├── .gitignore
├── .idea
├── fuzzer-data-collector.iml
├── inspectionProfiles
│ └── Project_Default.xml
├── misc.xml
├── modules.xml
└── vcs.xml
├── README.md
├── requirements-3.8.txt
├── requirements.txt
├── showmaps
├── .gitignore
├── Makefile
├── alloc-inl.h
├── config.h
├── debug.h
├── hash.h
├── showmaps.c
├── test.sh
├── test
│ ├── exiv2-afl
│ ├── hang-exiv2
│ │ └── hang20may
│ ├── mjs-afl
│ └── queue
│ │ ├── id:000000,orig:err1.js
│ │ ├── id:000001,orig:err2.js
│ │ ├── id:000002,orig:module1.js
│ │ ├── id:000003,orig:module2.js
│ │ ├── id:000004,orig:test_1.js
│ │ ├── id:000005,orig:test_10.js
│ │ ├── id:000006,orig:test_11.js
│ │ ├── id:000007,orig:test_12.js
│ │ ├── id:000008,orig:test_13.js
│ │ ├── id:000009,orig:test_2.js
│ │ ├── id:000010,orig:test_3.js
│ │ ├── id:000011,orig:test_4.js
│ │ ├── id:000012,orig:test_5.js
│ │ ├── id:000013,orig:test_6.js
│ │ ├── id:000014,orig:test_7.js
│ │ ├── id:000015,orig:test_8.js
│ │ └── id:000016,orig:test_9.js
└── types.h
└── stat_plot
├── .gitignore
├── conf.py
├── confgen.py
├── draw_boxplot.py
├── main.py
├── stat_plot.py
├── statistic_tester.py
└── test
├── data_boxplot
├── out_afl.txt
├── out_aflfast.txt
└── out_cerebro.txt
├── data_histo
├── test_afl.txt
├── test_aflfast.txt
├── test_mem.txt
└── test_perffuzz.txt
├── data_scatter
├── test_afl.txt
├── test_aflfast.txt
├── test_mem.txt
└── test_perffuzz.txt
├── statistics.csv
├── test_boxplot.toml
├── test_confgen.toml
├── test_config.toml
├── test_draw_boxplot.toml
├── test_generator.py
├── test_histo.toml
└── test_scatter.toml
/.gitignore:
--------------------------------------------------------------------------------
1 | # Created by .ignore support plugin (hsz.mobi)
2 | ### customized
3 | fdc-env/
4 | .vscode/
5 |
6 |
7 | ### C++ template
8 | # Prerequisites
9 | *.d
10 |
11 | # Compiled Object files
12 | *.slo
13 | *.lo
14 | *.o
15 | *.obj
16 |
17 | # Precompiled Headers
18 | *.gch
19 | *.pch
20 |
21 | # Compiled Dynamic libraries
22 | *.so
23 | *.dylib
24 | *.dll
25 |
26 | # Fortran module files
27 | *.mod
28 | *.smod
29 |
30 | # Compiled Static libraries
31 | *.lai
32 | *.la
33 | *.a
34 | *.lib
35 |
36 | # Executables
37 | *.exe
38 | *.out
39 | *.app
40 | ### Python template
41 | # Byte-compiled / optimized / DLL files
42 | __pycache__/
43 | *.py[cod]
44 | *$py.class
45 |
46 | # C extensions
47 |
48 | # Distribution / packaging
49 | .Python
50 | build/
51 | develop-eggs/
52 | dist/
53 | downloads/
54 | eggs/
55 | .eggs/
56 | lib/
57 | lib64/
58 | parts/
59 | sdist/
60 | var/
61 | wheels/
62 | *.egg-info/
63 | .installed.cfg
64 | *.egg
65 | MANIFEST
66 |
67 | # PyInstaller
68 | # Usually these files are written by a python script from a template
69 | # before PyInstaller builds the exe, so as to inject date/other infos into it.
70 | *.manifest
71 | *.spec
72 |
73 | # Installer logs
74 | pip-log.txt
75 | pip-delete-this-directory.txt
76 |
77 | # Unit test / coverage reports
78 | htmlcov/
79 | .tox/
80 | .coverage
81 | .coverage.*
82 | .cache
83 | nosetests.xml
84 | coverage.xml
85 | *.cover
86 | .hypothesis/
87 |
88 | # Translations
89 | *.mo
90 | *.pot
91 |
92 | # Django stuff:
93 | *.log
94 | .static_storage/
95 | .media/
96 | local_settings.py
97 |
98 | # Flask stuff:
99 | instance/
100 | .webassets-cache
101 |
102 | # Scrapy stuff:
103 | .scrapy
104 |
105 | # Sphinx documentation
106 | docs/_build/
107 |
108 | # PyBuilder
109 | target/
110 |
111 | # Jupyter Notebook
112 | .ipynb_checkpoints
113 |
114 | # pyenv
115 | .python-version
116 |
117 | # celery beat schedule file
118 | celerybeat-schedule
119 |
120 | # SageMath parsed files
121 | *.sage.py
122 |
123 | # Environments
124 | .env
125 | .venv
126 | env/
127 | venv/
128 | ENV/
129 | env.bak/
130 | venv.bak/
131 |
132 | # Spyder project settings
133 | .spyderproject
134 | .spyproject
135 |
136 | # Rope project settings
137 | .ropeproject
138 |
139 | # mkdocs documentation
140 | /site
141 |
142 | # mypy
143 | .mypy_cache/
144 | ### JetBrains template
145 | # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm
146 | # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
147 |
148 | # User-specific stuff:
149 | .idea/**/workspace.xml
150 | .idea/**/tasks.xml
151 | .idea/dictionaries
152 |
153 | # Sensitive or high-churn files:
154 | .idea/**/dataSources/
155 | .idea/**/dataSources.ids
156 | .idea/**/dataSources.xml
157 | .idea/**/dataSources.local.xml
158 | .idea/**/sqlDataSources.xml
159 | .idea/**/dynamic.xml
160 | .idea/**/uiDesigner.xml
161 |
162 | # Gradle:
163 | .idea/**/gradle.xml
164 | .idea/**/libraries
165 |
166 | # CMake
167 | cmake-build-debug/
168 |
169 | # Mongo Explorer plugin:
170 | .idea/**/mongoSettings.xml
171 |
172 | ## File-based project format:
173 | *.iws
174 |
175 | ## Plugin-specific files:
176 |
177 | # IntelliJ
178 | out/
179 |
180 | # mpeltonen/sbt-idea plugin
181 | .idea_modules/
182 |
183 | # JIRA plugin
184 | atlassian-ide-plugin.xml
185 |
186 | # Cursive Clojure plugin
187 | .idea/replstate.xml
188 |
189 | # Crashlytics plugin (for Android Studio and IntelliJ)
190 | com_crashlytics_export_strings.xml
191 | crashlytics.properties
192 | crashlytics-build.properties
193 | fabric.properties
194 | ### C template
195 | # Prerequisites
196 |
197 | # Object files
198 | *.ko
199 | *.elf
200 |
201 | # Linker output
202 | *.ilk
203 | *.map
204 | *.exp
205 |
206 | # Precompiled Headers
207 |
208 | # Libraries
209 |
210 | # Shared objects (inc. Windows DLLs)
211 | *.so.*
212 |
213 | # Executables
214 | *.i*86
215 | *.x86_64
216 | *.hex
217 |
218 | # Debug files
219 | *.dSYM/
220 | *.su
221 | *.idb
222 | *.pdb
223 |
224 | # Kernel Module Compile Results
225 | *.mod*
226 | *.cmd
227 | .tmp_versions/
228 | modules.order
229 | Module.symvers
230 | Mkfile.old
231 | dkms.conf
232 |
--------------------------------------------------------------------------------
/.idea/fuzzer-data-collector.iml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
--------------------------------------------------------------------------------
/.idea/inspectionProfiles/Project_Default.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
18 |
19 |
20 |
--------------------------------------------------------------------------------
/.idea/misc.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 |
13 |
14 |
15 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
23 |
24 |
25 |
26 |
27 |
28 |
29 |
30 |
31 |
32 |
33 |
34 |
35 |
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 |
45 |
46 |
47 |
48 |
49 |
50 |
51 |
52 |
53 |
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 | ApexVCS
74 |
75 |
76 |
--------------------------------------------------------------------------------
/.idea/modules.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
--------------------------------------------------------------------------------
/.idea/vcs.xml:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # fuzzer-data-collector
2 | Overall workflow:
3 | 1. use the `showmaps` program to generate the raw data
4 | 2. use the python scripts under `stats_plot` to draw the plots & generate statistic analysis results
5 |
6 | ## showmaps
7 |
8 | ```bash
9 | # build (under the showmaps folder)
10 | make
11 |
12 | # generate the raw data in the format ("time slot":"edge/path number")
13 | # the usage of showmaps is very similar to afl-showmap
14 | # -q means quite mode, will "eat" the output of the original program
15 | # -s means skipping individual seed trace generation (will not generate a trace file for each seed)
16 | # -S means skipping the first 'n' files (useful when we only want to calculate the increment in code coverage)
17 | # everything after "--" is the same as how you run AFL
18 | ./showmaps -i $PATH_TO_QUEUE_FOLDER -o data/queue -q -s -S 0 -- $AFL_INSTRUMENTED_PROGRAM @@
19 | ```
20 |
21 | ## stat_plot
22 |
23 | ```bash
24 | # install the environment
25 | virtualenv -p python3 venv
26 |
27 | source venv/bin/activate
28 |
29 | pip install -r requirements.txt
30 |
31 | # run the script under the virtual environment
32 | # before running the script, you need to prepare the .toml config file
33 | python main.py -c $PATH_TO_TOML_CONFIG
34 | ```
35 |
36 | ## Toml Config
37 | Example configs are available under the `stat_plot/test` folder.
38 |
39 | The example for plotting the line chart is the `test_config.toml` file.
40 |
41 | The `data_files` option should point to the files generated by `showmaps`.
42 |
43 |
44 |
--------------------------------------------------------------------------------
/requirements-3.8.txt:
--------------------------------------------------------------------------------
1 | cycler==0.11.0
2 | fonttools==4.28.5
3 | kiwisolver==1.3.2
4 | matplotlib==3.5.1
5 | numpy==1.22.0
6 | packaging==21.3
7 | pandas==1.4.0
8 | Pillow==9.0.0
9 | pyparsing==3.0.6
10 | python-dateutil==2.8.2
11 | pytz==2021.3
12 | scipy==1.7.3
13 | seaborn==0.11.2
14 | six==1.12.0
15 | toml==0.10.0
16 |
--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
1 | cycler==0.10.0
2 | kiwisolver==1.0.1
3 | matplotlib==3.0.2
4 | numpy==1.15.4
5 | pyparsing==2.3.0
6 | python-dateutil==2.7.5
7 | scipy==1.2.0
8 | six==1.12.0
9 | toml==0.10.0
10 |
--------------------------------------------------------------------------------
/showmaps/.gitignore:
--------------------------------------------------------------------------------
1 | # Created by .ignore support plugin (hsz.mobi)
2 | ### Custom
3 | showmaps
4 | test/out/
5 | test/out-simple/
6 | test/out-entry/
7 | temp/
8 |
9 | ### C template
10 | # Prerequisites
11 | *.d
12 |
13 | # Object files
14 | *.o
15 | *.ko
16 | *.obj
17 | *.elf
18 |
19 | # Linker output
20 | *.ilk
21 | *.map
22 | *.exp
23 |
24 | # Precompiled Headers
25 | *.gch
26 | *.pch
27 |
28 | # Libraries
29 | *.lib
30 | *.a
31 | *.la
32 | *.lo
33 |
34 | # Shared objects (inc. Windows DLLs)
35 | *.dll
36 | *.so
37 | *.so.*
38 | *.dylib
39 |
40 | # Executables
41 | *.exe
42 | *.out
43 | *.app
44 | *.i*86
45 | *.x86_64
46 | *.hex
47 |
48 | # Debug files
49 | *.dSYM/
50 | *.su
51 | *.idb
52 | *.pdb
53 |
54 | # Kernel Module Compile Results
55 | *.mod*
56 | *.cmd
57 | .tmp_versions/
58 | modules.order
59 | Module.symvers
60 | Mkfile.old
61 | dkms.conf
62 |
63 |
--------------------------------------------------------------------------------
/showmaps/Makefile:
--------------------------------------------------------------------------------
1 | VERSION = $(shell grep '^\#define VERSION ' config.h | cut -d '"' -f2)
2 |
3 | PROGS = showmaps
4 |
5 | CFLAGS ?= -O3 -funroll-loops
6 | CFLAGS += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign
7 |
8 | ifneq "$(filter Linux GNU%,$(shell uname))" ""
9 | LDFLAGS += -ldl
10 | endif
11 |
12 | COMM_HDR = alloc-inl.h config.h debug.h types.h
13 |
14 | all: $(PROGS)
15 |
16 | showmaps: showmaps.c $(COMM_HDR)
17 | $(CC) $(CFLAGS) $@.c -o $@ $(LDFLAGS)
18 |
19 | .NOTPARALLEL: clean
20 |
21 | clean:
22 | rm -f $(PROGS) *.o *~ a.out core core.[1-9][0-9]* *.stackdump
--------------------------------------------------------------------------------
/showmaps/alloc-inl.h:
--------------------------------------------------------------------------------
1 | /*
2 | american fuzzy lop - error-checking, memory-zeroing alloc routines
3 | ------------------------------------------------------------------
4 |
5 | Written and maintained by Michal Zalewski
6 |
7 | Copyright 2013, 2014, 2015 Google Inc. All rights reserved.
8 |
9 | Licensed under the Apache License, Version 2.0 (the "License");
10 | you may not use this file except in compliance with the License.
11 | You may obtain a copy of the License at:
12 |
13 | http://www.apache.org/licenses/LICENSE-2.0
14 |
15 | This allocator is not designed to resist malicious attackers (the canaries
16 | are small and predictable), but provides a robust and portable way to detect
17 | use-after-free, off-by-one writes, stale pointers, and so on.
