AFL이 저장할 input이란건 어디서 판단하나
[research] 1 min read
new_coverage는 여기서 판단
1/* Check if the result of an execve() during routine fuzzing is interesting,
2 save or queue the input test case for further analysis if so. Returns 1 if
3 entry is saved, 0 otherwise. */
4static u8 save_if_interesting(char** argv, void* mem, u32 len, u8 fault) {
5 /* 생략 */
6 if (hnb == 2) {
7 queue_last->has_new_cov = 1;
8 queued_with_cov++;
9 }
이후 add_to_queue함수에서 저장.
1/* Append new test case to the queue. */
2static void add_to_queue(u8* fname, u32 len, u8 passed_det, u64 prox_score) {
3 struct queue_entry* q = ck_alloc(sizeof(struct queue_entry));
4
5 q->fname = fname;
6 q->len = len;
7 q->depth = cur_depth + 1;
8 q->passed_det = passed_det;
9 q->prox_score = prox_score;
10 q->entry_id = queued_paths;