shm $(PROGS_ALWAYS) afl-cc.8
-else
-  TARGETS = test_shm test_deps $(PROGS) afl-cc.8 test_build all_done
-endif
-
-LLVM_MIN_4_0_1 = $(shell awk 'function tonum(ver, a) {split(ver,a,"."); return a[1]*1000000+a[2]*1000+a[3]} BEGIN { exit tonum(ARGV[1]) >= tonum(ARGV[2]) }' $(LLVMVER) 4.0.1; echo $$?)
-
-.PHONY: all
-all: $(TARGETS)
-
-.PHONY: test_shm
-ifeq "$(SHMAT_OK)" "1"
-test_shm:
-	@echo "[+] shmat seems to be working."
-	@rm -f .test2
-else
-test_shm:
-	@echo "[-] shmat seems not to be working, switching to mmap implementation"
-endif
-
-.PHONY: no_build
-no_build:
-	@printf "%b\\n" "\\033[0;31mPrerequisites are not met, skipping build llvm_mode\\033[0m"
-
-.PHONY: test_deps
-test_deps:
-	@echo "[*] Checking for working 'llvm-config'..."
- ifneq "$(LLVM_APPLE_XCODE)" "1"
-	@type $(LLVM_CONFIG) >/dev/null 2>&1 || ( echo "[-] Oops, can't find 'llvm-config'. Install clang or set \$$LLVM_CONFIG or \$$PATH beforehand."; echo "    (Sometimes, the binary will be named llvm-config-11 or something like that.)"; exit 1 )
- endif
-	@echo "[*] Checking for working '$(CC)'..."
-	@type $(CC) >/dev/null 2>&1 || ( echo "[-] Oops, can't find '$(CC)'. Make sure that it's in your \$$PATH (or set \$$CC and \$$CXX)."; exit 1 )
-	@echo "[*] Checking for matching versions of '$(CC)' and '$(LLVM_CONFIG)'"
-ifneq "$(CLANGVER)" "$(LLVMVER)"
-	@echo "[!] WARNING: we have llvm-config version $(LLVMVER) and a clang version $(CLANGVER)"
-else
-	@echo "[*] We have llvm-config version $(LLVMVER) with a clang version $(CLANGVER), good."
-endif
-	@echo "[*] Checking for './afl-showmap'..."
-	@test -f ./afl-showmap || ( echo "[-] Oops, can't find './afl-showmap'. Be sure to compile AFL first."; exit 1 )
-	@echo "[+] All set and ready to build."
-
-instrumentation/afl-common.o: ./src/afl-common.c
-	$(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@ $(LDFLAGS)
-
-./afl-cc: src/afl-cc.c instrumentation/afl-common.o
-	$(CC) $(CLANG_CFL) $(CFLAGS) $(CPPFLAGS) $< instrumentation/afl-common.o -o $@ -DLLVM_MINOR=$(LLVM_MINOR) -DLLVM_MAJOR=$(LLVM_MAJOR) $(LDFLAGS) -DCFLAGS_OPT=\"$(CFLAGS_OPT)\" -lm
-	@ln -sf afl-cc ./afl-c++
-	@ln -sf afl-cc ./afl-gcc
-	@ln -sf afl-cc ./afl-g++
-	@ln -sf afl-cc ./afl-clang
-	@ln -sf afl-cc ./afl-clang++
-	@ln -sf afl-cc ./afl-clang-fast
-	@ln -sf afl-cc ./afl-clang-fast++
-ifneq "$(AFL_CLANG_FLTO)" ""
-ifeq "$(LLVM_LTO)" "1"
-	@ln -sf afl-cc ./afl-clang-lto
-	@ln -sf afl-cc ./afl-clang-lto++
-	@ln -sf afl-cc ./afl-lto
-	@ln -sf afl-cc ./afl-lto++
-endif
-endif
-
-instrumentation/afl-llvm-common.o: instrumentation/afl-llvm-common.cc instrumentation/afl-llvm-common.h
-	$(CXX) $(CFLAGS) $(CPPFLAGS) `$(LLVM_CONFIG) --cxxflags` -fno-rtti -fPIC -std=$(LLVM_STDCXX) -c $< -o $@ 
-
-./afl-llvm-pass.so: instrumentation/afl-llvm-pass.so.cc instrumentation/afl-llvm-common.o | test_deps
-ifeq "$(LLVM_MIN_4_0_1)" "0"
-	$(info [!] N-gram branch coverage instrumentation is not available for llvm version $(LLVMVER))
-endif
-	$(CXX) $(CLANG_CPPFL) -Wdeprecated -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-
-./SanitizerCoveragePCGUARD.so: instrumentation/SanitizerCoveragePCGUARD.so.cc instrumentation/afl-llvm-common.o | test_deps
-ifeq "$(LLVM_13_OK)" "1"
-	-$(CXX) $(CLANG_CPPFL) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) -Wno-deprecated-copy-dtor -Wdeprecated instrumentation/afl-llvm-common.o
-endif
-
-./afl-llvm-lto-instrumentlist.so: instrumentation/afl-llvm-lto-instrumentlist.so.cc instrumentation/afl-llvm-common.o
-ifeq "$(LLVM_LTO)" "1"
-	$(CXX) $(CLANG_CPPFL) -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-endif
-
-./afl-ld-lto: src/afl-ld-lto.c
-ifeq "$(LLVM_LTO)" "1"
-	$(CC) $(CFLAGS) $(CPPFLAGS) $< -o $@
-endif
-
-./SanitizerCoverageLTO.so: instrumentation/SanitizerCoverageLTO.so.cc instrumentation/afl-llvm-common.o
-ifeq "$(LLVM_LTO)" "1"
-	$(CXX) $(CLANG_CPPFL) -Wno-writable-strings -fno-rtti -fPIC -std=$(LLVM_STDCXX) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-	$(CLANG_BIN) $(CFLAGS_SAFE) $(CPPFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -fPIC -c instrumentation/afl-llvm-rt-lto.o.c -o ./afl-llvm-rt-lto.o
-	@$(CLANG_BIN) $(CFLAGS_SAFE) $(CPPFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -m64 -fPIC -c instrumentation/afl-llvm-rt-lto.o.c -o ./afl-llvm-rt-lto-64.o 2>/dev/null; if [ "$$?" = "0" ]; then : ; fi
-	@$(CLANG_BIN) $(CFLAGS_SAFE) $(CPPFLAGS) -Wno-unused-result -O0 $(AFL_CLANG_FLTO) -m32 -fPIC -c instrumentation/afl-llvm-rt-lto.o.c -o ./afl-llvm-rt-lto-32.o 2>/dev/null; if [ "$$?" = "0" ]; then : ; fi
-endif
-
-# laf
-./split-switches-pass.so:	instrumentation/split-switches-pass.so.cc instrumentation/afl-llvm-common.o | test_deps
-	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-./compare-transform-pass.so:	instrumentation/compare-transform-pass.so.cc instrumentation/afl-llvm-common.o | test_deps
-	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-./split-compares-pass.so:	instrumentation/split-compares-pass.so.cc instrumentation/afl-llvm-common.o | test_deps
-	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-# /laf
-
-./cmplog-routines-pass.so:	instrumentation/cmplog-routines-pass.cc instrumentation/afl-llvm-common.o | test_deps
-	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-
-./cmplog-instructions-pass.so:	instrumentation/cmplog-instructions-pass.cc instrumentation/afl-llvm-common.o | test_deps
-	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-
-./cmplog-switches-pass.so:	instrumentation/cmplog-switches-pass.cc instrumentation/afl-llvm-common.o | test_deps
-	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-
-afl-llvm-dict2file.so:	instrumentation/afl-llvm-dict2file.so.cc instrumentation/afl-llvm-common.o | test_deps
-	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-
-./injection-pass.so:	instrumentation/injection-pass.cc instrumentation/afl-llvm-common.o | test_deps
-	$(CXX) $(CLANG_CPPFL) -shared $< -o $@ $(CLANG_LFL) instrumentation/afl-llvm-common.o
-
-.PHONY: document
-document:
-	$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS_SAFE) $(CPPFLAGS) $(CLANG_CFL) -O3 -Wno-unused-result -fPIC -c instrumentation/afl-compiler-rt.o.c -o ./afl-compiler-rt.o
-	@$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS_SAFE) $(CPPFLAGS) $(CLANG_CFL) -O3 -Wno-unused-result -m32 -fPIC -c instrumentation/afl-compiler-rt.o.c -o ./afl-compiler-rt-32.o 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
-	@$(CLANG_BIN) -D_AFL_DOCUMENT_MUTATIONS $(CFLAGS_SAFE) $(CPPFLAGS) $(CLANG_CFL) -O3 -Wno-unused-result -m64 -fPIC -c instrumentation/afl-compiler-rt.o.c -o ./afl-compiler-rt-64.o 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
-
-./afl-compiler-rt.o: instrumentation/afl-compiler-rt.o.c
-	$(CC) $(CLANG_CFL) $(CFLAGS_SAFE) $(CPPFLAGS) -O3 -Wno-unused-result -fPIC -c $< -o $@
-
-./afl-compiler-rt-32.o: instrumentation/afl-compiler-rt.o.c
-	@printf "[*] Building 32-bit variant of the runtime (-m32)... "
-	@$(CC) $(CLANG_CFL) $(CFLAGS_SAFE) $(CPPFLAGS) -O3 -Wno-unused-result -m32 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
-
-./afl-compiler-rt-64.o: instrumentation/afl-compiler-rt.o.c
-	@printf "[*] Building 64-bit variant of the runtime (-m64)... "
-	@$(CC) $(CLANG_CFL) $(CFLAGS_SAFE) $(CPPFLAGS) -O3 -Wno-unused-result -m64 -fPIC -c $< -o $@ 2>/dev/null; if [ "$$?" = "0" ]; then echo "success!"; else echo "failed (that's fine)"; fi
-
-.PHONY: test_build
-test_build: $(PROGS)
-	@echo "[*] Testing the CC wrapper and instrumentation output..."
-	unset AFL_USE_ASAN AFL_USE_MSAN AFL_INST_RATIO; ASAN_OPTIONS=detect_leaks=0 AFL_QUIET=1 AFL_PATH=. AFL_LLVM_LAF_ALL=1 ./afl-cc $(CFLAGS) $(CPPFLAGS) ./test-instr.c -o test-instr $(LDFLAGS)
-	ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr0 ./test-instr < /dev/null
-	echo 1 | ASAN_OPTIONS=detect_leaks=0 ./afl-showmap -m none -q -o .test-instr1 ./test-instr
-	@rm -f test-instr
-	@cmp -s .test-instr0 .test-instr1; DR="$$?"; rm -f .test-instr0 .test-instr1; if [ "$$DR" = "0" ]; then echo; echo "Oops, the instrumentation does not seem to be behaving correctly!"; echo; echo "Please post to https://github.com/AFLplusplus/AFLplusplus/issues to troubleshoot the issue."; echo; exit 1; fi
-	@echo "[+] All right, the instrumentation seems to be working!"
-
-.PHONY: all_done
-all_done: test_build
-	@echo "[+] All done! You can now use './afl-cc' to compile programs."
-
-.NOTPARALLEL: clean
-
-.PHONY: install
-install: all
-	@install -d -m 755 $${DESTDIR}$(BIN_PATH) $${DESTDIR}$(HELPER_PATH) $${DESTDIR}$(DOC_PATH) $${DESTDIR}$(MISC_PATH)
-	@if [ -f ./afl-cc ]; then set -e; install -m 755 ./afl-cc $${DESTDIR}$(BIN_PATH); ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-c++; fi
-	@rm -f $${DESTDIR}$(HELPER_PATH)/afl-llvm-rt*.o $${DESTDIR}$(HELPER_PATH)/afl-gcc-rt*.o
-	@if [ -f ./afl-compiler-rt.o ]; then set -e; install -m 755 ./afl-compiler-rt.o $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f ./afl-lto ]; then set -e; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-lto; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-lto++; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang-lto; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang-lto++; install -m 755 ./afl-llvm-rt-lto*.o ./afl-llvm-lto-instrumentlist.so $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f ./afl-ld-lto ]; then set -e; install -m 755 ./afl-ld-lto $${DESTDIR}$(BIN_PATH); fi
-	@if [ -f ./afl-compiler-rt-32.o ]; then set -e; install -m 755 ./afl-compiler-rt-32.o $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f ./afl-compiler-rt-64.o ]; then set -e; install -m 755 ./afl-compiler-rt-64.o $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f ./compare-transform-pass.so ]; then set -e; install -m 755 ./*.so $${DESTDIR}$(HELPER_PATH); fi
-	@if [ -f ./compare-transform-pass.so ]; then set -e; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang-fast ; ln -sf ./afl-c++ $${DESTDIR}$(BIN_PATH)/afl-clang-fast++ ; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang ; ln -sf ./afl-c++ $${DESTDIR}$(BIN_PATH)/afl-clang++ ; fi
-	@if [ -f ./SanitizerCoverageLTO.so ]; then set -e; ln -sf afl-cc $${DESTDIR}$(BIN_PATH)/afl-clang-lto ; ln -sf ./afl-c++ $${DESTDIR}$(BIN_PATH)/afl-clang-lto++ ; fi
-	set -e; install -m 644 ./dynamic_list.txt $${DESTDIR}$(HELPER_PATH)
-	install -m 644 instrumentation/README.*.md $${DESTDIR}$(DOC_PATH)/
-
-%.8: %
-	@echo .TH $* 8 $(BUILD_DATE) "AFL++" > ./$@
-	@echo .SH NAME >> ./$@
-	@printf "%s" ".B $* \- " >> ./$@
-	@./$* -h 2>&1 | head -n 1 | sed -e "s/$$(printf '\e')[^m]*m//g" >> ./$@
-	@echo .B $* >> ./$@
-	@echo >> ./$@
-	@echo .SH SYNOPSIS >> ./$@
-	@./$* -h 2>&1 | head -n 3 | tail -n 1 | sed 's/^\.\///' >> ./$@
-	@echo >> ./$@
-	@echo .SH OPTIONS >> ./$@
-	@echo .nf >> ./$@
-	@./$* -h 2>&1 | tail -n +4 >> ./$@
-	@echo >> ./$@
-	@echo .SH AUTHOR >> ./$@
-	@echo "AFL++ was written by Michal \"lcamtuf\" Zalewski and is maintained by Marc \"van Hauser\" Heuse <mh@mh-sec.de>, Dominik Maier <domenukk@gmail.com>, Andrea Fioraldi <andreafioraldi@gmail.com> and Heiko \"hexcoder-\" Eissfeldt <heiko.eissfeldt@hexco.de>" >> ./$@
-	@echo  The homepage of AFL++ is: https://github.com/AFLplusplus/AFLplusplus >> ./$@
-	@echo >> ./$@
-	@echo .SH LICENSE >> ./$@
-	@echo Apache License Version 2.0, January 2004 >> ./$@
-	@ln -sf afl-cc.8 ./afl-c++.8
-	@ln -sf afl-cc.8 ./afl-clang-fast.8
-	@ln -sf afl-cc.8 ./afl-clang-fast++.8
-ifneq "$(AFL_CLANG_FLTO)" ""
-ifeq "$(LLVM_LTO)" "1"
-	@ln -sf afl-cc.8 ./afl-clang-lto.8
-	@ln -sf afl-cc.8 ./afl-clang-lto++.8
-	@ln -sf afl-cc.8 ./afl-lto.8
-	@ln -sf afl-cc.8 ./afl-lto++.8
-endif
-endif
-
-.PHONY: clean
-clean:
-	rm -f *.o *.so *~ a.out core core.[1-9][0-9]* .test2 test-instr .test-instr0 .test-instr1 *.dwo
-	rm -f $(PROGS) afl-common.o ./afl-c++ ./afl-lto ./afl-lto++ ./afl-clang-lto* ./afl-clang-fast* ./afl-clang*.8 ./ld ./afl-ld ./afl-compiler-rt*.o ./afl-llvm-rt*.o instrumentation/*.o

QuickStartGuide.md

@@ -0,0 +1 @@
+docs/QuickStartGuide.md

README.md

@@ -1,260 +1,763 @@
-# American Fuzzy Lop plus plus (AFL++)
+# american fuzzy lop plus plus (afl++)
 
-<img align="right" src="https://raw.githubusercontent.com/AFLplusplus/Website/main/static/aflpp_bg.svg" alt="AFL++ logo" width="250" heigh="250">
+  <img align="right" src="https://raw.githubusercontent.com/andreafioraldi/AFLplusplus-website/master/static/logo_256x256.png" alt="AFL++ Logo">
 
-Release version: [4.21c](https://github.com/AFLplusplus/AFLplusplus/releases)
+  ![Travis State](https://api.travis-ci.com/AFLplusplus/AFLplusplus.svg?branch=stable)
 
-GitHub version: 4.21c
+  Release Version: [2.66c](https://github.com/AFLplusplus/AFLplusplus/releases)
 
-Repository:
-[https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)
+  Github Version: 2.66d
 
-AFL++ is maintained by:
+  includes all necessary/interesting changes from Google's afl 2.56b
 
-* Marc "van Hauser" Heuse <mh@mh-sec.de>
-* Dominik Maier <mail@dmnk.co>
-* Andrea Fioraldi <andreafioraldi@gmail.com>
-* Heiko "hexcoder-" Eissfeldt <heiko.eissfeldt@hexco.de>
-* frida_mode is maintained by @Worksbutnottested
-* Documentation: Jana Aydinbas <jana.aydinbas@gmail.com>
+  Originally developed by Michal "lcamtuf" Zalewski.
 
-Originally developed by Michal "lcamtuf" Zalewski.
+  Repository: [https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)
 
-AFL++ is a superior fork to Google's AFL - more speed, more and better
-mutations, more and better instrumentation, custom module support, etc.
+  afl++ is maintained by:
+    * Marc "van Hauser" Heuse <mh@mh-sec.de>,
+    * Heiko "hexcoder-" Eißfeldt <heiko.eissfeldt@hexco.de>,
+    * Andrea Fioraldi <andreafioraldi@gmail.com> and
+    * Dominik Maier <mail@dmnk.co>.
 
-You are free to copy, modify, and distribute AFL++ with attribution under the
-terms of the Apache-2.0 License. See the [LICENSE](LICENSE) for details.
+  Note that although afl now has a Google afl repository [https://github.com/Google/afl](https://github.com/Google/afl),
+  it is unlikely to receive any notable enhancements: [https://twitter.com/Dor3s/status/1154737061787660288](https://twitter.com/Dor3s/status/1154737061787660288)
 
-## Getting started
+## The enhancements compared to the original stock afl
 
-Here is some information to get you started:
+  Many improvements were made over the official afl release - which did not
+  get any feature improvements since November 2017.
 
-* For an overview of the AFL++ documentation and a very helpful graphical guide,
-  please visit [docs/README.md](docs/README.md).
-* To get you started with tutorials, go to
-  [docs/tutorials.md](docs/tutorials.md).
-* For releases, see the
-  [Releases tab](https://github.com/AFLplusplus/AFLplusplus/releases) and
-  [branches](#branches). The best branches to use are, however, `stable` or
-  `dev` - depending on your risk appetite. Also take a look at the list of
-  [important changes in AFL++](docs/important_changes.md) and the list of
-  [features](docs/features.md).
-* If you want to use AFL++ for your academic work, check the
-  [papers page](https://aflplus.plus/papers/) on the website.
-* To cite our work, look at the [Cite](#cite) section.
-* For comparisons, use the fuzzbench `aflplusplus` setup, or use
-  `afl-clang-fast` with `AFL_LLVM_CMPLOG=1`. You can find the `aflplusplus`
-  default configuration on Google's
-  [fuzzbench](https://github.com/google/fuzzbench/tree/master/fuzzers/aflplusplus).
+  Among other changes afl++ has a more performant llvm_mode, supports
+  llvm up to version 11, QEMU 3.1, more speed and crashfixes for QEMU,
+  better *BSD and Android support and much, much more.
 
-## Building and installing AFL++
+  Additionally the following features and patches have been integrated:
 
-To have AFL++ easily available with everything compiled, pull the image directly
-from the Docker Hub (available for both x86_64 and arm64):
+  * AFLfast's power schedules by Marcel Böhme: [https://github.com/mboehme/aflfast](https://github.com/mboehme/aflfast)
 
+  * The new excellent MOpt mutator: [https://github.com/puppet-meteor/MOpt-AFL](https://github.com/puppet-meteor/MOpt-AFL)
+
+  * InsTrim, a very effective CFG llvm_mode instrumentation implementation for large targets: [https://github.com/csienslab/instrim](https://github.com/csienslab/instrim)
+
+  * C. Holler's afl-fuzz Python mutator module and llvm_mode instrument file support: [https://github.com/choller/afl](https://github.com/choller/afl)
+
+  * Custom mutator by a library (instead of Python) by kyakdan
+
+  * Unicorn mode which allows fuzzing of binaries from completely different platforms (integration provided by domenukk)
+
+  * LAF-Intel or CompCov support for llvm_mode, qemu_mode and unicorn_mode
+
+  * NeverZero patch for afl-gcc, llvm_mode, qemu_mode and unicorn_mode which prevents a wrapping map value to zero, increases coverage
+  
+  * Persistent mode and deferred forkserver for qemu_mode
+  
+  * Win32 PE binary-only fuzzing with QEMU and Wine
+
+  * Radamsa mutator (as a custom mutator).
+
+  * QBDI mode to fuzz android native libraries via QBDI framework
+
+  * The new CmpLog instrumentation for LLVM and QEMU inspired by [Redqueen](https://www.syssec.ruhr-uni-bochum.de/media/emma/veroeffentlichungen/2018/12/17/NDSS19-Redqueen.pdf)
+
+  * LLVM mode Ngram coverage by Adrian Herrera [https://github.com/adrianherrera/afl-ngram-pass](https://github.com/adrianherrera/afl-ngram-pass)
+
+  A more thorough list is available in the [PATCHES](docs/PATCHES.md) file.
+
+  | Feature/Instrumentation | afl-gcc | llvm_mode | gcc_plugin | qemu_mode        | unicorn_mode |
+  | ----------------------- |:-------:|:---------:|:----------:|:----------------:|:------------:|
+  | NeverZero               |    x    |     x(1)  |      (2)   |         x        |       x      |
+  | Persistent mode         |         |     x     |     x      | x86[_64]/arm[64] |       x      |
+  | LAF-Intel / CompCov     |         |     x     |            | x86[_64]/arm[64] | x86[_64]/arm |
+  | CmpLog                  |         |     x     |            | x86[_64]/arm[64] |              |
+  | Instrument file list    |         |     x     |     x      |        (x)(3)    |              |
+  | Non-colliding coverage  |         |     x(4)  |            |        (x)(5)    |              |
+  | InsTrim                 |         |     x     |            |                  |              |
+  | Ngram prev_loc coverage |         |     x(6)  |            |                  |              |
+  | Context coverage        |         |     x     |            |                  |              |
+  | Snapshot LKM support    |         |     x     |            |        (x)(5)    |              |
+
+  neverZero:
+
+  (1) default for LLVM >= 9.0, env var for older version due an efficiency bug in llvm <= 8
+
+  (2) GCC creates non-performant code, hence it is disabled in gcc_plugin
+
+  (3) partially via AFL_CODE_START/AFL_CODE_END
+
+  (4) Only for LLVM >= 11 and not all targets compile
+
+  (5) upcoming, development in the branch
+
+  (6) not compatible with LTO instrumentation and needs at least LLVM >= 4.1
+
+  So all in all this is the best-of afl that is currently out there :-)
+
+  For new versions and additional information, check out:
+  [https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)
+
+  To compare notes with other users or get notified about major new features,
+  send a mail to <afl-users+subscribe@googlegroups.com>.
+
+  See [docs/QuickStartGuide.md](docs/QuickStartGuide.md) if you don't have time to
+  read this file.
+
+## Branches
+
+  The following branches exist:
+
+  * [master/trunk](https://github.com/AFLplusplus/AFLplusplus/) : stable state of afl++ - it is synced from dev from time to
+    time when we are satisfied with it's stability
+  * [dev](https://github.com/AFLplusplus/AFLplusplus/tree/dev) : development state of afl++ - bleeding edge and you might catch a
+    checkout which does not compile or has a bug. *We only accept PRs in dev!!*
+  * (any other) : experimental branches to work on specific features or testing
+    new functionality or changes.
+
+  For releases, please see the [Releases](https://github.com/AFLplusplus/AFLplusplus/releases) tab.
+
+## Google Summer of Code 2020 (and any other students and enthusiast developers)
+
+We are happy to be part of [Google Summer of Code 2020](https://summerofcode.withgoogle.com/organizations/5100744400699392/)! :-)
+
+We have several ideas we would like to see in AFL++ to make it even better.
+However, we already work on so many things that we do not have the time for
+all the big ideas.
+
+This can be your way to support and contribute to AFL++ - extend it to
+something cool.
+
+We have an idea list in [docs/ideas.md](docs/ideas.md).
+
+For everyone who wants to contribute (and send pull requests) please read
+[CONTRIBUTING.md](CONTRIBUTING.md) before your submit.
+
+## Building and installing afl++
+
+An easy way to install afl++ with everything compiled is available via docker:
+You can use the [Dockerfile](Dockerfile) (which has gcc-10 and clang-11 -
+hence afl-clang-lto is available!) or just pull directly from the docker hub:
 ```shell
 docker pull aflplusplus/aflplusplus
 docker run -ti -v /location/of/your/target:/src aflplusplus/aflplusplus
 ```
+This container is automatically generated when a push to master happens.
+You will find your target source code in /src in the container.
 
-This image is automatically published when a push to the stable branch happens
-(see [branches](#branches)). If you use the command above, you will find your
-target source code in `/src` in the container.
+If you want to build afl++ yourself you have many options.
+The easiest is to build and install everything:
 
-Note: you can also pull `aflplusplus/aflplusplus:dev` which is the most current
-development state of AFL++.
+```shell
+sudo apt install build-essential libtool-bin python3-dev automake flex bison libglib2.0-dev libpixman-1-dev clang python3-setuptools llvm
+make distrib
+sudo make install
+```
+It is recommended to install the newest available gcc and clang and llvm-dev
+possible in your distribution!
 
-To build AFL++ yourself - *which we recommend* - continue at
-[docs/INSTALL.md](docs/INSTALL.md).
+Note that "make distrib" also builds llvm_mode, qemu_mode, unicorn_mode and
+more. If you just want plain afl then do "make all", however compiling and
+using at least llvm_mode is highly recommended for much better results -
+hence in this case
 
-## Quick start: Fuzzing with AFL++
+```shell
+make source-only
+```
+is what you should choose.
 
-*NOTE: Before you start, please read about the
-[common sense risks of fuzzing](docs/fuzzing_in_depth.md#0-common-sense-risks).*
+These build targets exist:
 
-This is a quick start for fuzzing targets with the source code available. To
-read about the process in detail, see
-[docs/fuzzing_in_depth.md](docs/fuzzing_in_depth.md).
+* all: just the main afl++ binaries
+* binary-only: everything for binary-only fuzzing: qemu_mode, unicorn_mode, libdislocator, libtokencap
+* source-only: everything for source code fuzzing: llvm_mode, libdislocator, libtokencap
+* distrib: everything (for both binary-only and source code fuzzing)
+* man: creates simple man pages from the help option of the programs
+* install: installs everything you have compiled with the build options above
+* clean: cleans everything compiled, not downloads (unless not on a checkout)
+* deepclean: cleans everything including downloads
+* code-format: format the code, do this before you commit and send a PR please!
+* tests: runs test cases to ensure that all features are still working as they should
+* unit: perform unit tests (based on cmocka)
+* help: shows these build options
 
-To learn about fuzzing other targets, see:
-* Binary-only targets:
-  [docs/fuzzing_binary-only_targets.md](docs/fuzzing_binary-only_targets.md)
-* Network services:
-  [docs/best_practices.md#fuzzing-a-network-service](docs/best_practices.md#fuzzing-a-network-service)
-* GUI programs:
-  [docs/best_practices.md#fuzzing-a-gui-program](docs/best_practices.md#fuzzing-a-gui-program)
+[Unless you are on Mac OS X](https://developer.apple.com/library/archive/qa/qa1118/_index.html) you can also build statically linked versions of the 
+afl++ binaries by passing the STATIC=1 argument to make:
 
-Step-by-step quick start:
+```shell
+make all STATIC=1
+```
 
-1. Compile the program or library to be fuzzed using `afl-cc`. A common way to
-   do this would be:
+These build options exist:
 
-   ```
-   CC=/path/to/afl-cc CXX=/path/to/afl-c++ ./configure --disable-shared
-   make clean all
-   ```
+* STATIC - compile AFL++ static
+* ASAN_BUILD - compiles with memory sanitizer for debug purposes
+* PROFILING - compile with profiling information (gprof)
+* NO_PYTHON - disable python support
+* AFL_NO_X86 - if compiling on non-intel/amd platforms
+* LLVM_CONFIG - if your distro doesn't use the standard name for llvm-config (e.g. Debian)
 
-2. Get a small but valid input file that makes sense to the program. When
-   fuzzing verbose syntax (SQL, HTTP, etc.), create a dictionary as described in
-   [dictionaries/README.md](dictionaries/README.md), too.
+e.g.: make ASAN_BUILD=1
 
-3. If the program reads from stdin, run `afl-fuzz` like so:
+## Challenges of guided fuzzing
 
-   ```
-   ./afl-fuzz -i seeds_dir -o output_dir -- \
-   /path/to/tested/program [...program's cmdline...]
-   ```
+Fuzzing is one of the most powerful and proven strategies for identifying
+security issues in real-world software; it is responsible for the vast
+majority of remote code execution and privilege escalation bugs found to date
+in security-critical software.
 
-   To add a dictionary, add `-x /path/to/dictionary.txt` to afl-fuzz.
+Unfortunately, fuzzing is also relatively shallow; blind, random mutations
+make it very unlikely to reach certain code paths in the tested code, leaving
+some vulnerabilities firmly outside the reach of this technique.
 
-   If the program takes input from a file, you can put `@@` in the program's
-   command line; AFL++ will put an auto-generated file name in there for you.
+There have been numerous attempts to solve this problem. One of the early
+approaches - pioneered by Tavis Ormandy - is corpus distillation. The method
+relies on coverage signals to select a subset of interesting seeds from a
+massive, high-quality corpus of candidate files, and then fuzz them by
+traditional means. The approach works exceptionally well but requires such
+a corpus to be readily available. In addition, block coverage measurements
+provide only a very simplistic understanding of the program state and are less
+useful for guiding the fuzzing effort in the long haul.
 
-4. Investigate anything shown in red in the fuzzer UI by promptly consulting
-   [docs/afl-fuzz_approach.md#understanding-the-status-screen](docs/afl-fuzz_approach.md#understanding-the-status-screen).
+Other, more sophisticated research has focused on techniques such as program
+flow analysis ("concolic execution"), symbolic execution, or static analysis.
+All these methods are extremely promising in experimental settings, but tend
+to suffer from reliability and performance problems in practical uses - and
+currently do not offer a viable alternative to "dumb" fuzzing techniques.
 
-5. You will find found crashes and hangs in the subdirectories `crashes/` and
-   `hangs/` in the `-o output_dir` directory. You can replay the crashes by
-   feeding them to the target, e.g. if your target is using stdin:
 
-   ```
-   cat output_dir/crashes/id:000000,* | /path/to/tested/program [...program's cmdline...]
-   ```
+## The afl-fuzz approach
 
-   You can generate cores or use gdb directly to follow up the crashes.
+American Fuzzy Lop is a brute-force fuzzer coupled with an exceedingly simple
+but rock-solid instrumentation-guided genetic algorithm. It uses a modified
+form of edge coverage to effortlessly pick up subtle, local-scale changes to
+program control flow.
 
-6. We cannot stress this enough - if you want to fuzz effectively, read the
-   [docs/fuzzing_in_depth.md](docs/fuzzing_in_depth.md) document!
+Simplifying a bit, the overall algorithm can be summed up as:
 
-## Contact
+  1) Load user-supplied initial test cases into the queue,
 
-Questions? Concerns? Bug reports?
+  2) Take the next input file from the queue,
 
-* The contributors can be reached via (e.g., by creating an issue):
-  [https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus).
-* Take a look at our [FAQ](docs/FAQ.md). If you find an interesting or important
-  question missing, submit it via
-  [https://github.com/AFLplusplus/AFLplusplus/discussions](https://github.com/AFLplusplus/AFLplusplus/discussions).
-* Best: join the [Awesome Fuzzing](https://discord.gg/gCraWct) Discord server.
-* There is a (not really used) mailing list for the AFL/AFL++ project
-  ([browse archive](https://groups.google.com/group/afl-users)). To compare
-  notes with other users or to get notified about major new features, send an
-  email to <afl-users+subscribe@googlegroups.com>, but note that this is not
-  managed by us.
+  3) Attempt to trim the test case to the smallest size that doesn't alter
+     the measured behavior of the program,
 
-## Branches
+  4) Repeatedly mutate the file using a balanced and well-researched variety
+     of traditional fuzzing strategies,
 
-The following branches exist:
+  5) If any of the generated mutations resulted in a new state transition
+     recorded by the instrumentation, add mutated output as a new entry in the
+     queue.
 
-* [release](https://github.com/AFLplusplus/AFLplusplus/tree/release): the latest
-  release
-* [stable/trunk](https://github.com/AFLplusplus/AFLplusplus/): stable state of
-  AFL++ - it is synced from dev from time to time when we are satisfied with its
-  stability
-* [dev](https://github.com/AFLplusplus/AFLplusplus/tree/dev): development state
-  of AFL++ - bleeding edge and you might catch a checkout which does not compile
-  or has a bug. **We only accept PRs (pull requests) for the 'dev' branch!**
-* (any other): experimental branches to work on specific features or testing new
-  functionality or changes.
+  6) Go to 2.
 
-## Help wanted
+The discovered test cases are also periodically culled to eliminate ones that
+have been obsoleted by newer, higher-coverage finds; and undergo several other
+instrumentation-driven effort minimization steps.
 
-We have several [ideas](docs/ideas.md) we would like to see in AFL++ to make it
-even better. However, we already work on so many things that we do not have the
-time for all the big ideas.
+As a side result of the fuzzing process, the tool creates a small,
+self-contained corpus of interesting test cases. These are extremely useful
+for seeding other, labor- or resource-intensive testing regimes - for example,
+for stress-testing browsers, office applications, graphics suites, or
+closed-source tools.
 
-This can be your way to support and contribute to AFL++ - extend it to do
-something cool.
+The fuzzer is thoroughly tested to deliver out-of-the-box performance far
+superior to blind fuzzing or coverage-only tools.
 
-For everyone who wants to contribute (and send pull requests), please read our
-[contributing guidelines](CONTRIBUTING.md) before you submit.
+
+## Instrumenting programs for use with AFL
+
+PLEASE NOTE: llvm_mode compilation with afl-clang-fast/afl-clang-fast++
+instead of afl-gcc/afl-g++ is much faster and has many cool features.
+See llvm_mode/ - however few code does not compile with llvm.
+We support llvm versions 3.4 to 11.
+
+When source code is available, instrumentation can be injected by a companion
+tool that works as a drop-in replacement for gcc or clang in any standard build
+process for third-party code.
+
+The instrumentation has a fairly modest performance impact; in conjunction with
+other optimizations implemented by afl-fuzz, most programs can be fuzzed as fast
+or even faster than possible with traditional tools.
+
+The correct way to recompile the target program may vary depending on the
+specifics of the build process, but a nearly-universal approach would be:
+
+```shell
+CC=/path/to/afl/afl-gcc ./configure
+make clean all
+```
+
+For C++ programs, you'd would also want to set `CXX=/path/to/afl/afl-g++`.
+
+The clang wrappers (afl-clang and afl-clang++) can be used in the same way;
+clang users may also opt to leverage a higher-performance instrumentation mode,
+as described in [llvm_mode/README.md](llvm_mode/README.md).
+Clang/LLVM has a much better performance and works with LLVM version 3.4 to 11.
+
+Using the LAF Intel performance enhancements are also recommended, see 
+[llvm_mode/README.laf-intel.md](llvm_mode/README.laf-intel.md)
+
+Using partial instrumentation is also recommended, see
+[llvm_mode/README.instrument_file.md](llvm_mode/README.instrument_file.md)
+
+When testing libraries, you need to find or write a simple program that reads
+data from stdin or from a file and passes it to the tested library. In such a
+case, it is essential to link this executable against a static version of the
+instrumented library or to make sure that the correct .so file is loaded at
+runtime (usually by setting `LD_LIBRARY_PATH`). The simplest option is a static
+build, usually possible via:
+
+```shell
+CC=/path/to/afl/afl-gcc ./configure --disable-shared
+```
+
+Setting `AFL_HARDEN=1` when calling 'make' will cause the CC wrapper to
+automatically enable code hardening options that make it easier to detect
+simple memory bugs. Libdislocator, a helper library included with AFL (see
+[libdislocator/README.md](libdislocator/README.md)) can help uncover heap corruption issues, too.
+
+PS. ASAN users are advised to review [docs/notes_for_asan.md](docs/notes_for_asan.md)
+file for important caveats.
+
+
+## Instrumenting binary-only apps
+
+When source code is *NOT* available, the fuzzer offers experimental support for
+fast, on-the-fly instrumentation of black-box binaries. This is accomplished
+with a version of QEMU running in the lesser-known "user space emulation" mode.
+
+QEMU is a project separate from AFL, but you can conveniently build the
+feature by doing:
+
+```shell
+cd qemu_mode
+./build_qemu_support.sh
+```
+
+For additional instructions and caveats, see [qemu_mode/README.md](qemu_mode/README.md).
+
+If possible you should use the persistent mode, see [qemu_mode/README.persistent.md](qemu_mode/README.persistent.md).
+
+The mode is approximately 2-5x slower than compile-time instrumentation, is
+less conducive to parallelization, and may have some other quirks.
+
+If [afl-dyninst](https://github.com/vanhauser-thc/afl-dyninst) works for
+your binary, then you can use afl-fuzz normally and it will have twice
+the speed compared to qemu_mode.
+
+A more comprehensive description of these and other options can be found in
+[docs/binaryonly_fuzzing.md](docs/binaryonly_fuzzing.md)
+
+## Good examples and writeups
+
+Here are some good writeups to show how to effectively use AFL++:
+
+ * [https://aflplus.plus/docs/tutorials/libxml2_tutorial/](https://aflplus.plus/docs/tutorials/libxml2_tutorial/)
+ * [https://bananamafia.dev/post/gb-fuzz/](https://bananamafia.dev/post/gb-fuzz/)
+ * [https://securitylab.github.com/research/fuzzing-challenges-solutions-1](https://securitylab.github.com/research/fuzzing-challenges-solutions-1)
+ * [https://securitylab.github.com/research/fuzzing-sockets-FTP](https://securitylab.github.com/research/fuzzing-sockets-FTP)
+
+If you are interested in fuzzing structured data (where you define what the
+structure is), these two links have you covered:
+ * [https://github.com/bruce30262/libprotobuf-mutator_fuzzing_learning/tree/master/4_libprotobuf_aflpp_custom_mutator](https://github.com/bruce30262/libprotobuf-mutator_fuzzing_learning/tree/master/4_libprotobuf_aflpp_custom_mutator)
+ * [https://github.com/thebabush/afl-libprotobuf-mutator](https://github.com/thebabush/afl-libprotobuf-mutator)
+
+If you find other good ones, please send them to us :-)
+
+## Power schedules
+
+The power schedules were copied from Marcel Böhme's excellent AFLfast
+implementation and expand on the ability to discover new paths and
+therefore may increase the code coverage.
+
+The available schedules are:
+ 
+ - explore (default, original AFL)
+ - exploit (original AFL)
+ - fast (AFLfast)
+ - coe (AFLfast)
+ - quad (AFLfast)
+ - lin (AFLfast)
+ - rare (afl++ experimental)
+ - mmopt (afl++ experimental)
+ - seek (afl++ experimental)
+
+In parallel mode (-M/-S, several instances with the shared queue), we suggest to
+run the main node using the explore or fast schedule (-p explore) and the secondary
+nodes with a combination of cut-off-exponential (-p coe), exponential (-p fast),
+explore (-p explore) and mmopt (-p mmopt) schedules. If a schedule does
+not perform well for a target, restart the secondary nodes with a different schedule.
+
+In single mode, using -p fast is usually slightly more beneficial than the
+default explore mode.
+(We don't want to change the default behavior of afl, so "fast" has not been
+made the default mode).
+
+More details can be found in the paper published at the 23rd ACM Conference on
+Computer and Communications Security [CCS'16](https://www.sigsac.org/ccs/CCS2016/accepted-papers/)
+
+## Choosing initial test cases
+
+To operate correctly, the fuzzer requires one or more starting file that
+contains a good example of the input data normally expected by the targeted
+application. There are two basic rules:
+
+  - Keep the files small. Under 1 kB is ideal, although not strictly necessary.
+    For a discussion of why size matters, see [perf_tips.md](docs/perf_tips.md).
+
+  - Use multiple test cases only if they are functionally different from
+    each other. There is no point in using fifty different vacation photos
+    to fuzz an image library.
+
+You can find many good examples of starting files in the testcases/ subdirectory
+that comes with this tool.
+
+PS. If a large corpus of data is available for screening, you may want to use
+the afl-cmin utility to identify a subset of functionally distinct files that
+exercise different code paths in the target binary.
+
+
+## Fuzzing binaries
+
+The fuzzing process itself is carried out by the afl-fuzz utility. This program
+requires a read-only directory with initial test cases, a separate place to
+store its findings, plus a path to the binary to test.
+
+For target binaries that accept input directly from stdin, the usual syntax is:
+
+```shell
+./afl-fuzz -i testcase_dir -o findings_dir /path/to/program [...params...]
+```
+
+For programs that take input from a file, use '@@' to mark the location in
+the target's command line where the input file name should be placed. The
+fuzzer will substitute this for you:
+
+```shell
+./afl-fuzz -i testcase_dir -o findings_dir /path/to/program @@
+```
+
+You can also use the -f option to have the mutated data written to a specific
+file. This is useful if the program expects a particular file extension or so.
+
+Non-instrumented binaries can be fuzzed in the QEMU mode (add -Q in the command
+line) or in a traditional, blind-fuzzer mode (specify -n).
+
+You can use -t and -m to override the default timeout and memory limit for the
+executed process; rare examples of targets that may need these settings touched
+include compilers and video decoders.
+
+Tips for optimizing fuzzing performance are discussed in [perf_tips.md](docs/perf_tips.md).
+
+Note that afl-fuzz starts by performing an array of deterministic fuzzing
+steps, which can take several days, but tend to produce neat test cases. If you
+want quick & dirty results right away - akin to zzuf and other traditional
+fuzzers - add the -d option to the command line.
+
+## Interpreting output
+
+See the [docs/status_screen.md](docs/status_screen.md) file for information on
+how to interpret the displayed stats and monitor the health of the process. Be
+sure to consult this file especially if any UI elements are highlighted in red.
+
+The fuzzing process will continue until you press Ctrl-C. At a minimum, you want
+to allow the fuzzer to complete one queue cycle, which may take anywhere from a
+couple of hours to a week or so.
+
+There are three subdirectories created within the output directory and updated
+in real-time:
+
+  - queue/   - test cases for every distinctive execution path, plus all the
+               starting files given by the user. This is the synthesized corpus
+               mentioned in section 2.
+
+               Before using this corpus for any other purposes, you can shrink
+               it to a smaller size using the afl-cmin tool. The tool will find
+               a smaller subset of files offering equivalent edge coverage.
+
+  - crashes/ - unique test cases that cause the tested program to receive a
+               fatal signal (e.g., SIGSEGV, SIGILL, SIGABRT). The entries are 
+               grouped by the received signal.
+
+  - hangs/   - unique test cases that cause the tested program to time out. The
+               default time limit before something is classified as a hang is
+               the larger of 1 second and the value of the -t parameter.
+               The value can be fine-tuned by setting AFL_HANG_TMOUT, but this
+               is rarely necessary.
+
+Crashes and hangs are considered "unique" if the associated execution paths
+involve any state transitions not seen in previously-recorded faults. If a
+single bug can be reached in multiple ways, there will be some count inflation
+early in the process, but this should quickly taper off.
+
+The file names for crashes and hangs are correlated with the parent, non-faulting
+queue entries. This should help with debugging.
+
+When you can't reproduce a crash found by afl-fuzz, the most likely cause is
+that you are not setting the same memory limit as used by the tool. Try:
+
+```shell
+LIMIT_MB=50
+( ulimit -Sv $[LIMIT_MB << 10]; /path/to/tested_binary ... )
+```
+
+Change LIMIT_MB to match the -m parameter passed to afl-fuzz. On OpenBSD,
+also change -Sv to -Sd.
+
+Any existing output directory can be also used to resume aborted jobs; try:
+
+```shell
+./afl-fuzz -i- -o existing_output_dir [...etc...]
+```
+
+If you have gnuplot installed, you can also generate some pretty graphs for any
+active fuzzing task using afl-plot. For an example of how this looks like,
+see [http://lcamtuf.coredump.cx/afl/plot/](http://lcamtuf.coredump.cx/afl/plot/).
+
+## Parallelized fuzzing
+
+Every instance of afl-fuzz takes up roughly one core. This means that on
+multi-core systems, parallelization is necessary to fully utilize the hardware.
+For tips on how to fuzz a common target on multiple cores or multiple networked
+machines, please refer to [docs/parallel_fuzzing.md](docs/parallel_fuzzing.md).
+
+The parallel fuzzing mode also offers a simple way for interfacing AFL to other
+fuzzers, to symbolic or concolic execution engines, and so forth; again, see the
+last section of [docs/parallel_fuzzing.md](docs/parallel_fuzzing.md) for tips.
+
+## Fuzzer dictionaries
+
+By default, afl-fuzz mutation engine is optimized for compact data formats -
+say, images, multimedia, compressed data, regular expression syntax, or shell
+scripts. It is somewhat less suited for languages with particularly verbose and
+redundant verbiage - notably including HTML, SQL, or JavaScript.
+
+To avoid the hassle of building syntax-aware tools, afl-fuzz provides a way to
+seed the fuzzing process with an optional dictionary of language keywords,
+magic headers, or other special tokens associated with the targeted data type
+-- and use that to reconstruct the underlying grammar on the go:
+
+  [http://lcamtuf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html](http://lcamtuf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html)
+
+To use this feature, you first need to create a dictionary in one of the two
+formats discussed in [dictionaries/README.md](dictionaries/README.md);
+and then point the fuzzer to it via the -x option in the command line.
+
+(Several common dictionaries are already provided in that subdirectory, too.)
+
+There is no way to provide more structured descriptions of the underlying
+syntax, but the fuzzer will likely figure out some of this based on the
+instrumentation feedback alone. This actually works in practice, say:
+
+  [http://lcamtuf.blogspot.com/2015/04/finding-bugs-in-sqlite-easy-way.html](http://lcamtuf.blogspot.com/2015/04/finding-bugs-in-sqlite-easy-way.html)
+
+PS. Even when no explicit dictionary is given, afl-fuzz will try to extract
+existing syntax tokens in the input corpus by watching the instrumentation
+very closely during deterministic byte flips. This works for some types of
+parsers and grammars but isn't nearly as good as the -x mode.
+
+If a dictionary is really hard to come by, another option is to let AFL run
+for a while and then use the token capture library that comes as a companion
+utility with AFL. For that, see [libtokencap/README.md](libtokencap/README.tokencap.md).
+
+## Crash triage
+
+The coverage-based grouping of crashes usually produces a small data set that
+can be quickly triaged manually or with a very simple GDB or Valgrind script.
+Every crash is also traceable to its parent non-crashing test case in the
+queue, making it easier to diagnose faults.
+
+Having said that, it's important to acknowledge that some fuzzing crashes can be
+difficult to quickly evaluate for exploitability without a lot of debugging and
+code analysis work. To assist with this task, afl-fuzz supports a very unique
+"crash exploration" mode enabled with the -C flag.
+
+In this mode, the fuzzer takes one or more crashing test cases as the input
+and uses its feedback-driven fuzzing strategies to very quickly enumerate all
+code paths that can be reached in the program while keeping it in the
+crashing state.
+
+Mutations that do not result in a crash are rejected; so are any changes that
+do not affect the execution path.
+
+The output is a small corpus of files that can be very rapidly examined to see
+what degree of control the attacker has over the faulting address, or whether
+it is possible to get past an initial out-of-bounds read - and see what lies
+beneath.
+
+Oh, one more thing: for test case minimization, give afl-tmin a try. The tool
+can be operated in a very simple way:
+
+```shell
+./afl-tmin -i test_case -o minimized_result -- /path/to/program [...]
+```
+
+The tool works with crashing and non-crashing test cases alike. In the crash
+mode, it will happily accept instrumented and non-instrumented binaries. In the
+non-crashing mode, the minimizer relies on standard AFL instrumentation to make
+the file simpler without altering the execution path.
+
+The minimizer accepts the -m, -t, -f and @@ syntax in a manner compatible with
+afl-fuzz.
+
+Another recent addition to AFL is the afl-analyze tool. It takes an input
+file, attempts to sequentially flip bytes, and observes the behavior of the
+tested program. It then color-codes the input based on which sections appear to
+be critical, and which are not; while not bulletproof, it can often offer quick
+insights into complex file formats. More info about its operation can be found
+near the end of [docs/technical_details.md](docs/technical_details.md).
+
+## Going beyond crashes
+
+Fuzzing is a wonderful and underutilized technique for discovering non-crashing
+design and implementation errors, too. Quite a few interesting bugs have been
+found by modifying the target programs to call abort() when say:
+
+  - Two bignum libraries produce different outputs when given the same
+    fuzzer-generated input,
+
+  - An image library produces different outputs when asked to decode the same
+    input image several times in a row,
+
+  - A serialization / deserialization library fails to produce stable outputs
+    when iteratively serializing and deserializing fuzzer-supplied data,
+
+  - A compression library produces an output inconsistent with the input file
+    when asked to compress and then decompress a particular blob.
+
+Implementing these or similar sanity checks usually takes very little time;
+if you are the maintainer of a particular package, you can make this code
+conditional with `#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` (a flag also
+shared with libfuzzer) or `#ifdef __AFL_COMPILER` (this one is just for AFL).
+
+## Common-sense risks
+
+Please keep in mind that, similarly to many other computationally-intensive
+tasks, fuzzing may put a strain on your hardware and on the OS. In particular:
+
+  - Your CPU will run hot and will need adequate cooling. In most cases, if
+    cooling is insufficient or stops working properly, CPU speeds will be
+    automatically throttled. That said, especially when fuzzing on less
+    suitable hardware (laptops, smartphones, etc), it's not entirely impossible
+    for something to blow up.
+
+  - Targeted programs may end up erratically grabbing gigabytes of memory or
+    filling up disk space with junk files. AFL tries to enforce basic memory
+    limits, but can't prevent each and every possible mishap. The bottom line
+    is that you shouldn't be fuzzing on systems where the prospect of data loss
+    is not an acceptable risk.
+
+  - Fuzzing involves billions of reads and writes to the filesystem. On modern
+    systems, this will be usually heavily cached, resulting in fairly modest
+    "physical" I/O - but there are many factors that may alter this equation.
+    It is your responsibility to monitor for potential trouble; with very heavy
+    I/O, the lifespan of many HDDs and SSDs may be reduced.
+
+    A good way to monitor disk I/O on Linux is the 'iostat' command:
+
+```shell
+    $ iostat -d 3 -x -k [...optional disk ID...]
+```
+
+## Known limitations & areas for improvement
+
+Here are some of the most important caveats for AFL:
+
+  - AFL detects faults by checking for the first spawned process dying due to
+    a signal (SIGSEGV, SIGABRT, etc). Programs that install custom handlers for
+    these signals may need to have the relevant code commented out. In the same
+    vein, faults in child processes spawned by the fuzzed target may evade
+    detection unless you manually add some code to catch that.
+
+  - As with any other brute-force tool, the fuzzer offers limited coverage if
+    encryption, checksums, cryptographic signatures, or compression are used to
+    wholly wrap the actual data format to be tested.
+
+    To work around this, you can comment out the relevant checks (see
+    examples/libpng_no_checksum/ for inspiration); if this is not possible,
+    you can also write a postprocessor, one of the hooks of custom mutators.
+    See [docs/custom_mutators.md](docs/custom_mutators.md) on how to use
+    `AFL_CUSTOM_MUTATOR_LIBRARY`
+
+  - There are some unfortunate trade-offs with ASAN and 64-bit binaries. This
+    isn't due to any specific fault of afl-fuzz; see [docs/notes_for_asan.md](docs/notes_for_asan.md)
+    for tips.
+
+  - There is no direct support for fuzzing network services, background
+    daemons, or interactive apps that require UI interaction to work. You may
+    need to make simple code changes to make them behave in a more traditional
+    way. Preeny may offer a relatively simple option, too - see:
+    [https://github.com/zardus/preeny](https://github.com/zardus/preeny)
+
+    Some useful tips for modifying network-based services can be also found at:
+    [https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop](https://www.fastly.com/blog/how-to-fuzz-server-american-fuzzy-lop)
+
+  - AFL doesn't output human-readable coverage data. If you want to monitor
+    coverage, use afl-cov from Michael Rash: [https://github.com/mrash/afl-cov](https://github.com/mrash/afl-cov)
+
+  - Occasionally, sentient machines rise against their creators. If this
+    happens to you, please consult [http://lcamtuf.coredump.cx/prep/](http://lcamtuf.coredump.cx/prep/).
+
+Beyond this, see INSTALL for platform-specific tips.
 
