☰

AFL 中的总 tmout 存储在哪里？

tag-icon • tag-icon security
AFL 中的总 tmout 存储在哪里？

在《American Fuzzy Lop》中，我可以看到：

total tmouts : 16 (5 unique)

但是产生 5 个独特 tmouts 的输入在哪里呢？我在输出目录中找不到它：\

答案1

afl-fuzz.c : save_if_interesting() 函数

switch (fault) {
  
      case FAULT_TMOUT:
  
        /* Timeouts are not very interesting, but we're still obliged to keep
           a handful of samples. We use the presence of new bits in the
           hang-specific bitmap as a signal of uniqueness. In "dumb" mode, we
           just keep everything. */
  
        total_tmouts++;
        //some_code
        fn = alloc_printf("%s/replayable-hangs/id_%06llu", out_dir,
                                   unique_hangs);

因此，您要查找的测试用例应该位于 replayable-hangs 文件夹中。

但我想在你的情况下，如果目标在超时时没有屈服，而后者更慷慨，则该文件夹可能是空的

        /* Before saving, we make sure that it's a genuine hang by re-running
           the target with a more generous timeout (unless the default timeout
           is already generous). */
  
        if (exec_tmout < hang_tmout) {
  
          u8 new_fault;
          write_to_testcase(mem, len);
          new_fault = run_target(argv, hang_tmout);
  
          /* A corner case that one user reported bumping into: increasing the
             timeout actually uncovers a crash. Make sure we don't discard it if
             so. */
  
          if (!stop_soon && new_fault == FAULT_CRASH) goto keep_as_crash;
  
          if (stop_soon || new_fault != FAULT_TMOUT) return keeping;
  
        }

相关内容