add RARE schedule. also fixes doc_path
MODIFY
README.md
README.md
* [dev](https://github.com/AFLplusplus/AFLplusplus/tree/dev) : development state of afl++ - bleeding edge and you might catch a
checkout which does not compile or has a bug. *We only accept PRs in dev!!*
* (any other) : experimental branches to work on specific features or testing
- new functionality or changes
+ new functionality or changes.
For releases, please see the [Releases](https://github.com/AFLplusplus/AFLplusplus/releases) tab.
@@ -365,7 +365,8 @@ The available schedules are:
- quad
- lin
- exploit
- - mmopt
+ - mmopt (experimental)
+ - rare (experimental)
In parallel mode (-M/-S, several instances with shared queue), we suggest to
run the master using the explore or fast schedule (-p explore) and the slaves

MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -24,10 +24,11 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
- python mutator modules and custom mutator modules now use the same
interface and hence the API changed
- AFL_AUTORESUME will resume execution without the need to specify `-i -`
- - added experimental power schedule -p mmopt that ignores the runtime of
- queue entries and gives higher weighting to the last 5 queue entries
- it is currently experimental and subject to change but preliminary
- results are good
+ - added experimental power schedules (-p):
+ - mmopt: ignores runtime of queue entries, gives higher weighting to
+ the last 5 queue entries
+ - rare: puts focus on queue entries that hits rare branches, also ignores
+ runtime
- LTO collision free instrumented added in llvm_mode with afl-clang-lto -
note that this mode is amazing, but quite some targets won't compile
- llvm_mode InsTrim mode:

MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -235,6 +235,7 @@ enum {
/* 04 */ QUAD, /* Quadratic schedule */
/* 05 */ EXPLOIT, /* AFL's exploitation-based const. */
/* 06 */ MMOPT, /* Modified MOPT schedule */
+ /* 07 */ RARE, /* Rare edges */
POWER_SCHEDULES_NUM

UNKNOWN
include/android-ashmem.h
include/android-ashmem.h
MODIFY
src/afl-fuzz-globals.c
src/afl-fuzz-globals.c
@@ -30,8 +30,9 @@ s8 interesting_8[] = {INTERESTING_8};
s16 interesting_16[] = {INTERESTING_8, INTERESTING_16};
s32 interesting_32[] = {INTERESTING_8, INTERESTING_16, INTERESTING_32};
-char *power_names[POWER_SCHEDULES_NUM] = {"explore", "fast", "coe", "lin",
- "quad", "exploit", "mmopt"};
+char *power_names[POWER_SCHEDULES_NUM] = {
+
+ "explore", "fast", "coe", "lin", "quad", "exploit", "mmopt", "rare"};
u8 *doc_path = NULL; /* gath to documentation dir */

MODIFY
src/afl-fuzz-queue.c
src/afl-fuzz-queue.c
@@ -185,12 +185,16 @@ void destroy_queue(afl_state_t *afl) {
void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) {
u32 i;
- u64 fav_factor = q->exec_us * q->len;
+ u64 fav_factor;
u64 fuzz_p2 = next_p2(q->n_fuzz);
+ if (afl->schedule == MMOPT || afl->schedule == RARE)
+ fav_factor = q->len << 2;
+ else
+ fav_factor = q->exec_us * q->len;
+
/* For every byte set in afl->fsrv.trace_bits[], see if there is a previous
winner, and how it compares to us. */
-
for (i = 0; i < MAP_SIZE; ++i)
if (afl->fsrv.trace_bits[i]) {
@@ -198,20 +202,20 @@ void update_bitmap_score(afl_state_t *afl, struct queue_entry *q) {
if (afl->top_rated[i]) {
/* Faster-executing or smaller test cases are favored. */
+ u64 top_rated_fav_factor;
u64 top_rated_fuzz_p2 = next_p2(afl->top_rated[i]->n_fuzz);
- u64 top_rated_fav_factor =
- afl->top_rated[i]->exec_us * afl->top_rated[i]->len;
- if (fuzz_p2 > top_rated_fuzz_p2) {
+ if (afl->schedule == MMOPT || afl->schedule == RARE)
+ top_rated_fav_factor = afl->top_rated[i]->len << 2;
+ else
+ top_rated_fav_factor =
+ afl->top_rated[i]->exec_us * afl->top_rated[i]->len;
+ if (fuzz_p2 > top_rated_fuzz_p2)
continue;
-
- } else if (fuzz_p2 == top_rated_fuzz_p2) {
-
+ else if (fuzz_p2 == top_rated_fuzz_p2)
if (fav_factor > top_rated_fav_factor) continue;
- }
-
if (fav_factor > afl->top_rated[i]->exec_us * afl->top_rated[i]->len)
continue;
@@ -328,7 +332,7 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
// Longer execution time means longer work on the input, the deeper in
// coverage, the better the fuzzing, right? -mh
- if (afl->schedule != MMOPT) {
+ if (afl->schedule != MMOPT && afl->schedule != RARE) {
if (q->exec_us * 0.1 > avg_exec_us)
perf_score = 10;
@@ -448,8 +452,29 @@ u32 calculate_score(afl_state_t *afl, struct queue_entry *q) {
break;
case MMOPT:
+ /* -- this was a more complex setup, which is good, but competed with
+ -- rare. the simpler algo however is good when rare is not.
+ // the newer the entry, the higher the pref_score
+ perf_score *= (1 + (double)((double)q->depth /
+ (double)afl->queued_paths));
+ // with special focus on the last 8 entries
+ if (afl->max_depth - q->depth < 8) perf_score *= (1 + ((8 -
+ (afl->max_depth - q->depth)) / 5));
+ */
+ // put focus on the last 5 entries
+ if (afl->max_depth - q->depth < 5) perf_score *= 2;
+
+ break;
+
+ case RARE:
- if (afl->max_depth - q->depth < 5) perf_score *= 1.5;
+ // increase the score for every bitmap byte for which this entry
+ // is the top contender
+ perf_score += (q->tc_ref * 10);
+ // the more often fuzz result paths are equal to this queue entry,
+ // reduce its value
+ perf_score *=
+ (1 - (double)((double)q->n_fuzz / (double)afl->total_execs));
break;