18 |
19 | */
20 |
21 | #ifndef _HAVE_ALLOC_INL_H
22 | #define _HAVE_ALLOC_INL_H
23 |
24 | #include
25 | #include
26 | #include
27 |
28 | #include "config.h"
29 | #include "types.h"
30 | #include "debug.h"
31 |
32 | /* User-facing macro to sprintf() to a dynamically allocated buffer. */
33 |
34 | #define alloc_printf(_str...) ({ \
35 | u8* _tmp; \
36 | s32 _len = snprintf(NULL, 0, _str); \
37 | if (_len < 0) FATAL("Whoa, snprintf() fails?!"); \
38 | _tmp = ck_alloc(_len + 1); \
39 | snprintf((char*)_tmp, _len + 1, _str); \
40 | _tmp; \
41 | })
42 |
43 | /* Macro to enforce allocation limits as a last-resort defense against
44 | integer overflows. */
45 |
46 | #define ALLOC_CHECK_SIZE(_s) do { \
47 | if ((_s) > MAX_ALLOC) \
48 | ABORT("Bad alloc request: %u bytes", (_s)); \
49 | } while (0)
50 |
51 | /* Macro to check malloc() failures and the like. */
52 |
53 | #define ALLOC_CHECK_RESULT(_r, _s) do { \
54 | if (!(_r)) \
55 | ABORT("Out of memory: can't allocate %u bytes", (_s)); \
56 | } while (0)
57 |
58 | /* Magic tokens used to mark used / freed chunks. */
59 |
60 | #define ALLOC_MAGIC_C1 0xFF00FF00 /* Used head (dword) */
61 | #define ALLOC_MAGIC_F 0xFE00FE00 /* Freed head (dword) */
62 | #define ALLOC_MAGIC_C2 0xF0 /* Used tail (byte) */
63 |
64 | /* Positions of guard tokens in relation to the user-visible pointer. */
65 |
66 | #define ALLOC_C1(_ptr) (((u32*)(_ptr))[-2])
67 | #define ALLOC_S(_ptr) (((u32*)(_ptr))[-1])
68 | #define ALLOC_C2(_ptr) (((u8*)(_ptr))[ALLOC_S(_ptr)])
69 |
70 | #define ALLOC_OFF_HEAD 8
71 | #define ALLOC_OFF_TOTAL (ALLOC_OFF_HEAD + 1)
72 |
73 | /* Allocator increments for ck_realloc_block(). */
74 |
75 | #define ALLOC_BLK_INC 256
76 |
77 | /* Sanity-checking macros for pointers. */
78 |
79 | #define CHECK_PTR(_p) do { \
80 | if (_p) { \
81 | if (ALLOC_C1(_p) ^ ALLOC_MAGIC_C1) {\
82 | if (ALLOC_C1(_p) == ALLOC_MAGIC_F) \
83 | ABORT("Use after free."); \
84 | else ABORT("Corrupted head alloc canary."); \
85 | } \
86 | if (ALLOC_C2(_p) ^ ALLOC_MAGIC_C2) \
87 | ABORT("Corrupted tail alloc canary."); \
88 | } \
89 | } while (0)
90 |
91 | #define CHECK_PTR_EXPR(_p) ({ \
92 | typeof (_p) _tmp = (_p); \
93 | CHECK_PTR(_tmp); \
94 | _tmp; \
95 | })
96 |
97 |
98 | /* Allocate a buffer, explicitly not zeroing it. Returns NULL for zero-sized
99 | requests. */
100 |
101 | static inline void* DFL_ck_alloc_nozero(u32 size) {
102 |
103 | void* ret;
104 |
105 | if (!size) return NULL;
106 |
107 | ALLOC_CHECK_SIZE(size);
108 | ret = malloc(size + ALLOC_OFF_TOTAL);
109 | ALLOC_CHECK_RESULT(ret, size);
110 |
111 | ret += ALLOC_OFF_HEAD;
112 |
113 | ALLOC_C1(ret) = ALLOC_MAGIC_C1;
114 | ALLOC_S(ret) = size;
115 | ALLOC_C2(ret) = ALLOC_MAGIC_C2;
116 |
117 | return ret;
118 |
119 | }
120 |
121 |
122 | /* Allocate a buffer, returning zeroed memory. */
123 |
124 | static inline void* DFL_ck_alloc(u32 size) {
125 |
126 | void* mem;
127 |
128 | if (!size) return NULL;
129 | mem = DFL_ck_alloc_nozero(size);
130 |
131 | return memset(mem, 0, size);
132 |
133 | }
134 |
135 |
136 | /* Free memory, checking for double free and corrupted heap. When DEBUG_BUILD
137 | is set, the old memory will be also clobbered with 0xFF. */
138 |
139 | static inline void DFL_ck_free(void* mem) {
140 |
141 | if (!mem) return;
142 |
143 | CHECK_PTR(mem);
144 |
145 | #ifdef DEBUG_BUILD
146 |
147 | /* Catch pointer issues sooner. */
148 | memset(mem, 0xFF, ALLOC_S(mem));
149 |
150 | #endif /* DEBUG_BUILD */
151 |
152 | ALLOC_C1(mem) = ALLOC_MAGIC_F;
153 |
154 | free(mem - ALLOC_OFF_HEAD);
155 |
156 | }
157 |
158 |
159 | /* Re-allocate a buffer, checking for issues and zeroing any newly-added tail.
160 | With DEBUG_BUILD, the buffer is always reallocated to a new addresses and the
161 | old memory is clobbered with 0xFF. */
162 |
163 | static inline void* DFL_ck_realloc(void* orig, u32 size) {
164 |
165 | void* ret;
166 | u32 old_size = 0;
167 |
168 | if (!size) {
169 |
170 | DFL_ck_free(orig);
171 | return NULL;
172 |
173 | }
174 |
175 | if (orig) {
176 |
177 | CHECK_PTR(orig);
178 |
179 | #ifndef DEBUG_BUILD
180 | ALLOC_C1(orig) = ALLOC_MAGIC_F;
181 | #endif /* !DEBUG_BUILD */
182 |
183 | old_size = ALLOC_S(orig);
184 | orig -= ALLOC_OFF_HEAD;
185 |
186 | ALLOC_CHECK_SIZE(old_size);
187 |
188 | }
189 |
190 | ALLOC_CHECK_SIZE(size);
191 |
192 | #ifndef DEBUG_BUILD
193 |
194 | ret = realloc(orig, size + ALLOC_OFF_TOTAL);
195 | ALLOC_CHECK_RESULT(ret, size);
196 |
197 | #else
198 |
199 | /* Catch pointer issues sooner: force relocation and make sure that the
200 | original buffer is wiped. */
201 |
202 | ret = malloc(size + ALLOC_OFF_TOTAL);
203 | ALLOC_CHECK_RESULT(ret, size);
204 |
205 | if (orig) {
206 |
207 | memcpy(ret + ALLOC_OFF_HEAD, orig + ALLOC_OFF_HEAD, MIN(size, old_size));
208 | memset(orig + ALLOC_OFF_HEAD, 0xFF, old_size);
209 |
210 | ALLOC_C1(orig + ALLOC_OFF_HEAD) = ALLOC_MAGIC_F;
211 |
212 | free(orig);
213 |
214 | }
215 |
216 | #endif /* ^!DEBUG_BUILD */
217 |
218 | ret += ALLOC_OFF_HEAD;
219 |
220 | ALLOC_C1(ret) = ALLOC_MAGIC_C1;
221 | ALLOC_S(ret) = size;
222 | ALLOC_C2(ret) = ALLOC_MAGIC_C2;
223 |
224 | if (size > old_size)
225 | memset(ret + old_size, 0, size - old_size);
226 |
227 | return ret;
228 |
229 | }
230 |
231 |
232 | /* Re-allocate a buffer with ALLOC_BLK_INC increments (used to speed up
233 | repeated small reallocs without complicating the user code). */
234 |
235 | static inline void* DFL_ck_realloc_block(void* orig, u32 size) {
236 |
237 | #ifndef DEBUG_BUILD
238 |
239 | if (orig) {
240 |
241 | CHECK_PTR(orig);
242 |
243 | if (ALLOC_S(orig) >= size) return orig;
244 |
245 | size += ALLOC_BLK_INC;
246 |
247 | }
248 |
249 | #endif /* !DEBUG_BUILD */
250 |
251 | return DFL_ck_realloc(orig, size);
252 |
253 | }
254 |
255 |
256 | /* Create a buffer with a copy of a string. Returns NULL for NULL inputs. */
257 |
258 | static inline u8* DFL_ck_strdup(u8* str) {
259 |
260 | void* ret;
261 | u32 size;
262 |
263 | if (!str) return NULL;
264 |
265 | size = strlen((char*)str) + 1;
266 |
267 | ALLOC_CHECK_SIZE(size);
268 | ret = malloc(size + ALLOC_OFF_TOTAL);
269 | ALLOC_CHECK_RESULT(ret, size);
270 |
271 | ret += ALLOC_OFF_HEAD;
272 |
273 | ALLOC_C1(ret) = ALLOC_MAGIC_C1;
274 | ALLOC_S(ret) = size;
275 | ALLOC_C2(ret) = ALLOC_MAGIC_C2;
276 |
277 | return memcpy(ret, str, size);
278 |
279 | }
280 |
281 |
282 | /* Create a buffer with a copy of a memory block. Returns NULL for zero-sized
283 | or NULL inputs. */
284 |
285 | static inline void* DFL_ck_memdup(void* mem, u32 size) {
286 |
287 | void* ret;
288 |
289 | if (!mem || !size) return NULL;
290 |
291 | ALLOC_CHECK_SIZE(size);
292 | ret = malloc(size + ALLOC_OFF_TOTAL);
293 | ALLOC_CHECK_RESULT(ret, size);
294 |
295 | ret += ALLOC_OFF_HEAD;
296 |
297 | ALLOC_C1(ret) = ALLOC_MAGIC_C1;
298 | ALLOC_S(ret) = size;
299 | ALLOC_C2(ret) = ALLOC_MAGIC_C2;
300 |
301 | return memcpy(ret, mem, size);
302 |
303 | }
304 |
305 |
306 | /* Create a buffer with a block of text, appending a NUL terminator at the end.
307 | Returns NULL for zero-sized or NULL inputs. */
308 |
309 | static inline u8* DFL_ck_memdup_str(u8* mem, u32 size) {
310 |
311 | u8* ret;
312 |
313 | if (!mem || !size) return NULL;
314 |
315 | ALLOC_CHECK_SIZE(size);
316 | ret = malloc(size + ALLOC_OFF_TOTAL + 1);
317 | ALLOC_CHECK_RESULT(ret, size);
318 |
319 | ret += ALLOC_OFF_HEAD;
320 |
321 | ALLOC_C1(ret) = ALLOC_MAGIC_C1;
322 | ALLOC_S(ret) = size;
323 | ALLOC_C2(ret) = ALLOC_MAGIC_C2;
324 |
325 | memcpy(ret, mem, size);
326 | ret[size] = 0;
327 |
328 | return ret;
329 |
330 | }
331 |
332 |
333 | #ifndef DEBUG_BUILD
334 |
335 | /* In non-debug mode, we just do straightforward aliasing of the above functions
336 | to user-visible names such as ck_alloc(). */
337 |
338 | #define ck_alloc DFL_ck_alloc
339 | #define ck_alloc_nozero DFL_ck_alloc_nozero
340 | #define ck_realloc DFL_ck_realloc
341 | #define ck_realloc_block DFL_ck_realloc_block
342 | #define ck_strdup DFL_ck_strdup
343 | #define ck_memdup DFL_ck_memdup
344 | #define ck_memdup_str DFL_ck_memdup_str
345 | #define ck_free DFL_ck_free
346 |
347 | #define alloc_report()
348 |
349 | #else
350 |
351 | /* In debugging mode, we also track allocations to detect memory leaks, and the
352 | flow goes through one more layer of indirection. */
353 |
354 | /* Alloc tracking data structures: */
355 |
356 | #define ALLOC_BUCKETS 4096
357 |
358 | struct TRK_obj {
359 | void *ptr;
360 | char *file, *func;
361 | u32 line;
362 | };
363 |
364 | #ifdef AFL_MAIN
365 |
366 | struct TRK_obj* TRK[ALLOC_BUCKETS];
367 | u32 TRK_cnt[ALLOC_BUCKETS];
368 |
369 | # define alloc_report() TRK_report()
370 |
371 | #else
372 |
373 | extern struct TRK_obj* TRK[ALLOC_BUCKETS];
374 | extern u32 TRK_cnt[ALLOC_BUCKETS];
375 |
376 | # define alloc_report()
377 |
378 | #endif /* ^AFL_MAIN */
379 |
380 | /* Bucket-assigning function for a given pointer: */
381 |
382 | #define TRKH(_ptr) (((((u32)(_ptr)) >> 16) ^ ((u32)(_ptr))) % ALLOC_BUCKETS)
383 |
384 |
385 | /* Add a new entry to the list of allocated objects. */
386 |
387 | static inline void TRK_alloc_buf(void* ptr, const char* file, const char* func,
388 | u32 line) {
389 |
390 | u32 i, bucket;
391 |
392 | if (!ptr) return;
393 |
394 | bucket = TRKH(ptr);
395 |
396 | /* Find a free slot in the list of entries for that bucket. */
397 |
398 | for (i = 0; i < TRK_cnt[bucket]; i++)
399 |
400 | if (!TRK[bucket][i].ptr) {
401 |
402 | TRK[bucket][i].ptr = ptr;
403 | TRK[bucket][i].file = (char*)file;
404 | TRK[bucket][i].func = (char*)func;
405 | TRK[bucket][i].line = line;
406 | return;
407 |
408 | }
409 |
410 | /* No space available - allocate more. */
411 |
412 | TRK[bucket] = DFL_ck_realloc_block(TRK[bucket],
413 | (TRK_cnt[bucket] + 1) * sizeof(struct TRK_obj));
414 |
415 | TRK[bucket][i].ptr = ptr;
416 | TRK[bucket][i].file = (char*)file;
417 | TRK[bucket][i].func = (char*)func;
418 | TRK[bucket][i].line = line;
419 |
420 | TRK_cnt[bucket]++;
421 |
422 | }
423 |
424 |
425 | /* Remove entry from the list of allocated objects. */
426 |
427 | static inline void TRK_free_buf(void* ptr, const char* file, const char* func,
428 | u32 line) {
429 |
430 | u32 i, bucket;
431 |
432 | if (!ptr) return;
433 |
434 | bucket = TRKH(ptr);
435 |
436 | /* Find the element on the list... */
437 |
438 | for (i = 0; i < TRK_cnt[bucket]; i++)
439 |
440 | if (TRK[bucket][i].ptr == ptr) {
441 |
442 | TRK[bucket][i].ptr = 0;
443 | return;
444 |
445 | }
446 |
447 | WARNF("ALLOC: Attempt to free non-allocated memory in %s (%s:%u)",
448 | func, file, line);
449 |
450 | }
451 |
452 |
453 | /* Do a final report on all non-deallocated objects. */
454 |
455 | static inline void TRK_report(void) {
456 |
457 | u32 i, bucket;
458 |
459 | fflush(0);
460 |
461 | for (bucket = 0; bucket < ALLOC_BUCKETS; bucket++)
462 | for (i = 0; i < TRK_cnt[bucket]; i++)
463 | if (TRK[bucket][i].ptr)
464 | WARNF("ALLOC: Memory never freed, created in %s (%s:%u)",
465 | TRK[bucket][i].func, TRK[bucket][i].file, TRK[bucket][i].line);
466 |
467 | }
468 |
469 |
470 | /* Simple wrappers for non-debugging functions: */
471 |
472 | static inline void* TRK_ck_alloc(u32 size, const char* file, const char* func,
473 | u32 line) {
474 |
475 | void* ret = DFL_ck_alloc(size);
476 | TRK_alloc_buf(ret, file, func, line);
477 | return ret;
478 |
479 | }
480 |
481 |
482 | static inline void* TRK_ck_realloc(void* orig, u32 size, const char* file,
483 | const char* func, u32 line) {
484 |
485 | void* ret = DFL_ck_realloc(orig, size);
486 | TRK_free_buf(orig, file, func, line);
487 | TRK_alloc_buf(ret, file, func, line);
488 | return ret;
489 |
490 | }
491 |
492 |
493 | static inline void* TRK_ck_realloc_block(void* orig, u32 size, const char* file,
494 | const char* func, u32 line) {
495 |
496 | void* ret = DFL_ck_realloc_block(orig, size);
497 | TRK_free_buf(orig, file, func, line);
498 | TRK_alloc_buf(ret, file, func, line);
499 | return ret;
500 |
501 | }
502 |
503 |
504 | static inline void* TRK_ck_strdup(u8* str, const char* file, const char* func,
505 | u32 line) {
506 |
507 | void* ret = DFL_ck_strdup(str);
508 | TRK_alloc_buf(ret, file, func, line);
509 | return ret;
510 |
511 | }
512 |
513 |
514 | static inline void* TRK_ck_memdup(void* mem, u32 size, const char* file,
515 | const char* func, u32 line) {
516 |
517 | void* ret = DFL_ck_memdup(mem, size);
518 | TRK_alloc_buf(ret, file, func, line);
519 | return ret;
520 |
521 | }
522 |
523 |
524 | static inline void* TRK_ck_memdup_str(void* mem, u32 size, const char* file,
525 | const char* func, u32 line) {
526 |
527 | void* ret = DFL_ck_memdup_str(mem, size);
528 | TRK_alloc_buf(ret, file, func, line);
529 | return ret;
530 |
531 | }
532 |
533 |
534 | static inline void TRK_ck_free(void* ptr, const char* file,
535 | const char* func, u32 line) {
536 |
537 | TRK_free_buf(ptr, file, func, line);
538 | DFL_ck_free(ptr);
539 |
540 | }
541 |
542 | /* Aliasing user-facing names to tracking functions: */
543 |
544 | #define ck_alloc(_p1) \
545 | TRK_ck_alloc(_p1, __FILE__, __FUNCTION__, __LINE__)
546 |
547 | #define ck_alloc_nozero(_p1) \
548 | TRK_ck_alloc(_p1, __FILE__, __FUNCTION__, __LINE__)
549 |
550 | #define ck_realloc(_p1, _p2) \
551 | TRK_ck_realloc(_p1, _p2, __FILE__, __FUNCTION__, __LINE__)
552 |
553 | #define ck_realloc_block(_p1, _p2) \
554 | TRK_ck_realloc_block(_p1, _p2, __FILE__, __FUNCTION__, __LINE__)
555 |
556 | #define ck_strdup(_p1) \
557 | TRK_ck_strdup(_p1, __FILE__, __FUNCTION__, __LINE__)
558 |
559 | #define ck_memdup(_p1, _p2) \
560 | TRK_ck_memdup(_p1, _p2, __FILE__, __FUNCTION__, __LINE__)
561 |
562 | #define ck_memdup_str(_p1, _p2) \
563 | TRK_ck_memdup_str(_p1, _p2, __FILE__, __FUNCTION__, __LINE__)
564 |
565 | #define ck_free(_p1) \
566 | TRK_ck_free(_p1, __FILE__, __FUNCTION__, __LINE__)
567 |
568 | #endif /* ^!DEBUG_BUILD */
569 |
570 | #endif /* ! _HAVE_ALLOC_INL_H */
571 |
--------------------------------------------------------------------------------
/showmaps/config.h:
--------------------------------------------------------------------------------
1 | /*
2 | american fuzzy lop - vaguely configurable bits
3 | ----------------------------------------------
4 |
5 | Written and maintained by Michal Zalewski
6 |
7 | Copyright 2013, 2014, 2015, 2016 Google Inc. All rights reserved.