 ## Special thanks
 
-Many of the improvements to the original AFL and AFL++ wouldn't be possible
-without feedback, bug reports, or patches from our contributors.
+Many of the improvements to the original afl and afl++ wouldn't be possible
+without feedback, bug reports, or patches from:
 
-Thank you! (For people sending pull requests - please add yourself to this list
-:-)
+```
+  Jann Horn                             Hanno Boeck
+  Felix Groebert                        Jakub Wilk
+  Richard W. M. Jones                   Alexander Cherepanov
+  Tom Ritter                            Hovik Manucharyan
+  Sebastian Roschke                     Eberhard Mattes
+  Padraig Brady                         Ben Laurie
+  @dronesec                             Luca Barbato
+  Tobias Ospelt                         Thomas Jarosch
+  Martin Carpenter                      Mudge Zatko
+  Joe Zbiciak                           Ryan Govostes
+  Michael Rash                          William Robinet
+  Jonathan Gray                         Filipe Cabecinhas
+  Nico Weber                            Jodie Cunningham
+  Andrew Griffiths                      Parker Thompson
+  Jonathan Neuschaefer                  Tyler Nighswander
+  Ben Nagy                              Samir Aguiar
+  Aidan Thornton                        Aleksandar Nikolich
+  Sam Hakim                             Laszlo Szekeres
+  David A. Wheeler                      Turo Lamminen
+  Andreas Stieger                       Richard Godbee
+  Louis Dassy                           teor2345
+  Alex Moneger                          Dmitry Vyukov
+  Keegan McAllister                     Kostya Serebryany
+  Richo Healey                          Martijn Bogaard
+  rc0r                                  Jonathan Foote
+  Christian Holler                      Dominique Pelle
+  Jacek Wielemborek                     Leo Barnes
+  Jeremy Barnes                         Jeff Trull
+  Guillaume Endignoux                   ilovezfs
+  Daniel Godas-Lopez                    Franjo Ivancic
+  Austin Seipp                          Daniel Komaromy
+  Daniel Binderman                      Jonathan Metzman
+  Vegard Nossum                         Jan Kneschke
+  Kurt Roeckx                           Marcel Boehme
+  Van-Thuan Pham                        Abhik Roychoudhury
+  Joshua J. Drake                       Toby Hutton
+  Rene Freingruber                      Sergey Davidoff
+  Sami Liedes                           Craig Young
+  Andrzej Jackowski                     Daniel Hodson
+  Nathan Voss                           Dominik Maier
+  Andrea Biondo                         Vincent Le Garrec
+  Khaled Yakdan                         Kuang-che Wu
+  Josephine Calliotte                   Konrad Welc
+```
 
-<details>
+Thank you!
+(For people sending pull requests - please add yourself to this list :-)
 
-  <summary>List of contributors</summary>
+## Contact
 
-  ```
-    Jann Horn                             Hanno Boeck
-    Felix Groebert                        Jakub Wilk
-    Richard W. M. Jones                   Alexander Cherepanov
-    Tom Ritter                            Hovik Manucharyan
-    Sebastian Roschke                     Eberhard Mattes
-    Padraig Brady                         Ben Laurie
-    @dronesec                             Luca Barbato
-    Tobias Ospelt                         Thomas Jarosch
-    Martin Carpenter                      Mudge Zatko
-    Joe Zbiciak                           Ryan Govostes
-    Michael Rash                          William Robinet
-    Jonathan Gray                         Filipe Cabecinhas
-    Nico Weber                            Jodie Cunningham
-    Andrew Griffiths                      Parker Thompson
-    Jonathan Neuschaefer                  Tyler Nighswander
-    Ben Nagy                              Samir Aguiar
-    Aidan Thornton                        Aleksandar Nikolich
-    Sam Hakim                             Laszlo Szekeres
-    David A. Wheeler                      Turo Lamminen
-    Andreas Stieger                       Richard Godbee
-    Louis Dassy                           teor2345
-    Alex Moneger                          Dmitry Vyukov
-    Keegan McAllister                     Kostya Serebryany
-    Richo Healey                          Martijn Bogaard
-    rc0r                                  Jonathan Foote
-    Christian Holler                      Dominique Pelle
-    Jacek Wielemborek                     Leo Barnes
-    Jeremy Barnes                         Jeff Trull
-    Guillaume Endignoux                   ilovezfs
-    Daniel Godas-Lopez                    Franjo Ivancic
-    Austin Seipp                          Daniel Komaromy
-    Daniel Binderman                      Jonathan Metzman
-    Vegard Nossum                         Jan Kneschke
-    Kurt Roeckx                           Marcel Boehme
-    Van-Thuan Pham                        Abhik Roychoudhury
-    Joshua J. Drake                       Toby Hutton
-    Rene Freingruber                      Sergey Davidoff
-    Sami Liedes                           Craig Young
-    Andrzej Jackowski                     Daniel Hodson
-    Nathan Voss                           Dominik Maier
-    Andrea Biondo                         Vincent Le Garrec
-    Khaled Yakdan                         Kuang-che Wu
-    Josephine Calliotte                   Konrad Welc
-    Thomas Rooijakkers                    David Carlier
-    Ruben ten Hove                        Joey Jiao
-    fuzzah                                @intrigus-lgtm
-    Yaakov Saxon                          Sergej Schumilo
-  ```
+Questions? Concerns? Bug reports? The contributors can be reached via
+[https://github.com/AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus)
 
-</details>
-
-## Cite
-
-If you use AFL++ in scientific work, consider citing
-[our paper](https://www.usenix.org/conference/woot20/presentation/fioraldi)
-presented at WOOT'20:
-
-    Andrea Fioraldi, Dominik Maier, Heiko Eißfeldt, and Marc Heuse. “AFL++: Combining incremental steps of fuzzing research”. In 14th USENIX Workshop on Offensive Technologies (WOOT 20). USENIX Association, Aug. 2020.
-
-<details>
-
-<summary>BibTeX</summary>
-
-  ```bibtex
-  @inproceedings {AFLplusplus-Woot20,
-  author = {Andrea Fioraldi and Dominik Maier and Heiko Ei{\ss}feldt and Marc Heuse},
-  title = {{AFL++}: Combining Incremental Steps of Fuzzing Research},
-  booktitle = {14th {USENIX} Workshop on Offensive Technologies ({WOOT} 20)},
-  year = {2020},
-  publisher = {{USENIX} Association},
-  month = aug,
-  }
-  ```
-
-</details>
+There is also a mailing list for the afl project; to join, send a mail to
+<afl-users+subscribe@googlegroups.com>. Or, if you prefer to browse
+archives first, try: [https://groups.google.com/group/afl-users](https://groups.google.com/group/afl-users)

TODO.md

@@ -1,50 +1,32 @@
 # TODO list for AFL++
 
-## Must
+## Roadmap 2.66+
 
- - fast restart of afl-fuzz if cmdline + target hash is the same
- - check for null ptr for xml/curl/g_ string transform functions
- - hardened_usercopy=0 page_alloc.shuffle=0
- - add value_profile but only enable after 15 minutes without finds
- - cmplog max items env?
- - adapt MOpt to new mutation engine
-   - Update afl->pending_not_fuzzed for MOpt
- - cmplog rtn sanity check on fixed length? currently we ignore the length
- - afl-showmap -f support
- - afl-fuzz multicore wrapper script
- - when trimming then perform crash detection
-
-
-## Should
-
- - afl-crash-analysis
- - cmplog: add loop count resolving (byte -> loop cnt change, calc special values)
- - support persistent and deferred fork server in afl-showmap?
- - better autodetection of shifting runtime timeout values
- - afl-plot to support multiple plot_data
- - parallel builds for source-only targets
- - get rid of check_binary, replace with more forkserver communication
- - first fuzzer should be a main automatically? not sure.
-
-## Maybe
-
- - forkserver tells afl-fuzz if cmplog is supported and if so enable
-   it by default, with AFL_CMPLOG_NO=1 (?) set to skip?
- - afl_custom_splice()
- - cmdline option from-to range for mutations
+ - AFL_MAP_SIZE for qemu_mode and unicorn_mode
+ - namespace for targets? e.g. network
+ - learn from honggfuzz (mutations, maybe ptrace?)
+ - CPU affinity for many cores? There seems to be an issue > 96 cores
 
 ## Further down the road
 
-QEMU mode/FRIDA mode:
+afl-fuzz:
+ - ascii_only mode for mutation output - or use a custom mutator for this?
+ - setting min_len/max_len/start_offset/end_offset limits for mutation output
+
+llvm_mode:
+ - LTO - imitate sancov
+
+gcc_plugin:
+ - (wait for submission then decide)
+ - laf-intel
+ - better instrumentation (seems to be better with gcc-9+)
+
+qemu_mode:
+ - update to 5.x (if the performance bug if gone)
  - non colliding instrumentation
  - rename qemu specific envs to AFL_QEMU (AFL_ENTRYPOINT, AFL_CODE_START/END,
    AFL_COMPCOV_LEVEL?)
- - add AFL_QEMU_EXITPOINT (maybe multiple?)
-
-## Ideas
-
- - LTO/sancov: write current edge to prev_loc and use that information when
-   using cmplog or __sanitizer_cov_trace_cmp*. maybe we can deduct by follow up
-   edge numbers that both following cmp paths have been found and then disable
-   working on this edge id -> cmplog_intelligence branch
- - use cmplog colorization taint result for havoc locations?
+ - add AFL_QEMU_EXITPOINT (maybe multiple?), maybe pointless as we have
+   persistent mode
+ - add/implement AFL_QEMU_INST_LIBLIST and AFL_QEMU_NOINST_PROGRAM
+ - add/implement AFL_QEMU_INST_REGIONS as a list of _START/_END addresses

afl-addseeds

@@ -1,54 +0,0 @@
-#!/bin/sh
-
-test -z "$1" -o "$1" = "-h" -o "$1" = "--help" && {
-  echo Syntax: afl-addseeds -o afl-out-dir [-i seed_file_or_dir] seed_file_or_seed_dir seed_file_or_seed_dir ...
-  echo
-  echo Options:
-  echo "  -o afl-out-dir       the output directory being used in the fuzzing campaign"
-  echo "  -i seed_file_or_dir  file or directory of files to add"
-  echo
-  echo Adds new seeds to an existing AFL++ fuzzing campaign.
-  exit 0
-}
-
-for TOOL in find ls; do
-  X=`which $TOOL`
-  test -n "$X" || { echo "Error: required tool '$TOOL' not found."; exit 1; }
-done
-
-TEST=`printf %06d 123 2>/dev/null`
-test "$TEST" = "000123" || { echo "Error: required tool 'printf' not found."; exit 1; }
-
-OUT=
-NEXT=
-for i in $*; do
-  test -n "$NEXT" && { OUT=$i ; NEXT=""; }
-  test "$i" = "-o" && { NEXT=1; }
-done
-
-test -d "$OUT" || { echo Error: $OUT is not an existing directory; exit 1; }
-OK=`ls $OUT/*/fuzzer_stats 2>/dev/null`
-test -n "$OK" || { echo "Error: $OUT is not an 'afl-fuzz -o ... ' output directory" ; exit 1; }
-
-OUTDIR=$OUT/addseeds/queue
-mkdir -p "$OUTDIR" 2>/dev/null
-test -d "$OUTDIR" || { echo Error: could not create $OUTDIR ; exit 1 ; }
-
-echo Adding seeds ...
-NEXTID=0
-for i in $*; do
-  test -z "$i" -o "$i" = "$OUT" -o "$i" = "-i" -o "$i" = "-o" || {
-    find "$i" -type f | while read FILE; do
-      N=xxx
-      while [ -n "$N" ]; do
-        ID=$NEXTID
-        N=`ls "$OUTDIR/id:$(printf %06d $ID),"* 2>/dev/null`
-        NEXTID=$(($NEXTID + 1))
-      done
-      FN=`echo "$FILE" | sed 's/.*\///'`
-      cp -v "$FILE" "$OUTDIR/id:$(printf %06d $ID),time:0,execs:0,orig:$FN"
-    done
-  }
-done
-
-echo Done.

afl-cmin

@@ -1,19 +1,15 @@
 #!/usr/bin/env sh
-SYS=$(uname -s)
-test "$SYS" = "Darwin" && {
-  echo Error: afl-cmin does not work on Apple currently. please use afl-cmin.bash instead.
-  exit 1
-}
 export AFL_QUIET=1
 export ASAN_OPTIONS=detect_leaks=0
 THISPATH=`dirname ${0}`
 export PATH="${THISPATH}:$PATH"
 awk -f - -- ${@+"$@"} <<'EOF'
 #!/usr/bin/awk -f
+
 # awk script to minimize a test corpus of input files
 #
 # based on afl-cmin bash script written by Michal Zalewski
-# rewritten by Heiko Eissfeldt (hexcoder-)
+# rewritten by Heiko Eißfeldt (hexcoder-)
 # tested with:
 #   gnu awk (x86 Linux)
 #   bsd awk (x86 *BSD)
@@ -107,38 +103,23 @@ function usage() {
 "  -o dir        - output directory for minimized files\n" \
 "\n" \
 "Execution control settings:\n" \
-"  -T tasks      - how many parallel tasks to run (default: 1, all=nproc)\n" \
-"  -f file       - location read by the fuzzed program (default: stdin)\n" \
+"  -f file       - location read by the fuzzed program (stdin)\n" \
 "  -m megs       - memory limit for child process ("mem_limit" MB)\n" \
-"  -t msec       - run time limit for child process (default: 5000)\n" \
-"  -O            - use binary-only instrumentation (FRIDA mode)\n" \
+"  -t msec       - run time limit for child process (none)\n" \
 "  -Q            - use binary-only instrumentation (QEMU mode)\n" \
 "  -U            - use unicorn-based instrumentation (unicorn mode)\n" \
-"  -X            - use Nyx mode\n" \
 "\n" \
 "Minimization settings:\n" \
-"  -A            - allow crashes and timeouts (not recommended)\n" \
 "  -C            - keep crashing inputs, reject everything else\n" \
 "  -e            - solve for edge coverage only, ignore hit counts\n" \
 "\n" \
-"For additional tips, please consult README.md\n" \
+"For additional tips, please consult docs/README.md\n" \
 "\n" \
 "Environment variables used:\n" \
-"AFL_CRASH_EXITCODE: optional child exit code to be interpreted as crash\n" \
-"AFL_FORKSRV_INIT_TMOUT: time the fuzzer waits for the forkserver to come up\n" \
 "AFL_KEEP_TRACES: leave the temporary <out_dir>/.traces directory\n" \
-"AFL_KILL_SIGNAL: Signal delivered to child processes on timeout (default: SIGKILL)\n" \
-"AFL_FORK_SERVER_KILL_SIGNAL: Signal delivered to fork server processes on\n" \
-"   termination (default: SIGTERM). If this is not set and AFL_KILL_SIGNAL is\n" \
-"   set, this will be set to the same value as AFL_KILL_SIGNAL.\n" \
-"AFL_NO_FORKSRV: run target via execve instead of using the forkserver\n" \
-"AFL_CMIN_ALLOW_ANY: write tuples for crashing inputs also\n" \
-"AFL_PATH: path for the afl-showmap binary if not found anywhere in PATH\n" \
-"AFL_PRINT_FILENAMES: If set, the filename currently processed will be " \
-      "printed to stdout\n" \
-"AFL_SKIP_BIN_CHECK: skip afl instrumentation checks for target binary\n"
-"AFL_CUSTOM_MUTATOR_LIBRARY: custom mutator library (post_process and send)\n"
-"AFL_PYTHON_MODULE: custom mutator library (post_process and send)\n"
+"AFL_PATH: path for the afl-showmap binary\n" \
+"AFL_SKIP_BIN_CHECK: skip check for target binary\n" \
+"AFL_ALLOW_TMP: allow unsafe use of input/output directories under {/var}/tmp\n"
    exit 1
 }
 
@@ -147,35 +128,20 @@ function exists_and_is_executable(binarypath) {
 }
 
 BEGIN {
-  if (0 != system( "test -t 1")) {
-    redirected = 1
-  } else {
-    redirected = 0
-  }
-
-  print "corpus minimization tool for AFL++ (awk version)\n"
+  print "corpus minimization tool for afl++ (awk version)\n"
 
   # defaults
   extra_par = ""
-  AFL_CMIN_CRASHES_ONLY = ""
-  AFL_CMIN_ALLOW_ANY = ""
-
   # process options
   Opterr = 1    # default is to diagnose
   Optind = 1    # skip ARGV[0]
-  while ((_go_c = getopt(ARGC, ARGV, "hi:o:f:m:t:eACOQUXYT:?")) != -1) {
+  while ((_go_c = getopt(ARGC, ARGV, "hi:o:f:m:t:eCQU?")) != -1) {
     if (_go_c == "i") {
       if (!Optarg) usage()
       if (in_dir) { print "Option "_go_c" is only allowed once" > "/dev/stderr"}
       in_dir = Optarg
       continue
     } else 
-    if (_go_c == "T") {
-      if (!Optarg) usage()
-      if (threads) { print "Option "_go_c" is only allowed once" > "/dev/stderr"}
-      threads = Optarg
-      continue
-    } else 
     if (_go_c == "o") {
       if (!Optarg) usage()
       if (out_dir) { print "Option "_go_c" is only allowed once" > "/dev/stderr"}
@@ -202,40 +168,26 @@ BEGIN {
       continue
     } else 
     if (_go_c == "C") {
-      AFL_CMIN_CRASHES_ONLY = "AFL_CMIN_CRASHES_ONLY=1 "
-      continue
-    } else 
-    if (_go_c == "A") {
-      AFL_CMIN_ALLOW_ANY = "AFL_CMIN_ALLOW_ANY=1 "
+      ENVIRON["AFL_CMIN_CRASHES_ONLY"] = 1
       continue
     } else 
     if (_go_c == "e") {
       extra_par = extra_par " -e"
       continue
     } else 
-    if (_go_c == "O") {
-      if (frida_mode) { print "Option "_go_c" is only allowed once" > "/dev/stderr"}
-      extra_par = extra_par " -O"
-      frida_mode = 1
-      continue
-    } else 
     if (_go_c == "Q") {
       if (qemu_mode) { print "Option "_go_c" is only allowed once" > "/dev/stderr"}
       extra_par = extra_par " -Q"
+      if ( !mem_limit_given ) mem_limit = "250"
       qemu_mode = 1
       continue
     } else 
     if (_go_c == "U") {
       if (unicorn_mode) { print "Option "_go_c" is only allowed once" > "/dev/stderr"}
       extra_par = extra_par " -U"
+      if ( !mem_limit_given ) mem_limit = "250"
       unicorn_mode = 1
       continue
-    } else
-    if (_go_c == "X" || _go_c == "Y") {
-      if (nyx_mode) { print "Option "_go_c" is only allowed once" > "/dev/stderr"}
-      extra_par = extra_par " -X"
-      nyx_mode = 1
-      continue
     } else 
     if (_go_c == "?") {
       exit 1
@@ -243,8 +195,8 @@ BEGIN {
       usage()
   } # while options
 
-  if (!mem_limit) mem_limit = "none"
-  if (!timeout) timeout = "5000"
+  if (!mem_limit) mem_limit = 200
+  if (!timeout) timeout = "none"
 
   # get program args
   i = 0
@@ -252,7 +204,7 @@ BEGIN {
   for (; Optind < ARGC; Optind++) {
     prog_args[i++] = ARGV[Optind]
     if (i > 1)
-      prog_args_string = prog_args_string" '"ARGV[Optind]"'"
+      prog_args_string = prog_args_string" "ARGV[Optind]
   }
 
   # sanity checks
@@ -271,22 +223,15 @@ BEGIN {
     "pwd" | getline dirlist[4] # current directory
     for (dirind in dirlist) {
       dir = dirlist[dirind]
+
       if (dir ~ /^(\/var)?\/tmp/) {
-        print "[-] Warning: do not use this script in /tmp or /var/tmp for security reasons." > "/dev/stderr"
+        print "[-] Error: do not use this script in /tmp or /var/tmp." > "/dev/stderr"
+        exit 1
       }
     }
     delete dirlist
   }
 
-  if (threads && stdin_file) {
-    print "[-] Error: -T and -f cannot be used together." > "/dev/stderr"
-    exit 1
-  }
-
-  if (!threads && !stdin_file && !nyx_mode) {
-    print "[*] Are you aware of the '-T all' parallelize option that improves the speed for large/slow corpuses?"
-  }
-
   # If @@ is specified, but there's no -f, let's come up with a temporary input
   # file name.
 
@@ -295,7 +240,7 @@ BEGIN {
   if (!stdin_file) {
     found_atat = 0
     for (prog_args_ind in prog_args) {
-      if (match(prog_args[prog_args_ind], "@@") != 0) {
+      if ("@@" == prog_args[prog_args_ind]) {
         found_atat = 1
         break
       }
@@ -317,12 +262,9 @@ BEGIN {
     exit 1
   }
 
+  if (target_bin && !exists_and_is_executable(target_bin)) {
 
-  if (!nyx_mode && target_bin && !exists_and_is_executable(target_bin)) {
-
-    cmd = "command -v "target_bin" 2>/dev/null"
-    cmd | getline tnew
-    close(cmd)
+    "command -v "target_bin" 2>/dev/null" | getline tnew
     if (!tnew || !exists_and_is_executable(tnew)) {
       print "[-] Error: binary '"target_bin"' not found or not executable." > "/dev/stderr"
       exit 1
@@ -330,18 +272,7 @@ BEGIN {
     target_bin = tnew
   }
 
-  if (0 == system ( "grep -aq AFL_DUMP_MAP_SIZE " target_bin )) {
-    echo "[!] Trying to obtain the map size of the target ..."
-    get_map_size = "AFL_DUMP_MAP_SIZE=1 " target_bin
-    get_map_size | getline mapsize
-    close(get_map_size)
-    if (mapsize && mapsize > 65535 && mapsize < 100000000) {
-      AFL_MAP_SIZE = "AFL_MAP_SIZE="mapsize" "
-      print "[+] Setting "AFL_MAP_SIZE
-    }
-  }
-
-  if (!ENVIRON["AFL_SKIP_BIN_CHECK"] && !qemu_mode && !frida_mode && !unicorn_mode && !nyx_mode) {
+  if (!ENVIRON["AFL_SKIP_BIN_CHECK"] && !qemu_mode && !unicorn_mode) {
     if (0 != system( "grep -q __AFL_SHM_ID "target_bin )) {
       print "[-] Error: binary '"target_bin"' doesn't appear to be instrumented." > "/dev/stderr"
       exit 1
@@ -353,39 +284,19 @@ BEGIN {
     exit 1
   }
 
-  #if (0 == system( "test -d "in_dir"/default" )) {
-  #  in_dir = in_dir "/default"
-  #}
-  #
-  #if (0 == system( "test -d "in_dir"/queue" )) {
-  #  in_dir = in_dir "/queue"
-  #}
+  if (0 == system( "test -d "in_dir"/queue" )) {
+    in_dir = in_dir "/queue"
+  }
 
   system("rm -rf "trace_dir" 2>/dev/null");
   system("rm "out_dir"/id[:_]* 2>/dev/null")
 
-  cmd = "ls "out_dir"/* 2>/dev/null | wc -l"
-  cmd | getline noofentries
-  close(cmd)
+  "ls "out_dir"/* 2>/dev/null | wc -l" | getline noofentries
   if (0 == system( "test -d "out_dir" -a "noofentries" -gt 0" )) {
     print "[-] Error: directory '"out_dir"' exists and is not empty - delete it first." > "/dev/stderr"
     exit 1
   }
 
-  if (threads) {
-    cmd = "nproc"
-    cmd | getline nproc
-    close(cmd)
-    if (threads == "all") {
-      threads = nproc
-    } else {
-      if (!(threads > 1 && threads <= nproc)) {
-        print "[-] Error: -T option must be between 1 and "nproc" or \"all\"." > "/dev/stderr"
-        exit 1
-      }
-    }
-  }
-
   # Check for the more efficient way to copy files...
   if (0 != system("mkdir -p -m 0700 "trace_dir)) {
     print "[-] Error: Cannot create directory "trace_dir > "/dev/stderr"
@@ -395,23 +306,17 @@ BEGIN {
   if (stdin_file) {
     # truncate input file
     printf "" > stdin_file
-    close(stdin_file)
+    close( stdin_file )
   }
 
-  # First we look in PATH
-  if (0 == system("command -v afl-showmap >/dev/null 2>&1")) {
-    cmd = "command -v afl-showmap 2>/dev/null"
-    cmd | getline showmap
-    close(cmd)
-  } else {
-    # then we look in the current directory
-    if (0 == system("test -x ./afl-showmap")) {
+  if (!ENVIRON["AFL_PATH"]) {
+    if (0 == system("test -f afl-cmin")) {
       showmap = "./afl-showmap"
     } else {
-      if (ENVIRON["AFL_PATH"]) {
-        showmap = ENVIRON["AFL_PATH"] "/afl-showmap"
-      }
+      "command -v afl-showmap 2>/dev/null" | getline showmap
     }
+  } else {
+    showmap = ENVIRON["AFL_PATH"] "/afl-showmap"
   }
 
   if (!showmap || 0 != system("test -x "showmap )) {
@@ -424,80 +329,62 @@ BEGIN {
   # yuck, gnu stat is option incompatible to bsd stat
   # we use a heuristic to differentiate between
   # GNU stat and other stats
-  cmd = "stat --version 2>/dev/null"
-  cmd | getline statversion
-  close(cmd)
-  if (statversion ~ /GNU coreutils/ || statversion ~ /BusyBox/) {
+  "stat --version 2>/dev/null" | getline statversion
+  if (statversion ~ /GNU coreutils/) {
     stat_format = "-c '%s %n'" # GNU
   } else {
     stat_format = "-f '%z %N'" # *BSD, MacOS
   }
-  cmdline = "(cd "in_dir" && find . \\( ! -name \".*\" -a -type d \\) -o -type f -exec stat "stat_format" \\{\\} + | sort -k1n -k2r) | grep -Ev '^0'"
-  #cmdline = "ls "in_dir" | (cd "in_dir" && xargs stat "stat_format" 2>/dev/null) | sort -k1n -k2r"
-  #cmdline = "(cd "in_dir" && stat "stat_format" *) | sort -k1n -k2r"
-  #cmdline = "(cd "in_dir" && ls | xargs stat "stat_format" ) | sort -k1n -k2r"
+  cmdline = "cd "in_dir" && find . \\( ! -name . -a -type d -prune \\) -o -type f -exec stat "stat_format" \\{\\} \\; | sort -k1n -k2r"
+  cmdline = "ls "in_dir" | (cd "in_dir" && xargs stat "stat_format") | sort -k1n -k2r"
   while (cmdline | getline) {
     sub(/^[0-9]+ (\.\/)?/,"",$0)
-    infilesSmallToBigFull[i] = $0
-    sub(/.*\//, "", $0)
-    infilesSmallToBig[i] = $0
-    infilesSmallToBigMap[infilesSmallToBig[i]] = infilesSmallToBigFull[i]
-    infilesSmallToBigFullMap[infilesSmallToBigFull[i]] = infilesSmallToBig[i]
-    i++
+    infilesSmallToBig[i++] = $0
   }
-  close(cmdline)
   in_count = i
 
-  first_file = infilesSmallToBigFull[0]
+  first_file = infilesSmallToBig[0]
   
-  #if (0 == system("test -d ""\""in_dir"/"first_file"\"")) {
-  #  print "[-] Error: The input directory is empty or contains subdirectories - please fix." > "/dev/stderr"
-  #  exit 1
-  #}
+  # Make sure that we're not dealing with a directory.
 
-  system(">\""in_dir"/.afl-cmin.test\"")
-  if (0 == system("ln \""in_dir"/.afl-cmin.test\" "trace_dir"/.link_test")) {
+  if (0 == system("test -d "in_dir"/"first_file)) {
+    print "[-] Error: The input directory contains subdirectories - please fix." > "/dev/stderr"
+    exit 1
+  }
+
+  if (0 == system("ln "in_dir"/"first_file" "trace_dir"/.link_test")) {
     cp_tool = "ln"
   } else {
     cp_tool = "cp"
   }
-  system("rm -f \""in_dir"/.afl-cmin.test\"")
 
-  if (!ENVIRON["AFL_SKIP_BIN_CHECK"]) {
-    # Make sure that we can actually get anything out of afl-showmap before we
-    # waste too much time.
+  # Make sure that we can actually get anything out of afl-showmap before we
+  # waste too much time.
 
-    print "[*] Testing the target binary..."
+  print "[*] Testing the target binary..."
 
-    if (!stdin_file) {
-      system(AFL_MAP_SIZE "AFL_CMIN_ALLOW_ANY=1 "AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"/.run_test\" -Z "extra_par" -- \""target_bin"\" "prog_args_string" <\""in_dir"/"first_file"\"")
-    } else {
-      system("cp \""in_dir"/"first_file"\" "stdin_file)
-      system(AFL_MAP_SIZE "AFL_CMIN_ALLOW_ANY=1 "AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"/.run_test\" -Z "extra_par" -H \""stdin_file"\" -- \""target_bin"\" "prog_args_string" </dev/null")
-    }
-
-    first_count = 0
-
-    runtest = trace_dir"/.run_test"
-    while ((getline < runtest) > 0) {
-      ++first_count
-    }
-    close(runtest)
-
-    if (first_count) {
-      print "[+] OK, "first_count" tuples recorded."
-    } else {
-      print "[-] Error: no instrumentation output detected (perhaps crash or timeout)." > "/dev/stderr"
-      if (!ENVIRON["AFL_KEEP_TRACES"]) {
-        system("rm -rf "trace_dir" 2>/dev/null")
-      }
-      exit 1
-    }
+  if (!stdin_file) {
+    system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"/.run_test\" -Z "extra_par" -- \""target_bin"\" "prog_args_string" <\""in_dir"/"first_file"\"")
+  } else {
+    system("cp "in_dir"/"first_file" "stdin_file)
+    system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"/.run_test\" -Z "extra_par" -A \""stdin_file"\" -- \""target_bin"\" "prog_args_string" </dev/null")
   }
 
-  if (in_count < threads) {
-    threads = in_count
-    print "[!] WARNING: less inputs than threads, reducing threads to "threads" and likely the overhead of threading makes things slower..."
+  first_count = 0
+
+  runtest = trace_dir"/.run_test"
+  while ((getline < runtest) > 0) {
+    ++first_count
+  }
+
+  if (first_count) {
+    print "[+] OK, "first_count" tuples recorded."
+  } else {
+    print "[-] Error: no instrumentation output detected (perhaps crash or timeout)." > "/dev/stderr"
+    if (!ENVIRON["AFL_KEEP_TRACES"]) {
+      system("rm -rf "trace_dir" 2>/dev/null")
+    }
+    exit 1
   }
 
   # Let's roll!
@@ -506,79 +393,25 @@ BEGIN {
   # STEP 1: Collecting traces #
   #############################
 
-  if (threads) {
-
-    inputsperfile = int(in_count / threads)
-    if (in_count % threads) {
-      inputsperfile++;
-    }
-
-    cnt = 0;
-    tmpfile=out_dir "/.filelist"
-    for (instance = 1; instance < threads; instance++) {
-      for (i = 0; i < inputsperfile; i++) {
-        print in_dir"/"infilesSmallToBigFull[cnt] >> tmpfile"."instance
-        cnt++
-      }
-    }
-    for (; cnt < in_count; cnt++) {
-      print in_dir"/"infilesSmallToBigFull[cnt] >> tmpfile"."threads
-    }
-
-  }
-
   print "[*] Obtaining traces for "in_count" input files in '"in_dir"'."
 
   cur = 0;
-
-  if (threads > 1) {
-
-    print "[*] Creating " threads " parallel tasks with about " inputsperfile " items each."
-    for (i = 1; i <= threads; i++) {
-
-      if (!stdin_file) {
-#        print " { "AFL_MAP_SIZE AFL_CMIN_ALLOW_ANY AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -I \""tmpfile"."i"\" -- \""target_bin"\" "prog_args_string"; > "tmpfile"."i".done ; } &"
-        retval = system(" { "AFL_MAP_SIZE AFL_CMIN_ALLOW_ANY AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -I \""tmpfile"."i"\" -- \""target_bin"\" "prog_args_string"; > "tmpfile"."i".done ; } &")
-      } else {
-        stdin_file=tmpfile"."i".stdin"
-#        print " { "AFL_MAP_SIZE AFL_CMIN_ALLOW_ANY AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -I \""tmpfile"."i"\" -H \""stdin_file"\" -- \""target_bin"\" "prog_args_string" </dev/null; > "tmpfile"."i".done ; } &"
-        retval = system(" { "AFL_MAP_SIZE AFL_CMIN_ALLOW_ANY AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -I \""tmpfile"."i"\" -H \""stdin_file"\" -- \""target_bin"\" "prog_args_string" </dev/null; > "tmpfile"."i".done ; } &")
-      }
-    }
-    print "[*] Waiting for parallel tasks to complete ..."
-    # wait for all processes to finish
-    ok=0
-    while (ok < threads) {
-      ok=0
-      for (i = 1; i <= threads; i++) {
-        if (system("test -f "tmpfile"."i".done") == 0) {
-          ok++
-        }
-      }
-    }
-    print "[*] Done!"
-    system("rm -f "tmpfile"*")
+  if (!stdin_file) {
+    print "    Processing "in_count" files (forkserver mode)..."
+    retval = system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -- \""target_bin"\" "prog_args_string)
   } else {
-    if (!stdin_file) {
-      print "    Processing "in_count" files (forkserver mode)..."
-#      print AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -- \""target_bin"\" "prog_args_string
-      retval = system(AFL_MAP_SIZE AFL_CMIN_ALLOW_ANY AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -- \""target_bin"\" "prog_args_string)
-    } else {
-      print "    Processing "in_count" files (forkserver mode)..."
-#    print AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -H \""stdin_file"\" -- \""target_bin"\" "prog_args_string" </dev/null"
-      retval = system(AFL_MAP_SIZE AFL_CMIN_ALLOW_ANY AFL_CMIN_CRASHES_ONLY"\""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -H \""stdin_file"\" -- \""target_bin"\" "prog_args_string" </dev/null")
+    print "    Processing "in_count" files (forkserver mode)..."
+    retval = system( "AFL_CMIN_ALLOW_ANY=1 \""showmap"\" -m "mem_limit" -t "timeout" -o \""trace_dir"\" -Z "extra_par" -i \""in_dir"\" -- \""target_bin"\" "prog_args_string" </dev/null")
+  }
+
+  if (retval) {
+    print "[!]Exit code != 0 received from afl-showmap, terminating..."
+
+    if (!ENVIRON["AFL_KEEP_TRACES"]) {
+      system("rm -rf "trace_dir" 2>/dev/null")
+      system("rmdir "out_dir)
     }
-
-    if (retval && (!AFL_CMIN_CRASHES_ONLY && !AFL_CMIN_ALLOW_ANY)) {
-      print "[!] Exit code "retval" != 0 received from afl-showmap (this means a crashing or timeout input is likely present), terminating..."
-
-      if (!ENVIRON["AFL_KEEP_TRACES"]) {
-        system("rm -rf "trace_dir" 2>/dev/null")
-        system("rmdir "out_dir)
-      }
-      exit retval
-    }
-
+    exit retval
   }
 
   #######################################################
@@ -598,19 +431,9 @@ BEGIN {
   while (cur < in_count) {
     fn = infilesSmallToBig[cur]
     ++cur
-    if (redirected == 0) { printf "\r    Processing file "cur"/"in_count }
-    else { print "    Processing file "cur"/"in_count }
+    printf "\r    Processing file "cur"/"in_count
     # create path for the trace file from afl-showmap
     tracefile_path = trace_dir"/"fn
-    # ensure the file size is not zero
-    cmd = "du -b \""tracefile_path"\""
-    # "ls -l \""tracefile_path"\""
-    cmd | getline output
-    close(cmd)
-    split(output, result, "\t")
-    if (result[1] == 0) {
-      print "[!] WARNING: file "fn" is crashing the target, ignoring..."
-    }
     # gather all keys, and count them
     while ((getline line < tracefile_path) > 0) {
         key = line
@@ -647,9 +470,7 @@ BEGIN {
     key = field[nrFields]
 
     ++tcnt;
-    if (redirected == 0) { printf "\r    Processing tuple "tcnt"/"tuple_count" with count "key_count[key]"..." }
-    else { print "    Processing tuple "tcnt"/"tuple_count" with count "key_count[key]"..." }
-
+    printf "\r    Processing tuple "tcnt"/"tuple_count" with count "key_count[key]"..."
     if (key in keyAlreadyKnown) {
       continue
     }
@@ -664,8 +485,7 @@ BEGIN {
 
     # copy file unless already done
     if (! (fn in file_already_copied)) {
-      realfile = infilesSmallToBigMap[fn]
-      system(cp_tool" \""in_dir"/"realfile"\" \""out_dir"/"fn"\"")
+      system(cp_tool" "in_dir"/"fn" "out_dir"/"fn)
       file_already_copied[fn] = ""
       ++out_count
       #printf "tuple nr %d (%d cnt=%d) -> %s\n",tcnt,key,key_count[key],fn > trace_dir"/.log"

afl-cmin.bash

@@ -7,13 +7,11 @@
 #
 # Copyright 2014, 2015 Google Inc. All rights reserved.
 #
-# Copyright 2019-2024 AFLplusplus
-#
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at:
 #
-#   https://www.apache.org/licenses/LICENSE-2.0
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
 # This tool tries to find the smallest subset of files in the input directory
 # that still trigger the full range of instrumentation data points seen in
@@ -38,7 +36,7 @@
 # array sizes.
 #
 
-echo "corpus minimization tool for afl-fuzz"
+echo "corpus minimization tool for afl-fuzz by Michal Zalewski"
 echo
 
 #########
@@ -47,15 +45,15 @@ echo
 
 # Process command-line options...
 
-MEM_LIMIT=none
-TIMEOUT=5000
+MEM_LIMIT=200
+TIMEOUT=none
 
-unset IN_DIR OUT_DIR STDIN_FILE EXTRA_PAR MEM_LIMIT_GIVEN F_ARG \
-  AFL_CMIN_CRASHES_ONLY AFL_CMIN_ALLOW_ANY QEMU_MODE UNICORN_MODE T_ARG
+unset IN_DIR OUT_DIR STDIN_FILE EXTRA_PAR MEM_LIMIT_GIVEN \
+  AFL_CMIN_CRASHES_ONLY AFL_CMIN_ALLOW_ANY QEMU_MODE UNICORN_MODE
 
 export AFL_QUIET=1
 
-while getopts "+i:o:f:m:t:T:eOQUAChXY" opt; do
+while getopts "+i:o:f:m:t:eQUCh" opt; do
 
   case "$opt" in 
 
@@ -71,7 +69,6 @@ while getopts "+i:o:f:m:t:T:eOQUAChXY" opt; do
          ;;
     "f")
          STDIN_FILE="$OPTARG"
-         F_ARG=1
          ;;
     "m")
          MEM_LIMIT="$OPTARG"
@@ -83,35 +80,19 @@ while getopts "+i:o:f:m:t:T:eOQUAChXY" opt; do
     "e")
          EXTRA_PAR="$EXTRA_PAR -e"
          ;;
-    "A")
-         export AFL_CMIN_ALLOW_ANY=1
-         ;;
     "C")
          export AFL_CMIN_CRASHES_ONLY=1
          ;;
-    "O")
-         EXTRA_PAR="$EXTRA_PAR -O"
-         FRIDA_MODE=1
-         ;;         
     "Q")
          EXTRA_PAR="$EXTRA_PAR -Q"
+         test "$MEM_LIMIT_GIVEN" = "" && MEM_LIMIT=250
          QEMU_MODE=1
          ;;
-    "Y")
-         EXTRA_PAR="$EXTRA_PAR -X"
-         NYX_MODE=1
-         ;;
-    "X")
-         EXTRA_PAR="$EXTRA_PAR -X"
-         NYX_MODE=1
-         ;;
     "U")
          EXTRA_PAR="$EXTRA_PAR -U"
+         test "$MEM_LIMIT_GIVEN" = "" && MEM_LIMIT=250
          UNICORN_MODE=1
          ;;    
-    "T")
-         T_ARG="$OPTARG"
-         ;;
     "?")
          exit 1
          ;;
@@ -136,31 +117,23 @@ Required parameters:
 
 Execution control settings:
 
-  -T tasks      - how many parallel processes to create (default=1, "all"=nproc)
-  -f file       - location read by the fuzzed program (default: stdin)
-  -m megs       - memory limit for child process (default=$MEM_LIMIT MB)
-  -t msec       - run time limit for child process (default: 5000ms)
-  -O            - use binary-only instrumentation (FRIDA mode)
+  -f file       - location read by the fuzzed program (stdin)
+  -m megs       - memory limit for child process ($MEM_LIMIT MB)
+  -t msec       - run time limit for child process (none)
   -Q            - use binary-only instrumentation (QEMU mode)
   -U            - use unicorn-based instrumentation (Unicorn mode)
-  -X            - use Nyx mode
   
 Minimization settings:
 
-  -A            - allow crashing and timeout inputs
   -C            - keep crashing inputs, reject everything else
   -e            - solve for edge coverage only, ignore hit counts
 
-For additional tips, please consult README.md.
-This script cannot read filenames that end with a space ' '.
+For additional tips, please consult docs/README.md.
 
 Environment variables used:
 AFL_KEEP_TRACES: leave the temporary <out_dir>\.traces directory
-AFL_NO_FORKSRV: run target via execve instead of using the forkserver
-AFL_PATH: last resort location to find the afl-showmap binary
+AFL_PATH: path for the afl-showmap binary
 AFL_SKIP_BIN_CHECK: skip check for target binary
-AFL_CUSTOM_MUTATOR_LIBRARY: custom mutator library (post_process and send)
-AFL_PYTHON_MODULE: custom mutator library (post_process and send)
 _EOF_
   exit 1
 fi
@@ -168,28 +141,29 @@ fi
 # Do a sanity check to discourage the use of /tmp, since we can't really
 # handle this safely from a shell script.
 
-if [ "$AFL_ALLOW_TMP" = "" ]; then
-
-  echo "$IN_DIR" | grep -qE '^(/var)?/tmp/'
-  T1="$?"
-
-  echo "$TARGET_BIN" | grep -qE '^(/var)?/tmp/'
-  T2="$?"
-
-  echo "$OUT_DIR" | grep -qE '^(/var)?/tmp/'
-  T3="$?"
-
-  echo "$STDIN_FILE" | grep -qE '^(/var)?/tmp/'
-  T4="$?"
-
-  echo "$PWD" | grep -qE '^(/var)?/tmp/'
-  T5="$?"
-
-  if [ "$T1" = "0" -o "$T2" = "0" -o "$T3" = "0" -o "$T4" = "0" -o "$T5" = "0" ]; then
-    echo "[-] Warning: do not use this script in /tmp or /var/tmp for security reasons." 1>&2
-  fi
-
-fi
+#if [ "$AFL_ALLOW_TMP" = "" ]; then
+#
+#  echo "$IN_DIR" | grep -qE '^(/var)?/tmp/'
+#  T1="$?"
+#
+#  echo "$TARGET_BIN" | grep -qE '^(/var)?/tmp/'
+#  T2="$?"
+#
+#  echo "$OUT_DIR" | grep -qE '^(/var)?/tmp/'
+#  T3="$?"
+#
+#  echo "$STDIN_FILE" | grep -qE '^(/var)?/tmp/'
+#  T4="$?"
+#
+#  echo "$PWD" | grep -qE '^(/var)?/tmp/'
+#  T5="$?"
+#
+#  if [ "$T1" = "0" -o "$T2" = "0" -o "$T3" = "0" -o "$T4" = "0" -o "$T5" = "0" ]; then
+#    echo "[-] Error: do not use this script in /tmp or /var/tmp." 1>&2
+#    exit 1
+#  fi
+#
+#fi
 
 # If @@ is specified, but there's no -f, let's come up with a temporary input
 # file name.
@@ -206,11 +180,6 @@ fi
 
 # Check for obvious errors.
 
-if [ ! "$T_ARG" = "" -a -n "$F_ARG" -a ! "$NYX_MODE" == 1 ]; then
-  echo "[-] Error: -T and -f can not be used together." 1>&2
-  exit 1
-fi
-
 if [ ! "$MEM_LIMIT" = "none" ]; then
 
   if [ "$MEM_LIMIT" -lt "5" ]; then
@@ -229,32 +198,20 @@ if [ ! "$TIMEOUT" = "none" ]; then
 
 fi
 
-if [ "$NYX_MODE" = "" ]; then
-  if [ ! -f "$TARGET_BIN" -o ! -x "$TARGET_BIN" ]; then
+if [ ! -f "$TARGET_BIN" -o ! -x "$TARGET_BIN" ]; then
 
-    TNEW="`which "$TARGET_BIN" 2>/dev/null`"
-
-    if [ ! -f "$TNEW" -o ! -x "$TNEW" ]; then
-      echo "[-] Error: binary '$TARGET_BIN' not found or not executable." 1>&2
-      exit 1
-    fi
-
-    TARGET_BIN="$TNEW"
+  TNEW="`which "$TARGET_BIN" 2>/dev/null`"
 
+  if [ ! -f "$TNEW" -o ! -x "$TNEW" ]; then
+    echo "[-] Error: binary '$TARGET_BIN' not found or not executable." 1>&2
+    exit 1
   fi
 
+  TARGET_BIN="$TNEW"
+
 fi
 
-grep -aq AFL_DUMP_MAP_SIZE "$TARGET_BIN" && {
-  echo "[!] Trying to obtain the map size of the target ..."
-  MAPSIZE=`AFL_DUMP_MAP_SIZE=1 "./$TARGET_BIN" 2>/dev/null`
-  test -n "$MAPSIZE" && {
-    export AFL_MAP_SIZE=$MAPSIZE
-    echo "[+] Setting AFL_MAP_SIZE=$MAPSIZE"
-  }
-}
-
-if [ "$AFL_SKIP_BIN_CHECK" = "" -a "$QEMU_MODE" = "" -a "$FRIDA_MODE" = "" -a "$UNICORN_MODE" = "" -a "$NYX_MODE" = "" ]; then
+if [ "$AFL_SKIP_BIN_CHECK" = "" -a "$QEMU_MODE" = "" -a "$UNICORN_MODE" = "" ]; then
 
   if ! grep -qF "__AFL_SHM_ID" "$TARGET_BIN"; then
     echo "[-] Error: binary '$TARGET_BIN' doesn't appear to be instrumented." 1>&2
@@ -268,7 +225,6 @@ if [ ! -d "$IN_DIR" ]; then
   exit 1
 fi
 
-test -d "$IN_DIR/default" && IN_DIR="$IN_DIR/default"
 test -d "$IN_DIR/queue" && IN_DIR="$IN_DIR/queue"
 
 find "$OUT_DIR" -name 'id[:_]*' -maxdepth 1 -exec rm -- {} \; 2>/dev/null
@@ -288,21 +244,10 @@ if [ ! "$STDIN_FILE" = "" ]; then
   touch "$STDIN_FILE" || exit 1
 fi
 
-SHOWMAP=`command -v afl-showmap 2>/dev/null`
-
-if [ -z "$SHOWMAP" ]; then
-  TMP="${0%/afl-cmin.bash}/afl-showmap"
-  if [ -x "$TMP" ]; then
-    SHOWMAP=$TMP
-  fi
-fi
-
-if [ -z "$SHOWMAP" -a -x "./afl-showmap" ]; then
-  SHOWMAP="./afl-showmap"
+if [ "$AFL_PATH" = "" ]; then
+  SHOWMAP="${0%/afl-cmin.bash}/afl-showmap"
 else
-  if [ -n "$AFL_PATH" ]; then
-    SHOWMAP="$AFL_PATH/afl-showmap"
-  fi
+  SHOWMAP="$AFL_PATH/afl-showmap"
 fi
 
 if [ ! -x "$SHOWMAP" ]; then
@@ -311,41 +256,14 @@ if [ ! -x "$SHOWMAP" ]; then
   exit 1
 fi
 
-THREADS=
-if [ ! "$T_ARG" = "" ]; then
-  if [ "$T_ARG" = "all" ]; then
-    THREADS=$(nproc)
-  else
-    if [ "$T_ARG" -gt 1 -a "$T_ARG" -le "$(nproc)" ]; then
-      THREADS=$T_ARG
-    else
-      echo "[-] Error: -T parameter must between 2 and $(nproc) or \"all\"." 1>&2
-    fi
-  fi
-else
-  if [ -z "$F_ARG" ]; then
-    echo "[*] Are you aware of the '-T all' parallelize option that massively improves the speed?"
-  fi
-fi
-
 IN_COUNT=$((`ls -- "$IN_DIR" 2>/dev/null | wc -l`))
 
 if [ "$IN_COUNT" = "0" ]; then
-  echo "[-] Hmm, no inputs in the target directory. Nothing to be done."
+  echo "[+] Hmm, no inputs in the target directory. Nothing to be done."
   rm -rf "$TRACE_DIR"
   exit 1
 fi
 
-echo "[*] Are you aware that afl-cmin is faster than this afl-cmin.bash script?"
-echo "[+] Found $IN_COUNT files for minimizing."
-
-if [ -n "$THREADS" ]; then
-  if [ "$IN_COUNT" -lt "$THREADS" ]; then
-    THREADS=$IN_COUNT
-    echo "[!] WARNING: less inputs than threads, reducing threads to $THREADS and likely the overhead of threading makes things slower..."
-  fi
-fi
-
 FIRST_FILE=`ls "$IN_DIR" | head -1`
 
 # Make sure that we're not dealing with a directory.
@@ -376,7 +294,7 @@ if [ "$STDIN_FILE" = "" ]; then
 else
 
   cp "$IN_DIR/$FIRST_FILE" "$STDIN_FILE"
-  AFL_CMIN_ALLOW_ANY=1 "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/.run_test" -Z $EXTRA_PAR -H "$STDIN_FILE" -- "$@" </dev/null
+  AFL_CMIN_ALLOW_ANY=1 "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/.run_test" -Z $EXTRA_PAR -A "$STDIN_FILE" -- "$@" </dev/null
 
 fi
 
@@ -394,18 +312,6 @@ else
 
 fi
 
-TMPFILE=$OUT_DIR/.list.$$
-if [ ! "$THREADS" = "" ]; then
-  ls -- "$IN_DIR" > $TMPFILE 2>/dev/null
-  IN_COUNT=$(cat $TMPFILE | wc -l)
-  SPLIT=$(($IN_COUNT / $THREADS))
-  if [ "$(($IN_COUNT % $THREADS))" -gt 0 ]; then
-    SPLIT=$(($SPLIT + 1))
-  fi
-  echo "[+] Splitting workload into $THREADS tasks with $SPLIT items on average each."
-  split -l $SPLIT $TMPFILE $TMPFILE.
-fi
-
 # Let's roll!
 
 #############################
@@ -414,7 +320,6 @@ fi
 
 echo "[*] Obtaining traces for input files in '$IN_DIR'..."
 
-if [ "$THREADS" = "" ]; then
 (
 
   CUR=0
@@ -423,14 +328,10 @@ if [ "$THREADS" = "" ]; then
 
     ls "$IN_DIR" | while read -r fn; do
 
-      if [ -s "$IN_DIR/$fn" ]; then
+      CUR=$((CUR+1))
+      printf "\\r    Processing file $CUR/$IN_COUNT... "
 
-        CUR=$((CUR+1))
-        printf "\\r    Processing file $CUR/$IN_COUNT... "
-
-        "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/$fn" -Z $EXTRA_PAR -- "$@" <"$IN_DIR/$fn"
-      
-      fi
+      "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/$fn" -Z $EXTRA_PAR -- "$@" <"$IN_DIR/$fn"
 
     done
 
@@ -438,73 +339,21 @@ if [ "$THREADS" = "" ]; then
 
     ls "$IN_DIR" | while read -r fn; do
 
-      if [ -s "$IN_DIR/$fn" ]; then
+      CUR=$((CUR+1))
+      printf "\\r    Processing file $CUR/$IN_COUNT... "
 
-        CUR=$((CUR+1))
-        printf "\\r    Processing file $CUR/$IN_COUNT... "
+      cp "$IN_DIR/$fn" "$STDIN_FILE"
 
-        cp "$IN_DIR/$fn" "$STDIN_FILE"
-        "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/$fn" -Z $EXTRA_PAR -H "$STDIN_FILE" -- "$@" </dev/null
-
-      fi
+      "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/$fn" -Z $EXTRA_PAR -A "$STDIN_FILE" -- "$@" </dev/null
 
     done
 
-  fi
 
-  echo
+  fi
 
 )
 
-else
-
-  PIDS=
-  CNT=0
-  for inputs in $(ls ${TMPFILE}.*); do
-
-(
-
-  if [ "$STDIN_FILE" = "" ]; then
-
-    cat $inputs | while read -r fn; do
-
-      if [ -s "$IN_DIR/$fn" ]; then
-
-        "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/$fn" -Z $EXTRA_PAR -- "$@" <"$IN_DIR/$fn"
-
-      fi
-
-    done
-
-  else
-
-    if [ -s "$IN_DIR/$fn" ]; then
-      STDIN_FILE="$inputs.$$"
-      cat $inputs | while read -r fn; do
-
-        cp "$IN_DIR/$fn" "$STDIN_FILE"
-        "$SHOWMAP" -m "$MEM_LIMIT" -t "$TIMEOUT" -o "$TRACE_DIR/$fn" -Z $EXTRA_PAR -H "$STDIN_FILE" -- "$@" </dev/null
-
-      done
-
-    fi
-
-  fi
-
-) &
-
-  PIDS="$PIDS $!"
-  done
-
-  echo "[+] Waiting for running tasks IDs:$PIDS"
-  wait
-  echo "[+] all $THREADS running tasks completed."
-  rm -f ${TMPFILE}*
-
-  #echo trace dir files: $(ls $TRACE_DIR/*|wc -l)
-
-fi
-
+echo
 
 ##########################
 # STEP 2: SORTING TUPLES #
@@ -545,8 +394,6 @@ ls -rS "$IN_DIR" | while read -r fn; do
 
   sed "s#\$# $fn#" "$TRACE_DIR/$fn" >>"$TRACE_DIR/.candidate_list"
 
-  test -s "$TRACE_DIR/$fn" || echo Warning: $fn is ignored because of crashing the target
-
 done
 
 echo

afl-persistent-config

@@ -1,155 +0,0 @@
-#!/bin/bash
-# written by jhertz
-# 
-
-test "$1" = "-h" -o "$1" = "-hh" -o "$1" = "--help" && {
-  echo 'afl-persistent-config'
-  echo
-  echo $0
-  echo
-  echo afl-persistent-config has no command line options
-  echo
-  echo afl-persistent-config permanently reconfigures the system to a high performance fuzzing state.
-  echo "WARNING: this reduces the security of the system!"
-  echo
-  echo Note that there is also afl-system-config which sets additional runtime
-  echo configuration options.
-  exit 0
-}
-
-if [ $# -ne 0 ]; then
-  echo "ERROR: Unknown option(s): $@"
-  exit 1
-fi
-
-echo
-echo "WARNING: This scripts makes permanent configuration changes to the system to"
-echo "         increase the performance for fuzzing. As a result, the system also"
-echo "         becomes less secure against attacks! If you use this script, setup"
-echo "         strong firewall rules and only make SSH available as a network"
-echo "         service!"
-echo
-echo -n "Type \"YES\" to continue: "
-read ANSWER
-if [[ "$ANSWER" != "YES" ]]; then
-  echo Input was not YES, aborting ...
-  exit 1
-fi
-
-echo
-PLATFORM=`uname -s`
-ARCH=`uname -m`
-
-# check that we're on Mac
-if [[ "$PLATFORM" = "Darwin" ]] ; then
-
-  # check if UID == 0
-  if [[ "$EUID" -ne 0 ]]; then
-    echo "You need to be root to do this. E.g. use \"sudo\""
-    exit 1
-  fi
-
-  # check if SIP is disabled
-  if [[ ! $(csrutil status | grep "disabled") ]]; then
-    echo "SIP needs to be disabled. Restart and press Command-R at reboot, Utilities => Terminal => enter \"csrutil disable\""
-    exit 1
-  fi
-
-  echo "Checks passed."
-
-  echo "Installing /Library/LaunchDaemons/shm_setup.plist"
-
-  cat << EOF > /Library/LaunchDaemons/shm_setup.plist
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-  <dict>
-    <key>Label</key>
-    <string>shmemsetup</string>
-    <key>UserName</key>
-    <string>root</string>
-    <key>GroupName</key>
-    <string>wheel</string>
-    <key>ProgramArguments</key>
-    <array>
-      <string>/usr/sbin/sysctl</string>
-      <string>-w</string>
-      <string>kern.sysv.shmmax=524288000</string>
-      <string>kern.sysv.shmmin=1</string>
-      <string>kern.sysv.shmmni=128</string>
-      <string>kern.sysv.shmseg=48</string>
-      <string>kern.sysv.shmall=131072000</string>
-    </array>
-    <key>KeepAlive</key>
-    <false/>
-    <key>RunAtLoad</key>
-    <true/>
-  </dict>
-</plist>
-EOF
-
-  if [[ "$ARCH" = "x86_64" ]]; then
-    echo "Disabling ASLR system wide"
-    nvram boot-args="no_aslr=1"
-  else
-    echo NOTICE: on ARM64 we do not know currently how to disable system wide ASLR, please report if you know how.
-  fi
-
-  echo
-  echo "Reboot and enjoy your fuzzing"
-  exit 0
-fi
-
-if [[ "$PLATFORM" = "Linux" ]] ; then
-
-  # check if UID == 0
-  if [[ "$EUID" -ne 0 ]]; then
-    echo "You need to be root to do this. E.g. use \"sudo\""
-    exit 1
-  fi
-
-  echo "Checks passed."
-
-  test -d /etc/sysctl.d || echo Error: /etc/sysctl.d directory not found, cannot install shmem config
-  test -d /etc/sysctl.d -a '!' -e /etc/sysctl.d/99-fuzzing.conf && {
-    echo "Installing /etc/sysctl.d/99-fuzzing.conf"
-    cat << EOF > /etc/sysctl.d/99-fuzzing.conf
-kernel.core_uses_pid=0
-kernel.core_pattern=core
-kernel.randomize_va_space=0
-kernel.sched_child_runs_first=1
-kernel.sched_autogroup_enabled=1
-kernel.sched_migration_cost_ns=50000000
-kernel.sched_latency_ns=250000000
-EOF
-  }
-
-  grub_try_disable_mitigation () {
-    KEY="$1"
-    if ! grep -E "^$KEY=" /etc/default/grub | grep -E -q 'noibrs pcid nopti'; then
-      echo "Configuring performance boot options"
-      LINE=`grep -E "^$KEY=" /etc/default/grub | sed "s/^$KEY=//" | tr -d '"'`
-      OPTIONS="$LINE ibpb=off ibrs=off kpti=off l1tf=off spec_rstack_overflow=off mds=off no_stf_barrier noibpb noibrs pcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=on pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off srbds=off noexec=off noexec32=off tsx=on tsx=on tsx_async_abort=off mitigations=off audit=0 hardened_usercopy=off ssbd=force-off"
-      echo Setting boot options in /etc/default/grub to $KEY=\"$OPTIONS\"
-      sed -i "s|^$KEY=.*|$KEY=\"$OPTIONS\"|" /etc/default/grub
-    fi
-  }
-
-
-  if grep -E -q '^GRUB_CMDLINE_LINUX=' /etc/default/grub || grep -E -q '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub; then
-    grub_try_disable_mitigation "GRUB_CMDLINE_LINUX_DEFAULT"
-    # We also overwrite GRUB_CMDLINE_LINUX because some distributions already overwrite GRUB_CMDLINE_LINUX_DEFAULT
-    grub_try_disable_mitigation "GRUB_CMDLINE_LINUX"
-  else
-    echo "Error: /etc/default/grub with GRUB_CMDLINE_LINUX is not present, cannot set boot options"
-  fi
-
-  echo
-  echo "Reboot and enjoy your fuzzing"
-  exit 0
-fi
-
-
-
-echo "Error: Unknown platform \"$PLATFORM\", currently supported are Linux and MacOS."
-exit 1

afl-plot

@@ -12,7 +12,7 @@
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at:
 #
-#   https://www.apache.org/licenses/LICENSE-2.0
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
 
 get_abs_path() {
@@ -22,28 +22,16 @@ get_abs_path() {
 echo "progress plotting utility for afl-fuzz by Michal Zalewski"
 echo
 
-GRAPHICAL="0"
-
-if [ "$1"  = "-g" ] || [ "$1" = "--graphical" ]; then
-GRAPHICAL="1"
-shift
-fi
-
-if [ "$#" != "2" ]; then
+if [ ! "$#" = "2" ]; then
 
   cat 1>&2 <<_EOF_
-$0 [ -g | --graphical ] afl_state_dir graph_output_dir
+$0 afl_state_dir graph_output_dir
 
-This program generates gnuplot images from afl-fuzz output data.
+This program generates gnuplot images from afl-fuzz output data. Usage:
 
-Usage:
-
-    afl_state_dir       should point to an existing state directory for any
-                        active or stopped instance of afl-fuzz
-    graph_output_dir    should point to an empty directory where this
-                        tool can write the resulting plots to
-    -g, --graphical     (optional) display the plots in a graphical window
-                        (you should have built afl-plot-ui to use this option)
+The afl_state_dir parameter should point to an existing state directory for any
+active or stopped instance of afl-fuzz; while graph_output_dir should point to
+an empty directory where this tool can write the resulting plots to.
 