MODIFY
src/afl-fuzz-stats.c
src/afl-fuzz-stats.c
@@ -32,6 +32,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
struct rusage rus;
+ unsigned long long int cur_time = get_cur_time();
u8 * fn = alloc_printf("%s/fuzzer_stats", afl->out_dir);
s32 fd;
FILE * f;
@@ -69,6 +70,7 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
f,
"start_time : %llu\n"
"last_update : %llu\n"
+ "run_time : %llu\n"
"fuzzer_pid : %d\n"
"cycles_done : %llu\n"
"execs_done : %llu\n"
@@ -99,7 +101,8 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
"\n"
"target_mode : %s%s%s%s%s%s%s%s\n"
"command_line : %s\n",
- afl->start_time / 1000, get_cur_time() / 1000, getpid(),
+ afl->start_time / 1000, cur_time / 1000,
+ (cur_time - afl->start_time) / 1000, getpid(),
afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->total_execs,
/*eps,*/ afl->total_execs /
((double)(get_cur_time() - afl->start_time) / 1000),

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -97,7 +97,7 @@ static void usage(afl_state_t *afl, u8 *argv0, int more_help) {
" -p schedule - power schedules recompute a seed's performance "
"score.\n"
" <explore(default), fast, coe, lin, quad, exploit, "
- "mmopt>\n"
+ "mmopt, rare>\n"
" see docs/power_schedules.md\n"
" -f file - location read by the fuzzed program (stdin)\n"
" -t msec - timeout for each run (auto-scaled, 50-%d ms)\n"
@@ -250,7 +250,7 @@ int main(int argc, char **argv_orig, char **envp) {
SAYF(cCYA "afl-fuzz" VERSION cRST
" based on afl by Michal Zalewski and a big online community\n");
- doc_path = access(DOC_PATH, F_OK) ? (u8 *)"docs" : doc_path;
+ doc_path = access(DOC_PATH, F_OK) != 0 ? (u8 *)"docs" : (u8 *)DOC_PATH;
gettimeofday(&tv, &tz);
afl->init_seed = tv.tv_sec ^ tv.tv_usec ^ getpid();
@@ -304,6 +304,10 @@ int main(int argc, char **argv_orig, char **envp) {
afl->schedule = MMOPT;
+ } else if (!stricmp(optarg, "rare")) {
+
+ afl->schedule = RARE;
+
} else if (!stricmp(optarg, "explore") || !stricmp(optarg, "default") ||
!stricmp(optarg, "normal") || !stricmp(optarg, "afl")) {
@@ -760,8 +764,9 @@ int main(int argc, char **argv_orig, char **envp) {
case LIN: OKF("Using linear power schedule (LIN)"); break;
case QUAD: OKF("Using quadratic power schedule (QUAD)"); break;
case MMOPT: OKF("Using modified MOpt power schedule (MMOPT)"); break;
+ case RARE: OKF("Using rare edge focus power schedule (RARE)"); break;
case EXPLORE:
- OKF("Using exploration-based constant power schedule (EXPLORE)");
+ OKF("Using exploration-based constant power schedule (EXPLORE, default)");
break;
default: FATAL("Unknown power schedule"); break;

add RARE schedule. also fixes doc_path