8 |
9 | Licensed under the Apache License, Version 2.0 (the "License");
10 | you may not use this file except in compliance with the License.
11 | You may obtain a copy of the License at:
12 |
13 | http://www.apache.org/licenses/LICENSE-2.0
14 |
15 | */
16 |
17 | #ifndef _HAVE_CONFIG_H
18 | #define _HAVE_CONFIG_H
19 |
20 | #include "types.h"
21 |
22 | /* Version string: */
23 |
24 | #define VERSION "2.52b"
25 |
26 | /******************************************************
27 | * *
28 | * Settings that may be of interest to power users: *
29 | * *
30 | ******************************************************/
31 |
32 | /* Comment out to disable terminal colors (note that this makes afl-analyze
33 | a lot less nice): */
34 |
35 | #define USE_COLOR
36 |
37 | /* Comment out to disable fancy ANSI boxes and use poor man's 7-bit UI: */
38 |
39 | #define FANCY_BOXES
40 |
41 | /* Default timeout for fuzzed code (milliseconds). This is the upper bound,
42 | also used for detecting hangs; the actual value is auto-scaled: */
43 |
44 | #define EXEC_TIMEOUT 1000
45 |
46 | /* Timeout rounding factor when auto-scaling (milliseconds): */
47 |
48 | #define EXEC_TM_ROUND 20
49 |
50 | /* Default memory limit for child process (MB): */
51 |
52 | #ifndef __x86_64__
53 | # define MEM_LIMIT 25
54 | #else
55 | # define MEM_LIMIT 50
56 | #endif /* ^!__x86_64__ */
57 |
58 | /* Default memory limit when running in QEMU mode (MB): */
59 |
60 | #define MEM_LIMIT_QEMU 200
61 |
62 | /* Number of calibration cycles per every new test case (and for test
63 | cases that show variable behavior): */
64 |
65 | #define CAL_CYCLES 8
66 | #define CAL_CYCLES_LONG 40
67 |
68 | /* Number of subsequent timeouts before abandoning an input file: */
69 |
70 | #define TMOUT_LIMIT 250
71 |
72 | /* Maximum number of unique hangs or crashes to record: */
73 |
74 | #define KEEP_UNIQUE_HANG 500
75 | #define KEEP_UNIQUE_CRASH 5000
76 |
77 | /* Baseline number of random tweaks during a single 'havoc' stage: */
78 |
79 | #define HAVOC_CYCLES 256
80 | #define HAVOC_CYCLES_INIT 1024
81 |
82 | /* Maximum multiplier for the above (should be a power of two, beware
83 | of 32-bit int overflows): */
84 |
85 | #define HAVOC_MAX_MULT 16
86 |
87 | /* Absolute minimum number of havoc cycles (after all adjustments): */
88 |
89 | #define HAVOC_MIN 16
90 |
91 | /* Maximum stacking for havoc-stage tweaks. The actual value is calculated
92 | like this:
93 |
94 | n = random between 1 and HAVOC_STACK_POW2
95 | stacking = 2^n
96 |
97 | In other words, the default (n = 7) produces 2, 4, 8, 16, 32, 64, or
98 | 128 stacked tweaks: */
99 |
100 | #define HAVOC_STACK_POW2 7
101 |
102 | /* Caps on block sizes for cloning and deletion operations. Each of these
103 | ranges has a 33% probability of getting picked, except for the first
104 | two cycles where smaller blocks are favored: */
105 |
106 | #define HAVOC_BLK_SMALL 32
107 | #define HAVOC_BLK_MEDIUM 128
108 | #define HAVOC_BLK_LARGE 1500
109 |
110 | /* Extra-large blocks, selected very rarely (<5% of the time): */
111 |
112 | #define HAVOC_BLK_XL 32768
113 |
114 | /* Probabilities of skipping non-favored entries in the queue, expressed as
115 | percentages: */
116 |
117 | #define SKIP_TO_NEW_PROB 99 /* ...when there are new, pending favorites */
118 | #define SKIP_NFAV_OLD_PROB 95 /* ...no new favs, cur entry already fuzzed */
119 | #define SKIP_NFAV_NEW_PROB 75 /* ...no new favs, cur entry not fuzzed yet */
120 |
121 | /* Splicing cycle count: */
122 |
123 | #define SPLICE_CYCLES 15
124 |
125 | /* Nominal per-splice havoc cycle length: */
126 |
127 | #define SPLICE_HAVOC 32
128 |
129 | /* Maximum offset for integer addition / subtraction stages: */
130 |
131 | #define ARITH_MAX 35
132 |
133 | /* Limits for the test case trimmer. The absolute minimum chunk size; and
134 | the starting and ending divisors for chopping up the input file: */
135 |
136 | #define TRIM_MIN_BYTES 4
137 | #define TRIM_START_STEPS 16
138 | #define TRIM_END_STEPS 1024
139 |
140 | /* Maximum size of input file, in bytes (keep under 100MB): */
141 |
142 | #define MAX_FILE (10 * 1024 * 1024)
143 |
144 | /* The same, for the test case minimizer: */
145 |
146 | #define TMIN_MAX_FILE (10 * 1024 * 1024)
147 |
148 | /* Block normalization steps for afl-tmin: */
149 |
150 | #define TMIN_SET_MIN_SIZE 4
151 | #define TMIN_SET_STEPS 128
152 |
153 | /* Maximum dictionary token size (-x), in bytes: */
154 |
155 | #define MAX_DICT_FILE 128
156 |
157 | /* Length limits for auto-detected dictionary tokens: */
158 |
159 | #define MIN_AUTO_EXTRA 3
160 | #define MAX_AUTO_EXTRA 32
161 |
162 | /* Maximum number of user-specified dictionary tokens to use in deterministic
163 | steps; past this point, the "extras/user" step will be still carried out,
164 | but with proportionally lower odds: */
165 |
166 | #define MAX_DET_EXTRAS 200
167 |
168 | /* Maximum number of auto-extracted dictionary tokens to actually use in fuzzing
169 | (first value), and to keep in memory as candidates. The latter should be much
170 | higher than the former. */
171 |
172 | #define USE_AUTO_EXTRAS 50
173 | #define MAX_AUTO_EXTRAS (USE_AUTO_EXTRAS * 10)
174 |
175 | /* Scaling factor for the effector map used to skip some of the more
176 | expensive deterministic steps. The actual divisor is set to
177 | 2^EFF_MAP_SCALE2 bytes: */
178 |
179 | #define EFF_MAP_SCALE2 3
180 |
181 | /* Minimum input file length at which the effector logic kicks in: */
182 |
183 | #define EFF_MIN_LEN 128
184 |
185 | /* Maximum effector density past which everything is just fuzzed
186 | unconditionally (%): */
187 |
188 | #define EFF_MAX_PERC 90
189 |
190 | /* UI refresh frequency (Hz): */
191 |
192 | #define UI_TARGET_HZ 5
193 |
194 | /* Fuzzer stats file and plot update intervals (sec): */
195 |
196 | #define STATS_UPDATE_SEC 60
197 | #define PLOT_UPDATE_SEC 5
198 |
199 | /* Smoothing divisor for CPU load and exec speed stats (1 - no smoothing). */
200 |
201 | #define AVG_SMOOTHING 16
202 |
203 | /* Sync interval (every n havoc cycles): */
204 |
205 | #define SYNC_INTERVAL 5
206 |
207 | /* Output directory reuse grace period (minutes): */
208 |
209 | #define OUTPUT_GRACE 25
210 |
211 | /* Uncomment to use simple file names (id_NNNNNN): */
212 |
213 | // #define SIMPLE_FILES
214 |
215 | /* List of interesting values to use in fuzzing. */
216 |
217 | #define INTERESTING_8 \
218 | -128, /* Overflow signed 8-bit when decremented */ \
219 | -1, /* */ \
220 | 0, /* */ \
221 | 1, /* */ \
222 | 16, /* One-off with common buffer size */ \
223 | 32, /* One-off with common buffer size */ \
224 | 64, /* One-off with common buffer size */ \
225 | 100, /* One-off with common buffer size */ \
226 | 127 /* Overflow signed 8-bit when incremented */
227 |
228 | #define INTERESTING_16 \
229 | -32768, /* Overflow signed 16-bit when decremented */ \
230 | -129, /* Overflow signed 8-bit */ \
231 | 128, /* Overflow signed 8-bit */ \
232 | 255, /* Overflow unsig 8-bit when incremented */ \
233 | 256, /* Overflow unsig 8-bit */ \
234 | 512, /* One-off with common buffer size */ \
235 | 1000, /* One-off with common buffer size */ \
236 | 1024, /* One-off with common buffer size */ \
237 | 4096, /* One-off with common buffer size */ \
238 | 32767 /* Overflow signed 16-bit when incremented */
239 |
240 | #define INTERESTING_32 \
241 | -2147483648LL, /* Overflow signed 32-bit when decremented */ \
242 | -100663046, /* Large negative number (endian-agnostic) */ \
243 | -32769, /* Overflow signed 16-bit */ \
244 | 32768, /* Overflow signed 16-bit */ \
245 | 65535, /* Overflow unsig 16-bit when incremented */ \
246 | 65536, /* Overflow unsig 16 bit */ \
247 | 100663045, /* Large positive number (endian-agnostic) */ \
248 | 2147483647 /* Overflow signed 32-bit when incremented */
249 |
250 | /***********************************************************
251 | * *
252 | * Really exotic stuff you probably don't want to touch: *
253 | * *
254 | ***********************************************************/
255 |
256 | /* Call count interval between reseeding the libc PRNG from /dev/urandom: */
257 |
258 | #define RESEED_RNG 10000
259 |
260 | /* Maximum line length passed from GCC to 'as' and used for parsing
261 | configuration files: */
262 |
263 | #define MAX_LINE 8192
264 |
265 | /* Environment variable used to pass SHM ID to the called program. */
266 |
267 | #define SHM_ENV_VAR "__AFL_SHM_ID"
268 |
269 | /* Other less interesting, internal-only variables. */
270 |
271 | #define CLANG_ENV_VAR "__AFL_CLANG_MODE"
272 | #define AS_LOOP_ENV_VAR "__AFL_AS_LOOPCHECK"
273 | #define PERSIST_ENV_VAR "__AFL_PERSISTENT"
274 | #define DEFER_ENV_VAR "__AFL_DEFER_FORKSRV"
275 |
276 | /* In-code signatures for deferred and persistent mode. */
277 |
278 | #define PERSIST_SIG "##SIG_AFL_PERSISTENT##"
279 | #define DEFER_SIG "##SIG_AFL_DEFER_FORKSRV##"
280 |
281 | /* Distinctive bitmap signature used to indicate failed execution: */
282 |
283 | #define EXEC_FAIL_SIG 0xfee1dead
284 |
285 | /* Distinctive exit code used to indicate MSAN trip condition: */
286 |
287 | #define MSAN_ERROR 86
288 |
289 | /* Designated file descriptors for forkserver commands (the application will
290 | use FORKSRV_FD and FORKSRV_FD + 1): */
291 |
292 | #define FORKSRV_FD 198
293 |
294 | /* Fork server init timeout multiplier: we'll wait the user-selected
295 | timeout plus this much for the fork server to spin up. */
296 |
297 | #define FORK_WAIT_MULT 10
298 |
299 | /* Calibration timeout adjustments, to be a bit more generous when resuming
300 | fuzzing sessions or trying to calibrate already-added internal finds.