 The program will put index.html and three PNG images in the output directory;
 you should be able to view it with any web browser of your choice.
@@ -75,25 +63,7 @@ outputdir=`get_abs_path "$2"`
 
 if [ ! -f "$inputdir/plot_data" ]; then
 
-  if [ -f "$inputdir/default/plot_data" ]; then
-
-    echo "[-] Error: input directory is not valid (missing 'plot_data'), likely you mean $inputdir/default?" 1>&2
-    exit 1
-
-  else
-
-    echo "[-] Error: input directory is not valid (missing 'plot_data')." 1>&2
-    exit 1
-
-  fi
-
-fi
-
-LINES=`cat "$inputdir/plot_data" | wc -l`
-
-if [ "$LINES" -lt 3 ]; then
-
-  echo "[-] Error: plot_data carries too little data, let it run longer." 1>&2
+  echo "[-] Error: input directory is not valid (missing 'plot_data')." 1>&2
   exit 1
 
 fi
@@ -120,13 +90,21 @@ if [ ! -d "$outputdir" ]; then
 
 fi
 
-rm -f "$outputdir/high_freq.png" "$outputdir/low_freq.png" "$outputdir/exec_speed.png" "$outputdir/edges.png"
+rm -f "$outputdir/high_freq.png" "$outputdir/low_freq.png" "$outputdir/exec_speed.png"
 mv -f "$outputdir/index.html" "$outputdir/index.html.orig" 2>/dev/null
 
-GNUPLOT_SETUP="
-#set xdata time
-#set timefmt '%s'
-#set format x \"%b %d\n%H:%M\"
+echo "[*] Generating plots..."
+
+(
+
+cat <<_EOF_
+set terminal png truecolor enhanced size 1000,300 butt
+
+set output '$outputdir/high_freq.png'
+
+set xdata time
+set timefmt '%s'
+set format x "%b %d\n%H:%M"
 set tics font 'small'
 unset mxtics
 unset mytics
@@ -140,167 +118,29 @@ set key outside
 set autoscale xfixmin
 set autoscale xfixmax
 
-set xlabel \"relative time in seconds\" font \"small\"
-"
-
-PLOT_HF="
-set terminal png truecolor enhanced size 1000,300 butt
-set output '$outputdir/high_freq.png'
-
-$GNUPLOT_SETUP
-
-plot '$inputdir/plot_data' using 1:4 with filledcurve x1 title 'corpus count' linecolor rgb '#000000' fillstyle transparent solid 0.2 noborder, \\
-     '' using 1:3 with filledcurve x1 title 'current item' linecolor rgb '#f0f0f0' fillstyle transparent solid 0.5 noborder, \\
-     '' using 1:5 with lines title 'pending items' linecolor rgb '#0090ff' linewidth 3, \\
+plot '$inputdir/plot_data' using 1:4 with filledcurve x1 title 'total paths' linecolor rgb '#000000' fillstyle transparent solid 0.2 noborder, \\
+     '' using 1:3 with filledcurve x1 title 'current path' linecolor rgb '#f0f0f0' fillstyle transparent solid 0.5 noborder, \\
+     '' using 1:5 with lines title 'pending paths' linecolor rgb '#0090ff' linewidth 3, \\
      '' using 1:6 with lines title 'pending favs' linecolor rgb '#c00080' linewidth 3, \\
      '' using 1:2 with lines title 'cycles done' linecolor rgb '#c000f0' linewidth 3
-"
 
-PLOT_LF="
 set terminal png truecolor enhanced size 1000,200 butt
 set output '$outputdir/low_freq.png'
 
-$GNUPLOT_SETUP
-
 plot '$inputdir/plot_data' using 1:8 with filledcurve x1 title '' linecolor rgb '#c00080' fillstyle transparent solid 0.2 noborder, \\
      '' using 1:8 with lines title ' uniq crashes' linecolor rgb '#c00080' linewidth 3, \\
      '' using 1:9 with lines title 'uniq hangs' linecolor rgb '#c000f0' linewidth 3, \\
      '' using 1:10 with lines title 'levels' linecolor rgb '#0090ff' linewidth 3
-"
 
-PLOT_ES="
 set terminal png truecolor enhanced size 1000,200 butt
 set output '$outputdir/exec_speed.png'
 
-$GNUPLOT_SETUP
-
 plot '$inputdir/plot_data' using 1:11 with filledcurve x1 title '' linecolor rgb '#0090ff' fillstyle transparent solid 0.2 noborder, \\
      '$inputdir/plot_data' using 1:11 with lines title '    execs/sec' linecolor rgb '#0090ff' linewidth 3 smooth bezier;
-"
-
-PLOT_EG="
-set terminal png truecolor enhanced size 1000,300 butt
-set output '$outputdir/edges.png'
-
-$GNUPLOT_SETUP
-
-plot '$inputdir/plot_data' using 1:13 with lines title '        edges' linecolor rgb '#0090ff' linewidth 3
-"
-
-if [ "$#" = "2" ] && [ "$GRAPHICAL" = "1" ]; then
-
-afl-plot-ui -h > /dev/null 2>&1
-
-if [ "$?" != "0" ]; then
-
-cat 1>&2 <<_EOF_
-You do not seem to have the afl-plot-ui utility installed. If you have installed afl-plot-ui, make sure the afl-plot-ui executable is in your PATH.
-If you are still facing any problems, please open an issue at https://github.com/AFLplusplus/AFLplusplus/issues.
-
-No plots have been generated. Please rerun without the "-g" or "--graphical" flag to generate the plots.
-_EOF_
-
-exit 1
-
-fi
-
-rm -rf "$outputdir/.tmp"
-mkdir -p "$outputdir/.tmp"
-mkfifo "$outputdir/.tmp/win_ids" || exit 1
-
-afl-plot-ui > "$outputdir/.tmp/win_ids" &
-W_IDS=$(cat "$outputdir/.tmp/win_ids")
-
-rm -rf "$outputdir/.tmp"
-
-W_ID1=$(echo "$W_IDS" | head -n 1)
-W_ID2=$(echo "$W_IDS" | head -n 2 | tail -n 1)
-W_ID3=$(echo "$W_IDS" | head -n 3 | tail -n 1)
-W_ID4=$(echo "$W_IDS" | tail -n 1)
-
-echo "[*] Generating plots..."
-
-(
-
-cat << _EOF_
-
-$PLOT_HF
-set term x11 window "$W_ID3"
-set output
-replot
-pause mouse close
 
 _EOF_
 
-) | gnuplot 2> /dev/null &
-
-(
-
-cat << _EOF_
-
-$PLOT_LF
-set term x11 window "$W_ID4"
-set output
-replot
-pause mouse close
-
-_EOF_
-
-) | gnuplot 2> /dev/null &
-
-(
-
-cat << _EOF_
-
-$PLOT_ES
-set term x11 window "$W_ID2"
-set output
-replot
-pause mouse close
-
-_EOF_
-
-) | gnuplot 2> /dev/null &
-
-(
-
-cat << _EOF_
-
-$PLOT_EG
-set term x11 window "$W_ID1"
-set output
-replot
-pause mouse close
-
-_EOF_
-
-) | gnuplot 2> /dev/null &
-
-sleep 1
-
-else
-
-echo "[*] Generating plots..."
-
-(
-
-cat << _EOF_
-
-$PLOT_HF
-
-$PLOT_LF
-
-$PLOT_ES
-
-$PLOT_EG
-
-_EOF_
-
-) | gnuplot || echo "Note: if you see errors concerning 'unknown or ambiguous terminal type' then you need to use a gnuplot that has png support compiled in."
-
-echo "[?] You can also use -g flag to view the plots in an GUI window, and interact with the plots (if you have built afl-plot-ui). Run \"afl-plot -h\" to know more."
-
-fi
+) | gnuplot 
 
 if [ ! -s "$outputdir/exec_speed.png" ]; then
 
@@ -318,7 +158,6 @@ cat >"$outputdir/index.html" <<_EOF_
 <tr><td><b>Generated on:</b></td><td>`date`</td></tr>
 </table>
 <p>
-<img src="edges.png" width=1000 height=300>
 <img src="high_freq.png" width=1000 height=300><p>
 <img src="low_freq.png" width=1000 height=200><p>
 <img src="exec_speed.png" width=1000 height=200>
@@ -330,7 +169,7 @@ _EOF_
 # sensitive, this seems like a reasonable trade-off.
 
 chmod 755 "$outputdir"
-chmod 644 "$outputdir/high_freq.png" "$outputdir/low_freq.png" "$outputdir/exec_speed.png" "$outputdir/edges.png" "$outputdir/index.html"
+chmod 644 "$outputdir/high_freq.png" "$outputdir/low_freq.png" "$outputdir/exec_speed.png" "$outputdir/index.html"
 
 echo "[+] All done - enjoy your charts!"
 

afl-system-config

@@ -1,64 +1,45 @@
 #!/bin/sh
-test "$1" = "-h" -o "$1" = "-hh" -o "$1" = "--help" && {
+test "$1" = "-h" && {
   echo 'afl-system-config by Marc Heuse <mh@mh-sec.de>'
   echo
   echo $0
   echo
   echo afl-system-config has no command line options
   echo
-  echo afl-system-config reconfigures the system to a high performance fuzzing state.
-  echo "WARNING: this reduces the security of the system!"
+  echo afl-system reconfigures the system to a high performance fuzzing state
+  echo WARNING: this reduces the security of the system
   echo
-  echo Note that there is also afl-persistent-config which sets additional permanent
-  echo configuration options.
-  exit 0
-}
-if [ $# -ne 0 ]; then
-  echo "ERROR: Unknown option(s): $@"
   exit 1
-fi
+}
 
 DONE=
 PLATFORM=`uname -s`
 echo This reconfigures the system to have a better fuzzing performance.
-echo "WARNING: this reduces the security of the system!"
-echo
 if [ '!' "$EUID" = 0 ] && [ '!' `id -u` = 0 ] ; then
 	echo "Warning: you need to be root to run this!"
-	sleep 1
 	# we do not exit as other mechanisms exist that allows to do this than
 	# being root. let the errors speak for themselves.
 fi
-sleep 1
 if [ "$PLATFORM" = "Linux" ] ; then
 {
-  sysctl -w kernel.core_uses_pid=0
-  # Arch Linux requires core_pattern to be empty :(
-  test -e /etc/arch-release && sysctl -w kernel.core_pattern=
-  test -e /etc/arch-release || sysctl -w kernel.core_pattern=core
+  sysctl -w kernel.core_pattern=core
   sysctl -w kernel.randomize_va_space=0
   sysctl -w kernel.sched_child_runs_first=1
   sysctl -w kernel.sched_autogroup_enabled=1
-  sysctl -w kernel.sched_migration_cost_ns=50000000 2>/dev/null
-  sysctl -w kernel.sched_latency_ns=250000000 2>/dev/null
+  sysctl -w kernel.sched_migration_cost_ns=50000000
+  sysctl -w kernel.sched_latency_ns=250000000
   echo never > /sys/kernel/mm/transparent_hugepage/enabled
   test -e /sys/devices/system/cpu/cpufreq/scaling_governor && echo performance | tee /sys/devices/system/cpu/cpufreq/scaling_governor
   test -e /sys/devices/system/cpu/cpufreq/policy0/scaling_governor && echo performance | tee /sys/devices/system/cpu/cpufreq/policy*/scaling_governor
   test -e /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor && echo performance | tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
   test -e /sys/devices/system/cpu/intel_pstate/no_turbo && echo 0 > /sys/devices/system/cpu/intel_pstate/no_turbo
   test -e /sys/devices/system/cpu/cpufreq/boost && echo 1 > /sys/devices/system/cpu/cpufreq/boost
-  test -e /sys/devices/system/cpu/intel_pstate/max_perf_pct && echo 100 > /sys/devices/system/cpu/intel_pstate/max_perf_pct
-  test -n "$(which auditctl)" && auditctl -a never,task >/dev/null 2>&1
 } > /dev/null
   echo Settings applied.
-  echo
-  dmesg | grep -E -q 'noibrs pcid nopti' || {
+  dmesg | egrep -q 'nospectre_v2|spectre_v2=off' || {
     echo It is recommended to boot the kernel with lots of security off - if you are running a machine that is in a secured network - so set this:
-    echo '  /etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT="ibpb=off ibrs=off kpti=0 l1tf=off mds=off mitigations=off no_stf_barrier noibpb noibrs pcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=on pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off srbds=off noexec=off noexec32=off tsx=on tsx_async_abort=off arm64.nopauth audit=0 hardened_usercopy=off ssbd=force-off"'
-    echo
+    echo '  /etc/default/grub:GRUB_CMDLINE_LINUX_DEFAULT="ibpb=off ibrs=off kpti=off l1tf=off mds=off mitigations=off no_stf_barrier noibpb noibrs nopcid nopti nospec_store_bypass_disable nospectre_v1 nospectre_v2 pcid=off pti=off spec_store_bypass_disable=off spectre_v2=off stf_barrier=off"'
   }
-  echo If you run fuzzing instances in docker, run them with \"--security-opt seccomp=unconfined\" for more speed.
-  echo
   DONE=1
 fi
 if [ "$PLATFORM" = "FreeBSD" ] ; then
@@ -67,77 +48,36 @@ if [ "$PLATFORM" = "FreeBSD" ] ; then
   sysctl kern.elf64.aslr.enable=0
 } > /dev/null
   echo Settings applied.
-  echo
-  cat <<EOF
-In order to suppress core file generation during fuzzing it is recommended to set
-me:\\
-	:coredumpsize=0:
-in the ~/.login_conf file for the user used for fuzzing.
-EOF
   echo It is recommended to boot the kernel with lots of security off - if you are running a machine that is in a secured network - so set this:
   echo '  sysctl hw.ibrs_disable=1'
   echo 'Setting kern.pmap.pg_ps_enabled=0 into /boot/loader.conf might be helpful too.'
-  echo
   DONE=1
 fi
 if [ "$PLATFORM" = "OpenBSD" ] ; then
-  doas sysctl vm.malloc_conf=
-  echo 'Freecheck on allocation in particular can be detrimental to performance.'
-  echo 'Also we might not want necessarily to abort at any allocation failure.'
+  echo
   echo 'System security features cannot be disabled on OpenBSD.'
-  echo
-  DONE=1
-fi
-if [ "$PLATFORM" = "DragonFly" ] ; then
-  #/sbin/sysctl kern.corefile=/dev/null
-  #echo Settings applied.
-  cat <<EOF
-In order to suppress core file generation during fuzzing it is recommended to set
-me:\\
-	:coredumpsize=0:
-in the ~/.login_conf file for the user used for fuzzing.
-EOF
-  echo
   DONE=1
 fi
 if [ "$PLATFORM" = "NetBSD" ] ; then
 {
+  #echo It is recommended to enable unprivileged users to set cpu affinity
+  #echo to be able to use afl-gotcpu meaningfully.
   /sbin/sysctl -w security.models.extensions.user_set_cpu_affinity=1
 } > /dev/null
   echo Settings applied.
-  echo
   DONE=1
 fi
 if [ "$PLATFORM" = "Darwin" ] ; then
-  sysctl kern.sysv.shmmax=524288000
-  sysctl kern.sysv.shmmin=1
-  sysctl kern.sysv.shmseg=48
-  sysctl kern.sysv.shmall=131072000
-  echo Settings applied.
-  echo
-  if $(launchctl list 2>/dev/null | grep -q '\.ReportCrash\>') ; then
-    echo
-    echo Unloading the default crash reporter
+  if [ $(launchctl list 2>/dev/null | grep -q '\.ReportCrash$') ] ; then
+    echo We unload the default crash reporter here
     SL=/System/Library; PL=com.apple.ReportCrash
-    sudo -u "$SUDO_USER" launchctl unload -w ${SL}/LaunchAgents/${PL}.plist
-    launchctl unload -w ${SL}/LaunchDaemons/${PL}.Root.plist
-    echo
+    launchctl unload -w ${SL}/LaunchAgents/${PL}.plist
+    sudo launchctl unload -w ${SL}/LaunchDaemons/${PL}.Root.plist
+    echo Settings applied.
+  else
+    echo Nothing to do.
   fi
-  echo It is recommended to disable System Integrity Protection for increased performance.
-  echo See: https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection
-  echo
-  DONE=1
-fi
-if [ "$PLATFORM" = "Haiku" ] ; then
-  DEBUG_SERVER_DIR=~/config/settings/system/debug_server
-  [ ! -d ${DEBUG_SERVER_DIR} ] && mkdir -p ${DEBUG_SERVER_DIR}
-  SETTINGS=${DEBUG_SERVER_DIR}/settings
-  [ -r ${SETTINGS} ] && grep -qE "default_action\s+kill" ${SETTINGS} && { echo "Nothing to do"; } || { \
-    echo We change the debug_server default_action from user to silently kill; \
-    [ ! -r ${SETTINGS} ] && echo "default_action kill" >${SETTINGS} || { mv ${SETTINGS} s.tmp; sed -e "s/default_action\s\s*user/default_action kill/" s.tmp > ${SETTINGS}; rm s.tmp; }; \
-    echo Settings applied.; echo; \
-  }
   DONE=1
 fi
 test -z "$DONE" && echo Error: Unknown platform: $PLATFORM
-exit 0
+test -z "$AFL_TMPDIR" && echo Also use AFL_TMPDIR and point it to a tmpfs for the input file caching

afl-whatsup

@@ -6,172 +6,114 @@
 # Originally written by Michal Zalewski
 #
 # Copyright 2015 Google Inc. All rights reserved.
-# Copyright 2019-2024 AFLplusplus Project. All rights reserved.
+# Copyright 2019-2020 AFLplusplus Project. All rights reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at:
 #
-#   https://www.apache.org/licenses/LICENSE-2.0
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
 # This tool summarizes the status of any locally-running synchronized
 # instances of afl-fuzz.
 #
 
-test "$1" = "-h" -o "$1" = "-hh" && {
-  echo "$0 status check tool for afl-fuzz by Michal Zalewski"
-  echo
-  echo "Usage: $0 [-s] [-d] afl_output_directory"
+echo "$0 status check tool for afl-fuzz by Michal Zalewski"
+echo
+test "$1" = "-h" && {
+  echo $0 [-s] output_directory
   echo
   echo Options:
-  echo "  -d  -  include dead fuzzer stats"
-  echo "  -m  -  just show minimal stats"
-  echo "  -n  -  no color output"
-  echo "  -s  -  skip details and output summary results only"
+  echo   -s  -  skip details and output summary results only
   echo
   exit 1
 }
 
-unset MINIMAL_ONLY
-unset NO_COLOR
-unset PROCESS_DEAD
-unset SUMMARY_ONLY
-unset RED
-unset GREEN
-unset YELLOW
-unset BLUE
-unset NC
-unset RESET
+if [ "$1" = "-s" ]; then
 
-if [ -z "$TERM" ]; then export TERM=vt220; fi
+  SUMMARY_ONLY=1
+  DIR="$2"
 
-while [ "$1" = "-d" -o "$1" = "-m"  -o "$1" = "-n"  -o "$1" = "-s" ]; do
-  
-  if [ "$1" = "-d" ]; then
-    PROCESS_DEAD=1
-  fi
-  
-  if [ "$1" = "-m" ]; then
-    MINIMAL_ONLY=1
-  fi
-  
-  if [ "$1" = "-n" ]; then
-    NO_COLOR=1
-  fi
-  
-  if [ "$1" = "-s" ]; then
-    SUMMARY_ONLY=1
-  fi
-  
-  shift
-  
-done
+else
 
-DIR="$1"
+  unset SUMMARY_ONLY
+  DIR="$1"
 
-if [ "$DIR" = "" -o "$DIR" = "-h" -o "$DIR" = "--help" ]; then
-  
-  echo "$0 status check tool for afl-fuzz by Michal Zalewski" 1>&2
-  echo 1>&2
-  echo "Usage: $0 [-d] [-m] [-n] [-s] afl_output_directory" 1>&2
-  echo 1>&2
-  echo Options: 1>&2
-  echo "  -d  -  include dead fuzzer stats" 1>&2
-  echo "  -m  -  just show minimal stats" 1>&2
-  echo "  -n  -  no color output" 1>&2
-  echo "  -s  -  skip details and output summary results only" 1>&2
-  echo 1>&2
-  exit 1
-  
 fi
 
-if [ -z "$MINIMAL_ONLY" ]; then
-  echo "$0 status check tool for afl-fuzz by Michal Zalewski"
-  echo
+if [ "$DIR" = "" ]; then
+
+  echo "Usage: $0 [ -s ] afl_sync_dir" 1>&2
+  echo 1>&2
+  echo "The -s option causes the tool to skip all the per-fuzzer trivia and show" 1>&2
+  echo "just the summary results. See docs/parallel_fuzzing.md for additional tips." 1>&2
+  echo 1>&2
+  exit 1
+
 fi
 
 cd "$DIR" || exit 1
 
 if [ -d queue ]; then
-  
+
   echo "[-] Error: parameter is an individual output directory, not a sync dir." 1>&2
   exit 1
-  
+
 fi
 
-BC=`which bc 2>/dev/null`
-FUSER=`which fuser 2>/dev/null`
+RED=`tput setaf 9 1 1`
+GREEN=`tput setaf 2 1 1`
+BLUE=`tput setaf 4 1 1`
+YELLOW=`tput setaf 11 1 1`
+NC=`tput sgr0`
+RESET="$NC"
 
-if [ -z "$NO_COLOR" ]; then
-  RED=`tput setaf 9 1 1 2>/dev/null`
-  GREEN=`tput setaf 2 1 1 2>/dev/null`
-  BLUE=`tput setaf 4 1 1 2>/dev/null`
-  YELLOW=`tput setaf 11 1 1 2>/dev/null`
-  NC=`tput sgr0`
-  RESET="$NC"
-fi
-
-PLATFORM=`uname -s`
-if [ "$PLATFORM" = "Linux" ] ; then
-  CUR_TIME=`cat /proc/uptime | awk '{printf "%.0f\n", $1}'`
-else
-  # This will lead to inacurate results but will prevent the script from breaking on platforms other than Linux
-  CUR_TIME=`date +%s`
-fi
+CUR_TIME=`date +%s`
 
 TMP=`mktemp -t .afl-whatsup-XXXXXXXX` || TMP=`mktemp -p /data/local/tmp .afl-whatsup-XXXXXXXX` || TMP=`mktemp -p /data/local/tmp .afl-whatsup-XXXXXXXX` || exit 1
-trap "rm -f $TMP" 1 2 3 13 15
 
 ALIVE_CNT=0
 DEAD_CNT=0
-START_CNT=0
 
 TOTAL_TIME=0
 TOTAL_EXECS=0
 TOTAL_EPS=0
-TOTAL_EPLM=0
 TOTAL_CRASHES=0
-TOTAL_HANGS=0
 TOTAL_PFAV=0
 TOTAL_PENDING=0
-TOTAL_COVERAGE=
 
-# Time since last find / crash / hang, formatted as string
+# Time since last path / crash / hang, formatted as string
 FMT_TIME="0 days 0 hours"
-FMT_FIND="${RED}none seen yet${NC}"
+FMT_PATH="${RED}none seen yet${NC}"
 FMT_CRASH="none seen yet"
 FMT_HANG="none seen yet"
 
 if [ "$SUMMARY_ONLY" = "" ]; then
-  
+
   echo "Individual fuzzers"
   echo "=================="
   echo
-  
+
 fi
 
 fmt_duration()
 {
   DUR_STRING=
-  if [ $1 -le 0 ]; then
+  if [ $1 -eq 0 ]; then
     return 1
   fi
-  
+
   local duration=$((CUR_TIME - $1))
   local days=$((duration / 60 / 60 / 24))
   local hours=$(((duration / 60 / 60) % 24))
   local minutes=$(((duration / 60) % 60))
   local seconds=$((duration % 60))
-  
-  if [ $duration -le 0 ]; then
-    DUR_STRING="0 seconds"
-    elif [ $duration -eq 1 ]; then
-    DUR_STRING="1 second"
-    elif [ $days -gt 0 ]; then
+
+  if [ $days -gt 0 ]; then
     DUR_STRING="$days days, $hours hours"
-    elif [ $hours -gt 0 ]; then
+  elif [ $hours -gt 0 ]; then
     DUR_STRING="$hours hours, $minutes minutes"
-    elif [ $minutes -gt 0 ]; then
+  elif [ $minutes -gt 0 ]; then
     DUR_STRING="$minutes minutes, $seconds seconds"
   else
     DUR_STRING="$seconds seconds"
@@ -180,195 +122,106 @@ fmt_duration()
 
 FIRST=true
 TOTAL_WCOP=
-TOTAL_LAST_FIND=0
+TOTAL_LAST_PATH=0
 
-for j in `find . -maxdepth 2 -iname fuzzer_setup | sort`; do
-  
-  DIR=$(dirname "$j")
-  i=$DIR/fuzzer_stats
-  
-  if [ -f "$i" ]; then
-    
-    IS_STARTING=
-    IS_DEAD=
-    sed 's/^command_line.*$/_skip:1/;s/[ ]*:[ ]*/="/;s/$/"/' "$i" >"$TMP"
-    . "$TMP"
-    DIRECTORY=$DIR
-    DIR=${DIR##*/}
-    RUN_UNIX=$run_time
-    RUN_DAYS=$((RUN_UNIX / 60 / 60 / 24))
-    RUN_HRS=$(((RUN_UNIX / 60 / 60) % 24))
-    COVERAGE=$(echo $bitmap_cvg|tr -d %)
-    if [ -n "$TOTAL_COVERAGE" -a -n "$COVERAGE" -a -n "$BC" ]; then
-      if [ "$(echo "$TOTAL_COVERAGE < $COVERAGE" | bc)" -eq 1 ]; then
-        TOTAL_COVERAGE=$COVERAGE
-      fi
-    fi
-    if [ -z "$TOTAL_COVERAGE" ]; then TOTAL_COVERAGE=$COVERAGE ; fi
-    
-    test -n "$cycles_wo_finds" && {
-      test -z "$FIRST" && TOTAL_WCOP="${TOTAL_WCOP}/"
-      TOTAL_WCOP="${TOTAL_WCOP}${cycles_wo_finds}"
-      FIRST=
-    }
-    
-    if [ "$SUMMARY_ONLY" = "" ]; then
-      
-      echo ">>> $afl_banner instance: $DIR ($RUN_DAYS days, $RUN_HRS hrs) fuzzer PID: $fuzzer_pid <<<"
-      echo
-      
-    fi
-    
-    if ! kill -0 "$fuzzer_pid" 2>/dev/null; then
-      
-      if [ -e "$i" ] && [ -e "$j" ] && [ -n "$FUSER" ]; then
-        
-        if [ "$i" -ot "$j" ]; then
-          
-          # fuzzer_setup is newer than fuzzer_stats, maybe the instance is starting?
-          TMP_PID=`fuser -v "$DIRECTORY" 2>&1 | grep afl-fuzz`
-          
-          if [ -n "$TMP_PID" ]; then
-            
-            if [ "$SUMMARY_ONLY" = "" ]; then
-              
-              echo "  Instance is still starting up, skipping."
-              echo
-              
-            fi
-            
-            START_CNT=$((START_CNT + 1))
-            last_find=0
-            IS_STARTING=1
-            
-            if [ "$PROCESS_DEAD" = "" ]; then
-              
-              continue
-              
-            fi
-            
-          fi
-          
-        fi
-        
-      fi
-      
-      if [ -z "$IS_STARTING" ]; then
-        
-        if [ "$SUMMARY_ONLY" = "" ]; then
-          
-          echo "  Instance is dead or running remotely, skipping."
-          echo
-          
-        fi
-        
-        DEAD_CNT=$((DEAD_CNT + 1))
-        IS_DEAD=1
-        last_find=0
-        
-        if [ "$PROCESS_DEAD" = "" ]; then
-          
-          continue
-          
-        fi
-        
-      fi
-      
-    fi
-    
-    ALIVE_CNT=$((ALIVE_CNT + 1))
-    
-    EXEC_SEC=0
-    EXEC_MIN=0
-    test -z "$RUN_UNIX" -o "$RUN_UNIX" = 0 || EXEC_SEC=$((execs_done / RUN_UNIX))
-    PATH_PERC=$((cur_item * 100 / corpus_count))
+for i in `find . -maxdepth 2 -iname fuzzer_stats | sort`; do
 
-    test "$IS_DEAD" = 1 || EXEC_MIN=$(echo $execs_ps_last_min|sed 's/\..*//')
-    
-    TOTAL_TIME=$((TOTAL_TIME + RUN_UNIX))
-    TOTAL_EPS=$((TOTAL_EPS + EXEC_SEC))
-    TOTAL_EPLM=$((TOTAL_EPLM + EXEC_MIN))
-    TOTAL_EXECS=$((TOTAL_EXECS + execs_done))
-    TOTAL_CRASHES=$((TOTAL_CRASHES + saved_crashes))
-    TOTAL_HANGS=$((TOTAL_HANGS + saved_hangs))
-    TOTAL_PENDING=$((TOTAL_PENDING + pending_total))
-    TOTAL_PFAV=$((TOTAL_PFAV + pending_favs))
-    
-    if [ "$last_find" -gt "$TOTAL_LAST_FIND" ]; then
-      TOTAL_LAST_FIND=$last_find
-    fi
-    
-    if [ "$SUMMARY_ONLY" = "" ]; then
-      
-      # Warnings in red
-      TIMEOUT_PERC=$((exec_timeout * 100 / execs_done))
-      if [ $TIMEOUT_PERC -ge 10 ]; then
-        echo "  ${RED}timeout_ratio $TIMEOUT_PERC%${NC}"
-      fi
-      
-      if [ $EXEC_SEC -eq 0 ]; then
-        echo "  ${YELLOW}no data yet, 0 execs/sec${NC}"
-        elif [ $EXEC_SEC -lt 100 ]; then
-        echo "  ${RED}slow execution, $EXEC_SEC execs/sec${NC}"
-      fi
-      
-      fmt_duration $last_find && FMT_FIND=$DUR_STRING
-      fmt_duration $last_crash && FMT_CRASH=$DUR_STRING
-      fmt_duration $last_hang && FMT_HANG=$DUR_STRING
-      FMT_CWOP="not available"
-      test -n "$cycles_wo_finds" && {
-        test "$cycles_wo_finds" = 0 && FMT_CWOP="$cycles_wo_finds"
-        test "$cycles_wo_finds" -gt 10 && FMT_CWOP="${YELLOW}$cycles_wo_finds${NC}"
-        test "$cycles_wo_finds" -gt 50 && FMT_CWOP="${RED}$cycles_wo_finds${NC}"
-      }
-      
-      echo "  last_find       : $FMT_FIND"
-      echo "  last_crash      : $FMT_CRASH"
-      if [ -z "$MINIMAL_ONLY" ]; then
-        echo "  last_hang       : $FMT_HANG"
-        echo "  cycles_wo_finds : $FMT_CWOP"
-      fi
-      echo "  coverage        : $COVERAGE%"
-      
-      if [ -z "$MINIMAL_ONLY" ]; then
-        
-        CPU_USAGE=$(ps aux | grep -w $fuzzer_pid | grep -v grep | awk '{print $3}')
-        MEM_USAGE=$(ps aux | grep -w $fuzzer_pid | grep -v grep | awk '{print $4}')
-        
-        echo "  cpu usage $CPU_USAGE%, memory usage $MEM_USAGE%"
-        
-      fi
-      
-      echo "  cycles $((cycles_done + 1)), lifetime speed $EXEC_SEC execs/sec, items $cur_item/$corpus_count (${PATH_PERC}%)"
-      
-      if [ "$saved_crashes" = "0" ]; then
-        echo "  pending $pending_favs/$pending_total, coverage $bitmap_cvg, no crashes yet"
-      else
-        echo "  pending $pending_favs/$pending_total, coverage $bitmap_cvg, crashes saved $saved_crashes (!)"
-      fi
-      
-      echo
-      
-    fi
+  sed 's/^command_line.*$/_skip:1/;s/[ ]*:[ ]*/="/;s/$/"/' "$i" >"$TMP"
+  . "$TMP"
 
-  else
+  RUN_UNIX=$((CUR_TIME - start_time))
+  RUN_DAYS=$((RUN_UNIX / 60 / 60 / 24))
+  RUN_HRS=$(((RUN_UNIX / 60 / 60) % 24))
 
-    if [ ! -e "$i" -a -e "$j" ]; then
+  test -n "$cycles_wo_finds" && {
+    test -z "$FIRST" && TOTAL_WCOP="${TOTAL_WCOP}/"
+    TOTAL_WCOP="${TOTAL_WCOP}${cycles_wo_finds}"
+    FIRST=
+  }
 
-      if [ '!' "$PROCESS_DEAD" = "" ]; then
-        ALIVE_CNT=$((ALIVE_CNT + 1))
-      fi
-      START_CNT=$((START_CNT + 1))
-      last_find=0
-      IS_STARTING=1
-      
-    fi
+  if [ "$SUMMARY_ONLY" = "" ]; then
+
+    echo ">>> $afl_banner ($RUN_DAYS days, $RUN_HRS hrs) fuzzer PID: $fuzzer_pid <<<"
+    echo
 
   fi
-  
+
+  if ! kill -0 "$fuzzer_pid" 2>/dev/null; then
+
+    if [ "$SUMMARY_ONLY" = "" ]; then
+
+      echo "  Instance is dead or running remotely, skipping."
+      echo
+
+    fi
+
+    DEAD_CNT=$((DEAD_CNT + 1))
+    continue
+
+  fi
+
+  ALIVE_CNT=$((ALIVE_CNT + 1))
+
+  EXEC_SEC=$((execs_done / RUN_UNIX))
+  PATH_PERC=$((cur_path * 100 / paths_total))
+
+  TOTAL_TIME=$((TOTAL_TIME + RUN_UNIX))
+  TOTAL_EPS=$((TOTAL_EPS + EXEC_SEC))
+  TOTAL_EXECS=$((TOTAL_EXECS + execs_done))
+  TOTAL_CRASHES=$((TOTAL_CRASHES + unique_crashes))
+  TOTAL_PENDING=$((TOTAL_PENDING + pending_total))
+  TOTAL_PFAV=$((TOTAL_PFAV + pending_favs))
+
+  if [ "$last_path" -gt "$TOTAL_LAST_PATH" ]; then
+    TOTAL_LAST_PATH=$last_path
+  fi
+
+  if [ "$SUMMARY_ONLY" = "" ]; then
+
+    # Warnings in red
+    TIMEOUT_PERC=$((exec_timeout * 100 / execs_done))
+    if [ $TIMEOUT_PERC -ge 10 ]; then
+      echo "  ${RED}timeout_ratio $TIMEOUT_PERC%${NC}"
+    fi
+
+    if [ $EXEC_SEC -lt 100 ]; then
+      echo "  ${RED}slow execution, $EXEC_SEC execs/sec${NC}"
+    fi
+
+    fmt_duration $last_path && FMT_PATH=$DUR_STRING
+    fmt_duration $last_crash && FMT_CRASH=$DUR_STRING
+    fmt_duration $last_hang && FMT_HANG=$DUR_STRING
+    FMT_CWOP="not available"
+    test -n "$cycles_wo_finds" && {
+      test "$cycles_wo_finds" = 0 && FMT_CWOP="$cycles_wo_finds"
+      test "$cycles_wo_finds" -gt 10 && FMT_CWOP="${YELLOW}$cycles_wo_finds${NC}"
+      test "$cycles_wo_finds" -gt 50 && FMT_CWOP="${RED}$cycles_wo_finds${NC}"
+    }
+
+    echo "  last_path       : $FMT_PATH"
+    echo "  last_crash      : $FMT_CRASH"
+    echo "  last_hang       : $FMT_HANG"
+    echo "  cycles_wo_finds : $FMT_CWOP"
+
+    CPU_USAGE=$(ps aux | grep $fuzzer_pid | grep -v grep | awk '{print $3}')
+    MEM_USAGE=$(ps aux | grep $fuzzer_pid | grep -v grep | awk '{print $4}')
+
+    echo "  cpu usage $CPU_USAGE%, memory usage $MEM_USAGE%"
+    echo "  cycle $((cycles_done + 1)), lifetime speed $EXEC_SEC execs/sec, path $cur_path/$paths_total (${PATH_PERC}%)"
+
+    if [ "$unique_crashes" = "0" ]; then
+      echo "  pending $pending_favs/$pending_total, coverage $bitmap_cvg, no crashes yet"
+    else
+      echo "  pending $pending_favs/$pending_total, coverage $bitmap_cvg, crash count $unique_crashes (!)"
+    fi
+
+    echo
+
+  fi
+
 done
 
-# Formatting for total time, time since last find, crash, and hang
+# Formatting for total time, time since last path, crash, and hang
 fmt_duration $((CUR_TIME - TOTAL_TIME)) && FMT_TIME=$DUR_STRING
 # Formatting for total execution
 FMT_EXECS="0 millions"
@@ -376,7 +229,7 @@ EXECS_MILLION=$((TOTAL_EXECS / 1000 / 1000))
 EXECS_THOUSAND=$((TOTAL_EXECS / 1000 % 1000))
 if [ $EXECS_MILLION -gt 9 ]; then
   FMT_EXECS="$EXECS_MILLION millions"
-  elif [ $EXECS_MILLION -gt 0 ]; then
+elif [ $EXECS_MILLION -gt 0 ]; then
   FMT_EXECS="$EXECS_MILLION millions, $EXECS_THOUSAND thousands"
 else
   FMT_EXECS="$EXECS_THOUSAND thousands"
@@ -388,65 +241,34 @@ TOTAL_DAYS=$((TOTAL_TIME / 60 / 60 / 24))
 TOTAL_HRS=$(((TOTAL_TIME / 60 / 60) % 24))
 
 test -z "$TOTAL_WCOP" && TOTAL_WCOP="not available"
-fmt_duration $TOTAL_LAST_FIND && TOTAL_LAST_FIND=$DUR_STRING
+fmt_duration $TOTAL_LAST_PATH && TOTAL_LAST_PATH=$DUR_STRING
 
 test "$TOTAL_TIME" = "0" && TOTAL_TIME=1
 
-if [ "$PROCESS_DEAD" = "" ]; then
-  
-  TXT="excluded from stats"
-  
-else
-  
-  TXT="included in stats"
-  ALIVE_CNT=$(($ALIVE_CNT - $DEAD_CNT - $START_CNT))
-  
-fi
-
 echo "Summary stats"
 echo "============="
-if [ -z "$SUMMARY_ONLY" -o -z "$MINIMAL_ONLY" ]; then
-  echo
-fi
-
-echo "        Fuzzers alive : $ALIVE_CNT"
-
-if [ ! "$START_CNT" = "0" ]; then
-  echo "          Starting up : $START_CNT ($TXT)"
-fi
+echo
+echo "       Fuzzers alive : $ALIVE_CNT"
 
 if [ ! "$DEAD_CNT" = "0" ]; then
-  echo "       Dead or remote : $DEAD_CNT ($TXT)"
+  echo "      Dead or remote : $DEAD_CNT (excluded from stats)"
 fi
 
-echo "       Total run time : $FMT_TIME"
-if [ -z "$MINIMAL_ONLY" ]; then
-  echo "          Total execs : $FMT_EXECS"
-  echo "     Cumulative speed : $TOTAL_EPS execs/sec"
-  if [ "$ALIVE_CNT" -gt "0" ]; then
-    echo "  Total average speed : $((TOTAL_EPS / ALIVE_CNT)) execs/sec"
-  fi
-fi
+echo "      Total run time : $FMT_TIME"
+echo "         Total execs : $FMT_EXECS"
+echo "    Cumulative speed : $TOTAL_EPS execs/sec"
 if [ "$ALIVE_CNT" -gt "0" ]; then
-  echo "Current average speed : $TOTAL_EPLM execs/sec"
+  echo "       Average speed : $((TOTAL_EPS / ALIVE_CNT)) execs/sec"
 fi
-if [ -z "$MINIMAL_ONLY" ]; then
-  echo "        Pending items : $TOTAL_PFAV faves, $TOTAL_PENDING total"
+echo "       Pending paths : $TOTAL_PFAV faves, $TOTAL_PENDING total"
+
+if [ "$ALIVE_CNT" -gt "1" ]; then
+  echo "  Pending per fuzzer : $((TOTAL_PFAV/ALIVE_CNT)) faves, $((TOTAL_PENDING/ALIVE_CNT)) total (on average)"
 fi
 
-if [ "$ALIVE_CNT" -gt "1" -o -n "$MINIMAL_ONLY" ]; then
-  if [ "$ALIVE_CNT" -gt "0" ]; then
-    echo "   Pending per fuzzer : $((TOTAL_PFAV/ALIVE_CNT)) faves, $((TOTAL_PENDING/ALIVE_CNT)) total (on average)"
-  fi
-fi
-
-echo "     Coverage reached : ${TOTAL_COVERAGE}%"
-echo "        Crashes saved : $TOTAL_CRASHES"
-if [ -z "$MINIMAL_ONLY" ]; then
-  echo "          Hangs saved : $TOTAL_HANGS"
-  echo " Cycles without finds : $TOTAL_WCOP"
-fi
-echo "   Time without finds : $TOTAL_LAST_FIND"
+echo "       Crashes found : $TOTAL_CRASHES locally unique"
+echo "Cycles without finds : $TOTAL_WCOP"
+echo "  Time without finds : $TOTAL_LAST_PATH"
 echo
 
 exit 0

afl-wine-trace

@@ -28,9 +28,9 @@ if not os.getenv("AFL_INST_LIBS"):
         os.environ["AFL_CODE_END"] = "0x%x" % (pe.OPTIONAL_HEADER.ImageBase + pe.OPTIONAL_HEADER.BaseOfCode + pe.OPTIONAL_HEADER.SizeOfCode)
 
 if pe.FILE_HEADER.Machine == pefile.MACHINE_TYPE["IMAGE_FILE_MACHINE_AMD64"] or pe.FILE_HEADER.Machine == pefile.MACHINE_TYPE["IMAGE_FILE_MACHINE_IA64"]:
-    os.environ["QEMU_SET_ENV"] = "LD_PRELOAD=" + os.path.join(my_dir, "qemu_mode/unsigaction/unsigaction64.so") + ",WINEARCH=win64"
+    os.environ["LD_PRELOAD"] = os.path.join(my_dir, "qemu_mode/unsigaction/unsigaction64.so")
 else:
-    os.environ["QEMU_SET_ENV"] = "LD_PRELOAD=" + os.path.join(my_dir, "qemu_mode/unsigaction/unsigaction32.so") + ",WINEARCH=win32"
+    os.environ["LD_PRELOAD"] = os.path.join(my_dir, "qemu_mode/unsigaction/unsigaction32.so")
 
 if os.getenv("WINECOV_QEMU_PATH"):
     qemu_path = os.getenv("WINECOV_QEMU_PATH")
@@ -68,12 +68,7 @@ else:
 argv = sys.argv[1:]
 for i in range(len(argv)):
     if ".cur_input" in argv[i]:
-        # Get the Wine translated path using the winepath tool
-        arg_translated = subprocess.run([os.path.join(os.path.dirname(wine_path), "winepath"), "--windows", argv[i]], universal_newlines=True, stdout=subprocess.PIPE).stdout
-        # Remove the spurious LF at the end of the path
-        if len(arg_translated) > 0 and arg_translated[-1] == '\n':
-            arg_translated = arg_translated[:-1]
-        argv[i] = arg_translated
+        argv[i] = subprocess.run([os.path.join(os.path.dirname(wine_path), "winepath"), "--windows", argv[i]], universal_newlines=True, stdout=subprocess.PIPE).stdout
         break
 
 print("[afl-wine-trace] exec:", " ".join([qemu_path, wine_path] + argv))

benchmark/COMPARISON.md

@@ -1,13 +0,0 @@
-|CPU                                                 | MHz   | threads | singlecore | multicore | afl-*-config |
-|----------------------------------------------------|-------|---------|------------|-----------|--------------|
-|Raspberry Pi 5                                      | 2400  | 4       | 25786      | 101114    | both         |
-|AMD EPYC 7282 16-Core Processor                     | 3194  | 32      | 87199      | 769001    | both         |
-|AMD Ryzen 5 PRO 4650G with Radeon Graphics          | 3700  | 12      | 95356      | 704840    | both         |
-|Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz            | 4995  | 16      | 120064     | 1168943   | both         |
-|12th Gen Intel(R) Core(TM) i7-1270P                 | 4761  | 16      | 149778     | 641219    | both         |
-|AMD Ryzen 9 5950X 16-Core Processor                 | 4792  | 32      | 161690     | 2339763   | both         |
-|Apple Mac Studio M2 Ultra 2023, Linux VM guest      | 3500  | 16      | 163570     | 1157465   | both         |
-|AMD Ryzen 9 6900HS with Radeon Graphics             | 4676  | 16      | 62860      | 614404    | system       |
-|AMD Ryzen 9 6900HS with Radeon Graphics             | 4745  | 16      | 135501     | 991133    | both         |
-|AMD Ryzen 9 7950X3D 16-Core Processor               | 5400  | 32      | 71566      | 1566279   | system       |
-|AMD Ryzen 9 7950X3D 16-Core Processor               | 5478  | 32      | 161960     | 2173959   | both         |

benchmark/README.md

@@ -1,59 +0,0 @@
-# American Fuzzy Lop plus plus (AFL++)
-
-## benchmarking
-
-This directory contains benchmarking tools that allow you to compare one machine
-with another in terms of raw ability to execute a fuzzing target repeatedly.
-
-To achieve this, we use a sample program ("test-instr.c") where each path is
-equally likely, supply it a single seed, and tell AFL to exit after one run of
-deterministic mutations against that seed.
-
-**Note that this is not a real-world scenario!**
-Because the target does basically nothing this is rather a stress test on
-Kernel I/O / context switching.
-For this reason you will not see a difference if you run the multicore test
-with 20 or 40 threads - or even see the performance decline the more threads
-(`-f` parameter) you use. In a real-world scenario you can expect to gain
-exec/s until 40-60 threads (if you have that many available on your CPU).
-
-Usage example:
-
-```
-cd aflplusplus/benchmark
-python3 benchmark.py
- [*] Ready, starting benchmark...
- [*] Compiling the test-instr-persist-shmem fuzzing harness for the benchmark to use.
- [*] singlecore test-instr-persist-shmem run 1 of 2, execs/s: 124883.62
- [*] singlecore test-instr-persist-shmem run 2 of 2, execs/s: 126704.93
- [*] Average execs/sec for this test across all runs was: 125794.28
- [*] Using 16 fuzzers for multicore fuzzing (use --fuzzers to override).
- [*] multicore test-instr-persist-shmem run 1 of 2, execs/s: 1179822.66
- [*] multicore test-instr-persist-shmem run 2 of 2, execs/s: 1175584.09
- [*] Average execs/sec for this test across all runs was: 1177703.38
- [*] Results have been written to the benchmark-results.jsonl file.
- [*] Results have been written to the COMPARISON.md file.
-```
-
-By default, the script will use a number of parallel fuzzers equal to your
-available CPUs/threads (change with `--fuzzers`), and will perform each test
-three times and average the result (change with `--runs`).
-
-The script will use multicore fuzzing instead of singlecore by default (change
-with `--mode singlecore`) and use a persistent-mode shared memory harness for
-optimal speed (change with `--target test-instr`).
-
-Feel free to submit the resulting line for your CPU added to the COMPARISON.md
-and benchmark-results.jsonl files back to AFL++ in a pull request.
-
-Each run writes results to [benchmark-results.jsonl](benchmark-results.jsonl)
-in [JSON Lines](https://jsonlines.org/) format, ready to be pulled in to other
-tools such as [jq -cs](https://jqlang.github.io/jq/) or
-[pandas](https://pandas.pydata.org/) for analysis.
-
-## Data analysis
-
-There is sample data in [benchmark-results.jsonl](benchmark-results.jsonl), and
-a Jupyter notebook for exploring the results and suggesting their meaning at
-[benchmark.ipynb](benchmark.ipynb).
-

