3

In American Fuzzy Lop, I can see: 

total tmouts : 16 (5 unique)

But where is the input that made the 5 unique tmouts? I cannot find it in the output dir :\

Hessnov
  • 591

1 Answers1

1

afl-fuzz.c : save_if_interesting() function

switch (fault) {

  case FAULT_TMOUT:

    /* Timeouts are not very interesting, but we're still obliged to keep
       a handful of samples. We use the presence of new bits in the
       hang-specific bitmap as a signal of uniqueness. In "dumb" mode, we
       just keep everything. */

    total_tmouts++;
    //some_code
    fn = alloc_printf("%s/replayable-hangs/id_%06llu", out_dir,
                               unique_hangs);

So the test cases you're looking for should be in replayable-hangs folder.

But I suppose that in your case, this folder could be emply if the target doesn't yield in timeout when a latter is more generous

        /* Before saving, we make sure that it's a genuine hang by re-running
           the target with a more generous timeout (unless the default timeout
           is already generous). */

    if (exec_tmout < hang_tmout) {

      u8 new_fault;
      write_to_testcase(mem, len);
      new_fault = run_target(argv, hang_tmout);

      /* A corner case that one user reported bumping into: increasing the
         timeout actually uncovers a crash. Make sure we don't discard it if
         so. */

      if (!stop_soon && new_fault == FAULT_CRASH) goto keep_as_crash;

      if (stop_soon || new_fault != FAULT_TMOUT) return keeping;

    }
Ivan
  • 11