301 | The first value is a percentage, the other is in milliseconds: */
302 |
303 | #define CAL_TMOUT_PERC 125
304 | #define CAL_TMOUT_ADD 50
305 |
306 | /* Number of chances to calibrate a case before giving up: */
307 |
308 | #define CAL_CHANCES 3
309 |
310 | /* Map size for the traced binary (2^MAP_SIZE_POW2). Must be greater than
311 | 2; you probably want to keep it under 18 or so for performance reasons
312 | (adjusting AFL_INST_RATIO when compiling is probably a better way to solve
313 | problems with complex programs). You need to recompile the target binary
314 | after changing this - otherwise, SEGVs may ensue. */
315 |
316 | #define MAP_SIZE_POW2 16
317 | #define MAP_SIZE (1 << MAP_SIZE_POW2)
318 |
319 | /* Maximum allocator request size (keep well under INT_MAX): */
320 |
321 | #define MAX_ALLOC 0x40000000
322 |
323 | /* A made-up hashing seed: */
324 |
325 | #define HASH_CONST 0xa5b35705
326 |
327 | /* Constants for afl-gotcpu to control busy loop timing: */
328 |
329 | #define CTEST_TARGET_MS 5000
330 | #define CTEST_CORE_TRG_MS 1000
331 | #define CTEST_BUSY_CYCLES (10 * 1000 * 1000)
332 |
333 | /* Uncomment this to use inferior block-coverage-based instrumentation. Note
334 | that you need to recompile the target binary for this to have any effect: */
335 |
336 | // #define COVERAGE_ONLY
337 |
338 | /* Uncomment this to ignore hit counts and output just one bit per tuple.
339 | As with the previous setting, you will need to recompile the target
340 | binary: */
341 |
342 | // #define SKIP_COUNTS
343 |
344 | /* Uncomment this to use instrumentation data to record newly discovered paths,
345 | but do not use them as seeds for fuzzing. This is useful for conveniently
346 | measuring coverage that could be attained by a "dumb" fuzzing algorithm: */
347 |
348 | // #define IGNORE_FINDS
349 |
350 | #endif /* ! _HAVE_CONFIG_H */
351 |
--------------------------------------------------------------------------------
/showmaps/debug.h:
--------------------------------------------------------------------------------
1 | /*
2 | american fuzzy lop - debug / error handling macros
3 | --------------------------------------------------
4 |
5 | Written and maintained by Michal Zalewski
6 |
7 | Copyright 2013, 2014, 2015, 2016 Google Inc. All rights reserved.
8 |
9 | Licensed under the Apache License, Version 2.0 (the "License");
10 | you may not use this file except in compliance with the License.
11 | You may obtain a copy of the License at:
12 |
13 | http://www.apache.org/licenses/LICENSE-2.0
14 |
15 | */
16 |
17 | #ifndef _HAVE_DEBUG_H
18 | #define _HAVE_DEBUG_H
19 |
20 | #include
21 |
22 | #include "types.h"
23 | #include "config.h"
24 |
25 | /*******************
26 | * Terminal colors *
27 | *******************/
28 |
29 | #ifdef USE_COLOR
30 |
31 | # define cBLK "\x1b[0;30m"
32 | # define cRED "\x1b[0;31m"
33 | # define cGRN "\x1b[0;32m"
34 | # define cBRN "\x1b[0;33m"
35 | # define cBLU "\x1b[0;34m"
36 | # define cMGN "\x1b[0;35m"
37 | # define cCYA "\x1b[0;36m"
38 | # define cLGR "\x1b[0;37m"
39 | # define cGRA "\x1b[1;90m"
40 | # define cLRD "\x1b[1;91m"
41 | # define cLGN "\x1b[1;92m"
42 | # define cYEL "\x1b[1;93m"
43 | # define cLBL "\x1b[1;94m"
44 | # define cPIN "\x1b[1;95m"
45 | # define cLCY "\x1b[1;96m"
46 | # define cBRI "\x1b[1;97m"
47 | # define cRST "\x1b[0m"
48 |
49 | # define bgBLK "\x1b[40m"
50 | # define bgRED "\x1b[41m"
51 | # define bgGRN "\x1b[42m"
52 | # define bgBRN "\x1b[43m"
53 | # define bgBLU "\x1b[44m"
54 | # define bgMGN "\x1b[45m"
55 | # define bgCYA "\x1b[46m"
56 | # define bgLGR "\x1b[47m"
57 | # define bgGRA "\x1b[100m"
58 | # define bgLRD "\x1b[101m"
59 | # define bgLGN "\x1b[102m"
60 | # define bgYEL "\x1b[103m"
61 | # define bgLBL "\x1b[104m"
62 | # define bgPIN "\x1b[105m"
63 | # define bgLCY "\x1b[106m"
64 | # define bgBRI "\x1b[107m"
65 |
66 | #else
67 |
68 | # define cBLK ""
69 | # define cRED ""
70 | # define cGRN ""
71 | # define cBRN ""
72 | # define cBLU ""
73 | # define cMGN ""
74 | # define cCYA ""
75 | # define cLGR ""
76 | # define cGRA ""
77 | # define cLRD ""
78 | # define cLGN ""
79 | # define cYEL ""
80 | # define cLBL ""
81 | # define cPIN ""
82 | # define cLCY ""
83 | # define cBRI ""
84 | # define cRST ""
85 |
86 | # define bgBLK ""
87 | # define bgRED ""
88 | # define bgGRN ""
89 | # define bgBRN ""
90 | # define bgBLU ""
91 | # define bgMGN ""
92 | # define bgCYA ""
93 | # define bgLGR ""
94 | # define bgGRA ""
95 | # define bgLRD ""
96 | # define bgLGN ""
97 | # define bgYEL ""
98 | # define bgLBL ""
99 | # define bgPIN ""
100 | # define bgLCY ""
101 | # define bgBRI ""
102 |
103 | #endif /* ^USE_COLOR */
104 |
105 | /*************************
106 | * Box drawing sequences *
107 | *************************/
108 |
109 | #ifdef FANCY_BOXES
110 |
111 | # define SET_G1 "\x1b)0" /* Set G1 for box drawing */
112 | # define RESET_G1 "\x1b)B" /* Reset G1 to ASCII */
113 | # define bSTART "\x0e" /* Enter G1 drawing mode */
114 | # define bSTOP "\x0f" /* Leave G1 drawing mode */
115 | # define bH "q" /* Horizontal line */
116 | # define bV "x" /* Vertical line */
117 | # define bLT "l" /* Left top corner */
118 | # define bRT "k" /* Right top corner */
119 | # define bLB "m" /* Left bottom corner */
120 | # define bRB "j" /* Right bottom corner */
121 | # define bX "n" /* Cross */
122 | # define bVR "t" /* Vertical, branch right */
123 | # define bVL "u" /* Vertical, branch left */
124 | # define bHT "v" /* Horizontal, branch top */
125 | # define bHB "w" /* Horizontal, branch bottom */
126 |
127 | #else
128 |
129 | # define SET_G1 ""
130 | # define RESET_G1 ""
131 | # define bSTART ""
132 | # define bSTOP ""
133 | # define bH "-"
134 | # define bV "|"
135 | # define bLT "+"
136 | # define bRT "+"
137 | # define bLB "+"
138 | # define bRB "+"
139 | # define bX "+"
140 | # define bVR "+"
141 | # define bVL "+"
142 | # define bHT "+"
143 | # define bHB "+"
144 |
145 | #endif /* ^FANCY_BOXES */
146 |
147 | /***********************
148 | * Misc terminal codes *
149 | ***********************/
150 |
151 | #define TERM_HOME "\x1b[H"
152 | #define TERM_CLEAR TERM_HOME "\x1b[2J"
153 | #define cEOL "\x1b[0K"
154 | #define CURSOR_HIDE "\x1b[?25l"
155 | #define CURSOR_SHOW "\x1b[?25h"
156 |
157 | /************************
158 | * Debug & error macros *
159 | ************************/
160 |
161 | /* Just print stuff to the appropriate stream. */
162 |
163 | #ifdef MESSAGES_TO_STDOUT
164 | # define SAYF(x...) printf(x)
165 | #else
166 | # define SAYF(x...) fprintf(stderr, x)
167 | #endif /* ^MESSAGES_TO_STDOUT */
168 |
169 | /* Show a prefixed warning. */
170 |
171 | #define WARNF(x...) do { \
172 | SAYF(cYEL "[!] " cBRI "WARNING: " cRST x); \
173 | SAYF(cRST "\n"); \
174 | } while (0)
175 |
176 | /* Show a prefixed "doing something" message. */
177 |
178 | #define ACTF(x...) do { \
179 | SAYF(cLBL "[*] " cRST x); \
180 | SAYF(cRST "\n"); \
181 | } while (0)
182 |
183 | /* Show a prefixed "success" message. */
184 |
185 | #define OKF(x...) do { \
186 | SAYF(cLGN "[+] " cRST x); \
187 | SAYF(cRST "\n"); \
188 | } while (0)
189 |
190 | /* Show a prefixed fatal error message (not used in afl). */
191 |
192 | #define BADF(x...) do { \
193 | SAYF(cLRD "\n[-] " cRST x); \
194 | SAYF(cRST "\n"); \
195 | } while (0)
196 |
197 | /* Die with a verbose non-OS fatal error message. */
198 |
199 | #define FATAL(x...) do { \
200 | SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD "\n[-] PROGRAM ABORT : " \
201 | cBRI x); \
202 | SAYF(cLRD "\n Location : " cRST "%s(), %s:%u\n\n", \
203 | __FUNCTION__, __FILE__, __LINE__); \
204 | exit(1); \
205 | } while (0)
206 |
207 | /* Die by calling abort() to provide a core dump. */
208 |
209 | #define ABORT(x...) do { \
210 | SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD "\n[-] PROGRAM ABORT : " \
211 | cBRI x); \
212 | SAYF(cLRD "\n Stop location : " cRST "%s(), %s:%u\n\n", \
213 | __FUNCTION__, __FILE__, __LINE__); \
214 | abort(); \
215 | } while (0)
216 |
217 | /* Die while also including the output of perror(). */
218 |
219 | #define PFATAL(x...) do { \
220 | fflush(stdout); \
221 | SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD "\n[-] SYSTEM ERROR : " \
222 | cBRI x); \
223 | SAYF(cLRD "\n Stop location : " cRST "%s(), %s:%u\n", \
224 | __FUNCTION__, __FILE__, __LINE__); \
225 | SAYF(cLRD " OS message : " cRST "%s\n", strerror(errno)); \
226 | exit(1); \
227 | } while (0)
228 |
229 | /* Die with FAULT() or PFAULT() depending on the value of res (used to
230 | interpret different failure modes for read(), write(), etc). */
231 |
232 | #define RPFATAL(res, x...) do { \
233 | if (res < 0) PFATAL(x); else FATAL(x); \
234 | } while (0)
235 |
236 | /* Error-checking versions of read() and write() that call RPFATAL() as
237 | appropriate. */
238 |
239 | #define ck_write(fd, buf, len, fn) do { \
240 | u32 _len = (len); \
241 | s32 _res = write(fd, buf, _len); \
242 | if (_res != _len) RPFATAL(_res, "Short write to %s", fn); \
243 | } while (0)
244 |
245 | #define ck_read(fd, buf, len, fn) do { \
246 | u32 _len = (len); \
247 | s32 _res = read(fd, buf, _len); \
248 | if (_res != _len) RPFATAL(_res, "Short read from %s", fn); \
249 | } while (0)
250 |
251 | #endif /* ! _HAVE_DEBUG_H */
252 |
--------------------------------------------------------------------------------
/showmaps/hash.h:
--------------------------------------------------------------------------------
1 | /*
2 | american fuzzy lop - hashing function
3 | -------------------------------------
4 |
5 | The hash32() function is a variant of MurmurHash3, a good
6 | non-cryptosafe hashing function developed by Austin Appleby.
7 |
8 | For simplicity, this variant does *NOT* accept buffer lengths
9 | that are not divisible by 8 bytes. The 32-bit version is otherwise
10 | similar to the original; the 64-bit one is a custom hack with
11 | mostly-unproven properties.
12 |
13 | Austin's original code is public domain.
14 |
15 | Other code written and maintained by Michal Zalewski
16 |
17 | Copyright 2016 Google Inc. All rights reserved.
18 |
19 | Licensed under the Apache License, Version 2.0 (the "License");
20 | you may not use this file except in compliance with the License.