benchmark/benchmark-results.jsonl

@@ -1,424 +0,0 @@
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4788.77, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"singlecore": {"execs_per_sec": 9845.64, "execs_total": 98545, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4989.281, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"singlecore": {"execs_per_sec": 125682.73, "execs_total": 1257330, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4799.415, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 120293.77, "execs_total": 1203058, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4703.293, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 231429.96, "execs_total": 2314531, "fuzzers_used": 2}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4800.375, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 346759.33, "execs_total": 3468290, "fuzzers_used": 3}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4915.27, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 455340.06, "execs_total": 4554427, "fuzzers_used": 4}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4701.051, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 568405.15, "execs_total": 5685076, "fuzzers_used": 5}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4704.999, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 678030.96, "execs_total": 6781781, "fuzzers_used": 6}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4800.438, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 782585.04, "execs_total": 7827974, "fuzzers_used": 7}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4794.851, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 893618.35, "execs_total": 8938405, "fuzzers_used": 8}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.383, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 956026.15, "execs_total": 9562791, "fuzzers_used": 9}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.352, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 984942.13, "execs_total": 9853724, "fuzzers_used": 10}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4987.681, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1016758.62, "execs_total": 10172892, "fuzzers_used": 11}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.196, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1053087.9, "execs_total": 10536439, "fuzzers_used": 12}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.211, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1085797.87, "execs_total": 10865305, "fuzzers_used": 13}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.577, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1110640.2, "execs_total": 11114033, "fuzzers_used": 14}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4799.955, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1138984.22, "execs_total": 11397389, "fuzzers_used": 15}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.247, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1168943.19, "execs_total": 11699439, "fuzzers_used": 16}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4994.207, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1135093.91, "execs_total": 11360219, "fuzzers_used": 17}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4994.47, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1160430.45, "execs_total": 11614570, "fuzzers_used": 18}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4991.188, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1155769.97, "execs_total": 11569540, "fuzzers_used": 19}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.63, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1150156.26, "execs_total": 11509407, "fuzzers_used": 20}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.227, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1136873.58, "execs_total": 11377110, "fuzzers_used": 21}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.317, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1112404.25, "execs_total": 11134086, "fuzzers_used": 22}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5000.851, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1143131.72, "execs_total": 11440024, "fuzzers_used": 23}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.261, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1143931.38, "execs_total": 11448786, "fuzzers_used": 24}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.259, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1102090.61, "execs_total": 11028561, "fuzzers_used": 25}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.149, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1116518.7, "execs_total": 11172681, "fuzzers_used": 26}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4801.01, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1099224.19, "execs_total": 11000537, "fuzzers_used": 27}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.448, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1114945.37, "execs_total": 11158802, "fuzzers_used": 28}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.663, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1110889.91, "execs_total": 11118113, "fuzzers_used": 29}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.741, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1058548.28, "execs_total": 10595540, "fuzzers_used": 30}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.852, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1119804.85, "execs_total": 11208645, "fuzzers_used": 31}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.417, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1118828.99, "execs_total": 11197813, "fuzzers_used": 32}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5000.682, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1093426.61, "execs_total": 10942324, "fuzzers_used": 33}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.248, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1108123.59, "execs_total": 11090315, "fuzzers_used": 34}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.053, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1041486.52, "execs_total": 10422413, "fuzzers_used": 35}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.299, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1092395.61, "execs_total": 10932107, "fuzzers_used": 36}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.081, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"singlecore": {"execs_per_sec": 8278.64, "execs_total": 82894, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4994.118, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 90641.62, "execs_total": 906960, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.588, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 178184.19, "execs_total": 1782109, "fuzzers_used": 2}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.204, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 262652.86, "execs_total": 2627228, "fuzzers_used": 3}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.829, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 339119.32, "execs_total": 3391956, "fuzzers_used": 4}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.205, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 420239.94, "execs_total": 4202989, "fuzzers_used": 5}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.0, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 498062.02, "execs_total": 4981367, "fuzzers_used": 6}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5000.407, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 578495.44, "execs_total": 5786691, "fuzzers_used": 7}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5002.997, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 661836.22, "execs_total": 6620265, "fuzzers_used": 8}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.952, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 684808.49, "execs_total": 6850000, "fuzzers_used": 9}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.99, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 707094.65, "execs_total": 7074048, "fuzzers_used": 10}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.003, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 732106.17, "execs_total": 7325352, "fuzzers_used": 11}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.488, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 752910.17, "execs_total": 7533775, "fuzzers_used": 12}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5003.679, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 776179.85, "execs_total": 7767507, "fuzzers_used": 13}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.45, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 797520.58, "execs_total": 7981534, "fuzzers_used": 14}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.313, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 822235.41, "execs_total": 8228941, "fuzzers_used": 15}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.723, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 843897.51, "execs_total": 8445693, "fuzzers_used": 16}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.488, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 843177.15, "execs_total": 8438493, "fuzzers_used": 17}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.299, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 844779.09, "execs_total": 8456834, "fuzzers_used": 18}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.662, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 846060.74, "execs_total": 8465728, "fuzzers_used": 19}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.922, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 847556.23, "execs_total": 8482537, "fuzzers_used": 20}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.098, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 844022.97, "execs_total": 8447616, "fuzzers_used": 21}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.352, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 845818.7, "execs_total": 8464237, "fuzzers_used": 22}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.457, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 844118.27, "execs_total": 8448858, "fuzzers_used": 23}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.019, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 837189.02, "execs_total": 8379746, "fuzzers_used": 24}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.513, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 834712.31, "execs_total": 8354719, "fuzzers_used": 25}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.891, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 836344.12, "execs_total": 8370166, "fuzzers_used": 26}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.494, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 827784.91, "execs_total": 8283782, "fuzzers_used": 27}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.761, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 828641.27, "execs_total": 8293602, "fuzzers_used": 28}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.115, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 826123.67, "execs_total": 8268211, "fuzzers_used": 29}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4993.515, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 817765.77, "execs_total": 8184720, "fuzzers_used": 30}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.555, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 816556.66, "execs_total": 8171816, "fuzzers_used": 31}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.999, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 812661.77, "execs_total": 8132767, "fuzzers_used": 32}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.561, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 805352.16, "execs_total": 8060482, "fuzzers_used": 33}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.938, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 815888.26, "execs_total": 8164454, "fuzzers_used": 34}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.951, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 812348.56, "execs_total": 8129441, "fuzzers_used": 35}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4999.444, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 817278.03, "execs_total": 8178918, "fuzzers_used": 36}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.133, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 91247.98, "execs_total": 912571, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.029, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 177503.74, "execs_total": 1775569, "fuzzers_used": 2}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.516, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 263559.94, "execs_total": 2635863, "fuzzers_used": 3}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.946, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 339880.84, "execs_total": 3399660, "fuzzers_used": 4}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.539, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 418569.46, "execs_total": 4186780, "fuzzers_used": 5}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.53, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 496208.2, "execs_total": 4962992, "fuzzers_used": 6}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.015, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 580870.62, "execs_total": 5809953, "fuzzers_used": 7}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.662, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 662910.24, "execs_total": 6631172, "fuzzers_used": 8}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.8, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 683654.43, "execs_total": 6838092, "fuzzers_used": 9}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.849, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 707555.71, "execs_total": 7078261, "fuzzers_used": 10}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5007.628, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 732211.35, "execs_total": 7325661, "fuzzers_used": 11}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4981.601, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 756121.92, "execs_total": 7565074, "fuzzers_used": 12}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.041, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 774101.97, "execs_total": 7745053, "fuzzers_used": 13}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5004.554, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 796439.54, "execs_total": 7972225, "fuzzers_used": 14}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.433, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 822652.36, "execs_total": 8232836, "fuzzers_used": 15}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.063, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 846458.67, "execs_total": 8473949, "fuzzers_used": 16}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.85, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 847285.31, "execs_total": 8479183, "fuzzers_used": 17}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.627, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 847278.34, "execs_total": 8481577, "fuzzers_used": 18}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5002.007, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 849345.2, "execs_total": 8500890, "fuzzers_used": 19}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.497, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 848498.04, "execs_total": 8491840, "fuzzers_used": 20}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.084, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 848737.28, "execs_total": 8494747, "fuzzers_used": 21}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.872, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 847610.49, "execs_total": 8484864, "fuzzers_used": 22}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.036, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 846329.82, "execs_total": 8471670, "fuzzers_used": 23}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.731, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 839140.26, "execs_total": 8397496, "fuzzers_used": 24}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4988.743, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 843648.98, "execs_total": 8444091, "fuzzers_used": 25}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5004.084, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 835215.19, "execs_total": 8359949, "fuzzers_used": 26}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.828, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 833416.5, "execs_total": 8340275, "fuzzers_used": 27}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.795, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 826512.71, "execs_total": 8272574, "fuzzers_used": 28}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.022, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 828656.04, "execs_total": 8292856, "fuzzers_used": 29}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.939, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 823292.55, "execs_total": 8239885, "fuzzers_used": 30}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.233, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 824657.95, "execs_total": 8252812, "fuzzers_used": 31}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.909, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 817807.44, "execs_total": 8183838, "fuzzers_used": 32}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.834, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 815344.89, "execs_total": 8160193, "fuzzers_used": 33}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.968, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 814327.97, "execs_total": 8149984, "fuzzers_used": 34}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.625, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 819612.64, "execs_total": 8202605, "fuzzers_used": 35}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.404, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 813155.19, "execs_total": 8137546, "fuzzers_used": 36}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5001.911, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"singlecore": {"execs_per_sec": 8391.52, "execs_total": 83932, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4980.444, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"singlecore": {"execs_per_sec": 10754.79, "execs_total": 107720, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5000.011, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 126201.28, "execs_total": 1262139, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4993.941, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 245701.79, "execs_total": 2457750, "fuzzers_used": 2}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4983.297, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 361167.18, "execs_total": 3612273, "fuzzers_used": 3}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4994.008, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 475221.97, "execs_total": 4752815, "fuzzers_used": 4}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.977, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 586393.43, "execs_total": 5865460, "fuzzers_used": 5}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.97, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 690946.36, "execs_total": 6910846, "fuzzers_used": 6}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.017, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 801029.31, "execs_total": 8011774, "fuzzers_used": 7}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.617, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 913876.89, "execs_total": 9140715, "fuzzers_used": 8}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.997, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 946293.38, "execs_total": 9464848, "fuzzers_used": 9}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.162, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 980031.45, "execs_total": 9803628, "fuzzers_used": 10}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4994.223, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1015241.63, "execs_total": 10157948, "fuzzers_used": 11}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4994.761, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1042290.69, "execs_total": 10427527, "fuzzers_used": 12}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.045, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1073567.99, "execs_total": 10739590, "fuzzers_used": 13}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.484, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1119312.88, "execs_total": 11199130, "fuzzers_used": 14}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4994.729, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1156363.75, "execs_total": 11573213, "fuzzers_used": 15}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.146, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1183713.3, "execs_total": 11848245, "fuzzers_used": 16}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.048, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1187603.56, "execs_total": 11886825, "fuzzers_used": 17}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4986.845, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1190369.21, "execs_total": 11914954, "fuzzers_used": 18}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4985.364, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1188828.6, "execs_total": 11902947, "fuzzers_used": 19}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.108, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1187617.46, "execs_total": 11887934, "fuzzers_used": 20}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.754, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1188490.16, "execs_total": 11894967, "fuzzers_used": 21}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.129, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1184138.92, "execs_total": 11850653, "fuzzers_used": 22}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.048, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1189374.23, "execs_total": 11903803, "fuzzers_used": 23}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.261, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1178947.43, "execs_total": 11800850, "fuzzers_used": 24}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.422, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1173540.28, "execs_total": 11743120, "fuzzers_used": 25}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.909, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1168471.78, "execs_total": 11696401, "fuzzers_used": 26}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4966.966, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1169320.61, "execs_total": 11703900, "fuzzers_used": 27}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.207, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1165434.17, "execs_total": 11661131, "fuzzers_used": 28}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4999.554, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1161113.26, "execs_total": 11619771, "fuzzers_used": 29}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4994.822, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1155066.44, "execs_total": 11560147, "fuzzers_used": 30}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.061, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1145196.35, "execs_total": 11461349, "fuzzers_used": 31}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.006, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1151794.28, "execs_total": 11526764, "fuzzers_used": 32}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4995.939, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1151652.84, "execs_total": 11526720, "fuzzers_used": 33}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.002, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1153215.56, "execs_total": 11539780, "fuzzers_used": 34}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.456, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1146882.5, "execs_total": 11478112, "fuzzers_used": 35}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": false, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.183, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1155253.95, "execs_total": 11561694, "fuzzers_used": 36}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4848.974, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 10714.79, "execs_total": 107180, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.353, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 20493.07, "execs_total": 205279, "fuzzers_used": 2}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.198, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 29660.06, "execs_total": 297006, "fuzzers_used": 3}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.015, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 37875.57, "execs_total": 379078, "fuzzers_used": 4}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.975, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 46326.75, "execs_total": 463731, "fuzzers_used": 5}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.579, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 54595.48, "execs_total": 546283, "fuzzers_used": 6}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4983.814, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 62720.98, "execs_total": 628151, "fuzzers_used": 7}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.617, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 70777.99, "execs_total": 708505, "fuzzers_used": 8}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.286, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 74236.02, "execs_total": 743157, "fuzzers_used": 9}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4799.516, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 78134.94, "execs_total": 782272, "fuzzers_used": 10}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4911.536, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 81886.33, "execs_total": 819649, "fuzzers_used": 11}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.199, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 85923.44, "execs_total": 860033, "fuzzers_used": 12}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.447, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 89696.95, "execs_total": 897746, "fuzzers_used": 13}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.496, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 93540.52, "execs_total": 936217, "fuzzers_used": 14}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.936, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 97641.51, "execs_total": 977546, "fuzzers_used": 15}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4991.829, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 101692.65, "execs_total": 1017683, "fuzzers_used": 16}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.489, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 101236.75, "execs_total": 1013188, "fuzzers_used": 17}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.352, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 101006.28, "execs_total": 1011004, "fuzzers_used": 18}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4999.894, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 99952.26, "execs_total": 1000431, "fuzzers_used": 19}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4942.12, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 99798.64, "execs_total": 998795, "fuzzers_used": 20}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.686, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 99018.86, "execs_total": 991012, "fuzzers_used": 21}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.308, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 98600.87, "execs_total": 986643, "fuzzers_used": 22}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.683, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 98634.02, "execs_total": 987082, "fuzzers_used": 23}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.457, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 98352.9, "execs_total": 984071, "fuzzers_used": 24}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.733, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 98118.63, "execs_total": 981865, "fuzzers_used": 25}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4994.474, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 97752.45, "execs_total": 978192, "fuzzers_used": 26}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4853.378, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 97864.07, "execs_total": 979334, "fuzzers_used": 27}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.484, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 97821.8, "execs_total": 978814, "fuzzers_used": 28}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4996.738, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 97564.87, "execs_total": 976335, "fuzzers_used": 29}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.341, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 98508.1, "execs_total": 985853, "fuzzers_used": 30}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.773, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 98238.96, "execs_total": 983062, "fuzzers_used": 31}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.037, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 98363.93, "execs_total": 984411, "fuzzers_used": 32}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.448, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 96758.69, "execs_total": 968157, "fuzzers_used": 33}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.238, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 96327.0, "execs_total": 964046, "fuzzers_used": 34}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4997.619, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 95913.98, "execs_total": 959817, "fuzzers_used": 35}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "i9-9900k, 16GB DDR4-3000, Arch Linux", "compiler": "clang version 16.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4998.076, "cpu_model": "Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz", "cpu_threads": 16}, "targets": {"test-instr": {"multicore": {"execs_per_sec": 95871.39, "execs_total": 959318, "fuzzers_used": 36}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr": {"singlecore": {"execs_per_sec": 5741.89, "execs_total": 57505, "fuzzers_used": 1}}, "test-instr-persist-shmem": {"singlecore": {"execs_per_sec": 163570.34, "execs_total": 1635867, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 164224.43, "execs_total": 1642737, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 167222.58, "execs_total": 1672393, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 306547.24, "execs_total": 3065934, "fuzzers_used": 2}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 436010.2, "execs_total": 4360827, "fuzzers_used": 3}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 536415.92, "execs_total": 5365101, "fuzzers_used": 4}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 622104.43, "execs_total": 6222784, "fuzzers_used": 5}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 729436.2, "execs_total": 7295214, "fuzzers_used": 6}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 820258.88, "execs_total": 8203409, "fuzzers_used": 7}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 884746.31, "execs_total": 8848458, "fuzzers_used": 8}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 947308.55, "execs_total": 9474351, "fuzzers_used": 9}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 985953.62, "execs_total": 9860922, "fuzzers_used": 10}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1009716.71, "execs_total": 10098454, "fuzzers_used": 11}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1041437.1, "execs_total": 10415844, "fuzzers_used": 12}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1068180.17, "execs_total": 10683116, "fuzzers_used": 13}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1108873.82, "execs_total": 11089926, "fuzzers_used": 14}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1134135.0, "execs_total": 11354464, "fuzzers_used": 15}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1157465.79, "execs_total": 11582583, "fuzzers_used": 16}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1122785.14, "execs_total": 11235138, "fuzzers_used": 17}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1094132.3, "execs_total": 10950326, "fuzzers_used": 18}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1041102.04, "execs_total": 10420102, "fuzzers_used": 19}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1022474.0, "execs_total": 10236560, "fuzzers_used": 20}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 960681.48, "execs_total": 9618077, "fuzzers_used": 21}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 853680.22, "execs_total": 8545665, "fuzzers_used": 22}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 799719.75, "execs_total": 8005071, "fuzzers_used": 23}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 797512.71, "execs_total": 7983371, "fuzzers_used": 24}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 659476.15, "execs_total": 6601599, "fuzzers_used": 25}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 560625.96, "execs_total": 5612503, "fuzzers_used": 26}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 537839.62, "execs_total": 5381649, "fuzzers_used": 27}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 510072.53, "execs_total": 5106056, "fuzzers_used": 28}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 408667.49, "execs_total": 4091795, "fuzzers_used": 29}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 453849.79, "execs_total": 4542311, "fuzzers_used": 30}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 405935.72, "execs_total": 4064268, "fuzzers_used": 31}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 579312.77, "execs_total": 5798912, "fuzzers_used": 32}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 470961.79, "execs_total": 4715503, "fuzzers_used": 33}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 436380.3, "execs_total": 4368099, "fuzzers_used": 34}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 439819.17, "execs_total": 4405705, "fuzzers_used": 35}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "Apple Mac Studio M2 Ultra 2023, Linux VM guest, 16 threads assigned to VM", "compiler": "Ubuntu clang version 16.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3500.0, "cpu_model": "Apple Mac Studio M2 Ultra 2023", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 407460.31, "execs_total": 4084528, "fuzzers_used": 36}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3514.326, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 119469.35, "execs_total": 1194813, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.748, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 237177.2, "execs_total": 2372250, "fuzzers_used": 2}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3455.647, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 358305.9, "execs_total": 3583655, "fuzzers_used": 3}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.67, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 475974.21, "execs_total": 4760218, "fuzzers_used": 4}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.813, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 594372.12, "execs_total": 5944793, "fuzzers_used": 5}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3584.545, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 711732.18, "execs_total": 7118626, "fuzzers_used": 6}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.377, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 824314.1, "execs_total": 8245020, "fuzzers_used": 7}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.535, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 936358.89, "execs_total": 9365349, "fuzzers_used": 8}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3469.977, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1010050.77, "execs_total": 10102421, "fuzzers_used": 9}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.644, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1087333.72, "execs_total": 10875294, "fuzzers_used": 10}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3473.935, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1180500.37, "execs_total": 11807345, "fuzzers_used": 11}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3334.193, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1284695.8, "execs_total": 12849848, "fuzzers_used": 12}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3436.186, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1377659.89, "execs_total": 13779252, "fuzzers_used": 13}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.27, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1471828.49, "execs_total": 14721973, "fuzzers_used": 14}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3466.893, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1557812.41, "execs_total": 15581135, "fuzzers_used": 15}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3561.127, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1634678.08, "execs_total": 16349952, "fuzzers_used": 16}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.848, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1518908.2, "execs_total": 15192488, "fuzzers_used": 17}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3591.34, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1470513.71, "execs_total": 14709207, "fuzzers_used": 18}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.619, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1414625.05, "execs_total": 14156400, "fuzzers_used": 19}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.99, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1355481.53, "execs_total": 13565462, "fuzzers_used": 20}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.232, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1292684.55, "execs_total": 12934801, "fuzzers_used": 21}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3442.34, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1234478.66, "execs_total": 12352256, "fuzzers_used": 22}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.796, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1174550.37, "execs_total": 11752094, "fuzzers_used": 23}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3494.124, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1125218.66, "execs_total": 11258330, "fuzzers_used": 24}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3350.261, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1022021.81, "execs_total": 10226548, "fuzzers_used": 25}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.929, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 990339.75, "execs_total": 9908883, "fuzzers_used": 26}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3484.153, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 953861.38, "execs_total": 9543479, "fuzzers_used": 27}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3393.24, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 942151.65, "execs_total": 9426176, "fuzzers_used": 28}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3434.881, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 927072.1, "execs_total": 9275954, "fuzzers_used": 29}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3444.453, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 908669.71, "execs_total": 9092225, "fuzzers_used": 30}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3442.593, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 893432.26, "execs_total": 8938840, "fuzzers_used": 31}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3380.389, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 876618.01, "execs_total": 8770325, "fuzzers_used": 32}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3586.135, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 834676.33, "execs_total": 8350992, "fuzzers_used": 33}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.956, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 830200.25, "execs_total": 8306463, "fuzzers_used": 34}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.94, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 821667.96, "execs_total": 8220135, "fuzzers_used": 35}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3591.052, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 829075.87, "execs_total": 8294543, "fuzzers_used": 36}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3573.541, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 814422.62, "execs_total": 8148191, "fuzzers_used": 37}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.902, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 806770.85, "execs_total": 8071030, "fuzzers_used": 38}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3488.496, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 794433.8, "execs_total": 7947600, "fuzzers_used": 39}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3470.314, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 781022.61, "execs_total": 7813248, "fuzzers_used": 40}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.761, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 754394.26, "execs_total": 7546321, "fuzzers_used": 41}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.125, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 763116.33, "execs_total": 7634125, "fuzzers_used": 42}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.437, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 759323.54, "execs_total": 7596118, "fuzzers_used": 43}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.079, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 764198.14, "execs_total": 7644920, "fuzzers_used": 44}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.619, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 757777.51, "execs_total": 7580317, "fuzzers_used": 45}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3425.09, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 749357.06, "execs_total": 7496189, "fuzzers_used": 46}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.567, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 732083.87, "execs_total": 7323543, "fuzzers_used": 47}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.365, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 721133.28, "execs_total": 7214084, "fuzzers_used": 48}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.699, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 658925.82, "execs_total": 6591967, "fuzzers_used": 49}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.889, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 659890.97, "execs_total": 6601888, "fuzzers_used": 50}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3381.676, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 655176.63, "execs_total": 6554987, "fuzzers_used": 51}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3587.51, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 660889.12, "execs_total": 6612265, "fuzzers_used": 52}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3546.407, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 651803.54, "execs_total": 6520961, "fuzzers_used": 53}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3439.83, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 659012.17, "execs_total": 6593396, "fuzzers_used": 54}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3387.899, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 660016.18, "execs_total": 6603558, "fuzzers_used": 55}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3444.077, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 655931.36, "execs_total": 6561865, "fuzzers_used": 56}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.775, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 618906.23, "execs_total": 6192465, "fuzzers_used": 57}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.33, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 614008.28, "execs_total": 6143464, "fuzzers_used": 58}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.487, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 622400.85, "execs_total": 6227304, "fuzzers_used": 59}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.123, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 624883.06, "execs_total": 6251875, "fuzzers_used": 60}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3590.657, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 628668.94, "execs_total": 6289966, "fuzzers_used": 61}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.335, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 628892.17, "execs_total": 6292361, "fuzzers_used": 62}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.368, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 622065.07, "execs_total": 6224119, "fuzzers_used": 63}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3413.262, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 625528.06, "execs_total": 6258762, "fuzzers_used": 64}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.18, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 602248.19, "execs_total": 6025927, "fuzzers_used": 65}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3591.981, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 597615.89, "execs_total": 5979708, "fuzzers_used": 66}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3600.012, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 607270.98, "execs_total": 6076233, "fuzzers_used": 67}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3507.753, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 608945.09, "execs_total": 6092446, "fuzzers_used": 68}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.845, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 611736.03, "execs_total": 6121207, "fuzzers_used": 69}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3412.629, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 615031.23, "execs_total": 6153592, "fuzzers_used": 70}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3443.261, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 608202.64, "execs_total": 6084885, "fuzzers_used": 71}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.439, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 614339.09, "execs_total": 6146152, "fuzzers_used": 72}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3379.556, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 587046.59, "execs_total": 5873881, "fuzzers_used": 73}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.574, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 587238.27, "execs_total": 5875646, "fuzzers_used": 74}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.098, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 594097.56, "execs_total": 5944036, "fuzzers_used": 75}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3587.762, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 598450.35, "execs_total": 5987756, "fuzzers_used": 76}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.629, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 600430.29, "execs_total": 6007598, "fuzzers_used": 77}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3362.161, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 602014.19, "execs_total": 6023649, "fuzzers_used": 78}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3588.173, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 606146.9, "execs_total": 6065033, "fuzzers_used": 79}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3591.159, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 599360.46, "execs_total": 5997023, "fuzzers_used": 80}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3503.299, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 574792.78, "execs_total": 5751470, "fuzzers_used": 81}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3584.593, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 578265.29, "execs_total": 5785927, "fuzzers_used": 82}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3401.073, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 589985.07, "execs_total": 5903506, "fuzzers_used": 83}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3468.764, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 589281.87, "execs_total": 5895767, "fuzzers_used": 84}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3466.115, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 596581.77, "execs_total": 5969747, "fuzzers_used": 85}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3590.706, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 589017.68, "execs_total": 5893108, "fuzzers_used": 86}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3521.556, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 593403.75, "execs_total": 5937422, "fuzzers_used": 87}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.254, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 601611.06, "execs_total": 6019864, "fuzzers_used": 88}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.211, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 576056.15, "execs_total": 5763322, "fuzzers_used": 89}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.489, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 576151.97, "execs_total": 5764687, "fuzzers_used": 90}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.444, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 583769.1, "execs_total": 5841115, "fuzzers_used": 91}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3446.364, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 585285.47, "execs_total": 5856103, "fuzzers_used": 92}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3562.852, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 581524.67, "execs_total": 5818808, "fuzzers_used": 93}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.403, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 596383.31, "execs_total": 5967460, "fuzzers_used": 94}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3421.421, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 596239.29, "execs_total": 5965882, "fuzzers_used": 95}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3276.519, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 595382.67, "execs_total": 5957136, "fuzzers_used": 96}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.029, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 586144.68, "execs_total": 5865411, "fuzzers_used": 97}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3590.48, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 579467.06, "execs_total": 5798123, "fuzzers_used": 98}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.89, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 572801.45, "execs_total": 5731838, "fuzzers_used": 99}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.31, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 573916.1, "execs_total": 5742901, "fuzzers_used": 100}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3589.943, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 565823.06, "execs_total": 5660910, "fuzzers_used": 101}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3391.191, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 561854.84, "execs_total": 5621778, "fuzzers_used": 102}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3372.775, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 562717.02, "execs_total": 5630085, "fuzzers_used": 103}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3365.142, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 559273.67, "execs_total": 5596400, "fuzzers_used": 104}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3591.44, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 553209.58, "execs_total": 5535044, "fuzzers_used": 105}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3563.12, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 547678.42, "execs_total": 5480061, "fuzzers_used": 106}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3477.381, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 552316.36, "execs_total": 5526570, "fuzzers_used": 107}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.467, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 545257.97, "execs_total": 5455157, "fuzzers_used": 108}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3344.258, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 549190.03, "execs_total": 5495511, "fuzzers_used": 109}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3421.467, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 546845.0, "execs_total": 5472086, "fuzzers_used": 110}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.157, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 545239.46, "execs_total": 5455236, "fuzzers_used": 111}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.389, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 543139.24, "execs_total": 5434484, "fuzzers_used": 112}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3461.931, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 543252.43, "execs_total": 5435319, "fuzzers_used": 113}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3354.728, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 538720.77, "execs_total": 5390315, "fuzzers_used": 114}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.185, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 536681.55, "execs_total": 5369963, "fuzzers_used": 115}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.862, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 540956.43, "execs_total": 5412850, "fuzzers_used": 116}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.403, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 536348.84, "execs_total": 5367054, "fuzzers_used": 117}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.449, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 534734.41, "execs_total": 5350358, "fuzzers_used": 118}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.736, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 536060.28, "execs_total": 5363892, "fuzzers_used": 119}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3590.738, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 533480.83, "execs_total": 5338193, "fuzzers_used": 120}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.482, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 514271.98, "execs_total": 5145571, "fuzzers_used": 121}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.864, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 503271.79, "execs_total": 5035794, "fuzzers_used": 122}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3586.097, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 496011.52, "execs_total": 4963063, "fuzzers_used": 123}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3587.507, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 490784.42, "execs_total": 4910734, "fuzzers_used": 124}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.718, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 488441.09, "execs_total": 4887140, "fuzzers_used": 125}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.035, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 481281.33, "execs_total": 4815386, "fuzzers_used": 126}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.332, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 469294.96, "execs_total": 4695183, "fuzzers_used": 127}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3589.346, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 465563.78, "execs_total": 4657841, "fuzzers_used": 128}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.943, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 459922.67, "execs_total": 4601391, "fuzzers_used": 129}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3280.928, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 459384.3, "execs_total": 4596590, "fuzzers_used": 130}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.875, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 453310.58, "execs_total": 4535383, "fuzzers_used": 131}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3600.179, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 460246.7, "execs_total": 4604954, "fuzzers_used": 132}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3601.396, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 457201.82, "execs_total": 4574474, "fuzzers_used": 133}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3600.942, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 452487.43, "execs_total": 4527226, "fuzzers_used": 134}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3458.573, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 450514.18, "execs_total": 4507745, "fuzzers_used": 135}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.922, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 449479.52, "execs_total": 4496843, "fuzzers_used": 136}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.911, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 444691.06, "execs_total": 4449491, "fuzzers_used": 137}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.654, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 443497.81, "execs_total": 4437339, "fuzzers_used": 138}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.626, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 437981.1, "execs_total": 4382263, "fuzzers_used": 139}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.124, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 443055.68, "execs_total": 4432987, "fuzzers_used": 140}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.978, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 438908.41, "execs_total": 4391393, "fuzzers_used": 141}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3453.125, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 442841.02, "execs_total": 4430878, "fuzzers_used": 142}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3214.708, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 441891.92, "execs_total": 4421776, "fuzzers_used": 143}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.764, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 441860.76, "execs_total": 4421068, "fuzzers_used": 144}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3443.44, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 426935.73, "execs_total": 4272029, "fuzzers_used": 145}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3586.383, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 427322.41, "execs_total": 4275938, "fuzzers_used": 146}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3424.014, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 426914.69, "execs_total": 4271924, "fuzzers_used": 147}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.58, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 433246.64, "execs_total": 4335165, "fuzzers_used": 148}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.546, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 435016.77, "execs_total": 4352822, "fuzzers_used": 149}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.587, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 432197.7, "execs_total": 4324740, "fuzzers_used": 150}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3537.464, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 434928.88, "execs_total": 4351767, "fuzzers_used": 151}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.135, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 435174.29, "execs_total": 4354184, "fuzzers_used": 152}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3371.959, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 426852.22, "execs_total": 4271150, "fuzzers_used": 153}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.413, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 431241.89, "execs_total": 4315307, "fuzzers_used": 154}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3590.69, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 430842.14, "execs_total": 4311025, "fuzzers_used": 155}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3591.29, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 434156.3, "execs_total": 4344575, "fuzzers_used": 156}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3583.517, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 430896.1, "execs_total": 4311642, "fuzzers_used": 157}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.926, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 435704.89, "execs_total": 4360326, "fuzzers_used": 158}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.395, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 438155.8, "execs_total": 4384203, "fuzzers_used": 159}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3396.521, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 442883.53, "execs_total": 4432039, "fuzzers_used": 160}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.95, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 433993.37, "execs_total": 4342838, "fuzzers_used": 161}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.614, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 437174.96, "execs_total": 4374708, "fuzzers_used": 162}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.894, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 435745.93, "execs_total": 4360320, "fuzzers_used": 163}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.633, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 441564.58, "execs_total": 4418619, "fuzzers_used": 164}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.069, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 445500.18, "execs_total": 4457810, "fuzzers_used": 165}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3581.223, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 445887.53, "execs_total": 4461995, "fuzzers_used": 166}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.249, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 443509.97, "execs_total": 4438012, "fuzzers_used": 167}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.106, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 446851.67, "execs_total": 4471572, "fuzzers_used": 168}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3417.764, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 447685.22, "execs_total": 4479536, "fuzzers_used": 169}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3589.058, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 446730.72, "execs_total": 4470322, "fuzzers_used": 170}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.116, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 448668.48, "execs_total": 4489967, "fuzzers_used": 171}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3587.905, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 450972.11, "execs_total": 4513110, "fuzzers_used": 172}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.114, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 450615.23, "execs_total": 4509271, "fuzzers_used": 173}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.851, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 458016.89, "execs_total": 4583318, "fuzzers_used": 174}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.106, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 460677.5, "execs_total": 4609716, "fuzzers_used": 175}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3374.143, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 460763.9, "execs_total": 4610640, "fuzzers_used": 176}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.42, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 452298.55, "execs_total": 4526006, "fuzzers_used": 177}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.801, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 456748.89, "execs_total": 4570571, "fuzzers_used": 178}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.709, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 451289.94, "execs_total": 4516046, "fuzzers_used": 179}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.769, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 463235.15, "execs_total": 4635628, "fuzzers_used": 180}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3330.854, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 464366.11, "execs_total": 4646649, "fuzzers_used": 181}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.585, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 469453.17, "execs_total": 4697909, "fuzzers_used": 182}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.242, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 467300.47, "execs_total": 4676077, "fuzzers_used": 183}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.952, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 475115.57, "execs_total": 4754150, "fuzzers_used": 184}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3583.539, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 472179.98, "execs_total": 4724913, "fuzzers_used": 185}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3598.57, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 465528.62, "execs_total": 4658439, "fuzzers_used": 186}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3587.126, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 476194.69, "execs_total": 4765385, "fuzzers_used": 187}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3423.033, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 475886.86, "execs_total": 4762069, "fuzzers_used": 188}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.32, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 473599.91, "execs_total": 4739128, "fuzzers_used": 189}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3597.599, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 476949.52, "execs_total": 4772500, "fuzzers_used": 190}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3437.101, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 474259.76, "execs_total": 4745505, "fuzzers_used": 191}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "AWS EC2 r6a.48xlarge spot instance", "compiler": "clang version 15.0.7 (Amazon Linux 15.0.7-3.amzn2023.0.1)", "target_arch": "x86_64-amazon-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3599.17, "cpu_model": "AMD EPYC 7R13 Processor", "cpu_threads": 192}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 479848.23, "execs_total": 4801111, "fuzzers_used": 192}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "", "compiler": "Debian clang version 17.0.4 (++20231031083102+309d55140c46-1~exp1~20231031083155.63)", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4761.063, "cpu_model": "12th Gen Intel(R) Core(TM) i7-1270P", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 641219.02, "execs_total": 19251242, "fuzzers_used": 16}, "singlecore": {"execs_per_sec": 149778.22, "execs_total": 4493796, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "", "compiler": "Ubuntu clang version 17.0.2 (++20231003073128+b2417f51dbbd-1~exp1~20231003073233.51)", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3193.942, "cpu_model": "AMD EPYC 7282 16-Core Processor", "cpu_threads": 64}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 769000.8, "execs_total": 23084516, "fuzzers_used": 32}, "singlecore": {"execs_per_sec": 87198.85, "execs_total": 2616227, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.08a", "comment": "", "compiler": "Ubuntu clang version 14.0.0-1ubuntu1.1", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 3700.0, "cpu_model": "AMD Ryzen 5 PRO 4650G with Radeon Graphics", "cpu_threads": 12}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 704840.16, "execs_total": 21163992, "fuzzers_used": 12}, "singlecore": {"execs_per_sec": 95356.14, "execs_total": 2862114, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.09a", "comment": "", "compiler": "Debian clang version 14.0.6", "target_arch": "aarch64-unknown-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 2400.0, "cpu_model": "Raspberry Pi 5", "cpu_threads": 4}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 101114.23, "execs_total": 3036637, "fuzzers_used": 4}, "singlecore": {"execs_per_sec": 25786.11, "execs_total": 774460, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.07a", "comment": "", "compiler": "Debian clang version 17.0.0 (++20230417071830+ae77aceba5ad-1~exp1~20230417071935.630)", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4792.073, "cpu_model": "AMD Ryzen 9 5950X 16-Core Processor", "cpu_threads": 32}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 2339762.91, "execs_total": 70253164, "fuzzers_used": 32}, "singlecore": {"execs_per_sec": 161690.07, "execs_total": 4851838, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.10c", "comment": "", "compiler": "clang version 17.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4675.949, "cpu_model": "AMD Ryzen 9 6900HS with Radeon Graphics", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 614403.91, "execs_total": 18435083, "fuzzers_used": 16}, "singlecore": {"execs_per_sec": 62859.9, "execs_total": 1886111, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.10c", "comment": "", "compiler": "clang version 17.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 4744.522, "cpu_model": "AMD Ryzen 9 6900HS with Radeon Graphics", "cpu_threads": 16}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 991132.96, "execs_total": 29737588, "fuzzers_used": 16}, "singlecore": {"execs_per_sec": 135501.07, "execs_total": 4066116, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": false, "afl_system_config": true, "afl_version": "++4.10c", "comment": "", "compiler": "Ubuntu clang version 14.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5399.822, "cpu_model": "AMD Ryzen 9 7950X3D 16-Core Processor", "cpu_threads": 32}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 1566279.42, "execs_total": 46994452, "fuzzers_used": 32}, "singlecore": {"execs_per_sec": 71565.56, "execs_total": 2147396, "fuzzers_used": 1}}}}
-{"config": {"afl_persistent_config": true, "afl_system_config": true, "afl_version": "++4.10c", "comment": "", "compiler": "clang version 17.0.6", "target_arch": "x86_64-pc-linux-gnu"}, "hardware": {"cpu_fastest_core_mhz": 5478.258, "cpu_model": "AMD Ryzen 9 7950X3D 16-Core Processor", "cpu_threads": 32}, "targets": {"test-instr-persist-shmem": {"multicore": {"execs_per_sec": 2173959.15, "execs_total": 65229513, "fuzzers_used": 32}, "singlecore": {"execs_per_sec": 161960.29, "execs_total": 4859457, "fuzzers_used": 1}}}}

benchmark/benchmark.py

@@ -1,281 +0,0 @@
-#!/usr/bin/env python3
-# Part of the aflplusplus project, requires Python 3.8+.
-# Author: Chris Ball <chris@printf.net>, ported from Marc "van Hauser" Heuse's "benchmark.sh".
-import argparse, asyncio, json, multiprocessing, os, platform, re, shutil, sys
-from dataclasses import asdict, dataclass
-from decimal import Decimal
-from enum import Enum, auto
-from pathlib import Path
-from typing import Dict, List, Optional, Tuple
-
-blue   = lambda text: f"\033[1;94m{text}\033[0m"; gray = lambda text: f"\033[1;90m{text}\033[0m"
-green  = lambda text: f"\033[0;32m{text}\033[0m"; red  = lambda text: f"\033[0;31m{text}\033[0m"
-yellow = lambda text: f"\033[0;33m{text}\033[0m"
-
-class Mode(Enum):
-    multicore  = auto()
-    singlecore = auto()
-
-@dataclass
-class Target:
-    source: Path
-    binary: Path
-
-@dataclass
-class Run:
-    execs_per_sec: float
-    execs_total: float
-    fuzzers_used: int
-
-@dataclass
-class Config:
-    afl_persistent_config: bool
-    afl_system_config: bool
-    afl_version: Optional[str]
-    comment: str
-    compiler: str
-    target_arch: str
-
-@dataclass
-class Hardware:
-    cpu_fastest_core_mhz: float
-    cpu_model: str
-    cpu_threads: int
-
-@dataclass
-class Results:
-    config: Optional[Config]
-    hardware: Optional[Hardware]
-    targets: Dict[str, Dict[str, Optional[Run]]]
-
-all_modes = [Mode.singlecore, Mode.multicore]
-all_targets = [
-    Target(source=Path("../utils/persistent_mode/test-instr.c").resolve(), binary=Path("test-instr-persist-shmem")),
-    Target(source=Path("../test-instr.c").resolve(), binary=Path("test-instr"))
-]
-modes = [mode.name for mode in all_modes]
-targets = [str(target.binary) for target in all_targets]
-cpu_count = multiprocessing.cpu_count()
-env_vars = {
-    "AFL_DISABLE_TRIM": "1", "AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES": "1", "AFL_FAST_CAL": "1",
-    "AFL_NO_UI": "1", "AFL_TRY_AFFINITY": "1", "PATH": f'{str(Path("../").resolve())}:{os.environ["PATH"]}',
-}
-
-parser = argparse.ArgumentParser(formatter_class=argparse.ArgumentDefaultsHelpFormatter)
-parser.add_argument("-b", "--basedir", help="directory to use for temp files", type=str, default="/tmp/aflpp-benchmark")
-parser.add_argument("-d", "--debug", help="show verbose debugging output", action="store_true")
-parser.add_argument("-r", "--runs", help="how many runs to average results over", type=int, default=3)
-parser.add_argument("-f", "--fuzzers", help="how many afl-fuzz workers to use", type=int, default=cpu_count)
-parser.add_argument("-m", "--mode", help="pick modes", action="append", default=modes, choices=modes)
-parser.add_argument("-c", "--comment", help="add a comment about your setup", type=str, default="")
-parser.add_argument("--cpu", help="override the detected CPU model name", type=str, default="")
-parser.add_argument("--mhz", help="override the detected CPU MHz", type=str, default="")
-parser.add_argument(
-    "-t", "--target", help="pick targets", action="append", default=["test-instr-persist-shmem"], choices=targets
-)
-args = parser.parse_args()
-# Really unsatisfying argparse behavior: we want a default and to allow multiple choices, but if there's a manual choice
-# it should override the default.  Seems like we have to remove the default to get that and have correct help text?
-if len(args.target) > 1:
-    args.target = args.target[1:]
-if len(args.mode) > 2:
-    args.mode = args.mode[2:]
-
-chosen_modes = [mode for mode in all_modes if mode.name in args.mode]
-chosen_targets = [target for target in all_targets if str(target.binary) in args.target]
-results = Results(config=None, hardware=None, targets={
-    str(t.binary): {m.name: None for m in chosen_modes} for t in chosen_targets}
-)
-debug = lambda text: args.debug and print(blue(text))
-
-async def clean_up_tempfiles() -> None:
-    shutil.rmtree(f"{args.basedir}/in")
-    for target in chosen_targets:
-        target.binary.unlink()
-        for mode in chosen_modes:
-            shutil.rmtree(f"{args.basedir}/out-{mode.name}-{str(target.binary)}")
-
-async def check_afl_persistent() -> bool:
-    with open("/proc/cmdline", "r") as cmdline:
-        return "mitigations=off" in cmdline.read().strip().split(" ")
-
-async def check_afl_system() -> bool:
-    sysctl = next((s for s in ["sysctl", "/sbin/sysctl"] if shutil.which(s)), None)
-    if sysctl:
-        (returncode, stdout, _) = await run_command([sysctl, "kernel.randomize_va_space"])
-        return returncode == 0 and stdout.decode().rstrip().split(" = ")[1] == "0"
-    return False
-
-async def prep_env() -> None:
-    Path(f"{args.basedir}/in").mkdir(exist_ok=True, parents=True)
-    with open(f"{args.basedir}/in/in.txt", "wb") as seed:
-        seed.write(b"\x00" * 10240)
-
-async def compile_target(source: Path, binary: Path) -> None:
-    print(f" [*] Compiling the {binary} fuzzing harness for the benchmark to use.")
-    (returncode, stdout, stderr) = await run_command(
-        [str(Path("../afl-clang-lto").resolve()), "-o", str(Path(binary.resolve())), str(Path(source).resolve())]
-    )
-    if returncode == 0:
-        return
-    print(yellow(f" [*] afl-clang-lto was unable to compile; falling back to afl-cc."))
-    (returncode, stdout, stderr) = await run_command(
-        [str(Path("../afl-cc").resolve()), "-o", str(Path(binary.resolve())), str(Path(source).resolve())]
-    )
-    if returncode != 0:
-        sys.exit(red(f" [*] Error: afl-cc is unable to compile: {stderr.decode()} {stdout.decode()}"))
-
-async def run_command(cmd: List[str]) -> Tuple[Optional[int], bytes, bytes]:
-    debug(f"Launching command: {cmd} with env {env_vars}")
-    p = await asyncio.create_subprocess_exec(
-        *cmd, stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE, env=env_vars
-    )
-    stdout, stderr = await p.communicate()
-    debug(f"Output: {stdout.decode()} {stderr.decode()}")
-    return (p.returncode, stdout, stderr)
-
-async def check_deps() -> None:
-    if not (plat := platform.system()) == "Linux": sys.exit(red(f" [*] {plat} is not supported by this script yet."))
-    if not os.access(Path("../afl-fuzz").resolve(), os.X_OK) and os.access(Path("../afl-cc").resolve(), os.X_OK) and (
-        os.path.exists(Path("../SanitizerCoveragePCGUARD.so").resolve())):
-        sys.exit(red(" [*] Compile AFL++: we need afl-fuzz, afl-clang-fast and SanitizerCoveragePCGUARD.so built."))
-
-    (returncode, stdout, stderr) = await run_command([str(Path("../afl-cc").resolve()), "-v"])
-    if returncode != 0:
-        sys.exit(red(f" [*] Error: afl-cc -v returned: {stderr.decode()} {stdout.decode()}"))
-    compiler = ""
-    target_arch = ""
-    for line in stderr.decode().split("\n"):
-        if "clang version" in line:
-            compiler = line
-        elif m := re.match(r"^Target: (.*)", line):
-            target_arch = m.group(1)
-
-    # Pick some sample settings from afl-{persistent,system}-config to try to see whether they were run.
-    afl_pc = await check_afl_persistent()
-    afl_sc = await check_afl_system()
-    if not afl_pc:
-        print(yellow(f" [*] afl-persistent-config did not run; run it to improve performance (and decrease security)."))
-    if not afl_sc:
-        print(yellow(f" [*] afl-system-config did not run; run it to improve performance (and decrease security)."))
-    results.config = Config(afl_persistent_config=afl_pc, afl_system_config=afl_sc, afl_version="",
-                            comment=args.comment, compiler=compiler, target_arch=target_arch)
-
-async def colon_values(filename: str, searchKey: str) -> List[str]:
-    """Return a colon-separated value given a key in a file, e.g. 'cpu MHz         : 4976.109')"""
-    with open(filename, "r") as fh:
-        kv_pairs = (line.split(": ", 1) for line in fh if ": " in line)
-        v_list = [v.rstrip() for k, v in kv_pairs if k.rstrip() == searchKey]
-        return v_list
-
-async def describe_afl_config() -> str:
-   if results.config is None:
-       return "unknown"
-   elif results.config.afl_persistent_config and results.config.afl_system_config:
-       return "both"
-   elif results.config.afl_persistent_config:
-       return "persistent"
-   elif results.config.afl_system_config:
-       return "system"
-   else:
-       return "none"
-
-async def save_benchmark_results() -> None:
-    """Append a single row to the benchmark results in JSON Lines format (which is simple to write and diff)."""
-    with open("benchmark-results.jsonl", "a") as jsonfile:
-        json.dump(asdict(results), jsonfile, sort_keys=True)
-        jsonfile.write("\n")
-        print(blue(f" [*] Results have been written to the {jsonfile.name} file."))
-    with open("COMPARISON.md", "r+") as comparisonfile:
-        described_config = await describe_afl_config()
-        aflconfig = described_config.ljust(12)
-        if results.hardware is None:
-            return
-        cpu_model = results.hardware.cpu_model.ljust(51)
-        if cpu_model in comparisonfile.read():
-            print(blue(f" [*] Results have not been written to the COMPARISON.md file; this CPU is already present."))
-            return
-        cpu_mhz = str(round(results.hardware.cpu_fastest_core_mhz)).ljust(5)
-        if not "test-instr-persist-shmem" in results.targets or \
-           not "multicore" in results.targets["test-instr-persist-shmem"] or \
-           not "singlecore" in results.targets["test-instr-persist-shmem"] or \
-           results.targets["test-instr-persist-shmem"]["singlecore"] is None or \
-           results.targets["test-instr-persist-shmem"]["multicore"] is None:
-            return
-        single = str(round(results.targets["test-instr-persist-shmem"]["singlecore"].execs_per_sec)).ljust(10)
-        multi = str(round(results.targets["test-instr-persist-shmem"]["multicore"].execs_per_sec)).ljust(9)
-        cores = str(args.fuzzers).ljust(7)
-        comparisonfile.write(f"|{cpu_model} | {cpu_mhz} | {cores} | {single} | {multi} | {aflconfig} |\n")
-        print(blue(f" [*] Results have been written to the COMPARISON.md file."))
-    with open("COMPARISON.md", "r") as comparisonfile:
-        print(comparisonfile.read())
-
-
-async def main() -> None:
-    try:
-        await clean_up_tempfiles()
-    except FileNotFoundError:
-        pass
-    await check_deps()
-    if args.mhz:
-        cpu_mhz = float(args.mhz)
-    else:
-        cpu_mhz_str = await colon_values("/proc/cpuinfo", "cpu MHz")
-        if len(cpu_mhz_str) == 0:
-            cpu_mhz_str.append("0")
-        cpu_mhz = max([float(c) for c in cpu_mhz_str]) # use the fastest CPU MHz for now
-    if args.cpu:
-        cpu_model = [args.cpu]
-    else:
-        cpu_model = await colon_values("/proc/cpuinfo", "model name") or [""]
-    results.hardware = Hardware(cpu_fastest_core_mhz=cpu_mhz, cpu_model=cpu_model[0], cpu_threads=cpu_count)
-    await prep_env()
-    print(f" [*] Ready, starting benchmark...")
-    for target in chosen_targets:
-        await compile_target(target.source, target.binary)
-        binary = str(target.binary)
-        for mode in chosen_modes:
-            if mode == Mode.multicore:
-                print(blue(f" [*] Using {args.fuzzers} fuzzers for multicore fuzzing "), end="")
-                print(blue("(use --fuzzers to override)." if args.fuzzers == cpu_count else f"(the default is {cpu_count})"))
-            execs_per_sec, execs_total = ([] for _ in range(2))
-            for run_idx in range(0, args.runs):
-                print(gray(f" [*] {mode.name} {binary} run {run_idx+1} of {args.runs}, execs/s: "), end="", flush=True)
-                fuzzers = range(0, args.fuzzers if mode == Mode.multicore else 1)
-                outdir = f"{args.basedir}/out-{mode.name}-{binary}"
-                cmds = []
-                for fuzzer_idx, afl in enumerate(fuzzers):
-                    name = ["-o", outdir, "-M" if fuzzer_idx == 0 else "-S", str(afl)]
-                    cmds.append(["afl-fuzz", "-i", f"{args.basedir}/in"] + name + ["-s", "123", "-V10", "-D", f"./{binary}"])
-                # Prepare the afl-fuzz tasks, and then block while waiting for them to finish.
-                fuzztasks = [run_command(cmds[cpu]) for cpu in fuzzers]
-                await asyncio.gather(*fuzztasks)
-                afl_versions = await colon_values(f"{outdir}/0/fuzzer_stats", "afl_version")
-                if results.config:
-                    results.config.afl_version = afl_versions[0]
-                # Our score is the sum of all execs_per_sec entries in fuzzer_stats files for the run.
-                sectasks = [colon_values(f"{outdir}/{afl}/fuzzer_stats", "execs_per_sec") for afl in fuzzers]
-                all_execs_per_sec = await asyncio.gather(*sectasks)
-                execs = sum([Decimal(count[0]) for count in all_execs_per_sec])
-                print(green(execs))
-                execs_per_sec.append(execs)
-                # Also gather execs_total and total_run_time for this run.
-                exectasks = [colon_values(f"{outdir}/{afl}/fuzzer_stats", "execs_done") for afl in fuzzers]
-                all_execs_total = await asyncio.gather(*exectasks)
-                execs_total.append(sum([Decimal(count[0]) for count in all_execs_total]))
-
-            # (Using float() because Decimal() is not JSON-serializable.)
-            avg_afl_execs_per_sec = round(Decimal(sum(execs_per_sec) / len(execs_per_sec)), 2)
-            afl_execs_total = int(sum([Decimal(execs) for execs in execs_total]))
-            run = Run(execs_per_sec=float(avg_afl_execs_per_sec), execs_total=afl_execs_total, fuzzers_used=len(fuzzers))
-            results.targets[binary][mode.name] = run
-            print(f" [*] Average execs/sec for this test across all runs was: {green(avg_afl_execs_per_sec)}")
-            if (((max(execs_per_sec) - min(execs_per_sec)) / avg_afl_execs_per_sec) * 100) > 15:
-                print(yellow(" [*] The difference between your slowest and fastest runs was >15%, maybe try again?"))
-
-    await clean_up_tempfiles()
-    await save_benchmark_results()
-
-if __name__ == "__main__":
-    asyncio.run(main())
-

coresight_mode/.gitignore

@@ -1,2 +0,0 @@
-.local
-glibc*

coresight_mode/GNUmakefile

@@ -1,62 +0,0 @@
-#!/usr/bin/env make
-# SPDX-License-Identifier: Apache-2.0
-# Copyright 2021 Ricerca Security, Inc. All rights reserved.
-
-SHELL:=bash
-PREFIX?=$(shell pwd)/.local
-
-CS_TRACE:=coresight-trace
-
-PATCHELF?=$(PREFIX)/bin/patchelf
-
-PATCH_DIR:=patches
-
-GLIBC_VER:=2.33
-GLIBC_NAME:=glibc-$(GLIBC_VER)
-GLIBC_URL_BASE:=http://ftp.gnu.org/gnu/glibc
-GLIBC_LDSO?=$(PREFIX)/lib/ld-linux-aarch64.so.1
-
-OUTPUT?="$(TARGET).patched"
-
-all: build
-
-build:
-	git submodule update --init --recursive $(CS_TRACE)
-	$(MAKE) -C $(CS_TRACE)
-	cp $(CS_TRACE)/cs-proxy ../afl-cs-proxy
-
-patch: | $(PATCHELF) $(GLIBC_LDSO)
-	@if test -z "$(TARGET)"; then echo "TARGET is not set"; exit 1; fi
-	$(PATCHELF) \
-	  --set-interpreter $(GLIBC_LDSO) \
-	  --set-rpath $(dir $(GLIBC_LDSO)) \
-	  --output $(OUTPUT) \
-	  $(TARGET)
-
-$(PATCHELF): patchelf
-	git submodule update --init $<
-	cd $< && \
-	  ./bootstrap.sh && \
-	  ./configure --prefix=$(PREFIX) && \
-	  $(MAKE) && \
-	  $(MAKE) check && \
-	  $(MAKE) install
-
-$(GLIBC_LDSO): | $(GLIBC_NAME).tar.xz
-	tar -xf $(GLIBC_NAME).tar.xz
-	for file in $(shell find $(PATCH_DIR) -maxdepth 1 -type f); do \
-	  patch -p1 < $$file ; \
-	done
-	mkdir -p $(GLIBC_NAME)/build
-	cd $(GLIBC_NAME)/build && \
-	  ../configure --prefix=$(PREFIX) && \
-	  $(MAKE) && \
-	  $(MAKE) install
-
-$(GLIBC_NAME).tar.xz:
-	wget -qO $@ $(GLIBC_URL_BASE)/$@
-
-clean:
-	$(MAKE) -C $(CS_TRACE) clean
-
-.PHONY: all build patch clean

coresight_mode/Makefile

@@ -1,21 +0,0 @@
-#!/usr/bin/env make
-# SPDX-License-Identifier: Apache-2.0
-# Copyright 2021 Ricerca Security, Inc. All rights reserved.
-
-all:
-	@echo trying to use GNU make...
-	@gmake all || echo please install GNUmake
-
-build:
-	@echo trying to use GNU make...
-	@gmake build || echo please install GNUmake
-
-patch:
-	@echo trying to use GNU make...
-	@gmake patch || echo please install GNUmake
-
-clean:
-	@echo trying to use GNU make...
-	@gmake clean || echo please install GNUmake
-
-.PHONY: all build patch clean

coresight_mode/README.md

@@ -1,70 +0,0 @@
-# AFL++ CoreSight mode
-
-CoreSight mode enables binary-only fuzzing on ARM64 Linux using CoreSight (ARM's hardware tracing technology).
-
-NOTE: CoreSight mode is in the early development stage. Not applicable for production use.
-Currently the following hardware boards are supported:
-* NVIDIA Jetson TX2 (NVIDIA Parker)
-* NVIDIA Jetson Nano (NVIDIA Tegra X1)
-* GIGABYTE R181-T90 (Marvell ThunderX2 CN99XX)
-
-## Getting started
-
-Please read the [RICSec/coresight-trace README](https://github.com/RICSecLab/coresight-trace/blob/master/README.md) and check the prerequisites (capstone) before getting started.
-
-CoreSight mode supports the AFL++ fork server mode to reduce `exec` system call
-overhead. To support it for binary-only fuzzing, it needs to modify the target
-ELF binary to re-link to the patched glibc. We employ this design from
-[PTrix](https://github.com/junxzm1990/afl-pt).
-
-Check out all the git submodules in the `cs_mode` directory:
-
-```bash
-git submodule update --init --recursive
-```
-
-### Build coresight-trace
-
-There are some notes on building coresight-trace. Refer to the [README](https://github.com/RICSecLab/coresight-trace/blob/master/README.md) for the details. Run make in the `cs_mode` directory:
-
-```bash
-make build
-```
-
-Make sure `cs-proxy` is placed in the AFL++ root directory as `afl-cs-proxy`.
-
-### Patch COTS binary
-
-The fork server mode requires patchelf and the patched glibc. The dependency build can be done by just run make:
-
-```bash
-make patch TARGET=$BIN
-```
-
-The above make command builds and installs the dependencies to `$PREFIX` (default to `$PWD/.local`) at the first time. Then, it runs `patchelf` to `$BIN` with output `$OUTPUT` (`$BIN.patched` by default).
-
-### Run afl-fuzz
-
-Run `afl-fuzz` with `-A` option to use CoreSight mode.
-
-```bash
-sudo afl-fuzz -A -i input -o output -- $OUTPUT @@
-```
-
-## Environment Variables
-
-There are AFL++ CoreSight mode-specific environment variables for run-time configuration.
-
-* `AFL_CS_CUSTOM_BIN` overrides the proxy application path. `afl-cs-proxy` will be used if not defined.
-
-* `AFLCS_COV` specifies coverage type on CoreSight trace decoding. `edge` and `path` is supported. The default value is `edge`.
-* `AFLCS_UDMABUF` is the u-dma-buf device number used to store trace data in the DMA region. The default value is `0`.
-
-## TODO List
-
-* Eliminate modified glibc dependency
-* Support parallel fuzzing
-
-## Acknowledgements
-
-This project has received funding from the Acquisition, Technology & Logistics Agency (ATLA) under the National Security Technology Research Promotion Fund 2021 (JPJ004596).

coresight_mode/patches/0001-Add-AFL-forkserver.patch

@@ -1,117 +0,0 @@
-diff --git a/glibc-2.33/elf/rtld.c b/glibc-2.33/elf/rtld.c
-index 596b6ac3..2ee270d4 100644
---- a/glibc-2.33/elf/rtld.c
-+++ b/glibc-2.33/elf/rtld.c
-@@ -169,6 +169,99 @@ uintptr_t __pointer_chk_guard_local
- strong_alias (__pointer_chk_guard_local, __pointer_chk_guard)
- #endif
- 
-+#define AFLCS_RTLD 1
-+
-+#if AFLCS_RTLD
-+
-+#include <sys/shm.h>
-+#include <sys/types.h>
-+#include <sys/wait.h>
-+#include <dlfcn.h>
-+#include <signal.h>
-+
-+#include <asm/unistd.h>
-+#include <unistd.h>
-+
-+#define FORKSRV_FD 198
-+
-+#define AFLCS_ENABLE "__AFLCS_ENABLE"
-+
-+/* We use this additional AFLCS_# AFLCS_#+1 pair to communicate with proxy */
-+#define AFLCS_FORKSRV_FD (FORKSRV_FD - 3)
-+#define AFLCS_RTLD_SNIPPET do { __cs_start_forkserver(); } while(0)
-+
-+/* Fork server logic, invoked before we return from _dl_start. */
-+
-+static void __cs_start_forkserver(void) {
-+  int status;
-+  pid_t child_pid;
-+  static char tmp[4] = {0, 0, 0, 0};
-+
-+  if (!getenv(AFLCS_ENABLE)) {
-+    return;
-+  }
-+
-+  if (write(AFLCS_FORKSRV_FD + 1, tmp, 4) != 4) {
-+    _exit(-1);
-+  }
-+
-+  /* All right, let's await orders... */
-+  while (1) {
-+    /* Whoops, parent dead? */
-+    if (read(AFLCS_FORKSRV_FD, tmp, 4) != 4) {
-+      _exit(1);
-+    }
-+
-+    child_pid = INLINE_SYSCALL(clone, 5,
-+        CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID | SIGCHLD, 0,
-+        NULL, NULL, &THREAD_SELF->tid);
-+    if (child_pid < 0) {
-+      _exit(4);
-+    }
-+    if (!child_pid) {
-+      /* Child process. Wait for parent start tracing */
-+      kill(getpid(), SIGSTOP);
-+      /* Close descriptors and run free. */
-+      close(AFLCS_FORKSRV_FD);
-+      close(AFLCS_FORKSRV_FD + 1);
-+      return;
-+    }
-+
-+    /* Parent. */
-+    if (write(AFLCS_FORKSRV_FD + 1, &child_pid, 4) != 4) {
-+      _exit(5);
-+    }
-+
-+    /* Wait until SIGCONT is signaled. */
-+    if (waitpid(child_pid, &status, WCONTINUED) < 0) {
-+      _exit(6);
-+    }
-+    if (!WIFCONTINUED(status)) {
-+      /* Relay status to proxy. */
-+      if (write(AFLCS_FORKSRV_FD + 1, &status, 4) != 4) {
-+        _exit(7);
-+      }
-+      continue;
-+    }
-+    while (1) {
-+      /* Get status. */
-+      if (waitpid(child_pid, &status, WUNTRACED) < 0) {
-+        _exit(8);
-+      }
-+      /* Relay status to proxy. */
-+      if (write(AFLCS_FORKSRV_FD + 1, &status, 4) != 4) {
-+        _exit(9);
-+      }
-+      if (!(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP)) {
-+        /* The child process is exited. */
-+        break;
-+      }
-+    }
-+  }
-+}
-+
-+#endif /* AFLCS_RTLD */
-+
- /* Check that AT_SECURE=0, or that the passed name does not contain
-    directories and is not overly long.  Reject empty names
-    unconditionally.  */
-@@ -588,6 +681,12 @@ _dl_start (void *arg)
- # define ELF_MACHINE_START_ADDRESS(map, start) (start)
- #endif
- 
-+    /* AFL-CS-START */
-+#if AFLCS_RTLD
-+    AFLCS_RTLD_SNIPPET;
-+#endif
-+    /* AFL-CS-END */
-+
-     return ELF_MACHINE_START_ADDRESS (GL(dl_ns)[LM_ID_BASE]._ns_loaded, entry);
-   }
- }

custom_mutators/Android.bp

@@ -1,121 +0,0 @@
-cc_library_shared {
-  name: "libfuzzer-mutator",
-  vendor_available: true,
-  host_supported: true,
-
-  cflags: [
-    "-g",
-    "-O0",
-    "-funroll-loops",
-    "-fPIC",
-    "-fpermissive",
-    "-std=c++11",
-    "-Wno-unused-parameter",
-    "-Wno-unused-variable",
-  ],
-
-  srcs: [
-    "libfuzzer/FuzzerCrossOver.cpp",
-    "libfuzzer/FuzzerDataFlowTrace.cpp",
-    "libfuzzer/FuzzerDriver.cpp",
-    "libfuzzer/FuzzerExtFunctionsDlsym.cpp",
-    "libfuzzer/FuzzerExtFunctionsWeak.cpp",
-    "libfuzzer/FuzzerExtFunctionsWindows.cpp",
-    "libfuzzer/FuzzerExtraCounters.cpp",
-    "libfuzzer/FuzzerFork.cpp",
-    "libfuzzer/FuzzerIO.cpp",
-    "libfuzzer/FuzzerIOPosix.cpp",
-    "libfuzzer/FuzzerIOWindows.cpp",
-    "libfuzzer/FuzzerLoop.cpp",
-    "libfuzzer/FuzzerMerge.cpp",
-    "libfuzzer/FuzzerMutate.cpp",
-    "libfuzzer/FuzzerSHA1.cpp",
-    "libfuzzer/FuzzerTracePC.cpp",
-    "libfuzzer/FuzzerUtil.cpp",
-    "libfuzzer/FuzzerUtilDarwin.cpp",
-    "libfuzzer/FuzzerUtilFuchsia.cpp",
-    "libfuzzer/FuzzerUtilLinux.cpp",
-    "libfuzzer/FuzzerUtilPosix.cpp",
-    "libfuzzer/FuzzerUtilWindows.cpp",
-    "libfuzzer/libfuzzer.cpp",
-  ],
-
-  header_libs: [
-    "libafl_headers",
-  ],
-}
-
-/*cc_library_shared {
-  name: "honggfuzz-mutator",
-  vendor_available: true,
-  host_supported: true,
-
-  cflags: [
-    "-g",
-    "-O0",
-    "-funroll-loops",
-    "-fPIC",
-    "-Wl,-Bsymbolic",
-  ],
-
-  srcs: [
-    "honggfuzz/honggfuzz.c",
-    "honggfuzz/mangle.c",
-//    "../src/afl-perfomance.c",
-  ],
-
-  header_libs: [
-    "libafl_headers",
-  ],
-}*/
-
-cc_library_shared {
-  name: "radamsa-mutator",
-  vendor_available: true,
-  host_supported: true,
-
-  cflags: [
-    "-g",
-    "-O0",
-    "-funroll-loops",
-    "-fPIC",
-    "-Wno-unused-parameter",
-    "-Wno-unused-function",
-  ],
-
-  srcs: [
-    "radamsa/libradamsa.c",
-    "radamsa/radamsa-mutator.c",
-  ],
-
-  header_libs: [
-    "libafl_headers",
-  ],
-}
-
-cc_library_shared {
-  name: "symcc-mutator",
-  vendor_available: true,
-  host_supported: true,
-
-  cflags: [
-    "-g",
-    "-O0",
-    "-funroll-loops",
-    "-fPIC",
-    "-Wno-unused-parameter",
-    "-Wno-pointer-sign",
-  ],
-
-  srcs: [
-    "symcc/symcc.c",
-  ],
-
-  header_libs: [
-    "libafl_headers",
-  ],
-}
-
-subdirs = [
-  "libprotobuf-mutator-example",
-]

custom_mutators/README.md

@@ -1,17 +1,4 @@
-# Custom Mutators
-
-Custom mutators enhance and alter the mutation strategies of AFL++.
-For further information and documentation on how to write your own, read [the docs](../docs/custom_mutators.md).
-
-## Examples
-
-The `./examples` folder contains examples for custom mutators in python and C.
-
-## Rust
-
-In `./rust`, you will find rust bindings, including a simple example in `./rust/example` and an example for structured fuzzing, based on lain, in`./rust/example_lain`.
-
-## Production-Ready Custom Mutators
+# production ready custom mutators
 
 This directory holds ready to use custom mutators.
 Just type "make" in the individual subdirectories.
@@ -23,64 +10,3 @@ Use with e.g.
 and add `AFL_CUSTOM_MUTATOR_ONLY=1` if you only want to use the custom mutator.
 
