hide queue introspection behind define
MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -169,12 +169,16 @@ struct queue_entry {
u32 bitmap_size, /* Number of bits set in bitmap */
fuzz_level, /* Number of fuzzing iterations */
- n_fuzz_entry, /* offset in n_fuzz */
+ n_fuzz_entry /* offset in n_fuzz */
+#ifdef INTROSPECTION
+ ,
stats_selected, /* stats: how often selected */
stats_skipped, /* stats: how often skipped */
stats_finds, /* stats: # of saved finds */
stats_crashes, /* stats: # of saved crashes */
- stats_tmouts; /* stats: # of saved timeouts */
+ stats_tmouts /* stats: # of saved timeouts */
+#endif
+ ;
u64 exec_us, /* Execution time (us) */
handicap, /* Number of queue cycles behind */

MODIFY
src/afl-fuzz-one.c
src/afl-fuzz-one.c
@@ -743,7 +743,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
afl->stage_finds[STAGE_FLIP1] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP1] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Two walking bits. */
@@ -776,7 +778,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
afl->stage_finds[STAGE_FLIP2] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP2] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Four walking bits. */
@@ -813,7 +817,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
afl->stage_finds[STAGE_FLIP4] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP4] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Effector map setup. These macros calculate:
@@ -922,7 +928,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
afl->stage_finds[STAGE_FLIP8] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP8] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Two walking bytes. */
@@ -966,7 +974,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
afl->stage_finds[STAGE_FLIP16] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP16] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
if (len < 4) { goto skip_bitflip; }
@@ -1010,7 +1020,9 @@ u8 fuzz_one_original(afl_state_t *afl) {
afl->stage_finds[STAGE_FLIP32] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP32] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_bitflip:
@@ -1103,7 +1115,9 @@ skip_bitflip:
afl->stage_finds[STAGE_ARITH8] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_ARITH8] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* 16-bit arithmetics, both endians. */
@@ -1234,7 +1248,9 @@ skip_bitflip:
afl->stage_finds[STAGE_ARITH16] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_ARITH16] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* 32-bit arithmetics, both endians. */
@@ -1364,7 +1380,9 @@ skip_bitflip:
afl->stage_finds[STAGE_ARITH32] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_ARITH32] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_arith:
@@ -1431,7 +1449,9 @@ skip_arith:
afl->stage_finds[STAGE_INTEREST8] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_INTEREST8] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Setting 16-bit integers, both endians. */
@@ -1520,7 +1540,9 @@ skip_arith:
afl->stage_finds[STAGE_INTEREST16] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_INTEREST16] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
if (len < 4) { goto skip_interest; }
@@ -1610,7 +1632,9 @@ skip_arith:
afl->stage_finds[STAGE_INTEREST32] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_INTEREST32] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_interest:
@@ -1684,7 +1708,9 @@ skip_interest:
afl->stage_finds[STAGE_EXTRAS_UO] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_EXTRAS_UO] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Insertion of user-supplied extras. */
@@ -1741,7 +1767,9 @@ skip_interest:
afl->stage_finds[STAGE_EXTRAS_UI] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_EXTRAS_UI] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_user_extras:
@@ -1800,7 +1828,9 @@ skip_user_extras:
afl->stage_finds[STAGE_EXTRAS_AO] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_EXTRAS_AO] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Insertion of auto extras. */
@@ -1857,7 +1887,9 @@ skip_user_extras:
afl->stage_finds[STAGE_EXTRAS_AI] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_EXTRAS_AI] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_extras:
@@ -2004,7 +2036,9 @@ custom_mutator_stage:
afl->stage_finds[STAGE_CUSTOM_MUTATOR] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_CUSTOM_MUTATOR] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
if (likely(afl->custom_only)) {
@@ -2942,13 +2976,17 @@ havoc_stage:
afl->stage_finds[STAGE_HAVOC] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_HAVOC] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
} else {
afl->stage_finds[STAGE_SPLICE] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_SPLICE] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
}
@@ -3430,7 +3468,9 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
afl->stage_finds[STAGE_FLIP1] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP1] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Two walking bits. */
@@ -3462,7 +3502,9 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
afl->stage_finds[STAGE_FLIP2] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP2] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Four walking bits. */
@@ -3498,7 +3540,9 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
afl->stage_finds[STAGE_FLIP4] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP4] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Effector map setup. These macros calculate:
@@ -3606,7 +3650,9 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
afl->stage_finds[STAGE_FLIP8] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP8] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Two walking bytes. */
@@ -3649,7 +3695,9 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
afl->stage_finds[STAGE_FLIP16] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP16] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
if (len < 4) { goto skip_bitflip; }
@@ -3692,7 +3740,9 @@ static u8 mopt_common_fuzzing(afl_state_t *afl, MOpt_globals_t MOpt_globals) {
afl->stage_finds[STAGE_FLIP32] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_FLIP32] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_bitflip:
@@ -3783,7 +3833,9 @@ skip_bitflip:
afl->stage_finds[STAGE_ARITH8] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_ARITH8] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* 16-bit arithmetics, both endians. */
@@ -3910,7 +3962,9 @@ skip_bitflip:
afl->stage_finds[STAGE_ARITH16] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_ARITH16] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* 32-bit arithmetics, both endians. */
@@ -4036,7 +4090,9 @@ skip_bitflip:
afl->stage_finds[STAGE_ARITH32] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_ARITH32] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_arith:
@@ -4102,7 +4158,9 @@ skip_arith:
afl->stage_finds[STAGE_INTEREST8] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_INTEREST8] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Setting 16-bit integers, both endians. */
@@ -4189,7 +4247,9 @@ skip_arith:
afl->stage_finds[STAGE_INTEREST16] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_INTEREST16] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
if (len < 4) { goto skip_interest; }
@@ -4277,7 +4337,9 @@ skip_arith:
afl->stage_finds[STAGE_INTEREST32] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_INTEREST32] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_interest:
@@ -4351,7 +4413,9 @@ skip_interest:
afl->stage_finds[STAGE_EXTRAS_UO] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_EXTRAS_UO] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Insertion of user-supplied extras. */
@@ -4408,7 +4472,9 @@ skip_interest:
afl->stage_finds[STAGE_EXTRAS_UI] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_EXTRAS_UI] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_user_extras:
@@ -4468,7 +4534,9 @@ skip_user_extras:
afl->stage_finds[STAGE_EXTRAS_AO] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_EXTRAS_AO] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
/* Insertion of auto extras. */
@@ -4525,7 +4593,9 @@ skip_user_extras:
afl->stage_finds[STAGE_EXTRAS_AI] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_EXTRAS_AI] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
skip_extras:
@@ -5351,13 +5421,17 @@ pacemaker_fuzzing:
afl->stage_finds[STAGE_HAVOC] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_HAVOC] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
} else {
afl->stage_finds[STAGE_SPLICE] += new_hit_cnt - orig_hit_cnt;
afl->stage_cycles[STAGE_SPLICE] += afl->stage_max;
+#ifdef INTROSPECTION
afl->queue_cur->stats_mutated += afl->stage_max;
+#endif
}