21 | You may obtain a copy of the License at:
22 |
23 | http://www.apache.org/licenses/LICENSE-2.0
24 |
25 | */
26 |
27 | #ifndef _HAVE_HASH_H
28 | #define _HAVE_HASH_H
29 |
30 | #include "types.h"
31 |
32 | #ifdef __x86_64__
33 |
34 | #define ROL64(_x, _r) ((((u64)(_x)) << (_r)) | (((u64)(_x)) >> (64 - (_r))))
35 |
36 | static inline u32 hash32(const void* key, u32 len, u32 seed) {
37 |
38 | const u64* data = (u64*)key;
39 | u64 h1 = seed ^ len;
40 |
41 | len >>= 3;
42 |
43 | while (len--) {
44 |
45 | u64 k1 = *data++;
46 |
47 | k1 *= 0x87c37b91114253d5ULL;
48 | k1 = ROL64(k1, 31);
49 | k1 *= 0x4cf5ad432745937fULL;
50 |
51 | h1 ^= k1;
52 | h1 = ROL64(h1, 27);
53 | h1 = h1 * 5 + 0x52dce729;
54 |
55 | }
56 |
57 | h1 ^= h1 >> 33;
58 | h1 *= 0xff51afd7ed558ccdULL;
59 | h1 ^= h1 >> 33;
60 | h1 *= 0xc4ceb9fe1a85ec53ULL;
61 | h1 ^= h1 >> 33;
62 |
63 | return h1;
64 |
65 | }
66 |
67 | #else
68 |
69 | #define ROL32(_x, _r) ((((u32)(_x)) << (_r)) | (((u32)(_x)) >> (32 - (_r))))
70 |
71 | static inline u32 hash32(const void* key, u32 len, u32 seed) {
72 |
73 | const u32* data = (u32*)key;
74 | u32 h1 = seed ^ len;
75 |
76 | len >>= 2;
77 |
78 | while (len--) {
79 |
80 | u32 k1 = *data++;
81 |
82 | k1 *= 0xcc9e2d51;
83 | k1 = ROL32(k1, 15);
84 | k1 *= 0x1b873593;
85 |
86 | h1 ^= k1;
87 | h1 = ROL32(h1, 13);
88 | h1 = h1 * 5 + 0xe6546b64;
89 |
90 | }
91 |
92 | h1 ^= h1 >> 16;
93 | h1 *= 0x85ebca6b;
94 | h1 ^= h1 >> 13;
95 | h1 *= 0xc2b2ae35;
96 | h1 ^= h1 >> 16;
97 |
98 | return h1;
99 |
100 | }
101 |
102 | #endif /* ^__x86_64__ */
103 |
104 | #endif /* !_HAVE_HASH_H */
105 |
--------------------------------------------------------------------------------
/showmaps/showmaps.c:
--------------------------------------------------------------------------------
1 | /*
2 | american fuzzy lop - map display utility
3 | ----------------------------------------
4 |
5 | Written and maintained by Michal Zalewski
6 |
7 | Copyright 2013, 2014, 2015, 2016, 2017 Google Inc. All rights reserved.
8 |
9 | Licensed under the Apache License, Version 2.0 (the "License");
10 | you may not use this file except in compliance with the License.
11 | You may obtain a copy of the License at:
12 |
13 | http://www.apache.org/licenses/LICENSE-2.0
14 |
15 | A very simple tool that runs the targeted binary and displays
16 | the contents of the trace bitmap in a human-readable form. Useful in
17 | scripts to eliminate redundant inputs and perform other checks.
18 |
19 | Exit code is 2 if the target program crashes; 1 if it times out or
20 | there is a problem executing it; or 0 if execution is successful.
21 |
22 | */
23 |
24 | #define AFL_MAIN
25 |
26 | #include "alloc-inl.h"
27 | #include "config.h"
28 | #include "debug.h"
29 | #include "hash.h"
30 | #include "types.h"
31 |
32 | #include
33 | #include
34 | #include
35 | #include
36 | #include
37 | #include
38 | #include
39 | #include
40 | #include
41 |
42 | #include
43 | #include
44 | #include
45 | #include
46 | #include
47 | #include
48 |
49 | struct queue_entry
50 | {
51 |
52 | u8 *fname; /* File name for the test case */
53 | u32 len; /* Input length */
54 |
55 | u8 cal_failed, /* Calibration failed? */
56 | trim_done, /* Trimmed? */
57 | was_fuzzed, /* Had any fuzzing done yet? */
58 | passed_det, /* Deterministic stages passed? */
59 | has_new_cov, /* Triggers new coverage? */
60 | var_behavior, /* Variable behavior? */
61 | favored, /* Currently favored? */
62 | fs_redundant; /* Marked as redundant in the fs? */
63 |
64 | u32 bitmap_size, /* Number of bits set in bitmap */
65 | exec_cksum; /* Checksum of the execution trace */
66 |
67 | u64 mtime, /* Last modification time */
68 | sec_slot, /* Slot of seed, in sec */
69 | min_slot, /* Slot of seed, in min */
70 | hour_slot; /* Slot of seed ,in hour */
71 |
72 | u8 *trace_mini; /* Trace bytes, if kept */
73 | u32 tc_ref; /* Trace bytes ref count */
74 |
75 | struct queue_entry *next, /* Next element, if any */
76 | *prev; /* Previous element, if any */
77 | };
78 |
79 | static struct queue_entry *queue, /* Fuzzing queue (linked list) */
80 | *queue_cur, /* Current offset within the queue */
81 | *queue_top; /* Top of the list */
82 |
83 | // pair of time slot and value
84 |
85 | struct slot_val
86 | {
87 | u64 slot;
88 | u32 val;
89 | struct slot_val *next;
90 | };
91 |
92 | static struct slot_val *slot_edge, /* N.O. of edges covered over time */
93 | *slot_edge_top, /* Top of slot_edge */
94 | *slot_entry, /* N.O. of seeds found over time */
95 | *slot_entry_top, *cov_slot_entry, /* N.O. of new cov found over time */
96 | *cov_slot_entry_top,
97 | *mtime_edge,
98 | *mtime_edge_top,
99 | *mtime_entry,
100 | *mtime_entry_top,
101 | *mtime_cov_entry,
102 | *mtime_cov_entry_top;
103 |
104 | static s32 child_pid; /* PID of the tested program */
105 |
106 | static u8 *trace_bits; /* SHM with instrumentation bitmap */
107 |
108 | static u8 *in_dir, /* Input directory with test cases */
109 | *out_file, /* File to fuzz, if any */
110 | *out_dir, /* Working & output directory */
111 | *trace_file, /* File to store the current trace */
112 | *target_path; /* Path to target binary */
113 |
114 | static u32 queued_paths, /* Total number of queued testcases */
115 | skip_no = 0, /* no of files to skip for time count*/
116 | exec_tmout; /* Exec timeout (ms) */
117 |
118 | static u64 min_mtime = 0, /* Min mtime of all initial seeds */
119 | max_mtime, /* Max mtime of all initial seeds */
120 | mem_limit = MEM_LIMIT; /* Memory limit (MB) */
121 |
122 | static s32 out_fd, /* Persistent fd for out_file */
123 | dev_urandom_fd = -1, /* Persistent fd for /dev/urandom */
124 | dev_null_fd = -1, /* Persistent fd for /dev/null */
125 | shm_id, /* ID of the SHM region */
126 | out_dir_fd = -1; /* FD of the lock file */
127 |
128 | static u8 quiet_mode, /* Hide non-essential messages? */
129 | edges_only, /* Ignore hit counts? */
130 | given_min_mtime = 0, /* User provides min_mtime */
131 | use_stdin = 1, /* Target program read from stdin? */
132 | entries_only, /* Only count for N.O. of items? */
133 | binary_mode, /* Write output as a binary map */
134 | skip_individual, /* Skip individual trace generation */
135 | keep_cores; /* Allow coredumps? */
136 |
137 | static volatile u8 stop_soon, /* Ctrl-C pressed? */
138 | child_timed_out, /* Child timed out? */
139 | child_crashed; /* Child crashed? */
140 |
141 | u8 virgin_bits[MAP_SIZE]; /* Regions yet untouched by fuzzing */
142 |
143 | /* Classify tuple counts. Instead of mapping to individual bits, as in
144 | afl-fuzz.c, we map to more user-friendly numbers between 1 and 8. */
145 |
146 | static const u8 count_class_human[256] = {
147 |
148 | [0] = 0, [1] = 1, [2] = 2, [3] = 3, [4 ... 7] = 4, [8 ... 15] = 5, [16 ... 31] = 6, [32 ... 127] = 7, [128 ... 255] = 8
149 |
150 | };
151 |
152 | static const u8 count_class_binary[256] = {
153 |
154 | [0] = 0, [1] = 1, [2] = 2, [3] = 4, [4 ... 7] = 8, [8 ... 15] = 16, [16 ... 31] = 32, [32 ... 127] = 64, [128 ... 255] = 128
155 |
156 | };
157 |
158 | static u16 count_class_lookup16[65536];
159 |
160 | void init_count_class16(void)
161 | {
162 |
163 | u32 b1, b2;
164 |
165 | for (b1 = 0; b1 < 256; b1++)
166 | for (b2 = 0; b2 < 256; b2++)
167 | count_class_lookup16[(b1 << 8) + b2] =
168 | (count_class_binary[b1] << 8) | count_class_binary[b2];
169 | }
170 |
171 | static u8 *DI(u64 val)
172 | {
173 |
174 | static u8 tmp[12][16];
175 | static u8 cur;
176 |
177 | cur = (cur + 1) % 12;
178 |
179 | #define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \
180 | do \
181 | { \
182 | if (val < (_divisor) * (_limit_mult)) \
183 | { \
184 | sprintf(tmp[cur], _fmt, ((_cast)val) / (_divisor)); \
185 | return tmp[cur]; \
186 | } \
187 | } while (0)
188 |
189 | /* 0-9999 */
190 | CHK_FORMAT(1, 10000, "%llu", u64);
191 |
192 | /* 10.0k - 99.9k */
193 | CHK_FORMAT(1000, 99.95, "%0.01fk", double);
194 |
195 | /* 100k - 999k */
196 | CHK_FORMAT(1000, 1000, "%lluk", u64);
197 |
198 | /* 1.00M - 9.99M */
199 | CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double);
200 |
201 | /* 10.0M - 99.9M */
202 | CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double);
203 |
204 | /* 100M - 999M */
205 | CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64);
206 |
207 | /* 1.00G - 9.99G */
208 | CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double);
209 |
210 | /* 10.0G - 99.9G */
211 | CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double);
212 |
213 | /* 100G - 999G */
214 | CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64);
215 |
216 | /* 1.00T - 9.99G */
217 | CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double);
218 |
219 | /* 10.0T - 99.9T */
220 | CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double);
221 |
222 | /* 100T+ */
223 | strcpy(tmp[cur], "infty");
224 | return tmp[cur];
225 | }
226 |
227 | /* Describe float. Similar to the above, except with a single
228 | static buffer. */
229 |
230 | static u8 *DF(double val)
231 | {
232 |
233 | static u8 tmp[16];
234 |
235 | if (val < 99.995)
236 | {
237 | sprintf(tmp, "%0.02f", val);
238 | return tmp;
239 | }
240 |
241 | if (val < 999.95)
242 | {
243 | sprintf(tmp, "%0.01f", val);
244 | return tmp;
245 | }
246 |
247 | return DI((u64)val);
248 | }
249 |
250 | /* Describe integer as memory size. */
251 |
252 | static u8 *DMS(u64 val)
253 | {
254 |
255 | static u8 tmp[12][16];
256 | static u8 cur;
257 |
258 | cur = (cur + 1) % 12;
259 |
260 | /* 0-9999 */
261 | CHK_FORMAT(1, 10000, "%llu B", u64);
262 |
263 | /* 10.0k - 99.9k */
264 | CHK_FORMAT(1024, 99.95, "%0.01f kB", double);
265 |
266 | /* 100k - 999k */
267 | CHK_FORMAT(1024, 1000, "%llu kB", u64);
268 |
269 | /* 1.00M - 9.99M */
270 | CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double);
271 |
272 | /* 10.0M - 99.9M */
273 | CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double);
274 |
275 | /* 100M - 999M */
276 | CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64);
277 |
278 | /* 1.00G - 9.99G */
279 | CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double);
280 |
281 | /* 10.0G - 99.9G */
282 | CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double);
283 |
284 | /* 100G - 999G */
285 | CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64);
286 |
287 | /* 1.00T - 9.99G */
288 | CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double);
289 |
290 | /* 10.0T - 99.9T */
291 | CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double);
292 |
293 | #undef CHK_FORMAT
294 |
295 | /* 100T+ */
296 | strcpy(tmp[cur], "infty");
297 | return tmp[cur];
298 | }
299 |
300 | static void classify_counts(u8 *mem, const u8 *map)
301 | {
302 |
303 | u32 i = MAP_SIZE;
304 |
305 | if (edges_only)
306 | {
307 |
308 | while (i--)
309 | {
310 | if (*mem)
311 | *mem = 1;
312 | mem++;
313 | }
314 | }
315 | else
316 | {
317 |
318 | while (i--)
319 | {
320 | *mem = map[*mem];
321 | mem++;
322 | }
323 | }
324 | }
325 |
326 | // classify trace_bits counts
327 |
328 | #ifdef __x86_64__
329 |
330 | static inline void classify_trace_counts(u64 *mem)
331 | {
332 |
333 | u32 i = MAP_SIZE >> 3;
334 |
335 | while (i--)
336 | {
337 |
338 | /* Optimize for sparse bitmaps. */
339 |
340 | if (unlikely(*mem))
341 | {
342 |
343 | u16 *mem16 = (u16 *)mem;
344 |
345 | mem16[0] = count_class_lookup16[mem16[0]];
346 | mem16[1] = count_class_lookup16[mem16[1]];
347 | mem16[2] = count_class_lookup16[mem16[2]];
348 | mem16[3] = count_class_lookup16[mem16[3]];
349 | }
350 |
351 | mem++;
352 | }
353 | }
354 |
355 | #else
356 |
357 | static inline void classify_trace_counts(u32 *mem)
358 | {
359 |
360 | u32 i = MAP_SIZE >> 2;
361 |
362 | while (i--)
363 | {
364 |
365 | /* Optimize for sparse bitmaps. */
366 |
367 | if (unlikely(*mem))
368 | {
369 |
370 | u16 *mem16 = (u16 *)mem;
371 |
372 | mem16[0] = count_class_lookup16[mem16[0]];
373 | mem16[1] = count_class_lookup16[mem16[1]];
374 | }
375 |
376 | mem++;
377 | }
378 | }
379 |
380 | #endif /* ^__x86_64__ */
381 |
382 | // Linkedlist related