 Multiple custom mutators can be used by separating their paths with `:` in the environment variable.
-
-### The AFL++ grammar agnostic grammar mutator
-
-In `./autotokens` you find a token-level fuzzer that does not need to know
-anything about the grammar of an input as long as it is in ascii and allows
-whitespace.
-It is very fast and effective.
-
-If you are looking for an example of how to effectively create a custom
-mutator take a look at this one.
-
-### The AFL++ Grammar Mutator
-
-If you use git to clone AFL++, then the following will incorporate our
-excellent grammar custom mutator:
-
-```sh
-git submodule update --init
-```
-
-Read the README in the [Grammar-Mutator] repository on how to use it.
-
-[Grammar-Mutator]: https://github.com/AFLplusplus/Grammar-Mutator
-
-Note that this custom mutator is not very good though!
-
-### Other Mutators
-
-atnwalk and gramatron are grammar custom mutators. Example grammars are
-provided.
-
-honggfuzz, libfuzzer and  libafl are partial implementations based on the
-mutator implementations of the respective fuzzers. 
-More for playing than serious usage.
-
-radamsa is slow and not very good.
-
-## 3rd Party Custom Mutators
-
-### Superion Mutators
-
-Adrian Tiron ported the Superion grammar fuzzer to AFL++, it is WIP and
-requires cmake (among other things):
-[https://github.com/adrian-rt/superion-mutator](https://github.com/adrian-rt/superion-mutator)
-
-### libprotobuf Mutators
-
-There are three WIP protobuf projects, that require work to be working though:
-
-ASN.1 example:
-[https://github.com/airbus-seclab/AFLplusplus-blogpost/tree/main/src/mutator](https://github.com/airbus-seclab/AFLplusplus-blogpost/tree/main/src/mutator)
-
-transforms protobuf raw:
-[https://github.com/bruce30262/libprotobuf-mutator_fuzzing_learning/tree/master/4_libprotobuf_aflpp_custom_mutator](https://github.com/bruce30262/libprotobuf-mutator_fuzzing_learning/tree/master/4_libprotobuf_aflpp_custom_mutator)
-
-has a transform function you need to fill for your protobuf format, however
-needs to be ported to the updated AFL++ custom mutator API (not much work):
-[https://github.com/thebabush/afl-libprotobuf-mutator](https://github.com/thebabush/afl-libprotobuf-mutator)
-
-same as above but is for current AFL++:
-[https://github.com/P1umer/AFLplusplus-protobuf-mutator](https://github.com/P1umer/AFLplusplus-protobuf-mutator)

custom_mutators/aflpp/Makefile

@@ -1,10 +0,0 @@
-
-CFLAGS = -O3 -funroll-loops -fPIC -Wl,-Bsymbolic
-
-all: aflpp-mutator.so
-
-aflpp-mutator.so:	aflpp.c
-	$(CC) $(CFLAGS) -I../../include -I. -shared -o aflpp-mutator.so aflpp.c ../../src/afl-performance.c
-
-clean:
-	rm -f *.o *~ *.so core

custom_mutators/aflpp/README.md

@@ -1,8 +0,0 @@
-# custum mutator: AFL++
-
-this is the AFL++ havoc mutator as a custom mutator module for AFL++.
-
-just type `make` to build
-
-```AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/aflpp/aflpp-mutator.so afl-fuzz ...```
-

custom_mutators/aflpp/aflpp.c

@@ -1,90 +0,0 @@
-#include "afl-fuzz.h"
-#include "afl-mutations.h"
-
-typedef struct my_mutator {
-
-  afl_state_t *afl;
-  u8          *buf;
-  u32          buf_size;
-
-} my_mutator_t;
-
-my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
-
-  (void)seed;
-
-  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  if ((data->buf = malloc(MAX_FILE)) == NULL) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  } else {
-
-    data->buf_size = MAX_FILE;
-
-  }
-
-  data->afl = afl;
-
-  return data;
-
-}
-
-/* here we run the AFL++ mutator, which is the best! */
-
-size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
-                       u8 **out_buf, uint8_t *add_buf, size_t add_buf_size,
-                       size_t max_size) {
-
-  if (max_size > data->buf_size) {
-
-    u8 *ptr = realloc(data->buf, max_size);
-
-    if (ptr) {
-
-      return 0;
-
-    } else {
-
-      data->buf = ptr;
-      data->buf_size = max_size;
-
-    }
-
-  }
-
-  u32 havoc_steps = 1 + rand_below(data->afl, 16);
-
-  /* set everything up, costly ... :( */
-  memcpy(data->buf, buf, buf_size);
-
-  /* the mutation */
-  u32 out_buf_len = afl_mutate(data->afl, data->buf, buf_size, havoc_steps,
-                               false, true, add_buf, add_buf_size, max_size);
-
-  /* return size of mutated data */
-  *out_buf = data->buf;
-  return out_buf_len;
-
-}
-
-/**
- * Deinitialize everything
- *
- * @param data The data ptr from afl_custom_init
- */
-void afl_custom_deinit(my_mutator_t *data) {
-
-  free(data->buf);
-  free(data);
-
-}
-

custom_mutators/aflpp/standalone/Makefile

@@ -1,10 +0,0 @@
-
-CFLAGS = -O3 -funroll-loops -fPIC
-
-all: aflpp-standalone
-
-aflpp-standalone:	aflpp-standalone.c
-	$(CC) $(CFLAGS) -I../../../include -I. -o aflpp-standalone aflpp-standalone.c ../../../src/afl-performance.c
-
-clean:
-	rm -f *.o *~ aflpp-standalone core

custom_mutators/aflpp/standalone/README.md

@@ -1,10 +0,0 @@
-# AFL++ standalone mutator
-
-this is the AFL++ havoc mutator as a standalone mutator
-
-just type `make` to build.
-
-```
-aflpp-standalone inputfile outputfile [splicefile]
-```
-

custom_mutators/aflpp/standalone/aflpp-standalone.c

@@ -1,163 +0,0 @@
-#include "afl-fuzz.h"
-#include "afl-mutations.h"
-
-typedef struct my_mutator {
-
-  afl_state_t *afl;
-  u8          *buf;
-  u32          buf_size;
-
-} my_mutator_t;
-
-my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
-
-  (void)seed;
-
-  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  if ((data->buf = malloc(1024*1024)) == NULL) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  } else {
-
-    data->buf_size = 1024*1024;
-
-  }
-
-  /* fake AFL++ state */
-  data->afl = calloc(1, sizeof(afl_state_t));
-  data->afl->queue_cycle = 1;
-  data->afl->fsrv.dev_urandom_fd = open("/dev/urandom", O_RDONLY);
-  if (data->afl->fsrv.dev_urandom_fd < 0) { PFATAL("Unable to open /dev/urandom"); }
-  rand_set_seed(data->afl, getpid());
-
-  return data;
-
-}
-
-/* here we run the AFL++ mutator, which is the best! */
-
-size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
-                       u8 **out_buf, uint8_t *add_buf, size_t add_buf_size,
-                       size_t max_size) {
-
-  if (max_size > data->buf_size) {
-
-    u8 *ptr = realloc(data->buf, max_size);
-
-    if (ptr) {
-
-      return 0;
-
-    } else {
-
-      data->buf = ptr;
-      data->buf_size = max_size;
-
-    }
-
-  }
-
-  u32 havoc_steps = 1 + rand_below(data->afl, 16);
-
-  /* set everything up, costly ... :( */
-  memcpy(data->buf, buf, buf_size);
-
-  /* the mutation */
-  u32 out_buf_len = afl_mutate(data->afl, data->buf, buf_size, havoc_steps,
-                               false, true, add_buf, add_buf_size, max_size);
-
-  /* return size of mutated data */
-  *out_buf = data->buf;
-  return out_buf_len;
-
-}
-
-int main(int argc, char *argv[]) {
-
-  if (argc > 1 && strncmp(argv[1], "-h", 2) == 0) {
-    printf("Syntax: %s [-v] [inputfile [outputfile [splicefile]]]\n\n", argv[0]);
-    printf("Reads a testcase from stdin when no input file (or '-') is specified,\n");
-    printf("mutates according to AFL++'s mutation engine, and write to stdout when '-' or\n");
-    printf("no output filename is given. As an optional third parameter you can give a file\n");
-    printf("for splicing. Maximum input and output length is 1MB.\n");
-    printf("The -v verbose option prints debug output to stderr.\n");
-    return 0;
-  }
-
-  FILE *in = stdin, *out = stdout, *splice = NULL;
-  unsigned char *inbuf = malloc(1024 * 1024), *outbuf, *splicebuf = NULL;
-  int verbose = 0, splicelen = 0;
-
-  if (argc > 1 && strcmp(argv[1], "-v") == 0) {
-    verbose = 1;
-    argc--;
-    argv++;
-    fprintf(stderr, "Verbose active\n");
-  }
-
-  my_mutator_t *data = afl_custom_init(NULL, 0);
-
-  if (argc > 1 && strcmp(argv[1], "-") != 0) {
-    if ((in = fopen(argv[1], "r")) == NULL) {
-      perror(argv[1]);
-      return -1;
-    }
-    if (verbose) fprintf(stderr, "Input: %s\n", argv[1]);
-  }
-
-  size_t inlen = fread(inbuf, 1, 1024*1024, in);
-  
-  if (!inlen) {
-    fprintf(stderr, "Error: empty file %s\n", argv[1] ? argv[1] : "stdin");
-    return -1;
-  }
-
-  if (argc > 2 && strcmp(argv[2], "-") != 0) {
-    if ((out = fopen(argv[2], "w")) == NULL) {
-      perror(argv[2]);
-      return -1;
-    }
-    if (verbose) fprintf(stderr, "Output: %s\n", argv[2]);
-  }
-
-  if (argc > 3) {
-    if ((splice = fopen(argv[3], "r")) == NULL) {
-      perror(argv[3]);
-      return -1;
-    }
-    if (verbose) fprintf(stderr, "Splice: %s\n", argv[3]);
-    splicebuf = malloc(1024*1024);
-    size_t splicelen = fread(splicebuf, 1, 1024*1024, splice);
-    if (!splicelen) {
-      fprintf(stderr, "Error: empty file %s\n", argv[3]);
-      return -1;
-    }
-    if (verbose) fprintf(stderr, "Mutation splice length: %zu\n", splicelen);
-  }
-
-  if (verbose) fprintf(stderr, "Mutation input length: %zu\n", inlen);
-  unsigned int outlen = afl_custom_fuzz(data, inbuf, inlen, &outbuf, splicebuf, splicelen, 1024*1024);
-
-  if (outlen == 0 || !outbuf) {
-    fprintf(stderr, "Error: no mutation data returned.\n");
-    return -1;
-  }
-
-  if (verbose) fprintf(stderr, "Mutation output length: %u\n", outlen);
-
-  if (fwrite(outbuf, 1, outlen, out) != outlen) {
-    fprintf(stderr, "Warning: incomplete write.\n");
-    return -1;
-  }
-  
-  return 0;
-}

custom_mutators/aflpp_tritondse/README.md

@@ -1,22 +0,0 @@
-# An AFL++ custom mutator using TritonDSE
-
-## Installing the requirements
-
-`pip3 install tritondse`
-
-## How to run with an example
-
-```
-../../afl-cc -o ../../test-instr ../../test-instr.c
-mkdir -p in
-echo aaaa > in/in
-AFL_DISABLE_TRIM=1 AFL_CUSTOM_MUTATOR_ONLY=1 AFL_SYNC_TIME=1 AFL_PYTHON_MODULE=aflpp_tritondse PYTHONPATH=. ../../afl-fuzz -i in -o out -- ../../test-instr
-```
-
-Note that this custom mutator works differently, new finds are synced
-after 10-60 seconds to the fuzzing instance. This is necessary because only
-C/C++ custom mutators have access to the internal AFL++ state.
-
-Note that you should run first with `AFL_DEBUG` for 5-10 minutes and see if
-all important libraries and syscalls are hooked (look at `WARNING` and `CRITICAL`
-output during the run, best use with `AFL_NO_UI=1`)

custom_mutators/aflpp_tritondse/aflpp_tritondse.py

@@ -1,220 +0,0 @@
-import sys
-import os
-import logging
-import hashlib
-
-from tritondse import CleLoader
-from tritondse import CompositeData
-from tritondse import Config
-from tritondse import CoverageStrategy
-from tritondse import ProcessState
-from tritondse import Program
-from tritondse import Seed
-from tritondse import SeedFormat
-from tritondse import SymbolicExecutor
-from tritondse import SymbolicExplorator
-
-is_debug = False
-out_path = ""
-input_file = None
-prog = None
-config = None
-dse = None
-cycle = 0
-count = 0
-finding = 0
-hashes = set()
-format = SeedFormat.RAW
-
-def pre_exec_hook(se: SymbolicExecutor, state: ProcessState):
-    global count
-    global hashes
-    global finding
-    if se.seed.hash not in hashes:
-        hashes.add(se.seed.hash)
-        finding = 1
-        filename = out_path + "/id:" + f"{count:06}" + "," + se.seed.hash
-        if not os.path.exists(filename):
-            if is_debug:
-                print('Creating queue input ' + filename)
-            with open(filename, 'wb') as file:
-                if input_file:
-                    file.write(se.seed.content.files[input_file])
-                else:
-                    file.write(se.seed.content)
-                count += 1
-    #if input_file:
-    #    if is_debug:
-    #        print('Writing to ' + input_file + ' the content: ' + str(se.seed.content))
-    #    with open(input_file, 'wb') as file:
-    #        file.write(se.seed.content)
-
-
-#def rtn_open(se: SymbolicExecutor, pstate: ProcessState, pc):
-#    """
-#    The open behavior.
-#    """
-#    logging.debug('open hooked')
-#
-#    # Get arguments
-#    arg0 = pstate.get_argument_value(0)  # const char *pathname
-#    flags = pstate.get_argument_value(1)  # int flags
-#    mode = pstate.get_argument_value(2)  # int mode
-#    arg0s = pstate.memory.read_string(arg0)
-#
-#    # Concretize the whole path name
-#    pstate.concretize_memory_bytes(arg0, len(arg0s)+1)  # Concretize the whole string + \0
-#
-#    # We use flags as concrete value
-#    pstate.concretize_argument(1)
-#
-#    # Use the flags to open the file in the write mode.
-#    mode = ""
-#    if (flags & 0xFF) == 0x00:   # O_RDONLY
-#        mode = "r"
-#    elif (flags & 0xFF) == 0x01: # O_WRONLY
-#        mode = "w"
-#    elif (flags & 0xFF) == 0x02: # O_RDWR
-#        mode = "r+"
-#
-#    if (flags & 0x0100): # O_CREAT
-#        mode += "x"
-#    if (flags & 0x0200): # O_APPEND
-#        mode = "a"  # replace completely value
-#
-#    if se.seed.is_file_defined(arg0s) and "r" in mode:  # input file and opened in reading
-#        logging.info(f"opening an input file: {arg0s}")
-#        # Program is opening an input
-#        data = se.seed.get_file_input(arg0s)
-#        filedesc = pstate.create_file_descriptor(arg0s, io.BytesIO(data))
-#        fd = filedesc.id
-#    else:
-#        # Try to open it as a regular file
-#        try:
-#            fd = open(arg0s, mode)  # use the mode here
-#            filedesc = pstate.create_file_descriptor(arg0s, fd)
-#            fd = filedesc.id
-#        except Exception as e:
-#            logging.debug(f"Failed to open {arg0s} {e}")
-#            fd = pstate.minus_one
-#
-#    pstate.write_register("rax", fd)  # write the return value
-#    pstate.cpu.program_counter = pstate.pop_stack_value()  # pop the return value
-#    se.skip_instruction()  # skip the current instruction so that the engine go straight fetching the next instruction
-
-
-def init(seed):
-    global config
-    global dse
-    global format
-    global input_file
-    global is_debug
-    global out_path
-    global prog
-    # Load the program (LIEF-based program loader).
-    prog = CleLoader(os.environ['AFL_CUSTOM_INFO_PROGRAM'])
-    # Process other configuration environment variables.
-    argv = None
-    try:
-        foo = os.environ['AFL_DEBUG']
-        is_debug = True
-    except KeyError:
-        pass
-    if is_debug:
-        logging.basicConfig(level=logging.WARNING)
-    else:
-        logging.basicConfig(level=logging.CRITICAL)
-    try:
-        foo = os.environ['AFL_CUSTOM_INFO_OUT']
-        out_path = foo + '/../tritondse/queue'
-    except KeyError:
-        pass
-    try:
-        foo = os.environ['AFL_CUSTOM_INFO_PROGRAM_INPUT']
-        input_file = foo
-    except KeyError:
-        pass
-    try:
-        argv_list = os.environ['AFL_CUSTOM_INFO_PROGRAM_ARGV']
-        argv_tmp = [ os.environ['AFL_CUSTOM_INFO_PROGRAM'] ]
-        argv_tmp += argv_list.split()
-        argv = []
-        # now check for @@
-        for item in argv_tmp:
-            if "@@" in item:
-                input_file = out_path + '/../.input'
-                argv.append(input_file)
-            else:
-                argv.append(item)
-    except KeyError:
-        pass
-    # Create the output directory
-    os.makedirs(out_path, exist_ok=True)
-    # Debug
-    if is_debug:
-        print('DEBUG target: ' + os.environ['AFL_CUSTOM_INFO_PROGRAM'])
-        if argv:
-            print('DEBUG argv: ')
-            print(argv)
-        if input_file:
-            print('DEBUG input_file: ' + input_file)
-        print('DEBUG out_path: ' + out_path)
-        print('')
-    if input_file:
-        format = SeedFormat.COMPOSITE
-    # Now set up TritonDSE
-    config = Config(coverage_strategy = CoverageStrategy.PATH,
-    #                debug = is_debug,
-                    pipe_stdout = is_debug,
-                    pipe_stderr = is_debug,
-                    execution_timeout = 1,
-                    program_argv = argv,
-                    smt_timeout= 50,
-                    seed_format = format)
-    # Create an instance of the Symbolic Explorator
-    dse = SymbolicExplorator(config, prog)
-    # Add callbacks.
-    dse.callback_manager.register_pre_execution_callback(pre_exec_hook)
-    #dse.callback_manager.register_function_callback("open", rtn_open)
-
-
-def fuzz(buf, add_buf, max_size):
-    global finding
-    finding = 1
-    while finding == 1:
-      finding = 0
-      dse.step()
-    return b""
-
-
-def queue_new_entry(filename_new_queue, filename_orig_queue):
-    global cycle
-    global dse
-    # Add seed to the worklist.
-    with open(filename_new_queue, "rb") as file:
-        data = file.read()
-    hash = hashlib.md5(data).hexdigest()
-    if hash not in hashes:
-        hashes.add(hash)
-        if is_debug:
-            print("NEW FILE " + filename_new_queue + " hash " + hash + " count " + str(cycle))
-            cycle += 1
-        if input_file:
-            seed = Seed(CompositeData(files={"stdin": b"", # nothing on stdin
-                                  input_file: data}))
-        else:
-            seed = Seed(data)
-        dse.add_input_seed(seed)
-        # Start exploration!
-        #dse.step()
-        #dse.explore()
-    pass
-
-
-# we simulate just doing one single fuzz in the custom mutator
-def fuzz_count(buf):
-    return 1
-
-
-def splice_optout():
-    pass

custom_mutators/atnwalk/Makefile

@@ -1,7 +0,0 @@
-all:	atnwalk.so
-
-atnwalk.so:	atnwalk.c
-	$(CC) -I ../../include/ -shared -fPIC -O3 -o atnwalk.so atnwalk.c
-
-clean:
-	rm -f *.so *.o *~ core

custom_mutators/atnwalk/README.md

@@ -1,43 +0,0 @@
-# ATNwalk: Grammar-Based Fuzzing using Only Bit-Mutations
-
-This is a custom mutator integration of ATNwalk that works by communicating via UNIX domain sockets.
-
-Refer to [https://github.com/atnwalk/testbed](https://github.com/atnwalk/testbed) for detailed instructions on how to get ATNwalk running.
-
-## Build
-
-Just type `make` to build `atnwalk.so`.
-
-## Run
-
-**NOTE:** The commands below just demonstrate an example how running ATNwalk looks like and require a working [testbed](https://github.com/atnwalk/testbed)
-
-```bash
-# create the required a random seed first
-mkdir -p ~/campaign/example/seeds
-cd ~/campaign/example/seeds
-head -c1 /dev/urandom | ~/atnwalk/build/javascript/bin/decode -wb > seed.decoded 2> seed.encoded
-
-# create the required atnwalk directory and copy the seed
-cd ../
-mkdir -p atnwalk/in
-cp ./seeds/seed.encoded atnwalk/in/seed
-cd atnwalk
-
-# assign to a single core when benchmarking it, change the CPU number as required
-CPU_ID=0
-
-# start the ATNwalk server
-nohup taskset -c ${CPU_ID} ${HOME}/atnwalk/build/javascript/bin/server 100 > server.log 2>&1 &
-
-# start AFL++ with ATNwalk
-AFL_SKIP_CPUFREQ=1 \
-  AFL_DISABLE_TRIM=1 \
-  AFL_CUSTOM_MUTATOR_ONLY=1 \
-  AFL_CUSTOM_MUTATOR_LIBRARY=${HOME}/AFLplusplus/custom_mutators/atnwalk/atnwalk.so \
-  AFL_POST_PROCESS_KEEP_ORIGINAL=1 \
-  ~/AFLplusplus/afl-fuzz -t 100 -i in/ -o out -b ${CPU_ID} -- ~/jerryscript/build/bin/jerry
-
-# make sure to kill the ATNwalk server process after you're done
-kill "$(cat atnwalk.pid)"
-```

custom_mutators/atnwalk/atnwalk.c

@@ -1,539 +0,0 @@
-#include "afl-fuzz.h"
-
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-#include <unistd.h>
-
-#define BUF_SIZE_INIT 4096
-#define SOCKET_NAME "./atnwalk.socket"
-
-// how many errors (e.g. timeouts) to tolerate until moving on to the next queue
-// entry
-#define ATNWALK_ERRORS_MAX 1
-
-// how many execution timeouts to tolerate until moving on to the next queue
-// entry
-#define EXEC_TIMEOUT_MAX 2
-
-// handshake constants
-const uint8_t SERVER_ARE_YOU_ALIVE = 213;
-const uint8_t SERVER_YES_I_AM_ALIVE = 42;
-
-// control bits
-const uint8_t SERVER_CROSSOVER_BIT = 0b00000001;
-const uint8_t SERVER_MUTATE_BIT = 0b00000010;
-const uint8_t SERVER_DECODE_BIT = 0b00000100;
-const uint8_t SERVER_ENCODE_BIT = 0b00001000;
-
-typedef struct atnwalk_mutator {
-
-  afl_state_t *afl;
-  uint8_t      atnwalk_error_count;
-  uint64_t     prev_timeouts;
-  uint32_t     prev_hits;
-  uint32_t     stage_havoc_cur;
-  uint32_t     stage_havoc_max;
-  uint32_t     stage_splice_cur;
-  uint32_t     stage_splice_max;
-  uint8_t     *fuzz_buf;
-  size_t       fuzz_size;
-  uint8_t     *post_process_buf;
-  size_t       post_process_size;
-
-} atnwalk_mutator_t;
-
-int read_all(int fd, uint8_t *buf, size_t buf_size) {
-
-  int    n;
-  size_t offset = 0;
-  while (offset < buf_size) {
-
-    n = read(fd, buf + offset, buf_size - offset);
-    if (n == -1) { return 0; }
-    offset += n;
-
-  }
-
-  return 1;
-
-}
-
-int write_all(int fd, uint8_t *buf, size_t buf_size) {
-
-  int    n;
-  size_t offset = 0;
-  while (offset < buf_size) {
-
-    n = write(fd, buf + offset, buf_size - offset);
-    if (n == -1) { return 0; }
-    offset += n;
-
-  }
-
-  return 1;
-
-}
-
-void put_uint32(uint8_t *buf, uint32_t val) {
-
-  buf[0] = (uint8_t)(val >> 24);
-  buf[1] = (uint8_t)((val & 0x00ff0000) >> 16);
-  buf[2] = (uint8_t)((val & 0x0000ff00) >> 8);
-  buf[3] = (uint8_t)(val & 0x000000ff);
-
-}
-
-uint32_t to_uint32(uint8_t *buf) {
-
-  uint32_t val = 0;
-  val |= (((uint32_t)buf[0]) << 24);
-  val |= (((uint32_t)buf[1]) << 16);
-  val |= (((uint32_t)buf[2]) << 8);
-  val |= ((uint32_t)buf[3]);
-  return val;
-
-}
-
-void put_uint64(uint8_t *buf, uint64_t val) {
-
-  buf[0] = (uint8_t)(val >> 56);
-  buf[1] = (uint8_t)((val & 0x00ff000000000000) >> 48);
-  buf[2] = (uint8_t)((val & 0x0000ff0000000000) >> 40);
-  buf[3] = (uint8_t)((val & 0x000000ff00000000) >> 32);
-  buf[4] = (uint8_t)((val & 0x00000000ff000000) >> 24);
-  buf[5] = (uint8_t)((val & 0x0000000000ff0000) >> 16);
-  buf[6] = (uint8_t)((val & 0x000000000000ff00) >> 8);
-  buf[7] = (uint8_t)(val & 0x00000000000000ff);
-
-}
-
-/**
- * Initialize this custom mutator
- *
- * @param[in] afl a pointer to the internal state object. Can be ignored for
- * now.
- * @param[in] seed A seed for this mutator - the same seed should always mutate
- * in the same way.
- * @return Pointer to the data object this custom mutator instance should use.
- *         There may be multiple instances of this mutator in one afl-fuzz run!
- *         Return NULL on error.
- */
-atnwalk_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
-
-  srand(seed);
-  atnwalk_mutator_t *data =
-      (atnwalk_mutator_t *)malloc(sizeof(atnwalk_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  data->afl = afl;
-  data->prev_hits = 0;
-  data->fuzz_buf = (uint8_t *)malloc(BUF_SIZE_INIT);
-  data->fuzz_size = BUF_SIZE_INIT;
-  data->post_process_buf = (uint8_t *)malloc(BUF_SIZE_INIT);
-  data->post_process_size = BUF_SIZE_INIT;
-  return data;
-
-}
-
-unsigned int afl_custom_fuzz_count(atnwalk_mutator_t   *data,
-                                   const unsigned char *buf, size_t buf_size) {
-
-  // afl_custom_fuzz_count is called exactly once before entering the
-  // 'stage-loop' for the current queue entry thus, we use it to reset the error
-  // count and to initialize stage variables (somewhat not intended by the API,
-  // but still better than rewriting the whole thing to have a custom mutator
-  // stage)
-  data->atnwalk_error_count = 0;
-  data->prev_timeouts = data->afl->total_tmouts;
-
-  // it might happen that on the last execution of the splice stage a new path
-  // is found we need to fix that here and count it
-  if (data->prev_hits) {
-
-    data->afl->stage_finds[STAGE_SPLICE] +=
-        data->afl->queued_items + data->afl->saved_crashes - data->prev_hits;
-
-  }
-
-  data->prev_hits = data->afl->queued_items + data->afl->saved_crashes;
-  data->stage_havoc_cur = 0;
-  data->stage_splice_cur = 0;
-
-  // 50% havoc, 50% splice
-  data->stage_havoc_max = data->afl->stage_max >> 1;
-  if (data->stage_havoc_max < HAVOC_MIN) { data->stage_havoc_max = HAVOC_MIN; }
-  data->stage_splice_max = data->stage_havoc_max;
-  return data->stage_havoc_max + data->stage_splice_max;
-
-}
-
-size_t fail_fatal(int fd_socket, uint8_t **out_buf) {
-
-  if (fd_socket != -1) { close(fd_socket); }
-  *out_buf = NULL;
-  return 0;
-
-}
-
-size_t fail_gracefully(int fd_socket, atnwalk_mutator_t *data, uint8_t *buf,
-                       size_t buf_size, uint8_t **out_buf) {
-
-  if (fd_socket != -1) { close(fd_socket); }
-  data->atnwalk_error_count++;
-  if (data->atnwalk_error_count > ATNWALK_ERRORS_MAX) {
-
-    data->afl->stage_max = data->afl->stage_cur;
-
-  }
-
-  *out_buf = buf;
-  return buf_size;
-
-}
-
-/**
- * Perform custom mutations on a given input
- *
- * (Optional for now. Required in the future)
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @param[in] buf Pointer to input data to be mutated
- * @param[in] buf_size Size of input data
- * @param[out] out_buf the buffer we will work on. we can reuse *buf. NULL on
- * error.
- * @param[in] add_buf Buffer containing the additional test case
- * @param[in] add_buf_size Size of the additional test case
- * @param[in] max_size Maximum size of the mutated output. The mutation must not
- *     produce data larger than max_size.
- * @return Size of the mutated output.
- */
-size_t afl_custom_fuzz(atnwalk_mutator_t *data, uint8_t *buf, size_t buf_size,
-                       uint8_t **out_buf, uint8_t *add_buf, size_t add_buf_size,
-                       size_t max_size) {
-
-  struct sockaddr_un addr;
-  int                fd_socket;
-  uint8_t            ctrl_buf[8];
-  uint8_t            wanted;
-
-  // let's display what's going on in a nice way
-  if (data->stage_havoc_cur == 0) {
-
-    data->afl->stage_name = (uint8_t *)"atnwalk - havoc";
-
-  }
-
-  if (data->stage_havoc_cur == data->stage_havoc_max) {
-
-    data->afl->stage_name = (uint8_t *)"atnwalk - splice";
-
-  }
-
-  // increase the respective havoc or splice counters
-  if (data->stage_havoc_cur < data->stage_havoc_max) {
-
-    data->stage_havoc_cur++;
-    data->afl->stage_cycles[STAGE_HAVOC]++;
-
-  } else {
-
-    // if there is nothing to splice, continue with havoc and skip splicing this
-    // time
-    if (data->afl->ready_for_splicing_count < 1) {
-
-      data->stage_havoc_max = data->afl->stage_max;
-      data->stage_havoc_cur++;
-      data->afl->stage_cycles[STAGE_HAVOC]++;
-
-    } else {
-
-      data->stage_splice_cur++;
-      data->afl->stage_cycles[STAGE_SPLICE]++;
-
-    }
-
-  }
-
-  // keep track of found new corpus seeds per stage
-  if (data->afl->queued_items + data->afl->saved_crashes > data->prev_hits) {
-
-    if (data->stage_splice_cur <= 1) {
-
-      data->afl->stage_finds[STAGE_HAVOC] +=
-          data->afl->queued_items + data->afl->saved_crashes - data->prev_hits;
-
-    } else {
-
-      data->afl->stage_finds[STAGE_SPLICE] +=
-          data->afl->queued_items + data->afl->saved_crashes - data->prev_hits;
-
-    }
-
-  }
-
-  data->prev_hits = data->afl->queued_items + data->afl->saved_crashes;
-
-  // check whether this input produces a lot of timeouts, if it does then
-  // abandon this queue entry
-  if (data->afl->total_tmouts - data->prev_timeouts >= EXEC_TIMEOUT_MAX) {
-
-    data->afl->stage_max = data->afl->stage_cur;
-    return fail_gracefully(-1, data, buf, buf_size, out_buf);
-
-  }
-
-  // initialize the socket
-  fd_socket = socket(AF_UNIX, SOCK_STREAM, 0);
-  if (fd_socket == -1) { return fail_fatal(fd_socket, out_buf); }
-  memset(&addr, 0, sizeof(addr));
-  addr.sun_family = AF_UNIX;
-  strncpy(addr.sun_path, SOCKET_NAME, sizeof(addr.sun_path) - 1);
-  if (connect(fd_socket, (const struct sockaddr *)&addr, sizeof(addr)) == -1) {
-
-    return fail_fatal(fd_socket, out_buf);
-
-  }
-
-  // ask whether the server is alive
-  ctrl_buf[0] = SERVER_ARE_YOU_ALIVE;
-  if (!write_all(fd_socket, ctrl_buf, 1)) {
-
-    return fail_fatal(fd_socket, out_buf);
-
-  }
-
-  // see whether the server replies as expected
-  if (!read_all(fd_socket, ctrl_buf, 1) ||
-      ctrl_buf[0] != SERVER_YES_I_AM_ALIVE) {
-
-    return fail_fatal(fd_socket, out_buf);
-
-  }
-
-  // tell the server what we want to do
-  wanted = SERVER_MUTATE_BIT | SERVER_ENCODE_BIT;
-
-  // perform a crossover if we are splicing
-  if (data->stage_splice_cur > 0) { wanted |= SERVER_CROSSOVER_BIT; }
-
-  // tell the server what we want and how much data will be sent
-  ctrl_buf[0] = wanted;
-  put_uint32(ctrl_buf + 1, (uint32_t)buf_size);
-  if (!write_all(fd_socket, ctrl_buf, 5)) {
-
-    return fail_fatal(fd_socket, out_buf);
-
-  }
-
-  // send the data to mutate and encode
-  if (!write_all(fd_socket, buf, buf_size)) {
-
-    return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-  }
-
-  if (wanted & SERVER_CROSSOVER_BIT) {
-
-    // since we requested crossover, we will first tell how much additional data
-    // is to be expected
-    put_uint32(ctrl_buf, (uint32_t)add_buf_size);
-    if (!write_all(fd_socket, ctrl_buf, 4)) {
-
-      return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-    }
-
-    // send the additional data for crossover
-    if (!write_all(fd_socket, add_buf, add_buf_size)) {
-
-      return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-    }
-
-    // lastly, a seed is required for crossover so send one
-    put_uint64(ctrl_buf, (uint64_t)rand());
-    if (!write_all(fd_socket, ctrl_buf, 8)) {
-
-      return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-    }
-
-  }
-
-  // since we requested mutation, we need to provide a seed for that
-  put_uint64(ctrl_buf, (uint64_t)rand());
-  if (!write_all(fd_socket, ctrl_buf, 8)) {
-
-    return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-  }
-
-  // obtain the required buffer size for the data that will be returned
-  if (!read_all(fd_socket, ctrl_buf, 4)) {
-
-    return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-  }
-
-  size_t new_size = (size_t)to_uint32(ctrl_buf);
-
-  // if the data is too large then we ignore this round
-  if (new_size > max_size) {
-
-    return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-  }
-
-  if (new_size > buf_size) {
-
-    // buf is too small, need to use data->fuzz_buf, let's see whether we need
-    // to reallocate
-    if (new_size > data->fuzz_size) {
-
-      data->fuzz_size = new_size << 1;
-      data->fuzz_buf = (uint8_t *)realloc(data->fuzz_buf, data->fuzz_size);
-
-    }
-
-    *out_buf = data->fuzz_buf;
-
-  } else {
-
-    // new_size fits into buf, so re-use it
-    *out_buf = buf;
-
-  }
-
-  // obtain the encoded data
-  if (!read_all(fd_socket, *out_buf, new_size)) {
-
-    return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-  }
-
-  close(fd_socket);
-  return new_size;
-
-}
-
-/**
- * A post-processing function to use right before AFL writes the test case to
- * disk in order to execute the target.
- *
- * (Optional) If this functionality is not needed, simply don't define this
- * function.
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @param[in] buf Buffer containing the test case to be executed
- * @param[in] buf_size Size of the test case
- * @param[out] out_buf Pointer to the buffer containing the test case after
- *     processing. External library should allocate memory for out_buf.
- *     The buf pointer may be reused (up to the given buf_size);
- * @return Size of the output buffer after processing or the needed amount.
- *     A return of 0 indicates an error.
- */
-size_t afl_custom_post_process(atnwalk_mutator_t *data, uint8_t *buf,
-                               size_t buf_size, uint8_t **out_buf) {
-
-  struct sockaddr_un addr;
-  int                fd_socket;
-  uint8_t            ctrl_buf[8];
-
-  // initialize the socket
-  fd_socket = socket(AF_UNIX, SOCK_STREAM, 0);
-  if (fd_socket == -1) { return fail_fatal(fd_socket, out_buf); }
-  memset(&addr, 0, sizeof(addr));
-  addr.sun_family = AF_UNIX;
-  strncpy(addr.sun_path, SOCKET_NAME, sizeof(addr.sun_path) - 1);
-  if (connect(fd_socket, (const struct sockaddr *)&addr, sizeof(addr)) == -1) {
-
-    return fail_fatal(fd_socket, out_buf);
-
-  }
-
-  // ask whether the server is alive
-  ctrl_buf[0] = SERVER_ARE_YOU_ALIVE;
-  if (!write_all(fd_socket, ctrl_buf, 1)) {
-
-    return fail_fatal(fd_socket, out_buf);
-
-  }
-
-  // see whether the server replies as expected
-  if (!read_all(fd_socket, ctrl_buf, 1) ||
-      ctrl_buf[0] != SERVER_YES_I_AM_ALIVE) {
-
-    return fail_fatal(fd_socket, out_buf);
-
-  }
-
-  // tell the server what we want and how much data will be sent
-  ctrl_buf[0] = SERVER_DECODE_BIT;
-  put_uint32(ctrl_buf + 1, (uint32_t)buf_size);
-  if (!write_all(fd_socket, ctrl_buf, 5)) {
-
-    return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-  }
-
-  // send the data to decode
-  if (!write_all(fd_socket, buf, buf_size)) {
-
-    return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-  }
-
-  // obtain the required buffer size for the data that will be returned
-  if (!read_all(fd_socket, ctrl_buf, 4)) {
-
-    return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-  }
-
-  size_t new_size = (size_t)to_uint32(ctrl_buf);
-
-  // need to use data->post_process_buf, let's see whether we need to reallocate
-  if (new_size > data->post_process_size) {
-
-    data->post_process_size = new_size << 1;
-    data->post_process_buf =
-        (uint8_t *)realloc(data->post_process_buf, data->post_process_size);
-
-  }
-
-  *out_buf = data->post_process_buf;
-
-  // obtain the decoded data
-  if (!read_all(fd_socket, *out_buf, new_size)) {
-
-    return fail_gracefully(fd_socket, data, buf, buf_size, out_buf);
-
-  }
-
-  close(fd_socket);
-  return new_size;
-
-}
-
-/**
- * Deinitialize everything
- *
- * @param data The data ptr from afl_custom_init
- */
-void afl_custom_deinit(atnwalk_mutator_t *data) {
-
-  free(data->fuzz_buf);
-  free(data->post_process_buf);
-  free(data);
-
-}
-

custom_mutators/autotokens/Makefile

@@ -1,26 +0,0 @@
-ifdef debug
-	CPPLAGS += -fsanitize=address
-	CXXFLAGS += -Wall
-	CC := clang
-	CXX := clang++
-endif
-ifdef DEBUG
-	CPPFLAGS += -fsanitize=address
-	CXXFLAGS += -Wall
-	CC := clang
-	CXX := clang++
-endif
-
-all:	autotokens.so
-
-afl-fuzz-queue.o:	../../src/afl-fuzz-queue.c
-	$(CC) -D_STANDALONE_MODULE=1 -I../../include -g -O3 $(CPPFLAGS) -fPIC -c -o ./afl-fuzz-queue.o ../../src/afl-fuzz-queue.c
-
-afl-common.o:	../../src/afl-common.c
-	$(CC) -I../../include -g -O3 $(CPPFLAGS) -DBIN_PATH=\"dummy\" -Wno-pointer-sign -fPIC -c -o ./afl-common.o ../../src/afl-common.c
-
-autotokens.so:	afl-fuzz-queue.o afl-common.o autotokens.cpp
-	$(CXX) -Wno-deprecated -g -O3 $(CXXFLAGS) $(CPPFLAGS) -shared -fPIC -o autotokens.so -I../../include autotokens.cpp  ./afl-fuzz-queue.o ../../src/afl-performance.o ./afl-common.o
-
-clean:
-	rm -f autotokens.so *.o *~ core

custom_mutators/autotokens/README

@@ -1,34 +0,0 @@
-# Autotokens
-
-This implements an improved autotoken grammar fuzzing idea presented in
-[Token-Level Fuzzing][https://www.usenix.org/system/files/sec21-salls.pdf].
-It is a grammar fuzzer without actually knowing the grammar, but only works
-with text based inputs.
-
-It is recommended to run with together in an instance with `CMPLOG`.
-
-If you have a dictionary (`-x`) this improves this custom grammar mutator.
-
-If **not** running with `CMPLOG`, it is possible to set
-`AFL_CUSTOM_MUTATOR_ONLY` to concentrate on grammar bug classes.
-
-Do **not** set `AFL_DISABLE_TRIM` with this custom mutator!
-
-## Configuration via environment variables
-
-`AUTOTOKENS_ONLY_FAV` - only use this mutator on favorite queue items
-`AUTOTOKENS_COMMENT` - what character or string starts a comment which will be
-                       removed. Default: `/* ... */`
-`AUTOTOKENS_FUZZ_COUNT_SHIFT` - reduce the number of fuzzing performed, shifting
-                                the value by this number, e.g. 1.
-`AUTOTOKENS_AUTO_DISABLE` - disable this module if the seeds are not ascii
-                            (or no input and no (ascii) dictionary)
-`AUTOTOKENS_LEARN_DICT` - learn from dictionaries?
-                          0 = none
-                          1 = only -x or autodict
-                          2 = -x, autodict and `CMPLOG`
-`AUTOTOKENS_CHANGE_MIN` - minimum number of mutations (1-256, default 8)
-`AUTOTOKENS_CHANGE_MAX` - maximum number of mutations (1-4096, default 64)
-`AUTOTOKENS_CREATE_FROM_THIN_AIR` - if only one small start file is present and
-                                    a dictionary loaded then create one initial
-                                    structure based on the dictionary.