MODIFY
src/afl-fuzz-stats.c
src/afl-fuzz-stats.c
@@ -365,6 +365,7 @@ void write_stats_file(afl_state_t *afl, u32 t_bytes, double bitmap_cvg,
}
+#ifdef INTROSPECTION
void write_queue_stats(afl_state_t *afl) {
FILE *f;
@@ -395,6 +396,8 @@ void write_queue_stats(afl_state_t *afl) {
}
+#endif
+
/* Update the plot file if there is a reason to. */
void maybe_update_plot_file(afl_state_t *afl, u32 t_bytes, double bitmap_cvg,
@@ -649,7 +652,9 @@ void show_stats_normal(afl_state_t *afl) {
cur_ms - afl->stats_last_queue_ms > QUEUE_UPDATE_SEC * 1000)) {
afl->stats_last_queue_ms = cur_ms;
+#ifdef INTROSPECTION
write_queue_stats(afl);
+#endif
}
@@ -1445,7 +1450,9 @@ void show_stats_pizza(afl_state_t *afl) {
cur_ms - afl->stats_last_queue_ms > QUEUE_UPDATE_SEC * 1000)) {
afl->stats_last_queue_ms = cur_ms;
+#ifdef INTROSPECTION
write_queue_stats(afl);
+#endif
}

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -2279,8 +2279,10 @@ int main(int argc, char **argv_orig, char **envp) {
// real start time, we reset, so this works correctly with -V
afl->start_time = get_cur_time();
- u32 runs_in_current_cycle = (u32)-1;
- u32 prev_queued_items = 0, prev_saved_crashes = 0, prev_saved_tmouts = 0;
+ #ifdef INTROSPECTION
+ u32 prev_saved_crashes = 0, prev_saved_tmouts = 0;
+ #endif
+ u32 prev_queued_items = 0, runs_in_current_cycle = (u32)-1;
u8 skipped_fuzz;
#ifdef INTROSPECTION
@@ -2542,6 +2544,7 @@ int main(int argc, char **argv_orig, char **envp) {
}
skipped_fuzz = fuzz_one(afl);
+ #ifdef INTROSPECTION
++afl->queue_cur->stats_selected;
if (unlikely(skipped_fuzz)) {
@@ -2573,6 +2576,8 @@ int main(int argc, char **argv_orig, char **envp) {
}
+ #endif
+
if (unlikely(!afl->stop_soon && exit_1)) { afl->stop_soon = 2; }
if (unlikely(afl->old_seed_selection)) {

hide queue introspection behind define