383 |
384 | void swap(struct queue_entry *a, struct queue_entry *b)
385 | {
386 | u8 *tmp_fname;
387 | u32 tmp_len;
388 | u64 tmp_mtime;
389 |
390 | tmp_fname = a->fname;
391 | tmp_len = a->len;
392 | tmp_mtime = a->mtime;
393 |
394 | a->fname = b->fname;
395 | a->len = b->len;
396 | a->mtime = b->mtime;
397 |
398 | b->fname = tmp_fname;
399 | b->len = tmp_len;
400 | b->mtime = tmp_mtime;
401 | }
402 |
403 | struct queue_entry *last_node(struct queue_entry *root)
404 | {
405 | while (root && root->next)
406 | root = root->next;
407 | return root;
408 | }
409 |
410 | struct queue_entry *partition(struct queue_entry *l, struct queue_entry *h)
411 | {
412 | // set the pivot point as h value
413 | u64 x = h->mtime;
414 |
415 | struct queue_entry *i = l->prev;
416 |
417 | struct queue_entry *j = l;
418 |
419 | for (; j != h; j = j->next)
420 | {
421 | if (j->mtime <= x)
422 | {
423 | i = (i == NULL) ? l : i->next;
424 | swap(i, j);
425 | }
426 | }
427 | i = (i == NULL) ? l : i->next;
428 | swap(i, j);
429 | return i;
430 | }
431 |
432 | void _quick_sort(struct queue_entry *l, struct queue_entry *h)
433 | {
434 | if (h != NULL && l != h && l != h->next)
435 | {
436 | struct queue_entry *p = partition(l, h);
437 | _quick_sort(l, p->prev);
438 | _quick_sort(p->next, h);
439 | }
440 | }
441 |
442 | void quick_sort(struct queue_entry *head)
443 | {
444 | struct queue_entry *h = last_node(head);
445 | _quick_sort(head, h);
446 | }
447 |
448 | #define FF(_b) (0xff << ((_b) << 3))
449 |
450 | static u32 count_bytes(u8 *mem)
451 | {
452 |
453 | u32 *ptr = (u32 *)mem;
454 | u32 i = (MAP_SIZE >> 2);
455 | u32 ret = 0;
456 |
457 | while (i--)
458 | {
459 |
460 | u32 v = *(ptr++);
461 |
462 | if (!v)
463 | continue;
464 | if (v & FF(0))
465 | ret++;
466 | if (v & FF(1))
467 | ret++;
468 | if (v & FF(2))
469 | ret++;
470 | if (v & FF(3))
471 | ret++;
472 | }
473 |
474 | return ret;
475 | }
476 |
477 | /* Count the number of non-255 bytes set in the bitmap. Used strictly for the
478 | status screen, several calls per second or so. */
479 |
480 | static u32 count_non_255_bytes(u8 *mem)
481 | {
482 |
483 | u32 *ptr = (u32 *)mem;
484 | u32 i = (MAP_SIZE >> 2);
485 | u32 ret = 0;
486 |
487 | while (i--)
488 | {
489 |
490 | u32 v = *(ptr++);
491 |
492 | /* This is called on the virgin bitmap, so optimize for the most likely
493 | case. */
494 |
495 | if (v == 0xffffffff)
496 | continue;
497 | if ((v & FF(0)) != FF(0))
498 | ret++;
499 | if ((v & FF(1)) != FF(1))
500 | ret++;
501 | if ((v & FF(2)) != FF(2))
502 | ret++;
503 | if ((v & FF(3)) != FF(3))
504 | ret++;
505 | }
506 |
507 | return ret;
508 | }
509 |
510 | static inline u8 has_new_bits(u8 *virgin_map)
511 | {
512 |
513 | #ifdef __x86_64__
514 |
515 | u64 *current = (u64 *)trace_bits;
516 | u64 *virgin = (u64 *)virgin_map;
517 |
518 | u32 i = (MAP_SIZE >> 3);
519 |
520 | #else
521 |
522 | u32 *current = (u32 *)trace_bits;
523 | u32 *virgin = (u32 *)virgin_map;
524 |
525 | u32 i = (MAP_SIZE >> 2);
526 |
527 | #endif /* ^__x86_64__ */
528 |
529 | u8 ret = 0;
530 |
531 | while (i--)
532 | {
533 |
534 | /* Optimize for (*current & *virgin) == 0 - i.e., no bits in current bitmap
535 | that have not been already cleared from the virgin map - since this will
536 | almost always be the case. */
537 |
538 | if (unlikely(*current) && unlikely(*current & *virgin))
539 | {
540 |
541 | if (likely(ret < 2))
542 | {
543 |
544 | u8 *cur = (u8 *)current;
545 | u8 *vir = (u8 *)virgin;
546 |
547 | /* Looks like we have not found any new bytes yet; see if any non-zero
548 | bytes in current[] are pristine in virgin[]. */
549 |
550 | #ifdef __x86_64__
551 |
552 | if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
553 | (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff) ||
554 | (cur[4] && vir[4] == 0xff) || (cur[5] && vir[5] == 0xff) ||
555 | (cur[6] && vir[6] == 0xff) || (cur[7] && vir[7] == 0xff))
556 | ret = 2;
557 | else
558 | ret = 1;
559 |
560 | #else
561 |
562 | if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
563 | (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff))
564 | ret = 2;
565 | else
566 | ret = 1;
567 |
568 | #endif /* ^__x86_64__ */
569 | }
570 |
571 | *virgin &= ~*current;
572 | }
573 |
574 | current++;
575 | virgin++;
576 | }
577 |
578 | return ret;
579 | }
580 |
581 | /* Get rid of shared memory (atexit handler). */
582 |
583 | static void remove_shm(void) { shmctl(shm_id, IPC_RMID, NULL); }
584 |
585 | /* Configure shared memory. */
586 |
587 | static void setup_shm(void)
588 | {
589 |
590 | u8 *shm_str;
591 |
592 | shm_id = shmget(IPC_PRIVATE, MAP_SIZE, IPC_CREAT | IPC_EXCL | 0600);
593 |
594 | if (shm_id < 0)
595 | PFATAL("shmget() failed");
596 |
597 | atexit(remove_shm);
598 |
599 | shm_str = alloc_printf("%d", shm_id);
600 |
601 | setenv(SHM_ENV_VAR, shm_str, 1);
602 |
603 | ck_free(shm_str);
604 |
605 | trace_bits = shmat(shm_id, NULL, 0);
606 |
607 | if (!trace_bits)
608 | PFATAL("shmat() failed");
609 |
610 | memset(virgin_bits, 255, MAP_SIZE);
611 | }
612 |
613 | /* Write results. */
614 |
615 | static u32 write_results(void)
616 | {
617 |
618 | s32 fd;
619 | u32 i, ret = 0;
620 |
621 | u8 cco = !!getenv("AFL_CMIN_CRASHES_ONLY"),
622 | caa = !!getenv("AFL_CMIN_ALLOW_ANY");
623 |
624 | if (!strncmp(trace_file, "/dev/", 5))
625 | {
626 |
627 | fd = open(trace_file, O_WRONLY, 0600);
628 | if (fd < 0)
629 | PFATAL("Unable to open '%s'", trace_file);
630 | }
631 | else if (!strcmp(trace_file, "-"))
632 | {
633 |
634 | fd = dup(1);
635 | if (fd < 0)
636 | PFATAL("Unable to open stdout");
637 | }
638 | else
639 | {
640 |
641 | unlink(trace_file); /* Ignore errors */
642 | fd = open(trace_file, O_WRONLY | O_CREAT | O_EXCL, 0600);
643 | if (fd < 0)
644 | PFATAL("Unable to create '%s'", trace_file);
645 | }
646 |
647 | if (binary_mode)
648 | {
649 |
650 | for (i = 0; i < MAP_SIZE; i++)
651 | if (trace_bits[i])
652 | ret++;
653 |
654 | ck_write(fd, trace_bits, MAP_SIZE, trace_file);
655 | close(fd);
656 | }
657 | else
658 | {
659 |
660 | FILE *f = fdopen(fd, "w");
661 |
662 | if (!f)
663 | PFATAL("fdopen() failed");
664 |
665 | for (i = 0; i < MAP_SIZE; i++)
666 | {
667 |
668 | if (!trace_bits[i])
669 | continue;
670 | ret++;
671 |
672 | fprintf(f, "%06u:%u\n", i, trace_bits[i]);
673 | }
674 |
675 | fclose(f);
676 | }
677 |
678 | return ret;
679 | }
680 |
681 | /* Write results. */
682 |
683 | static u32 write_slot_val_file(u8 *filename, struct slot_val *list)
684 | {
685 |
686 | s32 fd;
687 | u32 i, ret = 0;
688 |
689 | if (!strncmp(filename, "/dev/", 5))
690 | {
691 |
692 | fd = open(filename, O_WRONLY, 0600);
693 | if (fd < 0)
694 | PFATAL("Unable to open '%s'", filename);
695 | }
696 | else if (!strcmp(filename, "-"))
697 | {
698 |
699 | fd = dup(1);
700 | if (fd < 0)
701 | PFATAL("Unable to open stdout");
702 | }
703 | else
704 | {
705 |
706 | unlink(filename); /* Ignore errors */
707 | fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, 0600);
708 | if (fd < 0)
709 | PFATAL("Unable to create '%s'", filename);
710 | }
711 |
712 | FILE *f = fdopen(fd, "w");
713 |
714 | if (!f)
715 | PFATAL("fdopen() failed");
716 |
717 | while (list != NULL)
718 | {
719 | SAYF("slot is %lld, value is %d\n", list->slot, list->val);
720 | fprintf(f, "%10lld:%d\n", list->slot, list->val);
721 | list = list->next;
722 | }
723 |
724 | fclose(f);
725 |
726 | return ret;
727 | }
728 |
729 | // update the slots for the seeds in queue; use param here to avoid modifying
730 | // the real head
731 |
732 | void update_slots(struct queue_entry *head)
733 | {
734 | while (head)
735 | {
736 | head->sec_slot = head->mtime - min_mtime;
737 | head->min_slot = head->sec_slot / 60;
738 | head->hour_slot = head->sec_slot / 3600;
739 | head = head->next;
740 | }
741 | }
742 |
743 | /* Handle timeout signal. */
744 |
745 | static void handle_timeout(int sig)
746 | {
747 |
748 | child_timed_out = 1;
749 | if (child_pid > 0)
750 | kill(child_pid, SIGKILL);
751 | }
752 |
753 | /* Execute target application. */
754 |
755 | static void run_target(char **argv)
756 | {
757 |
758 | static struct itimerval it;
759 | int status = 0;
760 |
761 | if (!quiet_mode)
762 | SAYF("-- Program output begins --\n" cRST);
763 |
764 | memset(trace_bits, 0, MAP_SIZE);
765 | MEM_BARRIER();
766 |
767 | child_pid = fork();
768 |
769 | if (child_pid < 0)
770 | PFATAL("fork() failed");
771 |
772 | if (!child_pid)
773 | {
774 |
775 | struct rlimit r;
776 |
777 | if (quiet_mode)
778 | {
779 |
780 | if (dev_null_fd < 0 || dup2(dev_null_fd, 1) < 0 ||
781 | dup2(dev_null_fd, 2) < 0)
782 | {
783 | *(u32 *)trace_bits = EXEC_FAIL_SIG;
784 | PFATAL("Descriptor initialization failed");
785 | }
786 |
787 | close(dev_null_fd);
788 | }
789 |
790 | if (mem_limit)
791 | {
792 |
793 | r.rlim_max = r.rlim_cur = ((rlim_t)mem_limit) << 20;
794 |
795 | #ifdef RLIMIT_AS
796 |
797 | setrlimit(RLIMIT_AS, &r); /* Ignore errors */
798 |
799 | #else
800 |
801 | setrlimit(RLIMIT_DATA, &r); /* Ignore errors */
802 |
803 | #endif /* ^RLIMIT_AS */
804 | }
805 |
806 | if (!keep_cores)
807 | r.rlim_max = r.rlim_cur = 0;
808 | else
809 | r.rlim_max = r.rlim_cur = RLIM_INFINITY;
810 |
811 | setrlimit(RLIMIT_CORE, &r); /* Ignore errors */
812 |
813 | if (!getenv("LD_BIND_LAZY"))
814 | setenv("LD_BIND_NOW", "1", 0);
815 |
816 | setsid();
817 |
818 | if (use_stdin)
819 | {
820 | FILE *temp;
821 | s32 out_fd;
822 | temp = fopen(out_file, "r");
823 | out_fd = fileno(temp);
824 | s32 ret = dup2(out_fd, 0);
825 | if (ret == -1)
826 | {
827 | FATAL("Error dup2 for stdin: message is %s", strerror(errno));
828 | }
829 | close(out_fd);
830 | }
831 |
832 | execv(target_path, argv);
833 |
834 | *(u32 *)trace_bits = EXEC_FAIL_SIG;
835 | exit(0);
836 | }
837 |
838 | /* Configure timeout, wait for child, cancel timeout. */
839 |
840 | if (exec_tmout)
841 | {
842 |
843 | child_timed_out = 0;
844 | it.it_value.tv_sec = (exec_tmout / 1000);
845 | it.it_value.tv_usec = (exec_tmout % 1000) * 1000;
846 | }
847 |
848 | setitimer(ITIMER_REAL, &it, NULL);
849 |
850 | if (waitpid(child_pid, &status, 0) <= 0)
851 | FATAL("waitpid() failed");
852 |
853 | child_pid = 0;
854 | it.it_value.tv_sec = 0;
855 | it.it_value.tv_usec = 0;
856 | setitimer(ITIMER_REAL, &it, NULL);
857 |
858 | MEM_BARRIER();
859 |
860 | /* Clean up bitmap, analyze exit condition, etc. */
861 |
862 | if (*(u32 *)trace_bits == EXEC_FAIL_SIG)
863 | FATAL("Unable to execute '%s'", argv[0]);
864 |
865 | classify_counts(trace_bits,
866 | binary_mode ? count_class_binary : count_class_human);
867 |
868 | if (!quiet_mode)
869 | SAYF(cRST "-- Program output ends --\n");
870 |
871 | if (!child_timed_out && !stop_soon && WIFSIGNALED(status))
872 | child_crashed = 1;
873 |
874 | if (!quiet_mode)
875 | {
876 |
877 | if (child_timed_out)
878 | SAYF(cLRD "\n+++ Program timed off +++\n" cRST);
879 | else if (stop_soon)
880 | SAYF(cLRD "\n+++ Program aborted by user +++\n" cRST);
881 | else if (child_crashed)
882 | SAYF(cLRD "\n+++ Program killed by signal %u +++\n" cRST,
883 | WTERMSIG(status));
884 | }
885 | }
886 |
887 | /* Handle Ctrl-C and the like. */
888 |
889 | static void handle_stop_sig(int sig)
890 | {
891 |
892 | stop_soon = 1;
893 |
894 | if (child_pid > 0)
895 | kill(child_pid, SIGKILL);
896 | }
897 |
898 | /* Do basic preparations - persistent fds, filenames, etc. */
899 |
900 | static void set_up_environment(void)
901 | {
902 |
903 | setenv("ASAN_OPTIONS", "abort_on_error=1:"
904 | "detect_leaks=0:"
905 | "symbolize=0:"
906 | "allocator_may_return_null=1",
907 | 0);
908 |
909 | setenv("MSAN_OPTIONS",
910 | "exit_code=" STRINGIFY(MSAN_ERROR) ":"
911 | "symbolize=0:"
912 | "abort_on_error=1:"
913 | "allocator_may_return_null=1:"
914 | "msan_track_origins=0",
915 | 0);
916 |
917 | if (getenv("AFL_PRELOAD"))
918 | {
919 | setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1);
920 | setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1);
921 | }
922 | }
923 |
924 | /* Setup signal handlers, duh. */
925 |
926 | static void setup_signal_handlers(void)