custom_mutators/examples/custom_post_run.c

@@ -1,53 +0,0 @@
-//
-// This is an example on how to use afl_custom_post_run
-// It executes custom code each time after AFL++ executes the target
-//
-// cc -O3 -fPIC -shared -g -o custom_post_run.so -I../../include custom_post_run.c
-// cd ../..
-// afl-cc -o test-instr test-instr.c
-// AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/examples/custom_post_run.so \
-//   afl-fuzz -i in -o out -- ./test-instr -f /tmp/foo
-//
-
-
-#include "afl-fuzz.h"
-
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-
-typedef struct my_mutator {
-
-  afl_state_t *afl;
-
-} my_mutator_t;
-
-my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
-
-  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  data->afl = afl;
-
-  return data;
-
-}
-
-void afl_custom_post_run(my_mutator_t *data) {
-
-  printf("hello from afl_custom_post_run\n");
-  return;
-}
-
-
-void afl_custom_deinit(my_mutator_t *data) {
-
-  free(data);
-
-}

custom_mutators/examples/custom_send.c

@@ -1,63 +0,0 @@
-//
-// This is an example on how to use afl_custom_send
-// It writes each mutated data set to /tmp/foo
-// You can modify this to send to IPC, shared memory, etc.
-//
-// cc -O3 -fPIC -shared -g -o custom_send.so -I../../include custom_send.c
-// cd ../..
-// afl-cc -o test-instr test-instr.c
-// AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/examples/custom_send.so \
-//   afl-fuzz -i in -o out -- ./test-instr -f /tmp/foo
-//
-
-#include <stdio.h>
-#include <stdint.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <fcntl.h>
-
-#include "afl-fuzz.h"
-
-typedef struct my_mutator {
-
-  afl_state_t *afl;
-
-} my_mutator_t;
-
-my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
-
-  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  data->afl = afl;
-
-  return data;
-
-}
-
-void afl_custom_fuzz_send(my_mutator_t *data, uint8_t *buf, size_t buf_size) {
-
-  int fd = open("/tmp/foo", O_CREAT | O_NOFOLLOW | O_TRUNC | O_RDWR, 0644);
-
-  if (fd >= 0) {
-
-    (void)write(fd, buf, buf_size);
-    close(fd);
-
-  }
-
-  return;
-
-}
-
-void afl_custom_deinit(my_mutator_t *data) {
-
-  free(data);
-
-}
-

custom_mutators/examples/elf_header_mutator.c

@@ -1,679 +0,0 @@
-/*
-   AFL++ Custom Mutator for ELF Headers
-   Written by @echel0n <melih.sahin@protonmail.com>
-   based on libgolf.h by @xcellerator
-   $ gcc -O3 -fPIC -shared -o elf_mutator.so -I ~/AFLplusplus/include/
- */
-#include "afl-fuzz.h"
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <limits.h>
-#include <linux/elf.h>
-
-/* EI_ABIVERSION isn't used anymore and elf.h defines EI_PAD to be 0x09 */
-#define EI_ABIVERSION 0x08
-#define EI_PAD 0x09
-/* Define the Architecture and ISA constants to match those in <linux/elf.h> */
-#define X86_64 EM_X86_64
-#define ARM32 EM_ARM
-#define AARCH64 EM_AARCH64
-#define uchar unsigned char
-#define DATA_SIZE 0x100
-
-/*
- * The ELF and Program headers are different sizes depending on 32- and 64-bit
- * architectures
- * taken from libgolf.h
- */
-#define EHDR_T(x) Elf##x##_Ehdr
-#define PHDR_T(x) Elf##x##_Phdr
-#define EHDR(x) ehdr##x
-#define PHDR(x) phdr##x
-#define GET_EHDR(x) (&(elf_ptr->EHDR(x)));
-#define GET_PHDR(x) (&(elf_ptr->PHDR(x)));
-#define REF_EHDR(b, x) ((Elf##b##_Ehdr *)ehdr)->x
-#define REF_PHDR(b, x) ((Elf##b##_Phdr *)phdr)->x
-int ehdr_size;
-int phdr_size;
-/*
- * This struct holds the bytes that will be executed, and the size.
- */
-typedef struct text_segment {
-
-  size_t         text_size;
-  unsigned char *text_segment;
-
-} TextSegment;
-
-// example shellcode that exits
-// taken from libgolf.h
-unsigned char buf[] = {0xb0, 0x3c, 0x31, 0xff, 0x0f, 0x05};
-
-/*
- * This is the raw ELF file
- * - EHDR(xx) is the ELF header
- * - PHDR(xx) is the program header
- * - text is the text segment
- * - filename is the name of the golf'd binary
- * - isa is the target architecture (X86_64, ARM32, AARCH64)
- * taken from libgolf.h
- */
-typedef struct rawbinary_t {
-
-  EHDR_T(32) EHDR(32);
-  PHDR_T(32) PHDR(32);
-  EHDR_T(64) EHDR(64);
-  PHDR_T(64) PHDR(64);
-  TextSegment text;
-  char       *filename;
-  int         isa;
-
-} RawBinary;
-
-/*
- * Copy an E_IDENT array into the corresponding fields in the ELF header
- * Called by populate_ehdr()
- * taken from libgolf.h
- */
-int populate_e_ident(RawBinary *elf_ptr, unsigned char e_ident[]) {
-
-  int i;
-  /* Depending on whether the target ISA is 32- or 64-bit, set e_ident */
-  switch (elf_ptr->isa) {
-
-    case X86_64:
-    case AARCH64:
-      for (i = 0; i < EI_NIDENT; i++)
-        elf_ptr->EHDR(64).e_ident[i] = e_ident[i];
-      break;
-    case ARM32:
-      for (i = 0; i < EI_NIDENT; i++)
-        elf_ptr->EHDR(32).e_ident[i] = e_ident[i];
-      break;
-    default:
-      exit(1);
-
-  }
-
-  return 0;
-
-}
-
-/*
- * Copy bytes from buf[] array into text_segment in ELF struct
- * taken from libgolf.h
- */
-int copy_text_segment(RawBinary *elf_ptr, unsigned char buf[], int text_size) {
-
-  int i;
-
-  /* Set size of text segment and allocate the buffer */
-  elf_ptr->text.text_size = text_size;
-  elf_ptr->text.text_segment =
-      malloc(elf_ptr->text.text_size * sizeof(unsigned char));
-
-  /* Copy the bytes into the text segment buffer */
-  for (i = 0; i < elf_ptr->text.text_size; i++) {
-
-    elf_ptr->text.text_segment[i] = buf[i];
-
-  }
-
-}
-
-/*
- * Populate the ELF Header with sane values
- * Returns a pointer to an EHDR struct
- * taken from libgolf.h
- */
-void *populate_ehdr(RawBinary *elf_ptr) {
-
-  /*
-   * Set ehdr_size and phdr_size. Determined by whether target ISA is 32- or
-   * 64-bit.
-   */
-  switch (elf_ptr->isa) {
-
-    case X86_64:
-    case AARCH64:
-      ehdr_size = sizeof(EHDR_T(64));
-      phdr_size = sizeof(PHDR_T(64));
-      break;
-    case ARM32:
-      ehdr_size = sizeof(EHDR_T(32));
-      phdr_size = sizeof(PHDR_T(32));
-      break;
-    default:
-      exit(1);
-
-  };
-
-  /* Start with the E_IDENT area at the top of the file */
-  unsigned char e_ident[EI_NIDENT] = {0};
-
-  /* Magic Bytes */
-  e_ident[EI_MAG0] = 0x7F;
-  e_ident[EI_MAG1] = 0x45;  // E
-  e_ident[EI_MAG2] = 0x4C;  // L
-  e_ident[EI_MAG3] = 0x46;  // F
-
-  /*
-   * EI_CLASS denotes the architecture:
-   * ELFCLASS32: 0x01
-   * ELFCLASS64: 0x02
-   */
-  switch (elf_ptr->isa) {
-
-    case X86_64:
-    case AARCH64:
-      e_ident[EI_CLASS] = ELFCLASS64;
-      break;
-    case ARM32:
-      e_ident[EI_CLASS] = ELFCLASS32;
-      break;
-    default:
-      exit(1);
-
-  }
-
-  /*
-   * EI_DATA denotes the endianness:
-   * ELFDATA2LSB:   0x01
-   * ELFDATA2MSB:   0x02
-   */
-  e_ident[EI_DATA] = ELFDATA2LSB;
-
-  /* EI_VERSION is always 0x01 */
-  e_ident[EI_VERSION] = EV_CURRENT;
-
-  /*
-   * EI_OSABI defines the target OS. Ignored by most modern ELF parsers.
-   */
-  e_ident[EI_OSABI] = ELFOSABI_NONE;
-
-  /* EI_ABIVERSION was for sub-classification. Un-defined since Linux 2.6 */
-  e_ident[EI_ABIVERSION] = 0x00;
-
-  /* EI_PAD is currently unused */
-  e_ident[EI_PAD] = 0x00;
-
-  /* Copy the E_IDENT section to the ELF struct */
-  populate_e_ident(elf_ptr, e_ident);
-
-  /*
-   * The remainder of the ELF header following E_IDENT follows.
-   *
-   * ehdr is a pointer to either an Elf32_Edhr, or Elf64_Ehdr struct.
-   */
-  void *ehdr = NULL;
-  switch (elf_ptr->isa) {
-
-    case X86_64:
-    case AARCH64:
-      ehdr = (&(elf_ptr->EHDR(64)));
-      break;
-    case ARM32:
-      ehdr = (&(elf_ptr->EHDR(32)));
-      break;
-    default:
-      exit(1);
-
-  }
-
-  /*
-   * Depending on whether the ISA is 32- or 64-bit determines the size of
-   * many of the fields in the ELF Header. This switch case deals with it.
-   */
-  switch (elf_ptr->isa) {
-
-    // 64-Bit ISAs
-    case X86_64:
-    case AARCH64:
-      /*
-       * e_type specifies what kind of ELF file this is:
-       * ET_NONE:         0x00    // Unknown Type
-       * ET_REL:          0x01    // Relocatable
-       * ET_EXEC:         0x02    // Executable File
-       * ET_DYN:          0x03    // Shared Object
-       * ET_CORE:         0x04    // Core Dump
-       */
-      REF_EHDR(64, e_type) = ET_EXEC;  // 0x0002
-
-      /* e_machine specifies the target ISA */
-      REF_EHDR(64, e_machine) = elf_ptr->isa;
-
-      /* e_version is always set of 0x01 for the original ELF spec */
-      REF_EHDR(64, e_version) = EV_CURRENT;  // 0x00000001
-
-      /*
-       * e_entry is the memory address of the entry point
-       * Set by set_entry_point() after p_vaddr is set in the phdr
-       */
-      REF_EHDR(64, e_entry) = 0x0;
-
-      /*
-       * e_phoff points to the start of the program header, which
-       * immediately follows the ELF header
-       */
-      REF_EHDR(64, e_phoff) = ehdr_size;
-
-      /* e_shoff points to the start of the section header table */
-      REF_EHDR(64, e_shoff) = 0x00;
-
-      /* e_flags is architecture dependent */
-      REF_EHDR(64, e_flags) = 0x0;
-
-      /* e_ehsize contains the size of the ELF header */
-      REF_EHDR(64, e_ehsize) = ehdr_size;
-
-      /* e_phentsize is the size of the program header */
-      REF_EHDR(64, e_phentsize) = phdr_size;
-
-      /*
-       * e_phnum contains the number of entries in the program header
-       * e_phnum * e_phentsize = size of program header table
-       */
-      REF_EHDR(64, e_phnum) = 0x1;
-
-      /* e_shentsize contains the size of a section header entry */
-      REF_EHDR(64, e_shentsize) = 0x0;
-
-      /*
-       * e_shnum contains the number of entries in the section header
-       * e_shnum * e_shentsize = size of section header table
-       */
-      REF_EHDR(64, e_shnum) = 0x0;
-
-      /*
-       * e_shstrndx contains the index of the section header table that
-       * contains the section names
-       */
-      REF_EHDR(64, e_shstrndx) = 0x0;
-
-      break;
-    // 32-Bit ISAs
-    case ARM32:
-      /*
-       * e_type specifies what kind of ELF file this is:
-       * ET_NONE:         0x00    // Unknown Type
-       * ET_REL:          0x01    // Relocatable
-       * ET_EXEC:         0x02    // Executable File
-       * ET_DYN:          0x03    // Shared Object
-       * ET_CORE:         0x04    // Core Dump
-       */
-      REF_EHDR(32, e_type) = ET_EXEC;  // 0x0002
-
-      /* e_machine specifies the target ISA */
-      REF_EHDR(32, e_machine) = elf_ptr->isa;
-
-      /* e_version is always set of 0x01 for the original ELF spec */
-      REF_EHDR(32, e_version) = EV_CURRENT;  // 0x00000001
-
-      /*
-       * e_entry is the memory address of the entry point
-       * Set by set_entry_point() after p_vaddr is set in the phdr
-       */
-      REF_EHDR(32, e_entry) = 0x0;
-
-      /*
-       * e_phoff points to the start of the program header, which
-       * immediately follows the ELF header
-       */
-      REF_EHDR(32, e_phoff) = ehdr_size;
-
-      /* e_shoff points to the start of the section header table */
-      REF_EHDR(32, e_shoff) = 0x0i;
-
-      /* e_flags is architecture dependent */
-      REF_EHDR(32, e_flags) = 0x0;
-
-      /* e_ehsize contains the size of the ELF header */
-      REF_EHDR(32, e_ehsize) = ehdr_size;
-
-      /* e_phentsize is the size of the program header */
-      REF_EHDR(32, e_phentsize) = phdr_size;
-
-      /*
-       * e_phnum contains the number of entries in the program header
-       * e_phnum * e_phentsize = size of program header table
-       */
-      REF_EHDR(32, e_phnum) = 0x1;
-
-      /* e_shentsize contains the size of a section header entry */
-      REF_EHDR(32, e_shentsize) = 0x0;
-
-      /*
-       * e_shnum contains the number of entries in the section header
-       * e_shnum * e_shentsize = size of section header table
-       */
-      REF_EHDR(32, e_shnum) = 0x0;
-
-      /*
-       * e_shstrndx contains the index of the section header table that
-       * contains the section names
-       */
-      REF_EHDR(32, e_shnum) = 0x0;
-
-      break;
-
-  }
-
-  return ehdr;
-
-}
-
-/*
- * Populate the program headers with sane values
- * Returns a pointer to a PHDR struct
- * taken from libgolf.h
- */
-void *populate_phdr(RawBinary *elf_ptr) {
-
-  /*
-   * All offsets are relative to the start of the program header (0x40)
-   *
-   * phdr is a pointer to either an Elf32_Phdr, or Elf64_Phdr struct.
-   */
-  void *phdr = NULL;
-  switch (elf_ptr->isa) {
-
-    case X86_64:
-    case AARCH64:
-      phdr = (&(elf_ptr->PHDR(64)));
-      break;
-    case ARM32:
-      phdr = (&(elf_ptr->PHDR(32)));
-      break;
-    default:
-      exit(1);
-
-  }
-
-  /*
-   * Depending on whether the ISA is 32- or 64-bit determines the size of
-   * many of the fields in the Progra Header. This switch case deals with it.
-   */
-  switch (elf_ptr->isa) {
-
-    // 64-Bit ISAs
-    case X86_64:
-    case AARCH64:
-      /*
-       * p_type identifies what type of segment this is
-       * PT_NULL:         0x0     // Unused
-       * PT_LOAD:         0x1     // Loadable Segment
-       * PT_DYNAMIC:      0x2     // Dynamic Linker Information
-       * PT_INTERP:       0x3     // Interpreter Information
-       * PT_NOTE:         0x4     // Auxiliary Information
-       * PT_SHLIB:        0x5     // Reserved
-       * PT_PHDR:         0x6     // Segment with Program Header
-       * PT_TLS:          0x7     // Thread Local Storage
-       */
-      REF_PHDR(64, p_type) = PT_LOAD;  // 0x1
-
-      /*
-       * p_flags defines permissions for this section
-       * PF_R:    0x4     // Read
-       * PF_W:    0x2     // Write
-       * PF_X:    0x1     // Execute
-       */
-      REF_PHDR(64, p_flags) = PF_R | PF_X;  // 0x5
-
-      /*
-       * p_offset is the offset in the file image (relative to the start
-       * of the program header) for this segment.
-       */
-      REF_PHDR(64, p_offset) = 0x0;
-
-      /*
-       * p_vaddr is the virtual address where this segment should be loaded
-       * p_paddr is for the physical address (unused by System V)
-       */
-      REF_PHDR(64, p_vaddr) = 0x400000;
-      REF_PHDR(64, p_paddr) = 0x400000;
-
-      /*
-       * p_filesz is the size of the segment in the file image
-       * p_memsz is the size of the segment in memory
-       *
-       * Note: p_filesz doesn't have to equal p_memsz
-       */
-      REF_PHDR(64, p_filesz) = elf_ptr->text.text_size;
-      REF_PHDR(64, p_memsz) = elf_ptr->text.text_size;
-
-      break;
-    // 32-Bit ISAs
-    case ARM32:
-      /*
-       * p_type identifies what type of segment this is
-       * PT_NULL:         0x0     // Unused
-       * PT_LOAD:         0x1     // Loadable Segment
-       * PT_DYNAMIC:      0x2     // Dynamic Linker Information
-       * PT_INTERP:       0x3     // Interpreter Information
-       * PT_NOTE:         0x4     // Auxiliary Information
-       * PT_SHLIB:        0x5     // Reserved
-       * PT_PHDR:         0x6     // Segment with Program Header
-       * PT_TLS:          0x7     // Thread Local Storage
-       */
-      REF_PHDR(32, p_type) = PT_LOAD;  // 0x1
-
-      /*
-       * p_flags defines permissions for this section
-       * PF_R:    0x4     // Read
-       * PF_W:    0x2     // Write
-       * PF_X:    0x1     // Execute
-       */
-      REF_PHDR(32, p_flags) = PF_R | PF_X;  // 0x5
-
-      /*
-       * p_offset is the offset in the file image (relative to the start
-       * of the program header) for this segment.
-       */
-      REF_PHDR(32, p_offset) = 0x0;
-
-      /*
-       * p_vaddr is the virtual address where this segment should be loaded
-       * p_paddr is for the physical address (unused by System V)
-       */
-      REF_PHDR(32, p_vaddr) = 0x10000;
-      REF_PHDR(32, p_paddr) = 0x10000;
-
-      /*
-       * p_filesz is the size of the segment in the file image
-       * p_memsz is the size of the segment in memory
-       *
-       * Note: p_filesz doesn't have to equal p_memsz
-       */
-      REF_PHDR(32, p_filesz) = elf_ptr->text.text_size;
-      REF_PHDR(32, p_memsz) = elf_ptr->text.text_size;
-
-      break;
-    default:
-      exit(1);
-
-  }
-
-  /*
-   * p_align is the memory alignment
-   *
-   * Note: p_vaddr = p_offset % p_align
-   */
-  switch (elf_ptr->isa) {
-
-    case X86_64:
-      REF_PHDR(64, p_align) = 0x400000;
-      break;
-    case ARM32:
-      REF_PHDR(32, p_align) = 0x10000;
-      break;
-    case AARCH64:
-      REF_PHDR(64, p_align) = 0x400000;
-      break;
-
-  }
-
-  return phdr;
-
-}
-
-/*
- * e_entry depends on p_vaddr, so has to be set after populate_ehdr()
- * and populate_phdr() have been called.
- * taken from libgolf.h
- */
-int set_entry_point(RawBinary *elf_ptr) {
-
-  /*
-   * Once the whole ELF file is copied into memory, control is handed to
-   * e_entry. Relative to the process's virtual memory address, the .text
-   * segment will be located immediately after the ELF and program header.
-   *
-   * ehdr and phdr are pointers to the ELF and Program headers respectively.
-   * The switch case casts and assigns them to the correct fields of the ELF
-   * struct, then sets ehdr->e_entry.
-   */
-  void *ehdr, *phdr;
-
-  switch (elf_ptr->isa) {
-
-    case X86_64:
-    case AARCH64:
-      ehdr = GET_EHDR(64);
-      phdr = GET_PHDR(64);
-      REF_EHDR(64, e_entry) = REF_PHDR(64, p_vaddr) + ehdr_size + phdr_size;
-      break;
-    case ARM32:
-      ehdr = GET_EHDR(32);
-      phdr = GET_PHDR(32);
-      REF_EHDR(32, e_entry) = REF_PHDR(32, p_vaddr) + ehdr_size + phdr_size;
-      break;
-    default:
-      exit(1);
-
-  }
-
-  return 0;
-
-}
-
-typedef struct my_mutator {
-
-  afl_state_t *afl;
-  size_t       trim_size_current;
-  int          trimmming_steps;
-  int          cur_step;
-  u8          *mutated_out, *post_process_buf, *trim_buf;
-
-} my_mutator_t;
-
-my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
-
-  srand(seed);  // needed also by surgical_havoc_mutate()
-  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  if ((data->mutated_out = (u8 *)malloc(MAX_FILE)) == NULL) {
-
-    perror("afl_custom_init malloc");
-    return NULL;
-
-  }
-
-  if ((data->post_process_buf = (u8 *)malloc(MAX_FILE)) == NULL) {
-
-    perror("afl_custom_init malloc");
-    return NULL;
-
-  }
-
-  if ((data->trim_buf = (u8 *)malloc(MAX_FILE)) == NULL) {
-
-    perror("afl_custom_init malloc");
-    return NULL;
-
-  }
-
-  data->afl = afl;
-  return data;
-
-}
-
-size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *in_buf, size_t buf_size,
-                       u8 **out_buf, uint8_t *add_buf,
-                       size_t add_buf_size,  // add_buf can be NULL
-                       size_t max_size) {
-
-  RawBinary  elf_obj;
-  RawBinary *elf = &elf_obj;
-  elf->isa = 62;
-  Elf64_Ehdr *ehdr;
-  Elf64_Phdr *phdr;
-  copy_text_segment(elf, buf, sizeof(buf));
-  ehdr = populate_ehdr(elf);
-  phdr = populate_phdr(elf);
-  set_entry_point(elf);
-
-  size_t mutated_size = ehdr_size + phdr_size + elf->text.text_size;
-  int    pos = 0;
-  // example fields
-  ehdr->e_ident[EI_CLASS] = (uint8_t *)(in_buf + pos++);
-  ehdr->e_ident[EI_DATA] = (uint8_t *)(in_buf + pos++);
-  ehdr->e_ident[EI_VERSION] = (uint8_t *)(in_buf + pos++);
-  ehdr->e_ident[EI_OSABI] = (uint8_t *)(in_buf + pos++);
-  for (int i = 0x8; i < 0x10; ++i) {
-
-    (ehdr->e_ident)[i] = (uint8_t *)(in_buf + pos++);
-
-  }
-
-  ehdr->e_version = (uint32_t *)(in_buf + pos);
-  pos += 4;
-  // sections headers
-  ehdr->e_shoff = (uint64_t *)(in_buf + pos);
-  pos += 8;
-  ehdr->e_shentsize = (uint16_t *)(in_buf + pos);
-  pos += 2;
-  ehdr->e_shnum = (uint16_t *)(in_buf + pos);
-  pos += 2;
-  ehdr->e_shstrndx = (uint16_t *)(in_buf + pos);
-  pos += 2;
-  ehdr->e_flags = (uint32_t *)(in_buf + pos);
-  pos += 4;
-  // physical addr
-  phdr->p_paddr = (uint64_t *)(in_buf + pos);
-  pos += 8;
-  phdr->p_align = (uint64_t *)(in_buf + pos);
-  pos += 8;
-
-  /* mimic GEN_ELF()
-   * Write:
-   * - ELF Header
-   * - Program Header
-   * - Text Segment
-   */
-  memcpy(data->mutated_out, ehdr, ehdr_size);
-  memcpy(data->mutated_out + ehdr_size, phdr, phdr_size);
-  memcpy(data->mutated_out + ehdr_size + phdr_size, elf->text.text_segment,
-         elf->text.text_size);
-
-  *out_buf = data->mutated_out;
-  return mutated_size;
-
-}
-
-void afl_custom_deinit(my_mutator_t *data) {
-
-  free(data->post_process_buf);
-  free(data->mutated_out);
-  free(data->trim_buf);
-  free(data);
-
-}
-

custom_mutators/gramatron/JSONC_VERSION

@@ -1 +0,0 @@
-af8dd4a307e7b837f9fa2959549548ace4afe08b

custom_mutators/gramatron/README.md

@@ -1,49 +0,0 @@
-# GramaTron
-
-GramaTron is a coverage-guided fuzzer that uses grammar automatons to perform
-grammar-aware fuzzing.  Technical details about our framework are available in
-the [ISSTA'21 paper](https://nebelwelt.net/files/21ISSTA.pdf). The artifact to
-reproduce the experiments presented in the paper are present in `artifact/`.
-Instructions to run a sample campaign and incorporate new grammars is presented
-below:
-
-## Compiling
-
-Execute `./build_gramatron_mutator.sh`.
-
-## Running
-
-You have to set the grammar file to use with `GRAMATRON_AUTOMATION`:
-
-```
-export AFL_DISABLE_TRIM=1
-export AFL_CUSTOM_MUTATOR_ONLY=1
-export AFL_CUSTOM_MUTATOR_LIBRARY=./gramatron.so
-export GRAMATRON_AUTOMATION=grammars/ruby/source_automata.json
-afl-fuzz -i in -o out -- ./target
-```
-
-## Adding and testing a new grammar
-
-- Specify in a JSON format for CFG. Examples are correspond `source.json` files.
-- Run the automaton generation script (in `src/gramfuzz-mutator/preprocess`)
-  which will place the generated automaton in the same folder.
-
-  ```
-  ./preprocess/prep_automaton.sh <grammar_file> <start_symbol> [stack_limit]
-
-  E.g., ./preprocess/prep_automaton.sh ~/grammars/ruby/source.json PROGRAM
-  ```
-
-- If the grammar has no self-embedding rules, then you do not need to pass the
-  stack limit parameter. However, if it does have self-embedding rules, then you
-  need to pass the stack limit parameter. We recommend starting with `5` and
-  then increasing it if you need more complexity.
-- To sanity-check that the automaton is generating inputs as expected, you can
-  use the `test` binary housed in `src/gramfuzz-mutator`.
-
-  ```
-  ./test SanityCheck <automaton_file>
-
-  E.g., ./test SanityCheck ~/grammars/ruby/source_automata.json
-  ```

custom_mutators/gramatron/build_gramatron_mutator.sh

@@ -1,149 +0,0 @@
-#!/bin/sh
-#
-# american fuzzy lop++ - gramatron build script
-# ------------------------------------------------
-#
-# Originally written by Nathan Voss <njvoss99@gmail.com>
-#
-# Adapted from code by Andrew Griffiths <agriffiths@google.com> and
-#                      Michal Zalewski
-#
-# Adapted for AFLplusplus by Dominik Maier <mail@dmnk.co>
-#
-# Copyright 2017 Battelle Memorial Institute. All rights reserved.
-# Copyright 2019-2023 AFLplusplus Project. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# This script downloads, patches, and builds a version of Unicorn with
-# minor tweaks to allow Unicorn-emulated binaries to be run under
-# afl-fuzz.
-#
-# The modifications reside in patches/*. The standalone Unicorn library
-# will be written to /usr/lib/libunicornafl.so, and the Python bindings
-# will be installed system-wide.
-#
-# You must make sure that Unicorn Engine is not already installed before
-# running this script. If it is, please uninstall it first.
-
-JSONC_VERSION="$(cat ./JSONC_VERSION)"
-JSONC_REPO="https://github.com/json-c/json-c"
-
-echo "================================================="
-echo "Gramatron Mutator build script"
-echo "================================================="
-echo
-
-echo "[*] Performing basic sanity checks..."
-
-PLT=`uname -s`
-
-if [ ! -f "../../config.h" ]; then
-
-  echo "[-] Error: key files not found - wrong working directory?"
-  exit 1
-
-fi
-
-if [ ! -f "../../src/afl-performance.o" ]; then
-
-  echo "[-] Error: you must build afl-fuzz first and not do a \"make clean\""
-  exit 1
-
-fi
-
-PYTHONBIN=`command -v python3 || command -v python || command -v python2 || echo python3`
-MAKECMD=make
-TARCMD=tar
-
-if [ "$PLT" = "Darwin" ]; then
-  CORES=`sysctl -n hw.ncpu`
-  TARCMD=tar
-fi
-
-if [ "$PLT" = "FreeBSD" ]; then
-  MAKECMD=gmake
-  CORES=`sysctl -n hw.ncpu`
-  TARCMD=gtar
-fi
-
-if [ "$PLT" = "NetBSD" ] || [ "$PLT" = "OpenBSD" ]; then
-  MAKECMD=gmake
-  CORES=`sysctl -n hw.ncpu`
-  TARCMD=gtar
-fi
-
-PREREQ_NOTFOUND=
-for i in git $MAKECMD $TARCMD; do
-
-  T=`command -v "$i" 2>/dev/null`
-
-  if [ "$T" = "" ]; then
-
-    echo "[-] Error: '$i' not found. Run 'sudo apt-get install $i' or similar."
-    PREREQ_NOTFOUND=1
-
-  fi
-
-done
-
-test -z "$CC" && export CC=cc
-
-if echo "$CC" | grep -qF /afl-; then
-
-  echo "[-] Error: do not use afl-gcc or afl-clang to compile this tool."
-  PREREQ_NOTFOUND=1
-
-fi
-
-if [ "$PREREQ_NOTFOUND" = "1" ]; then
-  exit 1
-fi
-
-echo "[+] All checks passed!"
-
-echo "[*] Making sure json-c is checked out"
-
-git status 1>/dev/null 2>/dev/null
-if [ $? -eq 0 ]; then
-  echo "[*] initializing json-c submodule"
-  git submodule init || exit 1
-  git submodule update ./json-c 2>/dev/null # ignore errors
-else
-  echo "[*] cloning json-c"
-  test -d json-c/.git || {
-    CNT=1
-    while [ '!' -d json-c/.git -a "$CNT" -lt 4 ]; do
-      echo "Trying to clone json-c (attempt $CNT/3)"
-      git clone "$JSONC_REPO" 
-      CNT=`expr "$CNT" + 1`
-    done
-  }
-fi
-
-test -e json-c/.git || { echo "[-] not checked out, please install git or check your internet connection." ; exit 1 ; }
-echo "[+] Got json-c."
-
-test -e json-c/.libs/libjson-c.a || {
-  cd "json-c" || exit 1
-  echo "[*] Checking out $JSONC_VERSION"
-  sh -c 'git stash && git stash drop' 1>/dev/null 2>/dev/null
-  git checkout "$JSONC_VERSION" || exit 1
-  sh autogen.sh || exit 1
-  export CFLAGS=-fPIC
-  ./configure --disable-shared || exit 1
-  make || exit 1
-  cd ..
-}
-
-echo
-echo
-echo "[+] Json-c successfully prepared!"
-echo "[+] Builing gramatron now."
-$CC -O3 -g -fPIC -Wno-unused-result -Wl,--allow-multiple-definition -I../../include -o gramatron.so -shared -I. -I/prg/dev/include gramfuzz.c gramfuzz-helpers.c gramfuzz-mutators.c gramfuzz-util.c hashmap.c ../../src/afl-performance.o json-c/.libs/libjson-c.a || exit 1
-echo
-echo "[+] gramatron successfully built!"

custom_mutators/gramatron/gramfuzz-helpers.c

@@ -1,336 +0,0 @@
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <assert.h>
-#include "afl-fuzz.h"
-#include "gramfuzz.h"
-
-/*Slices from beginning till idx*/
-Array *slice(Array *input, int idx) {
-
-  // printf("\nSlice idx:%d", idx);
-  terminal *origptr;
-  terminal *term_ptr;
-  Array *   sliced = (Array *)malloc(sizeof(Array));
-  initArray(sliced, input->size);
-  // Populate dynamic array members
-  if (idx == 0) { return sliced; }
-  for (int x = 0; x < idx; x++) {
-
-    origptr = &input->start[x];
-    insertArray(sliced, origptr->state, origptr->symbol, origptr->symbol_len,
-                origptr->trigger_idx);
-
-  }
-
-  return sliced;
-
-}
-
-/* Slices from idx till end*/
-Array *slice_inverse(Array *input, int idx) {
-
-  // printf("\nSlice idx:%d", idx);
-  terminal *origptr;
-  terminal *term_ptr;
-  Array *   sliced = (Array *)malloc(sizeof(Array));
-  initArray(sliced, input->size);
-  for (int x = idx; x < input->used; x++) {
-
-    origptr = &input->start[x];
-    insertArray(sliced, origptr->state, origptr->symbol, origptr->symbol_len,
-                origptr->trigger_idx);
-
-  }
-
-  return sliced;
-
-}
-
-/*Carves with `start` included and `end` excluded*/
-Array *carve(Array *input, int start, int end) {
-
-  terminal *origptr;
-  terminal *term_ptr;
-  Array *   sliced = (Array *)malloc(sizeof(Array));
-  initArray(sliced, input->size);
-  for (int x = start; x < end; x++) {
-
-    origptr = &input->start[x];
-    insertArray(sliced, origptr->state, origptr->symbol, origptr->symbol_len,
-                origptr->trigger_idx);
-
-  }
-
-  return sliced;
-
-}
-
-/*Concats prefix + feature *mult*/
-void concatPrefixFeature(Array *prefix, Array *feature) {
-
-  // XXX: Currently we have hardcoded the multiplication threshold for adding
-  // the recursive feature. Might want to fix it to choose a random number upper
-  // bounded by a static value instead.
-  terminal *featureptr;
-  int       len = rand_below(global_afl, RECUR_THRESHOLD);
-  for (int x = 0; x < len; x++) {
-
-    for (int y = 0; y < feature->used; y++) {
-
-      featureptr = &feature->start[y];
-      insertArray(prefix, featureptr->state, featureptr->symbol,
-                  featureptr->symbol_len, featureptr->trigger_idx);
-
-    }
-
-  }
-
-}
-
-void concatPrefixFeatureBench(Array *prefix, Array *feature) {
-
-  // XXX: Currently we have hardcoded the multiplication threshold for adding
-  // the recursive feature. Might want to fix it to choose a random number upper
-  // bounded by a static value instead.
-  terminal *featureptr;
-  int       len =
-      5;  // 5 is the number of times we compare performing random recursion.
-  for (int x = 0; x < len; x++) {
-
-    for (int y = 0; y < feature->used; y++) {
-
-      featureptr = &feature->start[y];
-      insertArray(prefix, featureptr->state, featureptr->symbol,
-                  featureptr->symbol_len, featureptr->trigger_idx);
-
-    }
-
-  }
-
-}
-
-Array *spliceGF(Array *orig, Array *toSplice, int idx) {
-
-  terminal *toSplicePtr;
-  terminal *tempPtr;
-  // Iterate through the splice candidate from the `idx` till end
-  for (int x = idx; x < toSplice->used; x++) {
-
-    toSplicePtr = &toSplice->start[x];
-    insertArray(orig, toSplicePtr->state, toSplicePtr->symbol,
-                toSplicePtr->symbol_len, toSplicePtr->trigger_idx);
-
-  }
-
-  return orig;
-
-}
-
-Array *gen_input(state *pda, Array *input) {
-
-  state *   state_ptr;
-  trigger * trigger_ptr;
-  terminal *term_ptr;
-  int       offset = 0;
-  int       randval, error;
-  // Generating an input for the first time
-  if (input == NULL) {
-
-    input = (Array *)calloc(1, sizeof(Array));
-    initArray(input, INIT_SIZE);
-    curr_state = init_state;
-
-  }
-
-  while (curr_state != final_state) {
-
-    // Retrieving the state from the pda
-    state_ptr = pda + curr_state;
-
-    // Get a random trigger
-    randval = rand_below(global_afl, state_ptr->trigger_len);
-    trigger_ptr = (state_ptr->ptr) + randval;
-
-    // Insert into the dynamic array
-    insertArray(input, curr_state, trigger_ptr->term, trigger_ptr->term_len,
-                randval);
-    curr_state = trigger_ptr->dest;
-    offset += 1;
-
-  }
-
-  return input;
-
-}
-
-Array *gen_input_count(state *pda, Array *input, int *mut_count) {
-
-  state *   state_ptr;
-  trigger * trigger_ptr;
-  terminal *term_ptr;
-  int       offset = 0;
-  int       randval, error;
-  // Generating an input for the first time
-  if (input == NULL) {
-
-    input = (Array *)calloc(1, sizeof(Array));
-    initArray(input, INIT_SIZE);
-    curr_state = init_state;
-
-  }
-
-  while (curr_state != final_state) {
-
-    *mut_count += 1;
-    // Retrieving the state from the pda
-    state_ptr = pda + curr_state;
-
-    // Get a random trigger
-    randval = rand_below(global_afl, state_ptr->trigger_len);
-    trigger_ptr = (state_ptr->ptr) + randval;
-
-    // Insert into the dynamic array
-    insertArray(input, curr_state, trigger_ptr->term, trigger_ptr->term_len,
-                randval);
-    curr_state = trigger_ptr->dest;
-    offset += 1;
-
-  }
-
-  return input;
-
-}
-
-/*Creates a candidate from walk with state hashmap and
- * recursion hashmap
- */
-
-Candidate *gen_candidate(Array *input) {
-
-  terminal *  term_ptr;
-  IdxMap_new *idxmapPtr;
-  // Declare the State Hash Table
-  IdxMap_new *idxmapStart =
-      (IdxMap_new *)malloc(sizeof(IdxMap_new) * numstates);
-  for (int x = 0; x < numstates; x++) {
-
-    idxmapPtr = &idxmapStart[x];
-    utarray_new(idxmapPtr->nums, &ut_int_icd);
-
-  }
-
-  char *     trigger;
-  int        state;
-  char *     key;
-  Candidate *candidate = (Candidate *)malloc(sizeof(Candidate));
-  candidate->walk = input;
-  int offset = 0, error;
-
-  // Generate statemap for splicing
-  while (offset < input->used) {
-
-    term_ptr = &input->start[offset];
-    state = term_ptr->state;
-    // char *statenum = state + 1;
-    // int num = atoi(statenum);
-    idxmapPtr = &idxmapStart[state];
-    utarray_push_back(idxmapPtr->nums, &offset);
-    offset += 1;
-
-  }
-
-  candidate->statemap = idxmapStart;
-  return candidate;
-
-}
-
-char *get_state(char *trigger) {
-
-  // Get the state from transition
-  int trigger_idx = 0;
-  printf("\nTrigger:%s", trigger);
-  char *state = (char *)malloc(sizeof(char) * 10);
-  while (trigger[trigger_idx] != '_') {
-
-    state[trigger_idx] = trigger[trigger_idx];
-    trigger_idx += 1;
-
-  }
-
-  printf("\nTrigger Idx:%d", trigger_idx);
-  state[trigger_idx] = '\0';
-  return state;
-
-}
-
-void print_repr(Array *input, char *prefix) {
-
-  size_t    offset = 0;
-  terminal *term_ptr;
-  char      geninput[input->used * 100];
-  if (!input->used) {
-
-    printf("\n=============");
-    printf("\n%s:%s", prefix, "");
-    printf("\n=============");
-    return;
-
-  }
-
-  // This is done to create a null-terminated initial string
-  term_ptr = &input->start[offset];
-  strcpy(geninput, term_ptr->symbol);
-  offset += 1;
-
-  while (offset < input->used) {
-
-    term_ptr = &input->start[offset];
-    strcat(geninput, term_ptr->symbol);
-    offset += 1;
-
-  }
-
-  printf("\n=============");
-  printf("\n%s:%s", prefix, geninput);
-  printf("\n=============");
-
-}
-
-// int main(int argc, char*argv[]) {
-
-//     char *mode;
-//     if (argc == 1) {
-
-//         printf("\nUsage: ./gramfuzzer <mode>");
-//         return -1;
-//     }
-//     if (argc >= 2) {
-
-//         mode = argv[1];
-//         printf("\nMode:%s", mode);
-//     }
-//     if (! strcmp(mode, "Generate")) {
-
-//         GenInputBenchmark();
-//     }
-//     else if (! strcmp(mode, "RandomMutation")) {
-
-//         RandomMutationBenchmark();
-//     }
-//     else if (! strcmp(mode, "Splice")) {
-
-//         SpliceMutationBenchmark();
-//     }
-//     else if (! strcmp(mode, "Recursive")) {
-
-//         RandomRecursiveBenchmark();
-//     }
-//     else {
-
-//         printf("\nUnrecognized mode");
-//         return -1;
-//     }
-//     return 0;
-// }
-

custom_mutators/gramatron/gramfuzz-mutators.c

@@ -1,247 +0,0 @@
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <assert.h>
-#include "afl-fuzz.h"
-#include "gramfuzz.h"
-
-Array *performRandomMutation(state *pda, Array *input) {
-
-  terminal *term_ptr;
-  // terminal *prev_ptr;
-  Array *mutated;
-  Array *sliced;
-
-  // Get offset at which to generate new input and slice it
-  int idx = rand_below(global_afl, input->used);
-  sliced = slice(input, idx);
-  // print_repr(sliced, "Slice");
-
-  // prev_ptr = & input->start[idx - 1];
-  // printf("\nState:%s Symbol:%s", prev_ptr->state, prev_ptr->symbol);
-  // Reset current state to that of the slice's last member
-  term_ptr = &input->start[idx];
-  curr_state = term_ptr->state;
-  // printf("\nState:%s Symbol:%s", curr_state, term_ptr->symbol);
-
-  // Set the next available cell to the one adjacent to this chosen point
-  mutated = gen_input(pda, sliced);
-  return mutated;
-
-}
-
-// Tries to perform splice operation between two automaton walks
-UT_icd intpair_icd = {sizeof(intpair_t), NULL, NULL, NULL};
-
-Array *performSpliceOne(Array *originput, IdxMap_new *statemap_orig,
-                        Array *splicecand) {
-
-  UT_array * stateptr, *pairs;
-  intpair_t  ip;
-  intpair_t *cand;
-
-  terminal *term_ptr;
-  Array *   prefix;
-  int       state;
-
-  // Initialize the dynamic holding the splice indice pairs
-  utarray_new(pairs, &intpair_icd);
-  // print_repr(originput, "Orig");
-  // print_repr(splicecand, "SpliceCand");
-
-  // Iterate through the splice candidate identifying potential splice points
-  // and pushing pair (orig_idx, splice_idx) to a dynamic array
-  for (int x = 0; x < splicecand->used; x++) {
-
-    term_ptr = &splicecand->start[x];
-    stateptr = statemap_orig[term_ptr->state].nums;
-    int length = utarray_len(stateptr);
-    if (length) {
-
-      int *splice_idx = (int *)utarray_eltptr(stateptr, rand_below(global_afl, length));
-      ip.orig_idx = *splice_idx;
-      ip.splice_idx = x;
-      utarray_push_back(pairs, &ip);
-
-    }
-
-  }
-
-  // Pick a random pair
-  int length = utarray_len(pairs);
-  cand = (intpair_t *)utarray_eltptr(pairs, rand_below(global_afl, length));
-  // printf("\n Orig_idx:%d Splice_idx:%d", cand->orig_idx, cand->splice_idx);
-
-  // Perform the splicing
-  prefix = slice(originput, cand->orig_idx);
-  Array *spliced = spliceGF(prefix, splicecand, cand->splice_idx);
-  // print_repr(spliced, "Spliced");
-  //
-  utarray_free(pairs);
-
-  return spliced;
-
-}
-
-UT_array **get_dupes(Array *input, int *recur_len) {
-
-  // Variables related to finding duplicates
-  int         offset = 0;
-  int         state;
-  terminal *  term_ptr;
-  IdxMap_new *idxMapPtr;
-  UT_array ** recurIdx;
-
-  // Declare the Recursive Map Table
-  IdxMap_new *idxmapStart =
-      (IdxMap_new *)malloc(sizeof(IdxMap_new) * numstates);
-  //
-  // UT_array *(recurIdx[numstates]);
-  recurIdx = malloc(sizeof(UT_array *) * numstates);
-
-  for (int x = 0; x < numstates; x++) {
-
-    idxMapPtr = &idxmapStart[x];
-    utarray_new(idxMapPtr->nums, &ut_int_icd);
-
-  }
-
-  // Obtain frequency distribution of states
-  while (offset < input->used) {
-
-    term_ptr = &input->start[offset];
-    state = term_ptr->state;
-    // int num = atoi(state + 1);
-    idxMapPtr = &idxmapStart[state];
-    utarray_push_back(idxMapPtr->nums, &offset);
-    offset += 1;
-
-  }
-
-  // Retrieve the duplicated states
-  offset = 0;
-  while (offset < numstates) {
-
-    idxMapPtr = &idxmapStart[offset];
-    int length = utarray_len(idxMapPtr->nums);
-    if (length >= 2) {
-
-      recurIdx[*recur_len] = idxMapPtr->nums;
-      *recur_len += 1;
-
-    }
-
-    // else {
-
-    //     utarray_free(idxMapPtr->nums);
-    // }
-    offset += 1;
-
-  }
-
-  if (*recur_len) {
-
-    // Declare the return struct
-    // We use this struct so that we save the reference to IdxMap_new and free
-    // it after we have used it in doMult
-    // Get_Dupes_Ret* getdupesret =
-    // (Get_Dupes_Ret*)malloc(sizeof(Get_Dupes_Ret));
-    return recurIdx;
-    // getdupesret->idxmap = idxmapStart;
-    // getdupesret->recurIdx = recurIdx;
-    // return getdupesret;
-
-  } else {
-
-    return NULL;
-
-  }
-
-}
-
-Array *doMult(Array *input, UT_array **recur, int recurlen) {
-
-  int       offset = 0;
-  int       idx = rand_below(global_afl, recurlen);
-  UT_array *recurMap = recur[idx];
-  UT_array *recurPtr;
-  Array *   prefix;
-  Array *   postfix;
-  Array *   feature;
-
-  // Choose two indices to get the recursive feature
-  int recurIndices = utarray_len(recurMap);
-  int firstIdx = 0;
-  int secondIdx = 0;
-  getTwoIndices(recurMap, recurIndices, &firstIdx, &secondIdx);
-
-  // Perform the recursive mut
-  // print_repr(input, "Orig");
-  prefix = slice(input, firstIdx);
-  // print_repr(prefix, "Prefix");
-  if (firstIdx < secondIdx) {
-
-    feature = carve(input, firstIdx, secondIdx);
-
-  } else {
-
-    feature = carve(input, secondIdx, firstIdx);
-
-  }
-
-  // print_repr(feature, "Feature");
-  concatPrefixFeature(prefix, feature);
-
-  // GC allocated structures
-  free(feature->start);
-  free(feature);
-  // for(int x = 0; x < recurlen; x++) {
-
-  //     utarray_free(recur[x]);
-  // }
-  // free(recur);
-  // print_repr(prefix, "Concat");
-  return spliceGF(prefix, input, secondIdx);
-
-}
-
-void getTwoIndices(UT_array *recur, int recurlen, int *firstIdx,
-                   int *secondIdx) {
-
-  int ArrayRecurIndices[recurlen];
-  int offset = 0, *p;
-  // Unroll into an array
-  for (p = (int *)utarray_front(recur); p != NULL;
-       p = (int *)utarray_next(recur, p)) {
-
-    ArrayRecurIndices[offset] = *p;
-    offset += 1;
-
-  }
-
-  /*Source:
-   * https://www.geeksforgeeks.org/shuffle-a-given-array-using-fisher-yates-shuffle-algorithm/
-   */
-  for (int i = offset - 1; i > 0; i--) {
-
-    // Pick a random index from 0 to i
-    int j = rand_below(global_afl, i + 1);
-
-    // Swap arr[i] with the element at random index
-    swap(&ArrayRecurIndices[i], &ArrayRecurIndices[j]);
-
-  }
-
-  *firstIdx = ArrayRecurIndices[0];
-  *secondIdx = ArrayRecurIndices[1];
-
-}
-
-void swap(int *a, int *b) {
-
-  int temp = *a;
-  *a = *b;
-  *b = temp;
-
-}
-

custom_mutators/gramatron/gramfuzz-util.c

@@ -1,268 +0,0 @@
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <assert.h>
-#include "afl-fuzz.h"
-#include "gramfuzz.h"
-#ifdef _GNU_SOURCE
-  #undef _GNU_SOURCE
-#endif
-#define _GNU_SOURCE
-#include <sys/mman.h>
-
-/* Dynamic Array for adding to the input repr
- * */
-void initArray(Array *a, size_t initialSize) {
-
-  a->start = (terminal *)calloc(1, sizeof(terminal) * initialSize);
-  a->used = 0;
-  a->size = initialSize;
-  a->inputlen = 0;
-
-}
-
-void insertArray(Array *a, int state, char *symbol, size_t symbol_len,
-                 int trigger_idx) {
-
-  // a->used is the number of used entries, because a->array[a->used++] updates
-  // a->used only *after* the array has been accessed. Therefore a->used can go
-  // up to a->size
-  terminal *term_ptr;
-  if (a->used == a->size) {
-
-    a->size = a->size * sizeof(terminal);
-    a->start = (terminal *)realloc(a->start, a->size * sizeof(terminal));
-
-  }
-
-  // Add the element
-  term_ptr = &a->start[a->used];
-  term_ptr->state = state;
-  term_ptr->symbol = symbol;
-  term_ptr->symbol_len = symbol_len;
-  term_ptr->trigger_idx = trigger_idx;
-
-  // Increment the pointer
-  a->used += 1;
-  a->inputlen += symbol_len;
-
-}
-
-void freeArray(Array *a) {
-
-  terminal *ptr;
-  for (int x = 0; x < a->used; x++) {
-
-    ptr = &a->start[x];
-    free(ptr);
-
-  }
-
-  a->start = NULL;
-  a->used = a->size = 0;
-
-}
-
-/* Dynamic array for adding indices of states/recursive features
- * Source:
- * https://stackoverflow.com/questions/3536153/c-dynamically-growing-array
- */
-void initArrayIdx(IdxMap *a, size_t initialSize) {
-
-  a->array = (int *)malloc(initialSize * sizeof(int));
-  a->used = 0;
-  a->size = initialSize;
-
-}
-
-void insertArrayIdx(IdxMap *a, int idx) {
-
-  // a->used is the number of used entries, because a->array[a->used++] updates
-  // a->used only *after* the array has been accessed. Therefore a->used can go
-  // up to a->size
-  if (a->used == a->size) {
-
-    a->size *= 2;
-    a->array = (int *)realloc(a->array, a->size * sizeof(int));
-
-  }
-
-  a->array[a->used++] = idx;
-
-}
-
-void freeArrayIdx(IdxMap *a) {
-
-  free(a->array);
-  a->array = NULL;
-  a->used = a->size = 0;
-
-}
-
-/* Dynamic array for adding potential splice points
- */
-void initArraySplice(SpliceCandArray *a, size_t initialSize) {
-
-  a->start = (SpliceCand *)malloc(initialSize * sizeof(SpliceCand));
-  a->used = 0;
-  a->size = initialSize;
-
-}
-
-void insertArraySplice(SpliceCandArray *a, Candidate *candidate, int idx) {
-
-  // a->used is the number of used entries, because a->array[a->used++] updates
-  // a->used only *after* the array has been accessed. Therefore a->used can go
-  // up to a->size
-  SpliceCand *candptr;
-  if (a->used == a->size) {
-
-    a->size = a->size * sizeof(SpliceCand);
-    a->start = (SpliceCand *)realloc(a->start, a->size * sizeof(SpliceCand));
-
-  }
-
-  // Add the element
-  candptr = &a->start[a->used];
-  candptr->splice_cand = candidate;
-  candptr->idx = idx;
-  a->used += 1;
-
-}
-
-void freeArraySplice(IdxMap *a) {
-
-  free(a->array);
-  a->array = NULL;
-  a->used = a->size = 0;
-
-}
-
-int fact(int n) {
-
-  int i, f = 1;
-  for (i = 1; i <= n; i++) {
-
-    f *= i;
-
-  }
-
-  return f;
-
-}
-
-/* Uses the walk to create the input in-memory */
-u8 *unparse_walk(Array *input) {
-
-  terminal *term_ptr;
-  int       offset = 0;
-  u8 *      unparsed = (u8 *)malloc(input->inputlen + 1);
-  term_ptr = &input->start[offset];
-  strcpy(unparsed, term_ptr->symbol);
-  offset += 1;
-  while (offset < input->used) {
-
-    term_ptr = &input->start[offset];
-    strcat(unparsed, term_ptr->symbol);
-    offset += 1;
-
-  }
-
-  return unparsed;
-
-}
-
-/*Dump the input representation into a file*/
-void write_input(Array *input, u8 *fn) {
-
-  FILE *fp;
-  // If file already exists, then skip creating the file
-  if (access(fn, F_OK) != -1) { return; }
-
-  fp = fopen(fn, "wbx+");
-  // If the input has already been flushed, then skip silently
-  if (fp == NULL) {
-
-    fprintf(stderr, "\n File '%s' could not be open, exiting\n", fn);
-    exit(1);
-
-  }
-
-  // Write the length parameters
-  fwrite(&input->used, sizeof(size_t), 1, fp);
-  fwrite(&input->size, sizeof(size_t), 1, fp);
-  fwrite(&input->inputlen, sizeof(size_t), 1, fp);
-
-  // Write the dynamic array to file
-  fwrite(input->start, input->size * sizeof(terminal), 1, fp);
-  // printf("\nUsed:%zu Size:%zu Inputlen:%zu", input->used, input->size,
-  // input->inputlen);
-  fclose(fp);
-
-}
-
-Array *parse_input(state *pda, FILE *fp) {
-
-  terminal *term;
-  state *   state_ptr;
-  trigger * trigger;
-  int       trigger_idx;
-  Array *   input = (Array *)calloc(1, sizeof(Array));
-
-  // Read the length parameters
-  fread(&input->used, sizeof(size_t), 1, fp);
-  fread(&input->size, sizeof(size_t), 1, fp);
-  fread(&input->inputlen, sizeof(size_t), 1, fp);
-
-  terminal *start_ptr = (terminal *)calloc(input->size, sizeof(terminal));
-  if (!start_ptr) {
-
-    fprintf(stderr, "alloc failed!\n");
-    return NULL;
-
-  }
-
-  // Read the dynamic array to memory
-  fread(start_ptr, input->size * sizeof(terminal), 1, fp);
-  // Update the pointers to the terminals since they would have
-  // changed
-  int idx = 0;
-  while (idx < input->used) {
-
-    terminal *term = &start_ptr[idx];
-    // Find the state
-    state_ptr = pda + term->state;
-    // Find the trigger and update the terminal address
-    trigger_idx = term->trigger_idx;
-    trigger = (state_ptr->ptr) + trigger_idx;
-    term->symbol = trigger->term;
-    idx += 1;
-
-  }
-
-  input->start = start_ptr;
-  // printf("\nUsed:%zu Size:%zu Inputlen:%zu", input->used, input->size,
-  // input->inputlen);
-
-  return input;
-
-}
-
-// Read the input representation into memory
-Array *read_input(state *pda, u8 *fn) {
-
-  FILE *fp;
-  fp = fopen(fn, "rb");
-  if (fp == NULL) {
-
-    fprintf(stderr, "\n File '%s' does not exist, exiting\n", fn);
-    exit(1);
-
-  }
-
-  Array *res = parse_input(pda, fp);
-  fclose(fp);
-  return res;
-
-}
-

custom_mutators/gramatron/gramfuzz.c

@@ -1,429 +0,0 @@
-// This simple example just creates random buffer <= 100 filled with 'A'
-// needs -I /path/to/AFLplusplus/include
-//#include "custom_mutator_helpers.h"
-
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-
-#include "afl-fuzz.h"
-#include "gramfuzz.h"
-
-#define MUTATORS 4  // Specify the total number of mutators
-
-typedef struct my_mutator {
-
-  afl_state_t *afl;
-
-  u8 *   mutator_buf;
-  u8 *   unparsed_input;
-  Array *mutated_walk;
-  Array *orig_walk;
-
-  IdxMap_new *statemap;  // Keeps track of the statemap
-  UT_array ** recurIdx;
-  // Get_Dupes_Ret* getdupesret; // Recursive feature map
-  int recurlen;
-
-  int mut_alloced;
-  int orig_alloced;
-  int mut_idx;  // Signals the current mutator being used, used to cycle through
-                // each mutator
-
-  unsigned int seed;
-
-} my_mutator_t;
-
-state *create_pda(u8 *automaton_file) {
-
-  struct json_object *parsed_json;
-  state *             pda;
-  json_object *       source_obj, *attr;
-  int                 arraylen, ii, ii2, trigger_len, error;
-
-  printf("\n[GF] Automaton file passed:%s", automaton_file);
-  // parsed_json =
-  // json_object_from_file("./gramfuzz/php_gnf_processed_full.json");
-  parsed_json = json_object_from_file(automaton_file);
-
-  // Getting final state
-  source_obj = json_object_object_get(parsed_json, "final_state");
-  printf("\t\nFinal=%s\n", json_object_get_string(source_obj));
-  final_state = atoi(json_object_get_string(source_obj));
-
-  // Getting initial state
-  source_obj = json_object_object_get(parsed_json, "init_state");
-  init_state = atoi(json_object_get_string(source_obj));
-  printf("\tInit=%s\n", json_object_get_string(source_obj));
-
-  // Getting number of states
-  source_obj = json_object_object_get(parsed_json, "numstates");
-  numstates = atoi(json_object_get_string(source_obj)) + 1;
-  printf("\tNumStates=%d\n", numstates);
-
-  // Allocate state space for each pda state
-  pda = (state *)calloc(atoi(json_object_get_string(source_obj)) + 1,
-                        sizeof(state));
-
-  // Getting PDA representation
-  source_obj = json_object_object_get(parsed_json, "pda");
-  enum json_type type;
-  json_object_object_foreach(source_obj, key, val) {
-
-    state *  state_ptr;
-    trigger *trigger_ptr;
-    int      offset;
-
-    // Get the correct offset into the pda to store state information
-    state_ptr = pda;
-    offset = atoi(key);
-    state_ptr += offset;
-    // Store state string
-    state_ptr->state_name = offset;
-
-    // Create trigger array of structs
-    trigger_len = json_object_array_length(val);
-    state_ptr->trigger_len = trigger_len;
-    trigger_ptr = (trigger *)calloc(trigger_len, sizeof(trigger));
-    state_ptr->ptr = trigger_ptr;
-
-    for (ii = 0; ii < trigger_len; ii++) {
-
-      json_object *obj = json_object_array_get_idx(val, ii);
-      // Get all the trigger trigger attributes
-      attr = json_object_array_get_idx(obj, 0);
-      (trigger_ptr)->id = strdup(json_object_get_string(attr));
-
-      attr = json_object_array_get_idx(obj, 1);
-      trigger_ptr->dest = atoi(json_object_get_string(attr));
-
-      attr = json_object_array_get_idx(obj, 2);
-      if (!strcmp("\\n", json_object_get_string(attr))) {
-
-        trigger_ptr->term = strdup("\n");
-
-      } else {
-
-        trigger_ptr->term = strdup(json_object_get_string(attr));
-
-      }
-
-      trigger_ptr->term_len = strlen(trigger_ptr->term);
-      trigger_ptr++;
-
-    }
-
-  }
-
-  // Delete the JSON object
-  json_object_put(parsed_json);
-
-  return pda;
-
-}
-
-my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
-
-  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) {
-
-    perror("mutator_buf alloc");
-    return NULL;
-
-  }
-
-  data->afl = afl;
-  global_afl = afl;  // dirty
-  data->seed = seed;
-
-  data->mut_alloced = 0;
-  data->orig_alloced = 0;
-  data->mut_idx = 0;
-  data->recurlen = 0;
-
-  // data->mutator_buf = NULL;
-  // data->unparsed_input = NULL;
-  // data->mutated_walk = NULL;
-  // data->orig_walk = NULL;
-  //
-  // data->statemap = NULL;  // Keeps track of the statemap
-  // data->recur_idx = NULL; // Will keep track of recursive feature indices
-  // u32 recur_len = 0;       // The number of recursive features
-  // data->mutator_buf = NULL;
-
-  char *automaton_file = getenv("GRAMATRON_AUTOMATION");
-  if (automaton_file) {
-
-    pda = create_pda(automaton_file);
-
-  } else {
-
-    fprintf(stderr,
-            "\nError: GrammaTron needs an automation json file set in "
-            "GRAMATRON_AUTOMATION\n");
-    exit(-1);
-
-  }
-
-  return data;
-
-}
-
-size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
-                       u8 **out_buf, uint8_t *add_buf, size_t add_buf_size,
-                       size_t max_size) {
-
-  u8 *unparsed_input;
-
-  // Pick a mutator
-  // int choice = rand() % MUTATORS;
-  // data->mut_idx = 1;
-  // GC old mutant
-  if (data->mut_alloced) {
-
-    free(data->mutated_walk->start);
-    free(data->mutated_walk);
-    data->mut_alloced = 0;
-
-  };
-
-  // printf("\nChoice:%d", choice);
-
-  if (data->mut_idx == 0) {  // Perform random mutation
-    data->mutated_walk = performRandomMutation(pda, data->orig_walk);
-    data->mut_alloced = 1;
-
-  } else if (data->mut_idx == 1 &&
-
-             data->recurlen) {  // Perform recursive mutation
-    data->mutated_walk =
-        doMult(data->orig_walk, data->recurIdx, data->recurlen);
-    data->mut_alloced = 1;
-
-  } else if (data->mut_idx == 2) {  // Perform splice mutation
-
-    // we cannot use the supplied splice data so choose a new random file
-    u32                 tid = rand_below(global_afl, data->afl->queued_items);
-    struct queue_entry *q = data->afl->queue_buf[tid];
-
-    // Read the input representation for the splice candidate
-    u8 *   automaton_fn = alloc_printf("%s.aut", q->fname);
-    Array *spliceCandidate = read_input(pda, automaton_fn);
-
-    if (spliceCandidate) {
-
-      data->mutated_walk =
-          performSpliceOne(data->orig_walk, data->statemap, spliceCandidate);
-      data->mut_alloced = 1;
-      free(spliceCandidate->start);
-      free(spliceCandidate);
-
-    } else {
-
-      data->mutated_walk = gen_input(pda, NULL);
-      data->mut_alloced = 1;
-
-    }
-
-    ck_free(automaton_fn);
-
-  } else {  // Generate an input from scratch
-
-    data->mutated_walk = gen_input(pda, NULL);
-    data->mut_alloced = 1;
-
-  }
-
-  // Cycle to the next mutator
-  if (data->mut_idx == MUTATORS - 1)
-    data->mut_idx =
-        0;  // Wrap around if we have reached end of the mutator list
-  else
-    data->mut_idx += 1;
-
-  // Unparse the mutated automaton walk
-  if (data->unparsed_input) { free(data->unparsed_input); }
-  data->unparsed_input = unparse_walk(data->mutated_walk);
-  *out_buf = data->unparsed_input;
-
-  return data->mutated_walk->inputlen;
-
-}
-
-/**
- * Create the automaton-based representation for the corresponding input
- *
- * @param data pointer returned in afl_custom_init for this fuzz case
- * @param filename_new_queue File name of the new queue entry
- * @param filename_orig_queue File name of the original queue entry
- */
-u8 afl_custom_queue_new_entry(my_mutator_t * data,
-                              const uint8_t *filename_new_queue,
-                              const uint8_t *filename_orig_queue) {
-
-  // get the filename
-  u8 *   automaton_fn, *unparsed_input;
-  Array *new_input;
-  s32    fd;
-
-  automaton_fn = alloc_printf("%s.aut", filename_new_queue);
-  // Check if this method is being called during initialization
-
-  // fprintf(stderr, "new: %s, old: %s, auto: %s\n",
-  // filename_new_queue,filename_orig_queue,automaton_fn);
-
-  if (filename_orig_queue) {
-
-    write_input(data->mutated_walk, automaton_fn);
-
-  } else {
-
-    new_input = gen_input(pda, NULL);
-    write_input(new_input, automaton_fn);
-
-    // Update the placeholder file
-    if (unlink(filename_new_queue)) {
-
-      PFATAL("Unable to delete '%s'", filename_new_queue);
-
-    }
-
-    unparsed_input = unparse_walk(new_input);
-    fd = open(filename_new_queue, O_WRONLY | O_CREAT | O_TRUNC,
-              S_IRUSR | S_IWUSR);
-    if (fd < 0) { PFATAL("Failed to update file '%s'", filename_new_queue); }
-    int written = write(fd, unparsed_input, new_input->inputlen + 1);
-    close(fd);
-
-    free(new_input->start);
-    free(new_input);
-    free(unparsed_input);
-
-  }
-
-  ck_free(automaton_fn);
-
-  return 1;
-
-}
-
-/**
- * Get the corresponding tree representation for the candidate that is to be
- * mutated
- *
- * @param[in] data pointer returned in afl_custom_init for this fuzz case
- * @param filename File name of the test case in the queue entry
- * @return Return True(1) if the fuzzer will fuzz the queue entry, and
- *     False(0) otherwise.
- */
-uint8_t afl_custom_queue_get(my_mutator_t *data, const uint8_t *filename) {
-
-  // get the filename
-  u8 *        automaton_fn = alloc_printf("%s.aut", filename);
-  IdxMap_new *statemap_ptr;
-  terminal *  term_ptr;
-  int         state;
-
-  // TODO: I don't think we need to update pointers when reading back
-  // Probably build two different versions of read_input one for flushing
-  // inputs to disk and the other that
-  if (data->orig_alloced) {
-
-    free(data->orig_walk->start);
-    free(data->orig_walk);
-    data->orig_alloced = 0;
-
-  }
-
-  if (data->statemap) {
-
-    for (int x = 0; x < numstates; x++) {
-
-      utarray_free(data->statemap[x].nums);
-
-    }
-
-    free(data->statemap);
-
-  }
-
-  if (data->recurIdx) {
-
-    data->recurlen = 0;
-    free(data->recurIdx);
-
-  }
-
-  data->orig_walk = read_input(pda, automaton_fn);
-  data->orig_alloced = 1;
-
-  // Create statemap for the fuzz candidate
-  IdxMap_new *statemap_start =
-      (IdxMap_new *)malloc(sizeof(IdxMap_new) * numstates);
-  for (int x = 0; x < numstates; x++) {
-
-    statemap_ptr = &statemap_start[x];
-    utarray_new(statemap_ptr->nums, &ut_int_icd);
-
-  }
-
-  int offset = 0;
-  while (offset < data->orig_walk->used) {
-
-    term_ptr = &data->orig_walk->start[offset];
-    state = term_ptr->state;
-    statemap_ptr = &statemap_start[state];
-    utarray_push_back(statemap_ptr->nums, &offset);
-    offset += 1;
-
-  }
-
-  data->statemap = statemap_start;
-
-  // Create recursive feature map (if it exists)
-  data->recurIdx = malloc(sizeof(UT_array *) * numstates);
-  // Retrieve the duplicated states
-  offset = 0;
-  while (offset < numstates) {
-
-    statemap_ptr = &data->statemap[offset];
-    int length = utarray_len(statemap_ptr->nums);
-    if (length >= 2) {
-
-      data->recurIdx[data->recurlen] = statemap_ptr->nums;
-      data->recurlen += 1;
-
-    }
-
-    offset += 1;
-
-  }
-
-  // data->getdupesret = get_dupes(data->orig_walk, &data->recurlen);
-
-  ck_free(automaton_fn);
-  return 1;
-
-}
-
-/**
- * Deinitialize everything
- *
- * @param data The data ptr from afl_custom_init
- */
-
-void afl_custom_deinit(my_mutator_t *data) {
-
-  free(data->mutator_buf);
-  free(data);
-
-}
-

custom_mutators/gramatron/gramfuzz.h

@@ -1,255 +0,0 @@
-#ifndef _GRAMFUZZ_H
-
-#define _GRAMFUZZ_H
-
-#include <json-c/json.h>
-#include <unistd.h>
-#include "hashmap.h"
-#include "uthash.h"
-#include "utarray.h"
-
-#define INIT_INPUTS 100  // No. of initial inputs to be generated
-
-// Set this as `numstates` + 1 where `numstates` is retrieved from gen automata
-// json #define STATES 63
-
-#define INIT_SIZE 100  // Initial size of the dynamic array holding the input
-
-#define SPLICE_CORPUS 10000
-#define RECUR_THRESHOLD 6
-#define SIZE_THRESHOLD 2048
-
-#define FLUSH_INTERVAL \
-  3600  // Inputs that gave new coverage will be dumped every FLUSH_INTERVAL
-        // seconds
-
-afl_state_t *global_afl;
-
-typedef struct trigger {
-
-  char * id;
-  int    dest;
-  char * term;
-  size_t term_len;
-
-} trigger;
-
-typedef struct state {
-
-  int      state_name;   // Integer State name
-  int      trigger_len;  // Number of triggers associated with this state
-  trigger *ptr;          // Pointer to beginning of the list of triggers
-
-} state;
-
-typedef struct terminal {
-
-  int    state;
-  int    trigger_idx;
-  size_t symbol_len;
-  char * symbol;
-
-} terminal;
-
-typedef struct buckethash {
-
-  int freq;
-
-} buckethash;
-
-int init_state;
-int curr_state;
-int final_state;
-int numstates;
-
-/*****************
-/ DYNAMIC ARRAY FOR WALKS
-*****************/
-
-typedef struct {
-
-  size_t    used;
-  size_t    size;
-  size_t    inputlen;
-  terminal *start;
-
-} Array;
-
-/*****************
-/ DYNAMIC ARRAY FOR STATEMAPS/RECURSION MAPS
-*****************/
-
-typedef struct {
-
-  int *  array;
-  size_t used;
-  size_t size;
-
-} IdxMap;
-
-typedef struct {
-
-  UT_array *nums;
-
-} IdxMap_new;
-
-typedef struct {
-
-  IdxMap_new *idxmap;
-  UT_array ** recurIdx;
-
-} Get_Dupes_Ret;
-
-/* Candidate Struct */
-typedef struct {
-
-  Array *     walk;
-  IdxMap_new *statemap;
-
-} Candidate;
-
-/* Splice Mutation helpers*/
-typedef struct {
-
-  Candidate *splice_cand;
-  int        idx;
-
-} SpliceCand;
-
-typedef struct {
-
-  SpliceCand *start;
-  size_t      used;
-  size_t      size;
-
-} SpliceCandArray;
-
-// Initialize dynamic array for potential splice points
-SpliceCand potential[SPLICE_CORPUS];
-
-typedef struct {
-
-  int orig_idx;
-  int splice_idx;
-
-} intpair_t;
-
-// Initialize dynamic array for potential splice points
-// SpliceCand potential[SPLICE_CORPUS];
-// IdxMap_new* rcuridx[STATES];
-
-/* Prototypes*/
-Array *    slice(Array *, int);
-state *    create_pda(u8 *);
-Array *    gen_input(state *, Array *);
-Array *    gen_input_count(state *, Array *, int *);
-int        updatebucket(map_t, int);
-void       itoa(int, char *, int);
-void       strrreverse(char *, char *);
-void       dbg_hashmap(map_t);
-void       print_repr(Array *, char *);
-int        isSatisfied(map_t);
-char *     get_state(char *);
-Candidate *gen_candidate(Array *);
-
-Array *spliceGF(Array *, Array *, int);
-Array *performSpliceOne(Array *, IdxMap_new *, Array *);
-/* Mutation Methods*/
-Array *    performRandomMutation(state *, Array *);
-Array *    performRandomMutationCount(state *, Array *, int *);
-Array *    performSpliceMutationBench(state *, Array *, Candidate **);
-UT_array **get_dupes(Array *, int *);
-Array *    doMult(Array *, UT_array **, int);
-Array *    doMultBench(Array *, UT_array **, int);
-
-/* Benchmarks*/
-void SpaceBenchmark(char *);
-void GenInputBenchmark(char *, char *);
-void RandomMutationBenchmark(char *, char *);
-void MutationAggrBenchmark(char *, char *);
-void SpliceMutationBenchmark(char *, char *);
-void SpliceMutationBenchmarkOne(char *, char *);
-void RandomRecursiveBenchmark(char *, char *);
-
-/* Testers */
-void SanityCheck(char *);
-
-/*Helpers*/
-void   initArray(Array *, size_t);
-void   insertArray(Array *, int, char *, size_t, int);
-void   freeArray(Array *);
-void   initArrayIdx(IdxMap *, size_t);
-void   insertArrayIdx(IdxMap *, int);
-void   freeArrayIdx(IdxMap *);
-void   initArraySplice(SpliceCandArray *, size_t);
-void   insertArraySplice(SpliceCandArray *, Candidate *, int);
-void   freeArraySplice(IdxMap *);
-void   getTwoIndices(UT_array *, int, int *, int *);
-void   swap(int *, int *);
-Array *slice_inverse(Array *, int);
-void   concatPrefixFeature(Array *, Array *);
-void   concatPrefixFeatureBench(Array *, Array *);
-Array *carve(Array *, int, int);
-int    fact(int);
-
-void                add_to_corpus(struct json_object *, Array *);
-struct json_object *term_to_json(terminal *);
-
-/* Gramatron specific prototypes */
-u8 *   unparse_walk(Array *);
-Array *performSpliceGF(state *, Array *, afl_state_t *);
-void   dump_input(u8 *, char *, int *);
-void   write_input(Array *, u8 *);
-Array *read_input(state *, u8 *);
-state *pda;
-
-// // AFL-specific struct
-// typedef uint8_t  u8;
-// typedef uint16_t u16;
-// typedef uint32_t u32;
-// #ifdef __x86_64__
-// typedef unsigned long long u64;
-// #else
-// typedef uint64_t u64;
-// #endif                                                    /* ^__x86_64__ */
-//
-// struct queue_entry {
-
-//   Array* walk;                           /* Pointer to the automaton walk*/
-//   u32 walk_len;                          /* Number of tokens in the input*/
-//   Candidate* cand;                     /* Preprocessed info about the
-//   candidate to allow for faster mutations*/
-//
-//   u8* fname;                          /* File name for the test case      */
-//   u32 len;                            /* Input length                     */
-//   UT_array** recur_idx;               /* Keeps track of recursive feature
-//   indices*/
-//
-//   u32 recur_len;                      /* The number of recursive features*/
-//
-//   u8  cal_failed,                     /* Calibration failed?              */
-//       trim_done,                      /* Trimmed?                         */
-//       was_fuzzed,                     /* Had any fuzzing done yet?        */
-//       passed_det,                     /* Deterministic stages passed?     */
-//       has_new_cov,                    /* Triggers new coverage?           */
-//       var_behavior,                   /* Variable behavior?               */
-//       favored,                        /* Currently favored?               */
-//       fs_redundant;                   /* Marked as redundant in the fs?   */
-//
-//   u32 bitmap_size,                    /* Number of bits set in bitmap     */
-//       exec_cksum;                     /* Checksum of the execution trace  */
-//
-//   u64 exec_us,                        /* Execution time (us)              */
-//       handicap,                       /* Number of queue cycles behind    */
-//       depth;                          /* Path depth                       */
-//
-//   u8* trace_mini;                     /* Trace bytes, if kept             */
-//   u32 tc_ref;                         /* Trace bytes ref count            */
-//
-//   struct queue_entry *next,           /* Next element, if any             */
-//                      *next_100;       /* 100 elements ahead               */
-//
-// };
-
-#endif
-

custom_mutators/gramatron/grammars/js/source.json

@@ -1,606 +0,0 @@
-{
-    "ARGLIST": [
-        "EXPR ',' ARGLIST",
-        "EXPR",
-        "EXPR ',' ARGLIST",
-        "EXPR"
-    ],
-    "ARGS": [
-        "'()'",
-        "'(' ARGLIST ')'",
-        "'()'",
-        "'(' ARGLIST ')'"
-    ],
-    "ARITHMETICOPERATION": [
-        "EXPR '/' EXPR",
-        "EXPR '*' EXPR",
-        "EXPR '+' EXPR",
-        "EXPR '-' EXPR",
-        "EXPR '%' EXPR",
-        "EXPR '**' EXPR",
-        "EXPR '++'"
-    ],
-    "ARRAY": [
-        "'[' ARRAYCONTENT ']'",
-        "'[]'"
-    ],
-    "ARRAYCONTENT": [
-        "EXPR ',' ARRAYCONTENT",
-        "EXPR"
-    ],
-    "BOOLEAN": [
-        "'true'",
-        "'false'"
-    ],
-    "BYTEWISEOPERATION": [
-        "EXPR '&' EXPR",
-        "EXPR '|' EXPR"
-    ],
-    "COMPARISONOPERATION": [
-        "EXPR '<' EXPR"
-    ],
-    "DECIMALDIGITS": [
-        "'20'",
-        "'1234'",
-        "'66'",
-        "'234_9'",
-        "'99999999999999999999'"
-    ],
-    "DECIMALNUMBER": [
-        "DECIMALDIGITS"
-    ],
-    "EXPR": [
-        "'(' EXPR ')'",
-        "VAR",
-        "'delete' SP EXPR",
-        "'new' SP IDENTIFIER ARGS",
-        "LITERAL",
-        "IDENTIFIER",
-        "METHODCALL",
-        "'(' ARITHMETICOPERATION ')'",
-        "'(' COMPARISONOPERATION ')'",
-        "'(' BYTEWISEOPERATION ')'",
-        "'(' LOGICALOPERATION ')'"
-    ],
-    "IDENTIFIER": [
-        "'Object'",
-        "VAR",
-        "'Function'",
-        "'main'",
-        "'opt'",
-        "'Boolean'",
-        "'Symbol'",
-        "'JSON'",
-        "'Error'",
-        "'EvalError'",
-        "'RangeError'",
-        "'ReferenceError'",
-        "'SyntaxError'",
-        "'TypeError'",
-        "'URIError'",
-        "'this'",
-        "'Number'",
-        "'Math'",
-        "'Date'",
-        "'String'",
-        "'RegExp'",
-        "'Array'",
-        "'Int8Array'",
-        "'Uint8Array'",
-        "'Uint8ClampedArray'",
-        "'Int16Array'",
-        "'Uint16Array'",
-        "'Int32Array'",
-        "'Uint32Array'",
-        "'Float32Array'",
-        "'Float64Array'",
-        "'DataView'",
-        "'ArrayBuffer'",
-        "'Map'",
-        "'Set'",
-        "'WeakMap'",
-        "'WeakSet'",
-        "'Promise'",
-        "'AsyncFunction'",
-        "'asyncGenerator'",
-        "'Reflect'",
-        "'Proxy'",
-        "'Intl'",
-        "'Intl.Collator'",
-        "'Intl.DateTimeFormat'",
-        "'Intl.NumberFormat'",
-        "'Intl.PluralRules'",
-        "'WebAssembly'",
-        "'WebAssembly.Module'",
-        "'WebAssembly.Instance'",
-        "'WebAssembly.Memory'",
-        "'WebAssembly.Table'",
-        "'WebAssembly.CompileError'",
-        "'WebAssembly.LinkError'",
-        "'WebAssembly.RuntimeError'",
-        "'arguments'",
-        "'Infinity'",
-        "'NaN'",
-        "'undefined'",
-        "'null'",
-        "'console'",
-        "' '"
-    ],
-    "IDENTIFIERLIST": [
-        "IDENTIFIER ',' IDENTIFIERLIST",
-        "'(' IDENTIFIERLIST '),' IDENTIFIERLIST",
-        "IDENTIFIER"
-    ],
-    "JSBLOCK": [
-        "JSSTATEMENT",
-        "JSSTATEMENT JSBLOCK"
-    ],
-    "JSSTATEMENT": [
-        "STATEMENT NEWLINE"
-    ],
-    "LITERAL": [
-        "'null'",
-        "BOOLEAN",
-        "NUMBER",
-        "ARRAY"
-    ],
-    "LOGICALOPERATION": [
-        "EXPR '&&' EXPR",
-        "EXPR '||' EXPR"
-    ],
-    "METHODCALL": [
-        "OBJECT PROPERTY METHODCALL1"
-    ],
-    "METHODCALL1": [
-        "'.' METHOD_NAME ARGS METHODCALL1",
-        "' '"
-    ],
-    "METHOD_NAME": [
-        "IDENTIFIER",
-        "'print'",
-        "'eval'",
-        "'uneval'",
-        "'isFinite'",
-        "'isNaN'",
-        "'parseFloat'",
-        "'parseInt'",
-        "'decodeURI'",
-        "'decodeURIComponent'",
-        "'encodeURI'",
-        "'encodeURIComponent'",
-        "'escape'",
-        "'unescape'",
-        "'assign'",
-        "'create'",
-        "'defineProperty'",
-        "'defineProperties'",
-        "'entries'",
-        "'freeze'",
-        "'getOwnPropertyDescriptor'",
-        "'getOwnPropertyDescriptors'",
-        "'getOwnPropertyNames'",
-        "'getOwnPropertySymbols'",
-        "'getPrototypeOf'",
-        "'is'",
-        "'isExtensible'",
-        "'isFrozen'",
-        "'isSealed'",
-        "'keys'",
-        "'preventExtensions'",
-        "'seal'",
-        "'setPrototypeOf'",
-        "'values'",
-        "'__defineGetter__'",
-        "'__defineSetter__'",
-        "'__lookupGetter__'",
-        "'__lookupSetter__'",
-        "'hasOwnProperty'",
-        "'isPrototypeOf'",
-        "'propertyIsEnumerable'",
-        "'toSource'",
-        "'toLocaleString'",
-        "'toString'",
-        "'unwatch'",
-        "'valueOf'",
-        "'watch'",
-        "'apply'",
-        "'bind'",
-        "'call'",
-        "'isGenerator'",
-        "'valueOf'",
-        "'for'",
-        "'keyFor'",
-        "'stringify'",
-        "'isInteger'",
-        "'isSafeInteger'",
-        "'toInteger'",
-        "'toExponential'",
-        "'toFixed'",
-        "'toLocaleString'",
-        "'toPrecision'",
-        "'abs'",
-        "'acos'",
-        "'acosh'",
-        "'asin'",
-        "'asinh'",
-        "'atan'",
-        "'atanh'",
-        "'atan2'",
-        "'cbrt'",
-        "'ceil'",
-        "'clz32'",
-        "'cos'",
-        "'cosh'",
-        "'exp'",
-        "'expm1'",
-        "'floor'",
-        "'fround'",
-        "'hypot'",
-        "'imul'",
-        "'log'",
-        "'log1p'",
-        "'log10'",
-        "'log2'",
-        "'max'",
-        "'min'",
-        "'pow'",
-        "'random'",
-        "'round'",
-        "'sign'",
-        "'sin'",
-        "'sinh'",
-        "'sqrt'",
-        "'tan'",
-        "'tanh'",
-        "'trunc'",
-        "'now'",
-        "'parse'",
-        "'UTC'",
-        "'getDate'",
-        "'getDay'",
-        "'getFullYear'",
-        "'getHours'",
-        "'getMilliseconds'",
-        "'getMinutes'",
-        "'getMonth'",
-        "'getSeconds'",
-        "'getTime'",
-        "'getTimezoneOffset'",
-        "'getUTCDate'",
-        "'getUTCDay'",
-        "'getUTCFullYear'",
-        "'getUTCHours'",
-        "'getUTCMilliseconds'",
-        "'getUTCMinutes'",
-        "'getUTCMonth'",
-        "'getUTCSeconds'",
-        "'getYear'",
-        "'setDate'",
-        "'setFullYear'",
-        "'setHours'",
-        "'setMilliseconds'",
-        "'setMinutes'",
-        "'setMonth'",
-        "'setSeconds'",
-        "'setTime'",
-        "'setUTCDate'",
-        "'setUTCFullYear'",
-        "'setUTCHours'",
-        "'setUTCMilliseconds'",
-        "'setUTCMinutes'",
-        "'setUTCMonth'",
-        "'setUTCSeconds'",
-        "'setYear'",
-        "'toDateString'",
-        "'toISOString'",
-        "'toJSON'",
-        "'toGMTString'",
-        "'toLocaleDateString'",
-        "'toLocaleFormat'",
-        "'toLocaleString'",
-        "'toLocaleTimeString'",
-        "'toTimeString'",
-        "'toUTCString'",
-        "'indexOf'",
-        "'substring'",
-        "'charAt'",
-        "'strcmp'",
-        "'fromCharCode'",
-        "'fromCodePoint'",
-        "'raw'",
-        "'charCodeAt'",
-        "'slice'",
-        "'codePointAt'",
-        "'concat'",
-        "'includes'",
-        "'endsWith'",
-        "'lastIndexOf'",
-        "'localeCompare'",
-        "'match'",
-        "'normalize'",
-        "'padEnd'",
-        "'padStart'",
-        "'quote'",
-        "'repeat'",
-        "'replace'",
-        "'search'",
-        "'split'",
-        "'startsWith'",
-        "'substr'",
-        "'toLocaleLowerCase'",
-        "'toLocaleUpperCase'",
-        "'toLowerCase'",
-        "'toUpperCase'",
-        "'trim'",
-        "'trimleft'",
-        "'trimright'",
-        "'anchor'",
-        "'big'",
-        "'blink'",
-        "'bold'",
-        "'fixed'",
-        "'fontcolor'",
-        "'fontsize'",
-        "'italics'",
-        "'link'",
-        "'small'",
-        "'strike'",
-        "'sub'",
-        "'sup'",
-        "'compile'",
-        "'exec'",
-        "'test'",
-        "'from'",
-        "'isArray'",
-        "'of'",
-        "'copyWithin'",
-        "'fill'",
-        "'pop'",
-        "'push'",
-        "'reverse'",
-        "'shift'",
-        "'sort'",
-        "'splice'",
-        "'unshift'",
-        "'concat'",
-        "'join'",
-        "'every'",
-        "'filter'",
-        "'findIndex'",
-        "'forEach'",
-        "'map'",
-        "'reduce'",
-        "'reduceRight'",
-        "'some'",
-        "'move'",
-        "'getInt8'",
-        "'getUint8'",
-        "'getInt16'",
-        "'getUint16'",
-        "'getInt32'",
-        "'getUint32'",
-        "'getFloat32'",
-        "'getFloat64'",
-        "'setInt8'",
-        "'setUint8'",
-        "'setInt16'",
-        "'setUint16'",
-        "'setInt32'",
-        "'setUint32'",
-        "'setFloat32'",
-        "'setFloat64'",
-        "'isView'",
-        "'transfer'",
-        "'clear'",
-        "'get'",
-        "'has'",
-        "'set'",
-        "'add'",
-        "'splat'",
-        "'check'",
-        "'extractLane'",
-        "'replaceLane'",
-        "'load'",
-        "'load1'",
-        "'load2'",
-        "'load3'",
-        "'store'",
-        "'store1'",
-        "'store2'",
-        "'store3'",
-        "'addSaturate'",
-        "'div'",
-        "'mul'",
-        "'neg'",
-        "'reciprocalApproximation'",
-        "'reciprocalSqrtApproximation'",
-        "'subSaturate'",
-        "'shuffle'",
-        "'swizzle'",
-        "'maxNum'",
-        "'minNum'",
-        "'select'",
-        "'equal'",
-        "'notEqual'",
-        "'lessThan'",
-        "'lessThanOrEqual'",
-        "'greaterThan'",
-        "'greaterThanOrEqual'",
-        "'and'",
-        "'or'",
-        "'xor'",
-        "'not'",
-        "'shiftLeftByScalar'",
-        "'shiftRightByScalar'",
-        "'allTrue'",
-        "'anyTrue'",
-        "'fromFloat32x4'",
-        "'fromFloat32x4Bits'",
-        "'fromFloat64x2Bits'",
-        "'fromInt32x4'",
-        "'fromInt32x4Bits'",
-        "'fromInt16x8Bits'",
-        "'fromInt8x16Bits'",
-        "'fromUint32x4'",
-        "'fromUint32x4Bits'",
-        "'fromUint16x8Bits'",
-        "'fromUint8x16Bits'",
-        "'neg'",
-        "'compareExchange'",
-        "'exchange'",
-        "'wait'",
-        "'wake'",
-        "'isLockFree'",
-        "'all'",
-        "'race'",
-        "'reject'",
-        "'resolve'",
-        "'catch'",
-        "'then'",
-        "'finally'",
-        "'next'",
-        "'throw'",
-        "'close'",
-        "'send'",
-        "'apply'",
-        "'construct'",
-        "'deleteProperty'",
-        "'ownKeys'",
-        "'getCanonicalLocales'",
-        "'supportedLocalesOf'",
-        "'resolvedOptions'",
-        "'formatToParts'",
-        "'resolvedOptions'",
-        "'instantiate'",
-        "'instantiateStreaming'",
-        "'compileStreaming'",
-        "'validate'",
-        "'customSections'",
-        "'exports'",
-        "'imports'",
-        "'grow'",
-        "'super'",
-        "'in'",
-        "'instanceof'",
-        "' '"
-    ],
-    "NEWLINE": [
-        "'\\n'"
-    ],
-    "NUMBER": [
-        "'1/2'",
-        "'1E2'",
-        "'1E02'",
-        "'1E+02'",
-        "'-1'",
-        "'-1.00'",
-        "'-1/2'",
-        "'-1E2'",
-        "'-1E02'",
-        "'-1E+02'",
-        "'1/0'",
-        "'0/0'",
-        "'-2147483648/-1'",
-        "'-9223372036854775808/-1'",
-        "'-0'",
-        "'-0.0'",
-        "'+0'"
-    ],
-    "OBJECT": [
-        "IDENTIFIER"
-    ],
-    "PROGRAM": [
-        "JSBLOCK"
-    ],
-    "PROPERTY": [
-        "'.length' PROPERTY",
-        "'.prototype' PROPERTY",
-        "'.constructor' PROPERTY",
-        "'.__proto__' PROPERTY",
-        "'.__noSuchMethod__' PROPERTY",
-        "'.__count__' PROPERTY",
-        "'.__parent__' PROPERTY",
-        "'.arguments' PROPERTY",
-        "'.arity' PROPERTY",
-        "'.caller' PROPERTY",
-        "'.name' PROPERTY",
-        "'.displayName' PROPERTY",
-        "'.iterator' PROPERTY",
-        "'.asyncIterator' PROPERTY",
-        "'.match' PROPERTY",
-        "'.replace' PROPERTY",
-        "'.search' PROPERTY",
-        "'.split' PROPERTY",
-        "'.hasInstance' PROPERTY",
-        "'.isConcatSpreadable' PROPERTY",
-        "'.unscopables' PROPERTY",
-        "'.species' PROPERTY",
-        "'.toPrimitive' PROPERTY",
-        "'.toStringTag' PROPERTY",
-        "'.fileName' PROPERTY",
-        "'.lineNumber' PROPERTY",
-        "'.columnNumber' PROPERTY",
-        "'.message' PROPERTY",
-        "'.name' PROPERTY",
-        "'.EPSILON' PROPERTY",
-        "'.MAX_SAFE_INTEGER' PROPERTY",
-        "'.MAX_VALUE' PROPERTY",
-        "'.MIN_SAFE_INTEGER' PROPERTY",
-        "'.MIN_VALUE' PROPERTY",
-        "'.NaN' PROPERTY",
-        "'.NEGATIVE_INFINITY' PROPERTY",
-        "'.POSITIVE_INFINITY' PROPERTY",
-        "'.E' PROPERTY",
-        "'.LN2' PROPERTY",
-        "'.LN10' PROPERTY",
-        "'.LOG2E' PROPERTY",
-        "'.LOG10E' PROPERTY",
-        "'.PI' PROPERTY",
-        "'.SQRT1_2' PROPERTY",
-        "'.SQRT2' PROPERTY",
-        "'.flags' PROPERTY",
-        "'.global' PROPERTY",
-        "'.ignoreCase' PROPERTY",
-        "'.multiline' PROPERTY",
-        "'.source' PROPERTY",
-        "'.sticky' PROPERTY",
-        "'.unicode' PROPERTY",
-        "'.buffer' PROPERTY",
-        "'.byteLength' PROPERTY",
-        "'.byteOffset' PROPERTY",
-        "'.BYTES_PER_ELEMENT' PROPERTY",
-        "'.compare' PROPERTY",
-        "'.format' PROPERTY",
-        "'.callee' PROPERTY",
-        "'.caller' PROPERTY",
-        "'.memory' PROPERTY",
-        "'.exports' PROPERTY",
-        "' '"
-    ],
-    "SP": [
-        "' '"
-    ],
-    "STATEMENT": [
-        "EXPR ';'",
-        "'var' SP VAR '=' EXPR ';'",
-        "'let' SP VAR '=' EXPR ';'",
-        "VAR '=' EXPR ';'",
-        "VAR PROPERTY '=' EXPR ';'",
-        "VAR '[' DECIMALNUMBER ']' '=' EXPR ';'",
-        "'const' SP VAR '=' EXPR ';'",
-        "'typeof' SP EXPR ';'",
-        "'void' SP EXPR ';'",
-        "'return' SP EXPR ';'",
-        "VAR ':'"
-    ],
-    "VAR": [
-        "'a'",
-        "'b'",
-        "'c'",
-        "'d'",
-        "'e'",
-        "'f'",
-        "'g'",
-        "'h'"
-    ]
-}

custom_mutators/gramatron/hashmap.c

@@ -1,434 +0,0 @@
-/*
- * Generic map implementation.
- */
-#include "hashmap.h"
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-
-#define INITIAL_SIZE (256)
-#define MAX_CHAIN_LENGTH (8)
-
-/* We need to keep keys and values */
-typedef struct _hashmap_element {
-
-  char *key;
-  int   in_use;
-  any_t data;
-
-} hashmap_element;
-
-/* A hashmap has some maximum size and current size,
- * as well as the data to hold. */
-typedef struct _hashmap_map {
-
-  int              table_size;
-  int              size;
-  hashmap_element *data;
-
-} hashmap_map;
-
-/*
- * Return an empty hashmap, or NULL on failure.
- */
-map_t hashmap_new() {
-
-  hashmap_map *m = (hashmap_map *)malloc(sizeof(hashmap_map));
-  if (!m) goto err;
-
-  m->data = (hashmap_element *)calloc(INITIAL_SIZE, sizeof(hashmap_element));
-  if (!m->data) goto err;
-
-  m->table_size = INITIAL_SIZE;
-  m->size = 0;
-
-  return m;
-err:
-  if (m) hashmap_free(m);
-  return NULL;
-
-}
-
-/* The implementation here was originally done by Gary S. Brown.  I have
-   borrowed the tables directly, and made some minor changes to the
-   crc32-function (including changing the interface). //ylo */
-
-/* ============================================================= */
-/*  COPYRIGHT (C) 1986 Gary S. Brown.  You may use this program, or       */
-/*  code or tables extracted from it, as desired without restriction.     */
-/*                                                                        */
-/*  First, the polynomial itself and its table of feedback terms.  The    */
-/*  polynomial is                                                         */
-/*  X^32+X^26+X^23+X^22+X^16+X^12+X^11+X^10+X^8+X^7+X^5+X^4+X^2+X^1+X^0   */
-/*                                                                        */
-/*  Note that we take it "backwards" and put the highest-order term in    */
-/*  the lowest-order bit.  The X^32 term is "implied"; the LSB is the     */
-/*  X^31 term, etc.  The X^0 term (usually shown as "+1") results in      */
-/*  the MSB being 1.                                                      */
-/*                                                                        */
-/*  Note that the usual hardware shift register implementation, which     */
-/*  is what we're using (we're merely optimizing it by doing eight-bit    */
-/*  chunks at a time) shifts bits into the lowest-order term.  In our     */
-/*  implementation, that means shifting towards the right.  Why do we     */
-/*  do it this way?  Because the calculated CRC must be transmitted in    */
-/*  order from highest-order term to lowest-order term.  UARTs transmit   */
-/*  characters in order from LSB to MSB.  By storing the CRC this way,    */
-/*  we hand it to the UART in the order low-byte to high-byte; the UART   */
-/*  sends each low-bit to hight-bit; and the result is transmission bit   */
-/*  by bit from highest- to lowest-order term without requiring any bit   */
-/*  shuffling on our part.  Reception works similarly.                    */
-/*                                                                        */
-/*  The feedback terms table consists of 256, 32-bit entries.  Notes:     */
-/*                                                                        */
-/*      The table can be generated at runtime if desired; code to do so   */
-/*      is shown later.  It might not be obvious, but the feedback        */
-/*      terms simply represent the results of eight shift/xor opera-      */
-/*      tions for all combinations of data and CRC register values.       */
-/*                                                                        */
-/*      The values must be right-shifted by eight bits by the "updcrc"    */
-/*      logic; the shift must be unsigned (bring in zeroes).  On some     */
-/*      hardware you could probably optimize the shift in assembler by    */
-/*      using byte-swap instructions.                                     */
-/*      polynomial $edb88320                                              */
-/*                                                                        */
-/*  --------------------------------------------------------------------  */
-
-static unsigned long crc32_tab[] = {
-
-    0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
-    0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
-    0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
-    0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
-    0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
-    0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
-    0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
-    0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
-    0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
-    0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
-    0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
-    0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
-    0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
-    0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
-    0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
-    0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
-    0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
-    0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
-    0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
-    0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
-    0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
-    0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
-    0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
-    0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
-    0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
-    0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
-    0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
-    0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
-    0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
-    0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
-    0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
-    0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
-    0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
-    0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
-    0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
-    0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
-    0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
-    0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
-    0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
-    0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
-    0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
-    0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
-    0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
-    0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
-    0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
-    0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
-    0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
-    0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
-    0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
-    0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
-    0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
-    0x2d02ef8dL};
-
-/* Return a 32-bit CRC of the contents of the buffer. */
-
-unsigned long crc32(const unsigned char *s, unsigned int len) {
-
-  unsigned int  i;
-  unsigned long crc32val;
-
-  crc32val = 0;
-  for (i = 0; i < len; i++) {
-
-    crc32val = crc32_tab[(crc32val ^ s[i]) & 0xff] ^ (crc32val >> 8);
-
-  }
-
-  return crc32val;
-
-}
-
-/*
- * Hashing function for a string
- */
-unsigned int hashmap_hash_int(hashmap_map *m, char *keystring) {
-
-  unsigned long key = crc32((unsigned char *)(keystring), strlen(keystring));
-
-  /* Robert Jenkins' 32 bit Mix Function */
-  key += (key << 12);
-  key ^= (key >> 22);
-  key += (key << 4);
-  key ^= (key >> 9);
-  key += (key << 10);
-  key ^= (key >> 2);
-  key += (key << 7);
-  key ^= (key >> 12);
-
-  /* Knuth's Multiplicative Method */
-  key = (key >> 3) * 2654435761;
-
-  return key % m->table_size;
-
-}
-
-/*
- * Return the integer of the location in data
- * to store the point to the item, or MAP_FULL.
- */
-int hashmap_hash(map_t in, char *key) {
-
-  int curr;
-  int i;
-
-  /* Cast the hashmap */
-  hashmap_map *m = (hashmap_map *)in;
-
-  /* If full, return immediately */
-  if (m->size >= (m->table_size / 2)) return MAP_FULL;
-
-  /* Find the best index */
-  curr = hashmap_hash_int(m, key);
-
-  /* Linear probing */
-  for (i = 0; i < MAX_CHAIN_LENGTH; i++) {
-
-    if (m->data[curr].in_use == 0) return curr;
-
-    if (m->data[curr].in_use == 1 && (strcmp(m->data[curr].key, key) == 0))
-      return curr;
-
-    curr = (curr + 1) % m->table_size;
-
-  }
-
-  return MAP_FULL;
-
-}
-
-/*
- * Doubles the size of the hashmap, and rehashes all the elements
- */
-int hashmap_rehash(map_t in) {
-
-  int              i;
-  int              old_size;
-  hashmap_element *curr;
-
-  /* Setup the new elements */
-  hashmap_map *    m = (hashmap_map *)in;
-  hashmap_element *temp =
-      (hashmap_element *)calloc(2 * m->table_size, sizeof(hashmap_element));
-  if (!temp) return MAP_OMEM;
-
-  /* Update the array */
-  curr = m->data;
-  m->data = temp;
-
-  /* Update the size */
-  old_size = m->table_size;
-  m->table_size = 2 * m->table_size;
-  m->size = 0;
-
-  /* Rehash the elements */
-  for (i = 0; i < old_size; i++) {
-
-    int status;
-
-    if (curr[i].in_use == 0) continue;
-
-    status = hashmap_put(m, curr[i].key, curr[i].data);
-    if (status != MAP_OK) return status;
-
-  }
-
-  free(curr);
-
-  return MAP_OK;
-
-}
-
-/*
- * Add a pointer to the hashmap with some key
- */
-int hashmap_put(map_t in, char *key, any_t value) {
-
-  int          index;
-  hashmap_map *m;
-
-  /* Cast the hashmap */
-  m = (hashmap_map *)in;
-
-  /* Find a place to put our value */
-  index = hashmap_hash(in, key);
-  while (index == MAP_FULL) {
-
-    if (hashmap_rehash(in) == MAP_OMEM) { return MAP_OMEM; }
-    index = hashmap_hash(in, key);
-
-  }
-
-  /* Set the data */
-  m->data[index].data = value;
-  m->data[index].key = key;
-  m->data[index].in_use = 1;
-  m->size++;
-
-  return MAP_OK;
-
-}
-
-/*
- * Get your pointer out of the hashmap with a key
- */
-int hashmap_get(map_t in, char *key, any_t *arg) {
-
-  int          curr;
-  int          i;
-  hashmap_map *m;
-
-  /* Cast the hashmap */
-  m = (hashmap_map *)in;
-
-  /* Find data location */
-  curr = hashmap_hash_int(m, key);
-
-  /* Linear probing, if necessary */
-  for (i = 0; i < MAX_CHAIN_LENGTH; i++) {
-
-    int in_use = m->data[curr].in_use;
-    if (in_use == 1) {
-
-      if (strcmp(m->data[curr].key, key) == 0) {
-
-        *arg = (m->data[curr].data);
-        return MAP_OK;
-
-      }
-
-    }
-
-    curr = (curr + 1) % m->table_size;
-
-  }
-
-  *arg = NULL;
-
-  /* Not found */
-  return MAP_MISSING;
-
-}
-
-/*
- * Iterate the function parameter over each element in the hashmap.  The
- * additional any_t argument is passed to the function as its first
- * argument and the hashmap element is the second.
- */
-int hashmap_iterate(map_t in, PFany f, any_t item) {
-
-  int i;
-
-  /* Cast the hashmap */
-  hashmap_map *m = (hashmap_map *)in;
-
-  /* On empty hashmap, return immediately */
-  if (hashmap_length(m) <= 0) return MAP_MISSING;
-
-  /* Linear probing */
-  for (i = 0; i < m->table_size; i++)
-    if (m->data[i].in_use != 0) {
-
-      any_t data = (any_t)(m->data[i].data);
-      int   status = f(item, data);
-      if (status != MAP_OK) { return status; }
-
-    }
-
-  return MAP_OK;
-
-}
-
-/*
- * Remove an element with that key from the map
- */
-int hashmap_remove(map_t in, char *key) {
-
-  int          i;
-  int          curr;
-  hashmap_map *m;
-
-  /* Cast the hashmap */
-  m = (hashmap_map *)in;
-
-  /* Find key */
-  curr = hashmap_hash_int(m, key);
-
-  /* Linear probing, if necessary */
-  for (i = 0; i < MAX_CHAIN_LENGTH; i++) {
-
-    int in_use = m->data[curr].in_use;
-    if (in_use == 1) {
-
-      if (strcmp(m->data[curr].key, key) == 0) {
-
-        /* Blank out the fields */
-        m->data[curr].in_use = 0;
-        m->data[curr].data = NULL;
-        m->data[curr].key = NULL;
-
-        /* Reduce the size */
-        m->size--;
-        return MAP_OK;
-
-      }
-
-    }
-
-    curr = (curr + 1) % m->table_size;
-
-  }
-
-  /* Data not found */
-  return MAP_MISSING;
-
-}
-
-/* Deallocate the hashmap */
-void hashmap_free(map_t in) {
-
-  hashmap_map *m = (hashmap_map *)in;
-  free(m->data);
-  free(m);
-
-}
-
-/* Return the length of the hashmap */
-int hashmap_length(map_t in) {
-
-  hashmap_map *m = (hashmap_map *)in;
-  if (m != NULL)
-    return m->size;
-  else
-    return 0;
-
-}
-

custom_mutators/gramatron/hashmap.h

@@ -1,83 +0,0 @@
-/*
- * Generic hashmap manipulation functions
- *
- * Originally by Elliot C Back -
- * http://elliottback.com/wp/hashmap-implementation-in-c/
- *
- * Modified by Pete Warden to fix a serious performance problem, support strings
- * as keys and removed thread synchronization - http://petewarden.typepad.com
- */
-#ifndef __HASHMAP_H__
-#define __HASHMAP_H__
-
-#define MAP_MISSING -3                                   /* No such element */
-#define MAP_FULL -2                                      /* Hashmap is full */
-#define MAP_OMEM -1                                        /* Out of Memory */
-#define MAP_OK 0                                                      /* OK */
-
-/*
- * any_t is a pointer.  This allows you to put arbitrary structures in
- * the hashmap.
- */
-typedef void *any_t;
-
-/*
- * PFany is a pointer to a function that can take two any_t arguments
- * and return an integer. Returns status code..
- */
-typedef int (*PFany)(any_t, any_t);
-
-/*
- * map_t is a pointer to an internally maintained data structure.
- * Clients of this package do not need to know how hashmaps are
- * represented.  They see and manipulate only map_t's.
- */
-typedef any_t map_t;
-
-/*
- * Return an empty hashmap. Returns NULL if empty.
- */
-extern map_t hashmap_new();
-
-/*
- * Iteratively call f with argument (item, data) for
- * each element data in the hashmap. The function must
- * return a map status code. If it returns anything other
- * than MAP_OK the traversal is terminated. f must
- * not reenter any hashmap functions, or deadlock may arise.
- */
-extern int hashmap_iterate(map_t in, PFany f, any_t item);
-
-/*
- * Add an element to the hashmap. Return MAP_OK or MAP_OMEM.
- */
-extern int hashmap_put(map_t in, char *key, any_t value);
-
-/*
- * Get an element from the hashmap. Return MAP_OK or MAP_MISSING.
- */
-extern int hashmap_get(map_t in, char *key, any_t *arg);
-
-/*
- * Remove an element from the hashmap. Return MAP_OK or MAP_MISSING.
- */
-extern int hashmap_remove(map_t in, char *key);
-
-/*
- * Get any element. Return MAP_OK or MAP_MISSING.
- * remove - should the element be removed from the hashmap
- */
-extern int hashmap_get_one(map_t in, any_t *arg, int remove);
-
-/*
- * Free the hashmap
- */
-extern void hashmap_free(map_t in);
-
-/*
- * Get the current size of a hashmap
- */
-extern int hashmap_length(map_t in);
-
-#endif
-

custom_mutators/gramatron/preprocess/construct_automata.py

@@ -1,275 +0,0 @@
-import sys
-import json
-import re
-from collections import defaultdict
-# import pygraphviz as pgv
-
-gram_data = None
-state_count = 1
-pda = []
-worklist = []
-state_stacks = {} 
-
-# === If user provides upper bound on the stack size during FSA creation ===
-# Specifies the upper bound to which the stack is allowed to grow
-# If for any generated state, the stack size is >= stack_limit then this
-# state is not expanded further.
-stack_limit = None 
-# Holds the set of unexpanded rules owing to the user-passed stack constraint limit
-unexpanded_rules = set()
-
-def main(grammar, limit):
-    global worklist, gram_data, stack_limit
-    current = '0'
-    stack_limit = limit
-    if stack_limit:
-        print ('[X] Operating in bounded stack mode')
-
-    with open(grammar, 'r') as fd:
-        gram_data = json.load(fd)
-    start_symbol = gram_data["Start"][0]
-    worklist.append([current, [start_symbol]])
-    # print (grammar)
-    filename = (grammar.split('/')[-1]).split('.')[0]
-    
-
-    while worklist:
-        # Take an element from the worklist
-        # print ('================')
-        # print ('Worklist:', worklist)
-        element = worklist.pop(0)
-        prep_transitions(element)
-    
-    pda_file = filename + '_transition.json'
-    graph_file = filename + '.png'
-    # print ('XXXXXXXXXXXXXXXX')
-    # print ('PDA file:%s Png graph file:%s' % (pda_file, graph_file))
-    # XXX Commented out because visualization of current version of PHP causes segfault
-    # Create the graph and dump the transitions to a file
-    # create_graph(filename)
-    transformed = postprocess()
-    with open(filename + '_automata.json', 'w+') as fd:
-        json.dump(transformed, fd)
-    with open(filename + '_transition.json', 'w+') as fd:
-        json.dump(pda, fd)
-    if not unexpanded_rules:
-        print ('[X] No unexpanded rules, absolute FSA formed')
-        exit(0)
-    else:
-        print ('[X] Certain rules were not expanded due to stack size limit. Inexact approximation has been created and the disallowed rules have been put in {}_disallowed.json'.format(filename))
-        print ('[X] Number of unexpanded rules:', len(unexpanded_rules))
-        with open(filename + '_disallowed.json', 'w+') as fd:
-            json.dump(list(unexpanded_rules), fd)
-
-def create_graph(filename):
-    '''
-    Creates a DOT representation of the PDA
-    '''
-    global pda
-    G = pgv.AGraph(strict = False, directed = True)
-    for transition in pda:
-        print ('Transition:', transition)
-        G.add_edge(transition['source'], transition['dest'], 
-                label = 'Term:{}'.format(transition['terminal']))
-    G.layout(prog = 'dot')
-    print ('Do it up 2')
-    G.draw(filename + '.png')
-
-def prep_transitions(element):
-    '''
-    Generates transitions
-    '''
-    global gram_data, state_count, pda, worklist, state_stacks, stack_limit, unexpanded_rules
-    state = element[0]
-    try:
-        nonterminal = element[1][0] 
-    except IndexError:
-        # Final state was encountered, pop from worklist without doing anything
-        return
-    rules = gram_data[nonterminal]
-    count = 1
-    for rule in rules:
-        isRecursive  = False
-        # print ('Current state:', state)
-        terminal, ss, termIsRegex = tokenize(rule)
-        transition = get_template()
-        transition['trigger'] = '_'.join([state, str(count)])
-        transition['source'] = state
-        transition['dest'] = str(state_count) 
-        transition['ss'] = ss 
-        transition['terminal'] = terminal
-        transition['rule'] = "{} -> {}".format(nonterminal, rule )
-        if termIsRegex:
-            transition['termIsRegex'] = True
-        
-        # Creating a state stack for the new state
-        try:
-            state_stack = state_stacks[state][:]
-        except:
-            state_stack = []
-        if len(state_stack):
-            state_stack.pop(0)
-        if ss:
-            for symbol in ss[::-1]:
-                state_stack.insert(0, symbol)
-        transition['stack'] = state_stack 
-
-        # Check if a recursive transition state being created, if so make a backward
-        # edge and don't add anything to the worklist
-        # print (state_stacks)
-        if state_stacks:
-            for state_element, stack in state_stacks.items():
-                # print ('Stack:', sorted(stack))
-                # print ('State stack:', sorted(state_stack))
-                if sorted(stack) == sorted(state_stack):
-                    transition['dest'] = state_element
-                    # print ('Recursive:', transition)
-                    pda.append(transition)
-                    count += 1
-                    isRecursive = True
-                    break 
-        # If a recursive transition exercised don't add the same transition as a new
-        # edge, continue onto the next transitions
-        if isRecursive:
-            continue
-            
-        # If the generated state has a stack size > stack_limit then that state is abandoned
-        # and not added to the FSA or the worklist for further expansion
-        if stack_limit:
-            if (len(transition['stack']) > stack_limit):
-                unexpanded_rules.add(transition['rule'])
-                continue
-
-        # Create transitions for the non-recursive relations and add to the worklist
-        # print ('Normal:', transition)
-        # print ('State2:', state)
-        pda.append(transition)
-        worklist.append([transition['dest'], transition['stack']])
-        state_stacks[transition['dest']] = state_stack
-        state_count += 1
-        count += 1
-
-def tokenize(rule):
-    '''
-    Gets the terminal and the corresponding stack symbols from a rule in GNF form
-    '''
-    pattern = re.compile("([r])*\'([\s\S]+)\'([\s\S]*)")
-    terminal = None
-    ss = None
-    termIsRegex = False
-    match = pattern.match(rule)
-    if match.group(1):
-        termIsRegex = True
-    if match.group(2):
-        terminal = match.group(2)
-    else:
-        raise AssertionError("Rule is not in GNF form")
-
-    if match.group(3):
-        ss = (match.group(3)).split()
-
-    return terminal, ss, termIsRegex
-
-def get_template():
-    transition_template = {
-            'trigger':None,
-            'source': None,
-            'dest': None,
-            'termIsRegex': False,
-            'terminal' : None,
-            'stack': []
-            }
-    return transition_template
-
-def postprocess():
-    '''
-    Creates a representation to be passed on to the C-module
-    '''
-    global pda
-    final_struct = {}
-    memoized = defaultdict(list)
-    # Supporting data structures for if stack limit is imposed
-    culled_pda = []
-    culled_final = []
-    num_transitions = 0 # Keep track of number of transitions
-
-
-    states, final, initial = _get_states()
-
-    print (initial)
-    assert len(initial) == 1, 'More than one init state found'
-
-    # Cull transitions to states which were not expanded owing to the stack limit
-    if stack_limit:
-
-        blocklist = []
-        for final_state in final:
-            for transition in pda:
-                if (transition["dest"] == final_state) and (len(transition["stack"]) > 0):
-                    blocklist.append(transition["dest"])
-                    continue
-                else:
-                    culled_pda.append(transition)
-        
-        culled_final = [state for state in final if state not in blocklist]
-
-        assert len(culled_final) == 1, 'More than one final state found'
-
-        for transition in culled_pda:
-            state = transition["source"]
-            if transition["dest"] in blocklist:
-                    continue 
-            num_transitions += 1
-            memoized[state].append([transition["trigger"], transition["dest"], 
-                transition["terminal"]])
-        final_struct["init_state"] = initial
-        final_struct["final_state"] = culled_final[0]
-        # The reason we do this is because when states are culled, the indexing is
-        # still relative to the actual number of states hence we keep numstates recorded
-        # as the original number of states
-        print ('[X] Actual Number of states:', len(memoized.keys()))
-        print ('[X] Number of transitions:', num_transitions)
-        print ('[X] Original Number of states:', len(states))
-        final_struct["numstates"] = len(states) 
-        final_struct["pda"] = memoized
-        return final_struct
-    
-    # Running FSA construction in exact approximation mode and postprocessing it like so
-    for transition in pda:
-       state = transition["source"]
-       memoized[state].append([transition["trigger"], transition["dest"], 
-           transition["terminal"]])
-
-    final_struct["init_state"] = initial
-    final_struct["final_state"] = final[0]
-    print ('[X] Actual Number of states:', len(memoized.keys()))
-    final_struct["numstates"] = len(memoized.keys()) 
-    final_struct["pda"] = memoized
-    return final_struct
-
-
-def _get_states():
-    source = set()
-    dest = set()
-    global pda
-    for transition in pda:
-        source.add(transition["source"])
-        dest.add(transition["dest"])
-    source_copy = source.copy()
-    source_copy.update(dest)
-    return list(source_copy), list(dest.difference(source)), str(''.join(list(source.difference(dest))))
-
-if __name__ == '__main__':
-    import argparse
-    parser = argparse.ArgumentParser(description = 'Script to convert GNF grammar to PDA')
-    parser.add_argument(
-            '--gf',
-            type = str,
-            help = 'Location of GNF grammar')
-    parser.add_argument(
-            '--limit',
-            type = int,
-            default = None,
-            help = 'Specify the upper bound for the stack size')
-    args = parser.parse_args()
-    main(args.gf, args.limit)