927 | {
928 |
929 | struct sigaction sa;
930 |
931 | sa.sa_handler = NULL;
932 | sa.sa_flags = SA_RESTART;
933 | sa.sa_sigaction = NULL;
934 |
935 | sigemptyset(&sa.sa_mask);
936 |
937 | /* Various ways of saying "stop". */
938 |
939 | sa.sa_handler = handle_stop_sig;
940 | sigaction(SIGHUP, &sa, NULL);
941 | sigaction(SIGINT, &sa, NULL);
942 | sigaction(SIGTERM, &sa, NULL);
943 |
944 | /* Exec timeout notifications. */
945 |
946 | sa.sa_handler = handle_timeout;
947 | sigaction(SIGALRM, &sa, NULL);
948 | }
949 |
950 | /* Detect @@ in args. */
951 |
952 | void detect_file_args(char **argv)
953 | {
954 |
955 | u32 i = 0;
956 | u8 *cwd = getcwd(NULL, 0);
957 |
958 | if (!cwd)
959 | PFATAL("getcwd() failed");
960 |
961 | /* If we don't have a file name chosen yet, use a safe default. */
962 |
963 | if (!out_file)
964 | out_file = alloc_printf("%s/.cur_input", out_dir);
965 |
966 | while (argv[i])
967 | {
968 |
969 | u8 *aa_loc = strstr(argv[i], "@@");
970 |
971 | if (aa_loc)
972 | {
973 |
974 | use_stdin = 0;
975 |
976 | u8 *aa_subst, *n_arg;
977 |
978 | /* Be sure that we're always using fully-qualified paths. */
979 |
980 | if (out_file[0] == '/')
981 | aa_subst = out_file;
982 | else
983 | aa_subst = alloc_printf("%s/%s", cwd, out_file);
984 |
985 | /* Construct a replacement argv value. */
986 |
987 | *aa_loc = 0;
988 | n_arg = alloc_printf("%s%s%s", argv[i], aa_subst, aa_loc + 2);
989 | argv[i] = n_arg;
990 | *aa_loc = '@';
991 |
992 | if (out_file[0] != '/')
993 | ck_free(aa_subst);
994 | }
995 |
996 | i++;
997 | }
998 |
999 | free(cwd); /* not tracked */
1000 | }
1001 |
1002 | /* Show banner. */
1003 |
1004 | static void show_banner(void)
1005 | {
1006 | SAYF(cCYA "showmaps utility " cBRI VERSION cRST " by ThePatrickStar\n");
1007 | }
1008 |
1009 | /* Display usage hints. */
1010 |
1011 | static void usage(u8 *argv0)
1012 | {
1013 |
1014 | show_banner();
1015 |
1016 | SAYF("\n%s [ options ] -- /path/to/target_app [ ... ]\n\n"
1017 |
1018 | "Required parameters:\n\n"
1019 |
1020 | " -i dir - input directory with test cases\n"
1021 | " -o dir - output directory\n\n"
1022 |
1023 | "Execution control settings:\n\n"
1024 |
1025 | " -f file - location read by the fuzzed program (stdin)\n"
1026 | " -t msec - timeout for each run (none)\n"
1027 | " -m megs - memory limit for child process (%u MB)\n"
1028 | " -s - skip individual trace file generation (speed up) \n\n"
1029 |
1030 | "Other settings:\n\n"
1031 |
1032 | " -T sec - the timestamp to be used as min_mtime (optional)\n"
1033 | " -q - sink program's output and don't show messages\n"
1034 | " -e - show edge coverage only, ignore hit counts\n"
1035 | " -E - count for N.O. of entries only, ignore coverage\n"
1036 | " -S number - skip the number of files for start time counting\n"
1037 | " -c - allow core dumps\n\n"
1038 |
1039 | "This tool displays raw tuple data captured by AFL "
1040 | "instrumentation.\n\n" cRST,
1041 |
1042 | argv0, MEM_LIMIT);
1043 |
1044 | exit(1);
1045 | }
1046 |
1047 | /* Find binary. */
1048 |
1049 | static void find_binary(u8 *fname)
1050 | {
1051 |
1052 | u8 *env_path = 0;
1053 | struct stat st;
1054 |
1055 | if (strchr(fname, '/') || !(env_path = getenv("PATH")))
1056 | {
1057 |
1058 | target_path = ck_strdup(fname);
1059 |
1060 | if (stat(target_path, &st) || !S_ISREG(st.st_mode) ||
1061 | !(st.st_mode & 0111) || st.st_size < 4)
1062 | FATAL("Program '%s' not found or not executable", fname);
1063 | }
1064 | else
1065 | {
1066 |
1067 | while (env_path)
1068 | {
1069 |
1070 | u8 *cur_elem, *delim = strchr(env_path, ':');
1071 |
1072 | if (delim)
1073 | {
1074 |
1075 | cur_elem = ck_alloc(delim - env_path + 1);
1076 | memcpy(cur_elem, env_path, delim - env_path);
1077 | delim++;
1078 | }
1079 | else
1080 | cur_elem = ck_strdup(env_path);
1081 |
1082 | env_path = delim;
1083 |
1084 | if (cur_elem[0])
1085 | target_path = alloc_printf("%s/%s", cur_elem, fname);
1086 | else
1087 | target_path = ck_strdup(fname);
1088 |
1089 | ck_free(cur_elem);
1090 |
1091 | if (!stat(target_path, &st) && S_ISREG(st.st_mode) &&
1092 | (st.st_mode & 0111) && st.st_size >= 4)
1093 | break;
1094 |
1095 | ck_free(target_path);
1096 | target_path = 0;
1097 | }
1098 |
1099 | if (!target_path)
1100 | FATAL("Program '%s' not found or not executable", fname);
1101 | }
1102 | }
1103 |
1104 | /* Prepare output directories and fds. */
1105 |
1106 | void setup_dirs_fds(void)
1107 | {
1108 |
1109 | u8 *tmp;
1110 |
1111 | ACTF("Setting up output directories...");
1112 |
1113 | if (mkdir(out_dir, 0700))
1114 | {
1115 |
1116 | if (errno != EEXIST)
1117 | PFATAL("Unable to create '%s'", out_dir);
1118 |
1119 | PFATAL("Directory '%s' exists!", out_dir);
1120 | }
1121 | else
1122 | {
1123 |
1124 | out_dir_fd = open(out_dir, O_RDONLY);
1125 |
1126 | #ifndef __sun
1127 |
1128 | if (out_dir_fd < 0 || flock(out_dir_fd, LOCK_EX | LOCK_NB))
1129 | PFATAL("Unable to flock() output directory.");
1130 |
1131 | #endif /* !__sun */
1132 | }
1133 |
1134 | /* The directory to store all the traces (same name as input) */
1135 | if (!skip_individual && !entries_only)
1136 | {
1137 | tmp = alloc_printf("%s/traces", out_dir);
1138 | if (mkdir(tmp, 0700))
1139 | PFATAL("Unable to create '%s'", tmp);
1140 | ck_free(tmp);
1141 | }
1142 |
1143 | /* Generally useful file descriptors. */
1144 |
1145 | dev_null_fd = open("/dev/null", O_RDWR);
1146 | if (dev_null_fd < 0)
1147 | PFATAL("Unable to open /dev/null");
1148 |
1149 | dev_urandom_fd = open("/dev/urandom", O_RDONLY);
1150 | if (dev_urandom_fd < 0)
1151 | PFATAL("Unable to open /dev/urandom");
1152 | }
1153 |
1154 | /* Append new test case to the queue. */
1155 |
1156 | static void add_to_queue(u8 *fname, u32 len, u64 mtime)
1157 | {
1158 |
1159 | struct queue_entry *q = ck_alloc(sizeof(struct queue_entry));
1160 |
1161 | q->fname = fname;
1162 | q->len = len;
1163 | q->mtime = mtime;
1164 | q->prev = NULL;
1165 |
1166 | if (queued_paths >= skip_no)
1167 | {
1168 |
1169 | if (queued_paths == skip_no)
1170 | {
1171 | max_mtime = mtime;
1172 | if (!given_min_mtime)
1173 | min_mtime = mtime;
1174 | }
1175 |
1176 | if (mtime >= max_mtime)
1177 | max_mtime = mtime;
1178 | if (mtime <= min_mtime && !given_min_mtime)
1179 | min_mtime = mtime;
1180 | }
1181 |
1182 | if (queue_top)
1183 | {
1184 |
1185 | queue_top->next = q;
1186 | q->prev = queue_top;
1187 | queue_top = q;
1188 | }
1189 | else
1190 | queue = queue_top = q;
1191 |
1192 | queued_paths++;
1193 | }
1194 |
1195 | // Append to slot_val list
1196 |
1197 | static void add_slot_val(struct slot_val **list, struct slot_val **list_top,
1198 | u64 slot, u32 val)
1199 | {
1200 |
1201 | struct slot_val *tmp = *list;
1202 |
1203 | while (tmp != NULL)
1204 | {
1205 | if (tmp->slot == slot)
1206 | {
1207 | tmp->val = val;
1208 | return;
1209 | }
1210 | tmp = tmp->next;
1211 | }
1212 |
1213 | struct slot_val *s = ck_alloc(sizeof(struct slot_val));
1214 | s->slot = slot;
1215 | s->val = val;
1216 | s->next = NULL;
1217 |
1218 | if (*list_top)
1219 | {
1220 | (*list_top)->next = s;
1221 | (*list_top) = s;
1222 | }
1223 | else
1224 | (*list) = (*list_top) = s;
1225 | }
1226 |
1227 | static void read_testcases(void)
1228 | {
1229 |
1230 | struct dirent **nl;
1231 | s32 nl_cnt;
1232 | u32 i;
1233 | u8 *fn;
1234 |
1235 | /* Auto-detect non-in-place resumption attempts. */
1236 |
1237 | fn = alloc_printf("%s/queue", in_dir);
1238 | if (!access(fn, F_OK))
1239 | in_dir = fn;
1240 | else
1241 | ck_free(fn);
1242 |
1243 | ACTF("Scanning '%s'...", in_dir);
1244 |
1245 | /* We use scandir() + alphasort() rather than readdir() because otherwise,
1246 | the ordering of test cases would vary somewhat randomly and would be
1247 | difficult to control. */
1248 |
1249 | nl_cnt = scandir(in_dir, &nl, NULL, alphasort);
1250 |
1251 | if (nl_cnt < 0)
1252 | {
1253 |
1254 | if (errno == ENOENT || errno == ENOTDIR)
1255 |
1256 | SAYF("\n" cLRD "[-] " cRST "The input directory does not seem to be "
1257 | "valid - try again. The fuzzer needs\n"
1258 | " one or more test case to start with - ideally, a small file "
1259 | "under 1 kB\n"
1260 | " or so. The cases must be stored as regular files directly in "
1261 | "the input\n"
1262 | " directory.\n");
1263 |
1264 | PFATAL("Unable to open '%s'", in_dir);
1265 | }
1266 |
1267 | for (i = 0; i < nl_cnt; i++)
1268 | {
1269 |
1270 | struct stat st;
1271 |
1272 | u8 *fn = alloc_printf("%s/%s", in_dir, nl[i]->d_name);
1273 |
1274 | u8 passed_det = 0;
1275 |
1276 | free(nl[i]); /* not tracked */
1277 |
1278 | if (lstat(fn, &st) || access(fn, R_OK))
1279 | PFATAL("Unable to access '%s'", fn);
1280 |
1281 | /* This also takes care of . and .. */
1282 |
1283 | if (!S_ISREG(st.st_mode) || !st.st_size || strstr(fn, "/README.txt"))
1284 | {
1285 |
1286 | ck_free(fn);
1287 | continue;
1288 | }
1289 |
1290 | if (st.st_size > MAX_FILE)
1291 | FATAL("Test case '%s' is too big (%s, limit is %s)", fn, DMS(st.st_size),
1292 | DMS(MAX_FILE));
1293 |
1294 | u64 mtime = (u64)st.st_mtim.tv_sec;
1295 |
1296 | add_to_queue(fn, st.st_size, mtime);
1297 | }
1298 |
1299 | free(nl); /* not tracked */
1300 |
1301 | if (!queued_paths)
1302 | {
1303 |
1304 | SAYF("\n" cLRD "[-] " cRST "Looks like there are no valid test cases in "
1305 | "the input directory! The fuzzer\n"
1306 | " needs one or more test case to start with - ideally, a small "
1307 | "file under\n"
1308 | " 1 kB or so. The cases must be stored as regular files directly "
1309 | "in the\n"
1310 | " input directory.\n");
1311 |
1312 | FATAL("No usable test cases in '%s'", in_dir);
1313 | }
1314 | }
1315 |
1316 | /* Helper function: link() if possible, copy otherwise. */
1317 |
1318 | static void link_or_copy(u8 *old_path, u8 *new_path)
1319 | {
1320 |
1321 | s32 i = link(old_path, new_path);
1322 | s32 sfd, dfd;
1323 | u8 *tmp;
1324 |
1325 | if (!i)
1326 | return;
1327 |
1328 | sfd = open(old_path, O_RDONLY);
1329 | if (sfd < 0)
1330 | PFATAL("Unable to open '%s'", old_path);
1331 |
1332 | dfd = open(new_path, O_WRONLY | O_CREAT | O_EXCL, 0600);
1333 | if (dfd < 0)
1334 | PFATAL("Unable to create '%s'", new_path);
1335 |
1336 | tmp = ck_alloc(64 * 1024);
1337 |
1338 | while ((i = read(sfd, tmp, 64 * 1024)) > 0)
1339 | ck_write(dfd, tmp, i, new_path);
1340 |
1341 | if (i < 0)
1342 | PFATAL("read() failed");
1343 |
1344 | ck_free(tmp);
1345 | close(sfd);
1346 | close(dfd);
1347 | }
1348 |
1349 | /* Main entry point */
1350 |
1351 | int main(int argc, char **argv)
1352 | {
1353 |
1354 | s32 opt;
1355 | u8 mem_limit_given = 0, timeout_given = 0, skip_no_given = 0;
1356 | u32 tcnt;
1357 | char **use_argv;
1358 |
1359 | while ((opt = getopt(argc, argv, "+i:o:f:m:t:S:T:Eeqbcs")) > 0)
1360 |
1361 | switch (opt)
1362 | {
1363 |
1364 | case 'i': /* input dir */
1365 |
1366 | if (in_dir)
1367 | FATAL("Multiple -i options not supported");
1368 | in_dir = optarg;
1369 | break;
1370 |
1371 | case 'o':
1372 |
1373 | if (out_dir)
1374 | FATAL("Multiple -o options not supported");
1375 | out_dir = optarg;
1376 | break;
1377 |
1378 | case 'f': /* target file */
1379 |
1380 | if (out_file)
1381 | FATAL("Multiple -f options not supported");
1382 | out_file = optarg;
1383 | break;
1384 |
1385 | case 'm':
1386 | {
1387 |
1388 | u8 suffix = 'M';
1389 |
1390 | if (mem_limit_given)
1391 | FATAL("Multiple -m options not supported");
1392 | mem_limit_given = 1;
1393 |
1394 | if (!strcmp(optarg, "none"))
1395 | {
1396 | mem_limit = 0;
1397 | break;
1398 | }
1399 |
1400 | if (sscanf(optarg, "%llu%c", &mem_limit, &suffix) < 1 || optarg[0] == '-')
1401 | FATAL("Bad syntax used for -m");
1402 |
1403 | switch (suffix)
1404 | {
1405 | case 'T':
1406 | mem_limit *= 1024 * 1024;
1407 | break;
1408 | case 'G':
1409 | mem_limit *= 1024;
1410 | break;
1411 | case 'k':
1412 | mem_limit /= 1024;
1413 | break;
1414 | case 'M':
1415 | break;
1416 |
1417 | default:
1418 | FATAL("Unsupported suffix or bad syntax for -m");
1419 | }
1420 |
1421 | if (mem_limit < 5)
1422 | FATAL("Dangerously low value of -m");
1423 |