custom_mutators/gramatron/preprocess/gnf_converter.py

@@ -1,289 +0,0 @@
-import sys
-import re
-import copy
-import json
-from string import ascii_uppercase
-from itertools import combinations
-from collections import defaultdict
-
-NONTERMINALSET = []
-COUNT = 1
-
-def main(grammar_file, out, start):
-    grammar = None
-    # If grammar file is a preprocessed NT file, then skip preprocessing
-    if '.json' in grammar_file:
-        with open(grammar_file, 'r') as fd:
-            grammar = json.load(fd)
-    elif '.g4' in grammar_file:
-        with open(grammar_file, 'r') as fd:
-            data = fd.readlines()
-        grammar = preprocess(data)
-    else:
-        raise('Unknwown file format passed. Accepts (.g4/.json)')
-
-    with open('debug_preprocess.json', 'w+') as fd:
-        json.dump(grammar, fd)
-    grammar = remove_unit(grammar) # eliminates unit productions
-    with open('debug_unit.json', 'w+') as fd:
-        json.dump(grammar, fd)
-    grammar = remove_mixed(grammar) # eliminate terminals existing with non-terminals
-    with open('debug_mixed.json', 'w+') as fd:
-        json.dump(grammar, fd)
-    grammar = break_rules(grammar) # eliminate rules with more than two non-terminals
-    with open('debug_break.json', 'w+') as fd:
-        json.dump(grammar, fd)
-    grammar = gnf(grammar)
-
-    # Dump GNF form of the grammar with only reachable rules 
-    # reachable_grammar = get_reachable(grammar, start)
-    # with open('debug_gnf_reachable.json', 'w+') as fd:
-    #     json.dump(reachable_grammar, fd)
-    with open('debug_gnf.json', 'w+') as fd:
-        json.dump(grammar, fd)
-
-    grammar["Start"] = [start]
-    with open(out, 'w+') as fd:
-        json.dump(grammar, fd)
-
-def get_reachable(grammar, start):
-    '''
-    Returns a grammar without dead rules
-    '''
-    reachable_nt = set()
-    worklist = list()
-    processed = set()
-    reachable_grammar = dict()
-    worklist.append(start)
-
-    while worklist:
-        nt = worklist.pop(0)
-        processed.add(nt)
-        reachable_grammar[nt] = grammar[nt]
-        rules = grammar[nt]
-        for rule in rules:
-            tokens = gettokens(rule)
-            for token in tokens:
-                if not isTerminal(token):
-                    if token not in processed:
-                        worklist.append(token)
-    return reachable_grammar
-
-
-def gettokens(rule):
-    pattern = re.compile("([^\s\"\']+)|\"([^\"]*)\"|\'([^\']*)\'")
-    return [matched.group(0) for matched in pattern.finditer(rule)]
-
-def gnf(grammar):
-    old_grammar = copy.deepcopy(grammar)
-    new_grammar = defaultdict(list)
-    isgnf = False
-    while not isgnf:
-        for lhs, rules in old_grammar.items():
-            for rule in rules:
-                tokens = gettokens(rule) 
-                if len(tokens) == 1 and isTerminal(rule):
-                    new_grammar[lhs].append(rule)
-                    continue
-                startoken = tokens[0]
-                endrule = tokens[1:]
-                if not isTerminal(startoken):
-                    newrules = []
-                    extendrules = old_grammar[startoken]
-                    for extension in extendrules:
-                        temprule = endrule[:]
-                        temprule.insert(0, extension)
-                        newrules.append(temprule)
-                    for newnew in newrules:
-                        new_grammar[lhs].append(' '.join(newnew))
-                else:
-                    new_grammar[lhs].append(rule)
-        isgnf = True
-        for lhs, rules in new_grammar.items():
-            for rule in rules:
-                # if "\' \'" or isTerminal(rule):
-                tokens = gettokens(rule)
-                if len(tokens) == 1 and isTerminal(rule):
-                    continue
-                startoken = tokens[0]
-                if not isTerminal(startoken):
-                    isgnf = False
-                    break
-        if not isgnf:
-            old_grammar = copy.deepcopy(new_grammar)
-            new_grammar = defaultdict(list)
-    return new_grammar
-                
-
-def preprocess(data):
-    productions = []
-    production = []
-    for line in data:
-        if line != '\n': 
-            production.append(line)
-        else:
-            productions.append(production)
-            production = []
-    final_rule_set = {}
-    for production in productions:
-        rules = []
-        init = production[0]
-        nonterminal = init.split(':')[0]
-        rules.append(strip_chars(init.split(':')[1]).strip('| '))
-        for production_rule in production[1:]:
-            rules.append(strip_chars(production_rule.split('|')[0]))
-        final_rule_set[nonterminal] = rules
-    # for line in data:
-    #     if line != '\n':
-    #         production.append(line)
-    return final_rule_set
-
-def remove_unit(grammar):
-    nounitproductions = False 
-    old_grammar = copy.deepcopy(grammar)
-    new_grammar = defaultdict(list)
-    while not nounitproductions:
-        for lhs, rules in old_grammar.items():
-            for rhs in rules:
-                # Checking if the rule is a unit production rule
-                if len(gettokens(rhs)) == 1:
-                    if not isTerminal(rhs):
-                        new_grammar[lhs].extend([rule for rule in old_grammar[rhs]])
-                    else:
-                        new_grammar[lhs].append(rhs)
-                else:
-                    new_grammar[lhs].append(rhs)
-        # Checking there are no unit productions left in the grammar 
-        nounitproductions = True
-        for lhs, rules in new_grammar.items():
-            for rhs in rules:
-                if len(gettokens(rhs)) == 1:
-                    if not isTerminal(rhs):
-                        nounitproductions = False
-                        break
-            if not nounitproductions:
-                break
-        # Unit productions are still there in the grammar -- repeat the process
-        if not nounitproductions:
-            old_grammar = copy.deepcopy(new_grammar)
-            new_grammar = defaultdict(list)
-    return new_grammar
-
-def isTerminal(rule):
-    # pattern = re.compile("([r]*\'[\s\S]+\')")
-    pattern = re.compile("\'(.*?)\'")
-    match = pattern.match(rule)
-    if match:
-        return True
-    else:
-        return False
-
-def remove_mixed(grammar):
-    '''
-    Remove rules where there are terminals mixed in with non-terminals
-    '''
-    new_grammar = defaultdict(list)
-    for lhs, rules in grammar.items():
-        for rhs in rules:
-            # tokens = rhs.split(' ')
-            regen_rule = []
-            tokens = gettokens(rhs)
-            if len(gettokens(rhs)) == 1:
-                new_grammar[lhs].append(rhs)
-                continue
-            for token in tokens:
-                # Identify if there is a terminal in the RHS
-                if isTerminal(token):
-                    # Check if a corresponding nonterminal already exists
-                    nonterminal = terminal_exist(token, new_grammar)
-                    if nonterminal:
-                        regen_rule.append(nonterminal)
-                    else:
-                        new_nonterm = get_nonterminal()
-                        new_grammar[new_nonterm].append(token)
-                        regen_rule.append(new_nonterm)
-                else:
-                    regen_rule.append(token)
-            new_grammar[lhs].append(' '.join(regen_rule))
-    return new_grammar
-
-def break_rules(grammar):
-    new_grammar = defaultdict(list)
-    old_grammar = copy.deepcopy(grammar)
-    nomulti = False
-    while not nomulti:
-        for lhs, rules in old_grammar.items():
-            for rhs in rules:
-                tokens = gettokens(rhs)
-                if len(tokens) > 2 and (not isTerminal(rhs)):
-                    split = tokens[:-1] 
-                    nonterminal = terminal_exist(' '.join(split), new_grammar)
-                    if nonterminal:
-                        newrule = ' '.join([nonterminal, tokens[-1]])
-                        new_grammar[lhs].append(newrule)
-                    else:
-                        nonterminal = get_nonterminal()
-                        new_grammar[nonterminal].append(' '.join(split))
-                        newrule = ' '.join([nonterminal, tokens[-1]])
-                        new_grammar[lhs].append(newrule)
-                else:
-                    new_grammar[lhs].append(rhs)
-        nomulti = True
-        for lhs, rules in new_grammar.items():
-            for rhs in rules:
-                # tokens = rhs.split(' ')
-                tokens = gettokens(rhs)
-                if len(tokens) > 2 and (not isTerminal(rhs)):
-                    nomulti = False
-                    break
-        if not nomulti:
-            old_grammar = copy.deepcopy(new_grammar)
-            new_grammar = defaultdict(list)
-    return new_grammar
-
-def strip_chars(rule):
-    return rule.strip('\n\t ')
-
-def get_nonterminal():
-    global NONTERMINALSET
-    if NONTERMINALSET:
-        return NONTERMINALSET.pop(0)
-    else:
-        _repopulate()
-        return NONTERMINALSET.pop(0)
-
-def _repopulate():
-    global COUNT
-    global NONTERMINALSET
-    NONTERMINALSET = [''.join(x) for x in list(combinations(ascii_uppercase, COUNT))]
-    COUNT += 1
-
-def terminal_exist(token, grammar):
-    for nonterminal, rules in grammar.items():
-        if token in rules:
-            return nonterminal
-    return None
-
-
-
-if __name__ == '__main__':
-    import argparse
-    parser = argparse.ArgumentParser(description = 'Script to convert grammar to GNF form')
-    parser.add_argument(
-            '--gf',
-            type = str,
-            required = True,
-            help = 'Location of grammar file')
-    parser.add_argument(
-            '--out',
-            type = str,
-            required = True,
-            help = 'Location of output file')
-    parser.add_argument(
-            '--start',
-            type = str,
-            required = True,
-            help = 'Start token')
-    args = parser.parse_args()
-
-    main(args.gf, args.out, args.start)

custom_mutators/gramatron/preprocess/prep_automaton.sh

@@ -1,38 +0,0 @@
-#!/bin/bash
-
-# This script creates a FSA describing the input grammar *.g4
-
-if [ ! "$#" -lt 4 ]; then
-  echo "Usage: ./prep_pda.sh <grammar_file> <start> [stack_limit]"         
-  exit 1
-fi
-
-GRAMMAR_FILE=$1
-GRAMMAR_DIR="$(dirname $GRAMMAR_FILE)"
-START="$2"
-STACK_LIMIT="$3"
-
-# Get filename
-FILE=$(basename -- "$GRAMMAR_FILE")
-echo "File:$FILE"
-FILENAME="${FILE%.*}"
-echo "Name:$FILENAME"
-
-
-# Create the GNF form of the grammar
-CMD="python gnf_converter.py --gf $GRAMMAR_FILE --out ${FILENAME}.json --start $START"
-$CMD
-
-# Generate grammar automaton 
-# Check if user provided a stack limit
-if [ -z "${STACK_LIMIT}" ]; then
-CMD="python3 construct_automata.py --gf ${FILENAME}.json" 
-else
-CMD="python construct_automata.py --gf ${FILENAME}.json --limit ${STACK_LIMIT}" 
-fi
-echo $CMD
-$CMD
-
-# Move PDA to the source dir of the grammar
-echo "Copying ${FILENAME}_automata.json to $GRAMMAR_DIR"
-mv "${FILENAME}_automata.json" $GRAMMAR_DIR/  

custom_mutators/gramatron/test.c

@@ -1,154 +0,0 @@
-/* This is the testing module for Gramatron
- */
-#include "afl-fuzz.h"
-#include "gramfuzz.h"
-
-#define NUMINPUTS 50
-
-state *create_pda(u8 *automaton_file) {
-
-  struct json_object *parsed_json;
-  state *             pda;
-  json_object *       source_obj, *attr;
-  int                 arraylen, ii, ii2, trigger_len, error;
-
-  printf("\n[GF] Automaton file passed:%s", automaton_file);
-  // parsed_json =
-  // json_object_from_file("./gramfuzz/php_gnf_processed_full.json");
-  parsed_json = json_object_from_file(automaton_file);
-
-  // Getting final state
-  source_obj = json_object_object_get(parsed_json, "final_state");
-  printf("\t\nFinal=%s\n", json_object_get_string(source_obj));
-  final_state = atoi(json_object_get_string(source_obj));
-
-  // Getting initial state
-  source_obj = json_object_object_get(parsed_json, "init_state");
-  init_state = atoi(json_object_get_string(source_obj));
-  printf("\tInit=%s\n", json_object_get_string(source_obj));
-
-  // Getting number of states
-  source_obj = json_object_object_get(parsed_json, "numstates");
-  numstates = atoi(json_object_get_string(source_obj)) + 1;
-  printf("\tNumStates=%d\n", numstates);
-
-  // Allocate state space for each pda state
-  pda = (state *)calloc(atoi(json_object_get_string(source_obj)) + 1,
-                        sizeof(state));
-
-  // Getting PDA representation
-  source_obj = json_object_object_get(parsed_json, "pda");
-  enum json_type type;
-  json_object_object_foreach(source_obj, key, val) {
-
-    state *  state_ptr;
-    trigger *trigger_ptr;
-    int      offset;
-
-    // Get the correct offset into the pda to store state information
-    state_ptr = pda;
-    offset = atoi(key);
-    state_ptr += offset;
-
-    // Store state string
-    state_ptr->state_name = offset;
-
-    // Create trigger array of structs
-    trigger_len = json_object_array_length(val);
-    state_ptr->trigger_len = trigger_len;
-    trigger_ptr = (trigger *)calloc(trigger_len, sizeof(trigger));
-    state_ptr->ptr = trigger_ptr;
-    printf("\nName:%d Trigger:%d", offset, trigger_len);
-
-    for (ii = 0; ii < trigger_len; ii++) {
-
-      json_object *obj = json_object_array_get_idx(val, ii);
-      // Get all the trigger trigger attributes
-      attr = json_object_array_get_idx(obj, 0);
-      (trigger_ptr)->id = strdup(json_object_get_string(attr));
-
-      attr = json_object_array_get_idx(obj, 1);
-      trigger_ptr->dest = atoi(json_object_get_string(attr));
-
-      attr = json_object_array_get_idx(obj, 2);
-      if (!strcmp("\\n", json_object_get_string(attr))) {
-
-        trigger_ptr->term = strdup("\n");
-
-      } else {
-
-        trigger_ptr->term = strdup(json_object_get_string(attr));
-
-      }
-
-      trigger_ptr->term_len = strlen(trigger_ptr->term);
-      trigger_ptr++;
-
-    }
-
-  }
-
-  // Delete the JSON object
-  json_object_put(parsed_json);
-
-  return pda;
-
-}
-
-void SanityCheck(char *automaton_path) {
-
-  state *        pda = create_pda(automaton_path);
-  int            count = 0, state;
-  Get_Dupes_Ret *getdupesret;
-  IdxMap_new *   statemap;
-  IdxMap_new *   statemap_ptr;
-  terminal *     term_ptr;
-
-  while (count < NUMINPUTS) {
-
-    // Perform input generation
-    Array *generated = gen_input(pda, NULL);
-    print_repr(generated, "Gen");
-    count += 1;
-
-  }
-
-}
-
-int main(int argc, char *argv[]) {
-
-  char *         mode;
-  char *         automaton_path;
-  char *         output_dir = NULL;
-  struct timeval tv;
-  struct timeval tz;
-  // gettimeofday(&tv, &tz);
-  srand(1337);
-  if (argc == 3) {
-
-    mode = argv[1];
-    automaton_path = strdup(argv[2]);
-    printf("\nMode:%s Path:%s", mode, automaton_path);
-
-  } else {
-
-    printf("\nUsage: ./test <mode> <automaton_path>");
-    return -1;
-
-  }
-
-  if (!strcmp(mode, "SanityCheck")) {
-
-    SanityCheck(automaton_path);
-
-  } else {
-
-    printf("\nUnrecognized mode");
-    return -1;
-
-  }
-
-  return 0;
-
-}
-

custom_mutators/gramatron/test.h

@@ -1,57 +0,0 @@
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-#include <json-c/json.h>
-#include <unistd.h>
-#include "hashmap.h"
-#include "uthash.h"
-#include "utarray.h"
-
-#define INIT_SIZE 100  // Initial size of the dynamic array holding the input
-
-typedef struct terminal {
-
-  int    state;
-  int    trigger_idx;
-  size_t symbol_len;
-  char * symbol;
-
-} terminal;
-
-typedef struct trigger {
-
-  char * id;
-  int    dest;
-  char * term;
-  size_t term_len;
-
-} trigger;
-
-typedef struct state {
-
-  int      state_name;   // Integer State name
-  int      trigger_len;  // Number of triggers associated with this state
-  trigger *ptr;          // Pointer to beginning of the list of triggers
-
-} state;
-
-typedef struct {
-
-  size_t    used;
-  size_t    size;
-  size_t    inputlen;
-  terminal *start;
-
-} Array;
-
-int init_state;
-int curr_state;
-int final_state;
-
-state *create_pda(char *);
-Array *gen_input(state *, Array *);
-void   print_repr(Array *, char *);
-void   initArray(Array *, size_t);
-void   insertArray(Array *, int, char *, size_t, int);
-

custom_mutators/gramatron/utarray.h

@@ -1,392 +0,0 @@
-/*
-Copyright (c) 2008-2018, Troy D. Hanson   http://troydhanson.github.com/uthash/
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
-IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
-TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
-PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER
-OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-/* a dynamic array implementation using macros
- */
-#ifndef UTARRAY_H
-#define UTARRAY_H
-
-#define UTARRAY_VERSION 2.1.0
-
-#include <stddef.h>                                               /* size_t */
-#include <string.h>                                          /* memset, etc */
-#include <stdlib.h>                                                 /* exit */
-
-#ifdef __GNUC__
-  #define UTARRAY_UNUSED __attribute__((__unused__))
-#else
-  #define UTARRAY_UNUSED
-#endif
-
-#ifdef oom
-  #error \
-      "The name of macro 'oom' has been changed to 'utarray_oom'. Please update your code."
-  #define utarray_oom() oom()
-#endif
-
-#ifndef utarray_oom
-  #define utarray_oom() exit(-1)
-#endif
-
-typedef void(ctor_f)(void *dst, const void *src);
-typedef void(dtor_f)(void *elt);
-typedef void(init_f)(void *elt);
-typedef struct {
-
-  size_t  sz;
-  init_f *init;
-  ctor_f *copy;
-  dtor_f *dtor;
-
-} UT_icd;
-
-typedef struct {
-
-  unsigned i, n;           /* i: index of next available slot, n: num slots */
-  UT_icd   icd;               /* initializer, copy and destructor functions */
-  char *   d;                                     /* n slots of size icd->sz*/
-
-} UT_array;
-
-#define utarray_init(a, _icd)       \
-  do {                              \
-                                    \
-    memset(a, 0, sizeof(UT_array)); \
-    (a)->icd = *(_icd);             \
-                                    \
-  } while (0)
-
-#define utarray_done(a)                            \
-  do {                                             \
-                                                   \
-    if ((a)->n) {                                  \
-                                                   \
-      if ((a)->icd.dtor) {                         \
-                                                   \
-        unsigned _ut_i;                            \
-        for (_ut_i = 0; _ut_i < (a)->i; _ut_i++) { \
-                                                   \
-          (a)->icd.dtor(utarray_eltptr(a, _ut_i)); \
-                                                   \
-        }                                          \
-                                                   \
-      }                                            \
-      free((a)->d);                                \
-                                                   \
-    }                                              \
-    (a)->n = 0;                                    \
-                                                   \
-  } while (0)
-
-#define utarray_new(a, _icd)                    \
-  do {                                          \
-                                                \
-    (a) = (UT_array *)malloc(sizeof(UT_array)); \
-    if ((a) == NULL) { utarray_oom(); }         \
-    utarray_init(a, _icd);                      \
-                                                \
-  } while (0)
-
-#define utarray_free(a) \
-  do {                  \
-                        \
-    utarray_done(a);    \
-    free(a);            \
-                        \
-  } while (0)
-
-#define utarray_reserve(a, by)                                     \
-  do {                                                             \
-                                                                   \
-    if (((a)->i + (by)) > (a)->n) {                                \
-                                                                   \
-      char *utarray_tmp;                                           \
-      while (((a)->i + (by)) > (a)->n) {                           \
-                                                                   \
-        (a)->n = ((a)->n ? (2 * (a)->n) : 8);                      \
-                                                                   \
-      }                                                            \
-      utarray_tmp = (char *)realloc((a)->d, (a)->n * (a)->icd.sz); \
-      if (utarray_tmp == NULL) { utarray_oom(); }                  \
-      (a)->d = utarray_tmp;                                        \
-                                                                   \
-    }                                                              \
-                                                                   \
-  } while (0)
-
-#define utarray_push_back(a, p)                             \
-  do {                                                      \
-                                                            \
-    utarray_reserve(a, 1);                                  \
-    if ((a)->icd.copy) {                                    \
-                                                            \
-      (a)->icd.copy(_utarray_eltptr(a, (a)->i++), p);       \
-                                                            \
-    } else {                                                \
-                                                            \
-      memcpy(_utarray_eltptr(a, (a)->i++), p, (a)->icd.sz); \
-                                                            \
-    };                                                      \
-                                                            \
-  } while (0)
-
-#define utarray_pop_back(a)                          \
-  do {                                               \
-                                                     \
-    if ((a)->icd.dtor) {                             \
-                                                     \
-      (a)->icd.dtor(_utarray_eltptr(a, --((a)->i))); \
-                                                     \
-    } else {                                         \
-                                                     \
-      (a)->i--;                                      \
-                                                     \
-    }                                                \
-                                                     \
-  } while (0)
-
-#define utarray_extend_back(a)                            \
-  do {                                                    \
-                                                          \
-    utarray_reserve(a, 1);                                \
-    if ((a)->icd.init) {                                  \
-                                                          \
-      (a)->icd.init(_utarray_eltptr(a, (a)->i));          \
-                                                          \
-    } else {                                              \
-                                                          \
-      memset(_utarray_eltptr(a, (a)->i), 0, (a)->icd.sz); \
-                                                          \
-    }                                                     \
-    (a)->i++;                                             \
-                                                          \
-  } while (0)
-
-#define utarray_len(a) ((a)->i)
-
-#define utarray_eltptr(a, j) (((j) < (a)->i) ? _utarray_eltptr(a, j) : NULL)
-#define _utarray_eltptr(a, j) ((a)->d + ((a)->icd.sz * (j)))
-
-#define utarray_insert(a, p, j)                                   \
-  do {                                                            \
-                                                                  \
-    if ((j) > (a)->i) utarray_resize(a, j);                       \
-    utarray_reserve(a, 1);                                        \
-    if ((j) < (a)->i) {                                           \
-                                                                  \
-      memmove(_utarray_eltptr(a, (j) + 1), _utarray_eltptr(a, j), \
-              ((a)->i - (j)) * ((a)->icd.sz));                    \
-                                                                  \
-    }                                                             \
-    if ((a)->icd.copy) {                                          \
-                                                                  \
-      (a)->icd.copy(_utarray_eltptr(a, j), p);                    \
-                                                                  \
-    } else {                                                      \
-                                                                  \
-      memcpy(_utarray_eltptr(a, j), p, (a)->icd.sz);              \
-                                                                  \
-    };                                                            \
-    (a)->i++;                                                     \
-                                                                  \
-  } while (0)
-
-#define utarray_inserta(a, w, j)                                               \
-  do {                                                                         \
-                                                                               \
-    if (utarray_len(w) == 0) break;                                            \
-    if ((j) > (a)->i) utarray_resize(a, j);                                    \
-    utarray_reserve(a, utarray_len(w));                                        \
-    if ((j) < (a)->i) {                                                        \
-                                                                               \
-      memmove(_utarray_eltptr(a, (j) + utarray_len(w)), _utarray_eltptr(a, j), \
-              ((a)->i - (j)) * ((a)->icd.sz));                                 \
-                                                                               \
-    }                                                                          \
-    if ((a)->icd.copy) {                                                       \
-                                                                               \
-      unsigned _ut_i;                                                          \
-      for (_ut_i = 0; _ut_i < (w)->i; _ut_i++) {                               \
-                                                                               \
-        (a)->icd.copy(_utarray_eltptr(a, (j) + _ut_i),                         \
-                      _utarray_eltptr(w, _ut_i));                              \
-                                                                               \
-      }                                                                        \
-                                                                               \
-    } else {                                                                   \
-                                                                               \
-      memcpy(_utarray_eltptr(a, j), _utarray_eltptr(w, 0),                     \
-             utarray_len(w) * ((a)->icd.sz));                                  \
-                                                                               \
-    }                                                                          \
-    (a)->i += utarray_len(w);                                                  \
-                                                                               \
-  } while (0)
-
-#define utarray_resize(dst, num)                                   \
-  do {                                                             \
-                                                                   \
-    unsigned _ut_i;                                                \
-    if ((dst)->i > (unsigned)(num)) {                              \
-                                                                   \
-      if ((dst)->icd.dtor) {                                       \
-                                                                   \
-        for (_ut_i = (num); _ut_i < (dst)->i; ++_ut_i) {           \
-                                                                   \
-          (dst)->icd.dtor(_utarray_eltptr(dst, _ut_i));            \
-                                                                   \
-        }                                                          \
-                                                                   \
-      }                                                            \
-                                                                   \
-    } else if ((dst)->i < (unsigned)(num)) {                       \
-                                                                   \
-      utarray_reserve(dst, (num) - (dst)->i);                      \
-      if ((dst)->icd.init) {                                       \
-                                                                   \
-        for (_ut_i = (dst)->i; _ut_i < (unsigned)(num); ++_ut_i) { \
-                                                                   \
-          (dst)->icd.init(_utarray_eltptr(dst, _ut_i));            \
-                                                                   \
-        }                                                          \
-                                                                   \
-      } else {                                                     \
-                                                                   \
-        memset(_utarray_eltptr(dst, (dst)->i), 0,                  \
-               (dst)->icd.sz *((num) - (dst)->i));                 \
-                                                                   \
-      }                                                            \
-                                                                   \
-    }                                                              \
-    (dst)->i = (num);                                              \
-                                                                   \
-  } while (0)
-
-#define utarray_concat(dst, src)                 \
-  do {                                           \
-                                                 \
-    utarray_inserta(dst, src, utarray_len(dst)); \
-                                                 \
-  } while (0)
-
-#define utarray_erase(a, pos, len)                                        \
-  do {                                                                    \
-                                                                          \
-    if ((a)->icd.dtor) {                                                  \
-                                                                          \
-      unsigned _ut_i;                                                     \
-      for (_ut_i = 0; _ut_i < (len); _ut_i++) {                           \
-                                                                          \
-        (a)->icd.dtor(utarray_eltptr(a, (pos) + _ut_i));                  \
-                                                                          \
-      }                                                                   \
-                                                                          \
-    }                                                                     \
-    if ((a)->i > ((pos) + (len))) {                                       \
-                                                                          \
-      memmove(_utarray_eltptr(a, pos), _utarray_eltptr(a, (pos) + (len)), \
-              ((a)->i - ((pos) + (len))) * (a)->icd.sz);                  \
-                                                                          \
-    }                                                                     \
-    (a)->i -= (len);                                                      \
-                                                                          \
-  } while (0)
-
-#define utarray_renew(a, u) \
-  do {                      \
-                            \
-    if (a)                  \
-      utarray_clear(a);     \
-    else                    \
-      utarray_new(a, u);    \
-                            \
-  } while (0)
-
-#define utarray_clear(a)                            \
-  do {                                              \
-                                                    \
-    if ((a)->i > 0) {                               \
-                                                    \
-      if ((a)->icd.dtor) {                          \
-                                                    \
-        unsigned _ut_i;                             \
-        for (_ut_i = 0; _ut_i < (a)->i; _ut_i++) {  \
-                                                    \
-          (a)->icd.dtor(_utarray_eltptr(a, _ut_i)); \
-                                                    \
-        }                                           \
-                                                    \
-      }                                             \
-      (a)->i = 0;                                   \
-                                                    \
-    }                                               \
-                                                    \
-  } while (0)
-
-#define utarray_sort(a, cmp)                 \
-  do {                                       \
-                                             \
-    qsort((a)->d, (a)->i, (a)->icd.sz, cmp); \
-                                             \
-  } while (0)
-
-#define utarray_find(a, v, cmp) bsearch((v), (a)->d, (a)->i, (a)->icd.sz, cmp)
-
-#define utarray_front(a) (((a)->i) ? (_utarray_eltptr(a, 0)) : NULL)
-#define utarray_next(a, e)                                             \
-  (((e) == NULL) ? utarray_front(a)                                    \
-                 : (((a)->i != utarray_eltidx(a, e) + 1)               \
-                        ? _utarray_eltptr(a, utarray_eltidx(a, e) + 1) \
-                        : NULL))
-#define utarray_prev(a, e)                                             \
-  (((e) == NULL) ? utarray_back(a)                                     \
-                 : ((utarray_eltidx(a, e) != 0)                        \
-                        ? _utarray_eltptr(a, utarray_eltidx(a, e) - 1) \
-                        : NULL))
-#define utarray_back(a) (((a)->i) ? (_utarray_eltptr(a, (a)->i - 1)) : NULL)
-#define utarray_eltidx(a, e) (((char *)(e) - (a)->d) / (a)->icd.sz)
-
-/* last we pre-define a few icd for common utarrays of ints and strings */
-static void utarray_str_cpy(void *dst, const void *src) {
-
-  char **_src = (char **)src, **_dst = (char **)dst;
-  *_dst = (*_src == NULL) ? NULL : strdup(*_src);
-
-}
-
-static void utarray_str_dtor(void *elt) {
-
-  char **eltc = (char **)elt;
-  if (*eltc != NULL) free(*eltc);
-
-}
-
-static const UT_icd ut_str_icd UTARRAY_UNUSED = {
-
-    sizeof(char *), NULL, utarray_str_cpy, utarray_str_dtor};
-static const UT_icd ut_int_icd UTARRAY_UNUSED = {sizeof(int), NULL, NULL, NULL};
-static const UT_icd ut_ptr_icd UTARRAY_UNUSED = {sizeof(void *), NULL, NULL,
-                                                 NULL};
-
-#endif                                                         /* UTARRAY_H */
-

custom_mutators/grammar_mutator/GRAMMAR_VERSION

@@ -1 +0,0 @@
-95a6857

custom_mutators/grammar_mutator/README.md

@@ -1,6 +0,0 @@
-# Grammar-Mutator
-
-This is just a stub directory that will clone the real grammar mutator
-directory.
-
-Execute `./build_grammar_mutator.sh` to set everything up.

custom_mutators/grammar_mutator/build_grammar_mutator.sh

@@ -1,141 +0,0 @@
-#!/bin/sh
-#
-# american fuzzy lop++ - unicorn mode build script
-# ------------------------------------------------
-#
-# Originally written by Nathan Voss <njvoss99@gmail.com>
-#
-# Adapted from code by Andrew Griffiths <agriffiths@google.com> and
-#                      Michal Zalewski
-#
-# Adapted for AFLplusplus by Dominik Maier <mail@dmnk.co>
-#
-# CompareCoverage and NeverZero counters by Andrea Fioraldi
-#                                <andreafioraldi@gmail.com>
-#
-# Copyright 2017 Battelle Memorial Institute. All rights reserved.
-# Copyright 2019-2023 AFLplusplus Project. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at:
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# This script downloads, patches, and builds a version of Unicorn with
-# minor tweaks to allow Unicorn-emulated binaries to be run under
-# afl-fuzz.
-#
-# The modifications reside in patches/*. The standalone Unicorn library
-# will be written to /usr/lib/libunicornafl.so, and the Python bindings
-# will be installed system-wide.
-#
-# You must make sure that Unicorn Engine is not already installed before
-# running this script. If it is, please uninstall it first.
-
-GRAMMAR_VERSION="$(cat ./GRAMMAR_VERSION)"
-GRAMMAR_REPO="https://github.com/AFLplusplus/grammar-mutator"
-
-echo "================================================="
-echo "Grammar Mutator build script"
-echo "================================================="
-echo
-
-echo "[*] Performing basic sanity checks..."
-
-PLT=`uname -s`
-
-if [ ! -f "../../config.h" ]; then
-
-  echo "[-] Error: key files not found - wrong working directory?"
-  exit 1
-
-fi
-
-PYTHONBIN=`command -v python3 || command -v python || command -v python2 || echo python3`
-MAKECMD=make
-TARCMD=tar
-
-if [ "$PLT" = "Darwin" ]; then
-  CORES=`sysctl -n hw.ncpu`
-  TARCMD=tar
-fi
-
-if [ "$PLT" = "FreeBSD" ]; then
-  MAKECMD=gmake
-  CORES=`sysctl -n hw.ncpu`
-  TARCMD=gtar
-fi
-
-if [ "$PLT" = "NetBSD" ] || [ "$PLT" = "OpenBSD" ]; then
-  MAKECMD=gmake
-  CORES=`sysctl -n hw.ncpu`
-  TARCMD=gtar
-fi
-
-PREREQ_NOTFOUND=
-for i in git $MAKECMD $TARCMD; do
-
-  T=`command -v "$i" 2>/dev/null`
-
-  if [ "$T" = "" ]; then
-
-    echo "[-] Error: '$i' not found. Run 'sudo apt-get install $i' or similar."
-    PREREQ_NOTFOUND=1
-
-  fi
-
-done
-
-if echo "$CC" | grep -qF /afl-; then
-
-  echo "[-] Error: do not use afl-gcc or afl-clang to compile this tool."
-  PREREQ_NOTFOUND=1
-
-fi
-
-if [ "$PREREQ_NOTFOUND" = "1" ]; then
-  exit 1
-fi
-
-echo "[+] All checks passed!"
-
-echo "[*] Making sure grammar mutator is checked out"
-
-git status 1>/dev/null 2>/dev/null
-if [ $? -eq 0 ]; then
-  echo "[*] initializing grammar mutator submodule"
-  git submodule init || exit 1
-  git submodule update ./grammar_mutator 2>/dev/null # ignore errors
-else
-  echo "[*] cloning grammar mutator"
-  test -d grammar_mutator/.git || {
-    CNT=1
-    while [ '!' -d grammar_mutator/.git -a "$CNT" -lt 4 ]; do
-      echo "Trying to clone grammar_mutator (attempt $CNT/3)"
-      git clone "$GRAMMAR_REPO" 
-      CNT=`expr "$CNT" + 1`
-    done
-  }
-fi
-
-test -e grammar_mutator/.git || { echo "[-] not checked out, please install git or check your internet connection." ; exit 1 ; }
-echo "[+] Got grammar mutator."
-
-cd "grammar_mutator" || exit 1
-echo "[*] Checking out $GRAMMAR_VERSION"
-git pull >/dev/null 2>&1
-sh -c 'git stash && git stash drop' 1>/dev/null 2>/dev/null
-git checkout "$GRAMMAR_VERSION" || exit 1
-echo "[*] Downloading antlr..."
-wget -q https://www.antlr.org/download/antlr-4.8-complete.jar
-cd ..
-
-echo
-echo
-echo "[+] All successfully prepared!"
-echo "[!] To build for your grammar just do:"
-echo "      cd grammar_mutator"
-echo "      make GRAMMAR_FILE=/path/to/your/grammar"
-echo "[+] You will find a JSON and RUBY grammar in grammar_mutator/grammars to play with."
-echo

custom_mutators/grammar_mutator/update_grammar_ref.sh

@@ -1,50 +0,0 @@
-#!/bin/sh
-
-##################################################
-# AFL++ tool to update a git ref.
-# Usage: ./<script>.sh <new commit hash>
-# If no commit hash was provided, it'll take HEAD.
-##################################################
-
-TOOL="grammar mutator"
-VERSION_FILE='./GRAMMAR_VERSION'
-REPO_FOLDER='./grammar_mutator'
-THIS_SCRIPT=`basename $0`
-BRANCH="stable"
-
-NEW_VERSION="$1"
-
-if [ "$NEW_VERSION" = "-h" ]; then
-  echo "Internal script to update bound $TOOL version."
-  echo
-  echo "Usage: $THIS_SCRIPT <new commit hash>"
-  echo "If no commit hash is provided, will use HEAD."
-  echo "-h to show this help screen."
-  exit 1
-fi
-
-git submodule init && git submodule update ./grammar_mutator || exit 1
-cd "$REPO_FOLDER" || exit 1
-git fetch origin $BRANCH 1>/dev/null || exit 1
-git stash 1>/dev/null 2>/dev/null
-git stash drop 1>/dev/null 2>/dev/null
-git checkout $BRANCH
-
-if [ -z "$NEW_VERSION" ]; then
-  # No version provided, take HEAD.
-  NEW_VERSION=$(git rev-parse --short HEAD)
-fi
-
-if [ -z "$NEW_VERSION" ]; then
-  echo "Error getting version."
-  exit 1
-fi
-
-git checkout "$NEW_VERSION" || exit 1
-
-cd ..
-
-rm "$VERSION_FILE"
-echo "$NEW_VERSION" > "$VERSION_FILE"
-
-echo "Done. New $TOOL version is $NEW_VERSION."

custom_mutators/honggfuzz/Makefile

@@ -1,17 +0,0 @@
-
-CFLAGS = -O3 -funroll-loops -fPIC -Wl,-Bsymbolic
-
-all: honggfuzz-mutator.so
-
-honggfuzz-mutator.so:	honggfuzz.c input.h mangle.c ../../src/afl-performance.c
-	$(CC) $(CFLAGS) -I../../include -I. -shared -o honggfuzz-mutator.so honggfuzz.c mangle.c ../../src/afl-performance.c
-
-update:
-	@# seriously? --unlink is a dud option? sigh ...
-	rm -f mangle.c mangle.h honggfuzz.h
-	wget --unlink https://github.com/google/honggfuzz/raw/master/mangle.c
-	wget --unlink https://github.com/google/honggfuzz/raw/master/mangle.h
-	wget --unlink https://github.com/google/honggfuzz/raw/master/honggfuzz.h
-
-clean:
-	rm -f *.o *~ *.so core

custom_mutators/honggfuzz/README.md

@@ -1,12 +0,0 @@
-# custum mutator: honggfuzz mangle
-
-this is the honggfuzz mutator in mangle.c as a custom mutator
-module for AFL++. It is the original mangle.c, mangle.h and honggfuzz.h
-with a lot of mocking around it :-)
-
-just type `make` to build
-
-```AFL_CUSTOM_MUTATOR_LIBRARY=custom_mutators/honggfuzz/honggfuzz-mutator.so afl-fuzz ...```
-
-> Original repository: https://github.com/google/honggfuzz
-> Source commit: d0fbcb0373c32436b8fb922e6937da93b17291f5

custom_mutators/honggfuzz/honggfuzz.c

@@ -1,146 +0,0 @@
-#include <stdio.h>
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "afl-fuzz.h"
-#include "mangle.h"
-
-#define NUMBER_OF_MUTATIONS 5
-
-uint8_t          *queue_input;
-size_t            queue_input_size;
-afl_state_t      *afl_struct;
-run_t             run;
-honggfuzz_t       global;
-struct _dynfile_t dynfile;
-
-typedef struct my_mutator {
-
-  afl_state_t *afl;
-  run_t       *run;
-  u8          *mutator_buf;
-  unsigned int seed;
-  unsigned int extras_cnt, a_extras_cnt;
-
-} my_mutator_t;
-
-my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) {
-
-  my_mutator_t *data = calloc(1, sizeof(my_mutator_t));
-  if (!data) {
-
-    perror("afl_custom_init alloc");
-    return NULL;
-
-  }
-
-  if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) {
-
-    free(data);
-    perror("mutator_buf alloc");
-    return NULL;
-
-  }
-
-  run.dynfile = &dynfile;
-  run.global = &global;
-  data->afl = afl;
-  data->seed = seed;
-  data->run = &run;
-  afl_struct = afl;
-
-  run.global->mutate.maxInputSz = MAX_FILE;
-  run.global->mutate.mutationsPerRun = NUMBER_OF_MUTATIONS;
-  run.mutationsPerRun = NUMBER_OF_MUTATIONS;
-  run.global->timing.lastCovUpdate = 6;
-
-  // global->feedback.cmpFeedback
-  // global->feedback.cmpFeedbackMap
-
-  return data;
-
-}
-
-/* When a new queue entry is added we check if there are new dictionary
-   entries to add to honggfuzz structure */
-
-void afl_custom_queue_new_entry(my_mutator_t  *data,
-                                const uint8_t *filename_new_queue,
-                                const uint8_t *filename_orig_queue) {
-
-  if (run.global->mutate.dictionaryCnt >= 1024) return;
-
-  while (data->extras_cnt < data->afl->extras_cnt &&
-         run.global->mutate.dictionaryCnt < 1024) {
-
-    memcpy(run.global->mutate.dictionary[run.global->mutate.dictionaryCnt].val,
-           data->afl->extras[data->extras_cnt].data,
-           data->afl->extras[data->extras_cnt].len);
-    run.global->mutate.dictionary[run.global->mutate.dictionaryCnt].len =
-        data->afl->extras[data->extras_cnt].len;
-    run.global->mutate.dictionaryCnt++;
-    data->extras_cnt++;
-
-  }
-
-  while (data->a_extras_cnt < data->afl->a_extras_cnt &&
-         run.global->mutate.dictionaryCnt < 1024) {
-
-    memcpy(run.global->mutate.dictionary[run.global->mutate.dictionaryCnt].val,
-           data->afl->a_extras[data->a_extras_cnt].data,
-           data->afl->a_extras[data->a_extras_cnt].len);
-    run.global->mutate.dictionary[run.global->mutate.dictionaryCnt].len =
-        data->afl->a_extras[data->a_extras_cnt].len;
-    run.global->mutate.dictionaryCnt++;
-    data->a_extras_cnt++;
-
-  }
-
-  return;
-
-}
-
-/* we could set only_printable if is_ascii is set ... let's see
-uint8_t afl_custom_queue_get(void *data, const uint8_t *filename) {
-
-  //run.global->cfg.only_printable = ...
-
-}
-
-*/
-
-/* here we run the honggfuzz mutator, which is really good */
-
-size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
-                       u8 **out_buf, uint8_t *add_buf, size_t add_buf_size,
-                       size_t max_size) {
-
-  /* set everything up, costly ... :( */
-  memcpy(data->mutator_buf, buf, buf_size);
-  queue_input = data->mutator_buf;
-  run.dynfile->data = data->mutator_buf;
-  queue_input_size = buf_size;
-  run.dynfile->size = buf_size;
-  *out_buf = data->mutator_buf;
-
-  /* the mutation */
-  mangle_mangleContent(&run, NUMBER_OF_MUTATIONS);
-
-  /* return size of mutated data */
-  return run.dynfile->size;
-
-}
-
-/**
- * Deinitialize everything
- *
- * @param data The data ptr from afl_custom_init
- */
-void afl_custom_deinit(my_mutator_t *data) {
-
-  free(data->mutator_buf);
-  free(data);
-
-}
-

custom_mutators/honggfuzz/honggfuzz.h

@@ -1,387 +0,0 @@
-/*
- *
- * honggfuzz - core structures and macros
- * -----------------------------------------
- *
- * Author: Robert Swiecki <swiecki@google.com>
- *
- * Copyright 2010-2018 by Google Inc. All Rights Reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License. You may obtain
- * a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- * implied. See the License for the specific language governing
- * permissions and limitations under the License.
- *
- */
-
-#ifndef _HF_HONGGFUZZ_H_
-#define _HF_HONGGFUZZ_H_
-
-#include <dirent.h>
-#include <inttypes.h>
-#include <limits.h>
-#include <pthread.h>
-#include <signal.h>
-#include <stdbool.h>
-#include <stdint.h>
-#include <sys/param.h>
-#include <sys/queue.h>
-#include <sys/types.h>
-#include <time.h>
-
-#include "libhfcommon/util.h"
-
-#define PROG_NAME    "honggfuzz"
-#define PROG_VERSION "2.4"
-
-/* Name of the template which will be replaced with the proper name of the file */
-#define _HF_FILE_PLACEHOLDER "___FILE___"
-
-/* Default name of the report created with some architectures */
-#define _HF_REPORT_FILE "HONGGFUZZ.REPORT.TXT"
-
-/* Default stack-size of created threads. */
-#define _HF_PTHREAD_STACKSIZE (1024ULL * 1024ULL * 2ULL) /* 2MB */
-
-/* Name of envvar which indicates sequential number of fuzzer */
-#define _HF_THREAD_NO_ENV "HFUZZ_THREAD_NO"
-
-/* Name of envvar which indicates that the netDriver should be used */
-#define _HF_THREAD_NETDRIVER_ENV "HFUZZ_USE_NETDRIVER"
-
-/* Name of envvar which indicates honggfuzz's log level in use */
-#define _HF_LOG_LEVEL_ENV "HFUZZ_LOG_LEVEL"
-
-/* Number of crash verifier iterations before tag crash as stable */
-#define _HF_VERIFIER_ITER 5
-
-/* Size (in bytes) for report data to be stored in stack before written to file */
-#define _HF_REPORT_SIZE 32768
-
-/* Perf bitmap size */
-#define _HF_PERF_BITMAP_SIZE_16M   (1024U * 1024U * 16U)
-#define _HF_PERF_BITMAP_BITSZ_MASK 0x7FFFFFFULL
-/* Maximum number of PC guards (=trace-pc-guard) we support */
-#define _HF_PC_GUARD_MAX (1024ULL * 1024ULL * 64ULL)
-
-/* Maximum size of the input file in bytes (1 MiB) */
-#define _HF_INPUT_MAX_SIZE (1024ULL * 1024ULL)
-
-/* Default maximum size of produced inputs */
-#define _HF_INPUT_DEFAULT_SIZE (1024ULL * 8)
-
-/* Per-thread bitmap */
-#define _HF_PERTHREAD_BITMAP_FD 1018
-/* FD used to report back used int/str constants from the fuzzed process */
-#define _HF_CMP_BITMAP_FD 1019
-/* FD used to log inside the child process */
-#define _HF_LOG_FD 1020
-/* FD used to represent the input file */
-#define _HF_INPUT_FD 1021
-/* FD used to pass coverage feedback from the fuzzed process */
-#define _HF_COV_BITMAP_FD 1022
-#define _HF_BITMAP_FD     _HF_COV_BITMAP_FD /* Old name for _HF_COV_BITMAP_FD */
-/* FD used to pass data to a persistent process */
-#define _HF_PERSISTENT_FD 1023
-
-/* Input file as a string */
-#define _HF_INPUT_FILE_PATH "/dev/fd/" HF_XSTR(_HF_INPUT_FD)
-
-/* Maximum number of supported execve() args */
-#define _HF_ARGS_MAX 2048
-
-/* Message indicating that the fuzzed process is ready for new data */
-static const uint8_t HFReadyTag = 'R';
-
-/* Maximum number of active fuzzing threads */
-#define _HF_THREAD_MAX 1024U
-
-/* Persistent-binary signature - if found within file, it means it's a persistent mode binary */
-#define _HF_PERSISTENT_SIG "\x01_LIBHFUZZ_PERSISTENT_BINARY_SIGNATURE_\x02\xFF"
-/* HF NetDriver signature - if found within file, it means it's a NetDriver-based binary */
-#define _HF_NETDRIVER_SIG "\x01_LIBHFUZZ_NETDRIVER_BINARY_SIGNATURE_\x02\xFF"
-
-/* printf() nonmonetary separator. According to MacOSX's man it's supported there as well */
-#define _HF_NONMON_SEP "'"
-
-typedef enum {
-    _HF_DYNFILE_NONE         = 0x0,
-    _HF_DYNFILE_INSTR_COUNT  = 0x1,
-    _HF_DYNFILE_BRANCH_COUNT = 0x2,
-    _HF_DYNFILE_BTS_EDGE     = 0x10,
-    _HF_DYNFILE_IPT_BLOCK    = 0x20,
-    _HF_DYNFILE_SOFT         = 0x40,
-} dynFileMethod_t;
-
-typedef struct {
-    uint64_t cpuInstrCnt;
-    uint64_t cpuBranchCnt;
-    uint64_t bbCnt;
-    uint64_t newBBCnt;
-    uint64_t softCntPc;
-    uint64_t softCntEdge;
-    uint64_t softCntCmp;
-} hwcnt_t;
-
-typedef enum {
-    _HF_STATE_UNSET = 0,
-    _HF_STATE_STATIC,
-    _HF_STATE_DYNAMIC_DRY_RUN,
-    _HF_STATE_DYNAMIC_MAIN,
-    _HF_STATE_DYNAMIC_MINIMIZE,
-} fuzzState_t;
-
-typedef enum {
-    HF_MAYBE = -1,
-    HF_NO    = 0,
-    HF_YES   = 1,
-} tristate_t;
-
-struct _dynfile_t {
-    size_t             size;
-    uint64_t           cov[4];
-    size_t             idx;
-    int                fd;
-    uint64_t           timeExecUSecs;
-    char               path[PATH_MAX];
-    struct _dynfile_t* src;
-    uint32_t           refs;
-    uint8_t*           data;
-    TAILQ_ENTRY(_dynfile_t) pointers;
-};
-
-typedef struct _dynfile_t dynfile_t;
-
-struct strings_t {
-    size_t len;
-    TAILQ_ENTRY(strings_t) pointers;
-    char s[];
-};
-
-typedef struct {
-    uint8_t  pcGuardMap[_HF_PC_GUARD_MAX];
-    uint8_t  bbMapPc[_HF_PERF_BITMAP_SIZE_16M];
-    uint32_t bbMapCmp[_HF_PERF_BITMAP_SIZE_16M];
-    uint64_t pidNewPC[_HF_THREAD_MAX];
-    uint64_t pidNewEdge[_HF_THREAD_MAX];
-    uint64_t pidNewCmp[_HF_THREAD_MAX];
-    uint64_t guardNb;
-    uint64_t pidTotalPC[_HF_THREAD_MAX];
-    uint64_t pidTotalEdge[_HF_THREAD_MAX];
-    uint64_t pidTotalCmp[_HF_THREAD_MAX];
-} feedback_t;
-
-typedef struct {
-    uint32_t cnt;
-    struct {
-        uint8_t  val[32];
-        uint32_t len;
-    } valArr[1024 * 16];
-} cmpfeedback_t;
-
-typedef struct {
-    struct {
-        size_t    threadsMax;
-        size_t    threadsFinished;
-        uint32_t  threadsActiveCnt;
-        pthread_t mainThread;
-        pid_t     mainPid;
-        pthread_t threads[_HF_THREAD_MAX];
-    } threads;
-    struct {
-        const char* inputDir;
-        const char* outputDir;
-        DIR*        inputDirPtr;
-        size_t      fileCnt;
-        size_t      testedFileCnt;
-        const char* fileExtn;
-        size_t      maxFileSz;
-        size_t      newUnitsAdded;
-        char        workDir[PATH_MAX];
-        const char* crashDir;
-        const char* covDirNew;
-        bool        saveUnique;
-        bool        saveSmaller;
-        size_t      dynfileqMaxSz;
-        size_t      dynfileqCnt;
-        dynfile_t*  dynfileqCurrent;
-        dynfile_t*  dynfileq2Current;
-        TAILQ_HEAD(dyns_t, _dynfile_t) dynfileq;
-        bool exportFeedback;
-    } io;
-    struct {
-        int                argc;
-        const char* const* cmdline;
-        bool               nullifyStdio;
-        bool               fuzzStdin;
-        const char*        externalCommand;
-        const char*        postExternalCommand;
-        const char*        feedbackMutateCommand;
-        bool               netDriver;
-        bool               persistent;
-        uint64_t           asLimit;
-        uint64_t           rssLimit;
-        uint64_t           dataLimit;
-        uint64_t           coreLimit;
-        uint64_t           stackLimit;
-        bool               clearEnv;
-        char*              env_ptrs[128];
-        char               env_vals[128][4096];
-        sigset_t           waitSigSet;
-    } exe;
-    struct {
-        time_t  timeStart;
-        time_t  runEndTime;
-        time_t  tmOut;
-        time_t  lastCovUpdate;
-        int64_t timeOfLongestUnitUSecs;
-        bool    tmoutVTALRM;
-    } timing;
-    struct {
-        struct {
-            uint8_t val[512];
-            size_t  len;
-        } dictionary[8192];
-        size_t      dictionaryCnt;
-        const char* dictionaryFile;
-        size_t      mutationsMax;
-        unsigned    mutationsPerRun;
-        size_t      maxInputSz;
-    } mutate;
-    struct {
-        bool    useScreen;
-        char    cmdline_txt[65];
-        int64_t lastDisplayUSecs;
-    } display;
-    struct {
-        bool        useVerifier;
-        bool        exitUponCrash;
-        uint8_t     exitCodeUponCrash;
-        const char* reportFile;
-        size_t      dynFileIterExpire;
-        bool        only_printable;
-        bool        minimize;
-        bool        switchingToFDM;
-    } cfg;
-    struct {
-        bool enable;
-        bool del_report;
-    } sanitizer;
-    struct {
-        fuzzState_t     state;
-        feedback_t*     covFeedbackMap;
-        int             covFeedbackFd;
-        cmpfeedback_t*  cmpFeedbackMap;
-        int             cmpFeedbackFd;
-        bool            cmpFeedback;
-        const char*     blocklistFile;
-        uint64_t*       blocklist;
-        size_t          blocklistCnt;
-        bool            skipFeedbackOnTimeout;
-        uint64_t        maxCov[4];
-        dynFileMethod_t dynFileMethod;
-        hwcnt_t         hwCnts;
-    } feedback;
-    struct {
-        size_t mutationsCnt;
-        size_t crashesCnt;
-        size_t uniqueCrashesCnt;
-        size_t verifiedCrashesCnt;
-        size_t blCrashesCnt;
-        size_t timeoutedCnt;
-    } cnts;
-    struct {
-        bool enabled;
-        int  serverSocket;
-        int  clientSocket;
-    } socketFuzzer;
-    struct {
-        pthread_rwlock_t dynfileq;
-        pthread_mutex_t  feedback;
-        pthread_mutex_t  report;
-        pthread_mutex_t  state;
-        pthread_mutex_t  input;
-        pthread_mutex_t  timing;
-    } mutex;
-
-    /* For the Linux code */
-    struct {
-        int         exeFd;
-        uint64_t    dynamicCutOffAddr;
-        bool        disableRandomization;
-        void*       ignoreAddr;
-        const char* symsBlFile;
-        char**      symsBl;
-        size_t      symsBlCnt;
-        const char* symsWlFile;
-        char**      symsWl;
-        size_t      symsWlCnt;
-        uintptr_t   cloneFlags;
-        tristate_t  useNetNs;
-        bool        kernelOnly;
-        bool        useClone;
-    } arch_linux;
-    /* For the NetBSD code */
-    struct {
-        void*       ignoreAddr;
-        const char* symsBlFile;
-        char**      symsBl;
-        size_t      symsBlCnt;
-        const char* symsWlFile;
-        char**      symsWl;
-        size_t      symsWlCnt;
-    } arch_netbsd;
-} honggfuzz_t;
-
-typedef enum {
-    _HF_RS_UNKNOWN                   = 0,
-    _HF_RS_WAITING_FOR_INITIAL_READY = 1,
-    _HF_RS_WAITING_FOR_READY         = 2,
-    _HF_RS_SEND_DATA                 = 3,
-} runState_t;
-
-typedef struct {
-    honggfuzz_t* global;
-    pid_t        pid;
-    int64_t      timeStartedUSecs;
-    char         crashFileName[PATH_MAX];
-    uint64_t     pc;
-    uint64_t     backtrace;
-    uint64_t     access;
-    int          exception;
-    char         report[_HF_REPORT_SIZE];
-    bool         mainWorker;
-    unsigned     mutationsPerRun;
-    dynfile_t*   dynfile;
-    bool         staticFileTryMore;
-    uint32_t     fuzzNo;
-    int          persistentSock;
-    runState_t   runState;
-    bool         tmOutSignaled;
-    char*        args[_HF_ARGS_MAX + 1];
-    int          perThreadCovFeedbackFd;
-    unsigned     triesLeft;
-    dynfile_t*   current;
-#if !defined(_HF_ARCH_DARWIN)
-    timer_t timerId;
-#endif    // !defined(_HF_ARCH_DARWIN)
-    hwcnt_t hwCnts;
-
-    struct {
-        /* For Linux code */
-        uint8_t* perfMmapBuf;
-        uint8_t* perfMmapAux;
-        int      cpuInstrFd;
-        int      cpuBranchFd;
-        int      cpuIptBtsFd;
-    } arch_linux;
-} run_t;
-
-#endif

custom_mutators/honggfuzz/input.h

@@ -1,106 +0,0 @@
-#ifndef _HG_INPUT_
-#define _HG_INPUT_
-
-#include <stdarg.h>
-#ifdef __clang__
-#include <stdatomic.h>
-#endif
-#include <stdbool.h>
-#include <stdint.h>
-#include <time.h>
-
-#include "honggfuzz.h"
-#include "afl-fuzz.h"
-
-/*
- * Go-style defer scoped implementation
- *
- * If compiled with clang, use: -fblocks -lBlocksRuntime
- *
- * Example of use:
- *
- * {
- *   int fd = open(fname, O_RDONLY);
- *   if (fd == -1) {
- *     error(....);
- *     return;
- *   }
- *   defer { close(fd); };
- *   ssize_t sz = read(fd, buf, sizeof(buf));
- *   ...
- *   ...
- * }
- *
- */
-
-#define __STRMERGE(a, b) a##b
-#define _STRMERGE(a, b)  __STRMERGE(a, b)
-#ifdef __clang__
-#if __has_extension(blocks)
-static void __attribute__((unused)) __clang_cleanup_func(void (^*dfunc)(void)) {
-    (*dfunc)();
-}
-
-#define defer                                                                                      \
-    void (^_STRMERGE(__defer_f_, __COUNTER__))(void)                                               \
-        __attribute__((cleanup(__clang_cleanup_func))) __attribute__((unused)) = ^
-
-#else /* __has_extension(blocks) */
-#define defer UNIMPLEMENTED - NO - SUPPORT - FOR - BLOCKS - IN - YOUR - CLANG - ENABLED
-#endif /*  __has_extension(blocks) */
-#else  /* !__clang__, e.g.: gcc */
-
-#define __block
-#define _DEFER(a, count)                                                                            \
-    auto void _STRMERGE(__defer_f_, count)(void* _defer_arg __attribute__((unused)));               \
-    int       _STRMERGE(__defer_var_, count) __attribute__((cleanup(_STRMERGE(__defer_f_, count)))) \
-        __attribute__((unused));                                                                    \
-    void _STRMERGE(__defer_f_, count)(void* _defer_arg __attribute__((unused)))
-#define defer _DEFER(a, __COUNTER__)
-#endif /* ifdef __clang__ */
-
-#define HF_MIN(x, y) (x <= y ? x : y)
-#define HF_MAX(x, y) (x >= y ? x : y)
-#define ATOMIC_GET
-#define ARRAYSIZE(x) (sizeof(x) / sizeof(*x))
-#define HF_ATTR_UNUSED __attribute__((unused))
-#define util_Malloc(x) malloc(x)
-
-extern uint8_t *         queue_input;
-extern size_t            queue_input_size;
-extern afl_state_t *     afl_struct;
-
-inline void wmb() { }
-inline void LOG_F(const char *format, ...) { }
-static inline uint64_t util_rndGet(uint64_t min, uint64_t max) {
-  return min + rand_below(afl_struct, max - min + 1);
-}
-static inline uint64_t util_rnd64() { return rand_below(afl_struct, 1 << 30); }
-
-static inline const uint8_t* input_getRandomInputAsBuf(run_t* run, size_t* len) {
-  *len = queue_input_size;
-  run->dynfile->data = queue_input;
-  run->dynfile->size = queue_input_size;
-  return queue_input;
-}
-static inline void input_setSize(run_t* run, size_t sz) {
-  run->dynfile->size = sz;
-}
-static inline void util_turnToPrintable(uint8_t* buf, size_t sz) {
-  for (size_t i = 0; i < sz; i++)
-    buf[i] = buf[i] % 95 + 32;
-}
-static inline void util_rndBuf(uint8_t* buf, size_t sz) {
-  if (sz == 0) return;
-  for (size_t i = 0; i < sz; i++)
-    buf[i] = (uint8_t)rand_below(afl_struct, 256);
-}
-static inline uint8_t util_rndPrintable() {
-  return 32 + rand_below(afl_struct, 127 - 32);
-}
-static inline void util_rndBufPrintable(uint8_t* buf, size_t sz) {
-  for (size_t i = 0; i < sz; i++)
-    buf[i] = util_rndPrintable();
-}
-
-#endif

custom_mutators/honggfuzz/libhfcommon/common.h

@@ -1,3 +0,0 @@
-#ifndef LOG_E
-  #define LOG_E LOG_F
-#endif

custom_mutators/honggfuzz/libhfcommon/log.h

@@ -1 +0,0 @@
-common.h

custom_mutators/honggfuzz/libhfcommon/util.h

@@ -1 +0,0 @@
-common.h