1424 | if (sizeof(rlim_t) == 4 && mem_limit > 2000)
1425 | FATAL("Value of -m out of range on 32-bit systems");
1426 | }
1427 |
1428 | break;
1429 |
1430 | case 't':
1431 |
1432 | if (timeout_given)
1433 | FATAL("Multiple -t options not supported");
1434 | timeout_given = 1;
1435 |
1436 | if (strcmp(optarg, "none"))
1437 | {
1438 | exec_tmout = atoi(optarg);
1439 |
1440 | if (exec_tmout < 20 || optarg[0] == '-')
1441 | FATAL("Dangerously low value of -t");
1442 | }
1443 |
1444 | break;
1445 |
1446 | case 'S':
1447 |
1448 | if (skip_no_given)
1449 | FATAL("Multiple -S options not supported");
1450 | skip_no_given = 1;
1451 |
1452 | skip_no = atoi(optarg);
1453 |
1454 | break;
1455 |
1456 | case 'e':
1457 |
1458 | if (edges_only)
1459 | FATAL("Multiple -e options not supported");
1460 | edges_only = 1;
1461 | break;
1462 |
1463 | case 'q':
1464 |
1465 | if (quiet_mode)
1466 | FATAL("Multiple -q options not supported");
1467 | quiet_mode = 1;
1468 | break;
1469 |
1470 | case 'b':
1471 |
1472 | /* Secret undocumented mode. Writes output in raw binary format
1473 | similar to that dumped by afl-fuzz in has_new_cov = 0;
1562 | // SAYF("current fname is %s, queue_cur mtime is: %lld, sec_slot is: %lld, min_slot is: %lld, hour_slot is: %lld\n",\
1563 | // queue_cur->fname, queue_cur->mtime, queue_cur->sec_slot, queue_cur->min_slot, queue_cur->hour_slot);
1564 | u64 slot = queue_cur->sec_slot;
1565 | if (current_no >= skip_no && (int)slot >= 0)
1566 | {
1567 | SAYF("current fname is %s, queue_cur mtime is: %lld, sec_slot is: %lld\n",
1568 | queue_cur->fname, queue_cur->mtime, queue_cur->sec_slot);
1569 | }
1570 | else
1571 | {
1572 | SAYF("skipping but still executing %s, queue_cur mtime is: %lld, "
1573 | "sec_slot is: %lld\n",
1574 | queue_cur->fname, queue_cur->mtime, queue_cur->sec_slot);
1575 | }
1576 |
1577 | if (!entries_only)
1578 | {
1579 | // create hard link of current item to the out_file
1580 | link_or_copy(queue_cur->fname, out_file);
1581 |
1582 | // run the program against the current item
1583 | run_target(use_argv);
1584 |
1585 | // delete the out_file
1586 | unlink(out_file);
1587 |
1588 | if (!skip_individual && current_no >= skip_no)
1589 | {
1590 |
1591 | // setup the path for the new trace file
1592 | pure_fname = strrchr(queue_cur->fname, '/');
1593 | trace_file = alloc_printf("%s/traces/%s.txt", out_dir, pure_fname);
1594 |
1595 | // write the trace
1596 | write_results();
1597 |
1598 | ck_free(trace_file);
1599 | }
1600 |
1601 | // classify the trace as log2 based
1602 | #ifdef __x86_64__
1603 | classify_trace_counts((u64 *)trace_bits);
1604 | #else
1605 | classify_trace_counts((u32 *)trace_bits);
1606 | #endif /* ^__x86_64__ */
1607 |
1608 | // update virgin bits
1609 | ret_new_bits = has_new_bits(virgin_bits);
1610 |
1611 | if (ret_new_bits)
1612 | {
1613 | queue_cur->has_new_cov = 1;
1614 | cov_entries_no += 1;
1615 | }
1616 |
1617 | u32 bitmap_size = count_non_255_bytes(virgin_bits);
1618 | // SAYF("bitmap_size is %d\n", bitmap_size);
1619 | if (current_no >= skip_no && (int)slot >= 0) {
1620 | add_slot_val(&slot_edge, &slot_edge_top, slot, bitmap_size);
1621 | add_slot_val(&mtime_edge, &mtime_edge_top, queue_cur->mtime, bitmap_size);
1622 | }
1623 |
1624 | }
1625 |
1626 | entries_no++;
1627 | if (current_no >= skip_no && (int)slot >= 0)
1628 | {
1629 | add_slot_val(&slot_entry, &slot_entry_top, slot, entries_no);
1630 | add_slot_val(&mtime_entry, &mtime_entry_top, queue_cur->mtime, entries_no);
1631 | if (queue_cur->has_new_cov) {
1632 | add_slot_val(&cov_slot_entry, &cov_slot_entry_top, slot,
1633 | cov_entries_no);
1634 | add_slot_val(&mtime_cov_entry, &mtime_cov_entry_top, queue_cur->mtime, cov_entries_no);
1635 | }
1636 | }
1637 |
1638 | // move to the next item in queue
1639 | queue_cur = queue_cur->next;
1640 | current_no++;
1641 | }
1642 |
1643 | if (!entries_only)
1644 | {
1645 |
1646 | u8 *slot_edge_file = alloc_printf("%s/slot_edge.txt", out_dir);
1647 |
1648 | write_slot_val_file(slot_edge_file, slot_edge);
1649 |
1650 | ck_free(slot_edge_file);
1651 |
1652 | u8 *mtime_edge_file = alloc_printf("%s/mtime_edge.txt", out_dir);
1653 |
1654 | write_slot_val_file(mtime_edge_file, mtime_edge);
1655 |
1656 | ck_free(mtime_edge_file);
1657 |
1658 | u8 *cov_slot_entry_file = alloc_printf("%s/cov_slot_entry.txt", out_dir);
1659 |
1660 | write_slot_val_file(cov_slot_entry_file, cov_slot_entry);
1661 |
1662 | ck_free(cov_slot_entry_file);
1663 |
1664 | u8 *mtime_cov_entry_file = alloc_printf("%s/mtime_cov_entry.txt", out_dir);
1665 |
1666 | write_slot_val_file(mtime_cov_entry_file, mtime_cov_entry);
1667 |
1668 | ck_free(mtime_cov_entry_file);
1669 | }
1670 |
1671 | u8 *slot_entry_file = alloc_printf("%s/slot_entry.txt", out_dir);
1672 |
1673 | write_slot_val_file(slot_entry_file, slot_entry);
1674 |
1675 | ck_free(slot_entry_file);
1676 |
1677 | u8 *mtime_entry_file = alloc_printf("%s/mtime_entry.txt", out_dir);
1678 |
1679 | write_slot_val_file(mtime_entry_file, mtime_entry);
1680 |
1681 | ck_free(mtime_entry_file);
1682 | }
1683 |
--------------------------------------------------------------------------------
/showmaps/test.sh:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env bash
2 |
3 | make
4 |
5 | rm -rf test/out/
6 | rm -rf test/out-simple/
7 | rm -rf test/out-entry/
8 |
9 | ./showmaps -i test/queue -o test/out -q -- ./test/mjs-afl @@
10 |
11 | ./showmaps -i test/queue -o test/out-simple -q -s -- ./test/mjs-afl @@
12 |
13 | ./showmaps -i test/queue -o test/out-entry -E
--------------------------------------------------------------------------------
/showmaps/test/exiv2-afl:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ThePatrickStar/fuzzer-data-collector/7ba2d9a79d35243cc3504aa8e4a27e8a205e26ec/showmaps/test/exiv2-afl
--------------------------------------------------------------------------------
/showmaps/test/hang-exiv2/hang20may:
--------------------------------------------------------------------------------
1 | MM *
--------------------------------------------------------------------------------
/showmaps/test/mjs-afl:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ThePatrickStar/fuzzer-data-collector/7ba2d9a79d35243cc3504aa8e4a27e8a205e26ec/showmaps/test/mjs-afl
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000000,orig:err1.js:
--------------------------------------------------------------------------------
1 |
2 | function err1f2() {
3 | return bar;
4 | }
5 |
6 | function err1f1() {
7 | return err1f2();
8 | }
9 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000001,orig:err2.js:
--------------------------------------------------------------------------------
1 |
2 | function err2f1() {
3 | return err2f2();
4 | }
5 |
6 | function err2f2() {
7 | return bar;
8 | }
9 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000002,orig:module1.js:
--------------------------------------------------------------------------------
1 | let foo = 1;
2 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000003,orig:module2.js:
--------------------------------------------------------------------------------
1 | let o = {
2 | a: 1,
3 | foo: ffi('int foo(int)'),
4 | };
5 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000004,orig:test_1.js:
--------------------------------------------------------------------------------
1 | let o = {a: 1, 'b': 2, c: {d: 3}, d: [1, 2, 3, 'xx']};
2 | let a = 'foo', b = 'bar';
3 | let s1 = 'a' + "b";
4 | let s2 = 'abcdef' + "123456";
5 | 1 - 2 + 3 + o['a'] + o.c.d + o.b === 8 && a === "foo" && a !== b &&
6 | s1 === 'ab' && s2 === 'abcdef123456' && o.d[0] === 1 && o.d[3] === 'xx' &&
7 | o.d[4] === undefined;
8 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000005,orig:test_10.js:
--------------------------------------------------------------------------------
1 | (1 ? 2 : 3) === 2 && (0 ? 2 : 3) === 3 && (0 ? 1 : 2 ? 3 : 4) === 3 &&
2 | (0 ? 1 : false ? 3 : 4) === 4 && (0 ? 1 ? 2 : 3 : 4) === 4 &&
3 | (1 ? 0 ? 2 : 3 : 4) === 3 && (1 ? 1 ? 2 : 3 : 4) === 2;
4 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000006,orig:test_11.js:
--------------------------------------------------------------------------------
1 | let s = '{"a": 1, "b": "foo", "c": true, "d": [null], "e": "1\\n2"}';
2 | let o = JSON.parse(s);
3 | let z = JSON.parse('""'); // Zlength string
4 | let s2 = JSON.stringify(o);
5 | s2 === '{"e":"1\\n2","d":[null],"c":true,"b":"foo","a":1}' && o.c && o.a === 1 && o.e === '1\n2' && z === '';
6 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000007,orig:test_12.js:
--------------------------------------------------------------------------------
1 | typeof 1 === 'number' && typeof('foo') === 'string' && typeof '' === 'string' &&
2 | typeof(1 === 2) === 'boolean' && typeof(true) === 'boolean' &&
3 | typeof false === 'boolean' && typeof[] === 'array' &&
4 | typeof({}) === 'object' && typeof print === 'foreign_ptr' &&
5 | typeof(function() {}) === 'function' && typeof null === 'null' &&
6 | typeof undefined === 'undefined';
7 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000008,orig:test_13.js:
--------------------------------------------------------------------------------
1 | let s = '', sum = 0, o = {a: 1, b: 2, c: 3};
2 | for (let k in o) {
3 | s = s + k;
4 | sum += o[k];
5 | }
6 |
7 | // esent in object, false otherwise
8 | let f = function(obj, key) {
9 | for (let k in obj) if (k === key) return true;
10 | return false;
11 | };
12 |
13 | s === 'cba' && sum === 6 && f(o, 'x') === false && f(o, 'b') === true;
14 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000009,orig:test_2.js:
--------------------------------------------------------------------------------
1 | let x = 1, y = 2, z = 3;
2 |
3 | let f = function(x) {
4 | let f2 = function(y) { return x - z + y;
5 | };
6 | return f2(7);
7 | };
8 |
9 | let o = {
10 | x: function(y) {
11 | return y * y;
12 | },
13 | y: function() {
14 | return this.z;
15 | },
16 | z: 123
17 | };
18 |
19 | f(5) === 9 && o.x(12) === 144;
20 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000010,orig:test_3.js:
--------------------------------------------------------------------------------
1 | let a = function() {
2 | return function() {
3 | return true;
4 | };
5 | };
6 |
7 | let b = function() {
8 | for (let i = 3; i < 100; i++) return i;
9 | };
10 |
11 | let c = function() {
12 | let i, res = 0;
13 | for (i = 0; i < 10; i++) {
14 | if (i < 2) continue; res += i;
15 | break;
16 | }
17 | return res;
18 | };
19 |
20 | let d = function() {
21 | let i = -5;
22 | for (let i = 3; i < 100; i++) 1;
23 | return i;
24 | };
25 |
26 |
27 | a()() && b() === 3 && d() === -5 && c() === 2;
28 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000011,orig:test_4.js:
--------------------------------------------------------------------------------
1 | let a = function() {
2 | let y = 17;
3 | let boo = function() {
4 | return y;
5 | };
6 | return boo();
7 | };
8 |
9 | a() === 17;
10 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000012,orig:test_5.js:
--------------------------------------------------------------------------------
1 | // Aruthmetics
2 | 0x64 === 100 && (0 - 14) >>> 2 === 1073741820 && 100 << 3 === 800;
3 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000013,orig:test_6.js:
--------------------------------------------------------------------------------
1 | let x = 1;
2 |
3 | let a = function() {
4 | let x = 2;
5 | {
6 | let y = 3; return y;
7 | }
8 | };
9 |
10 | let b = function() {
11 | return x;
12 | };
13 |
14 | a() === 3 && b() === 1 && x === 1;
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000014,orig:test_7.js:
--------------------------------------------------------------------------------
1 | let x = 1;
2 | let y = x++;
3 | if (x > 0) x++;
4 | x === 3 && y === 1 && !'' === true && !!'' === false;
5 |
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000015,orig:test_8.js:
--------------------------------------------------------------------------------
1 | let i, a = 0, b = 0, c = 0, d = 0, e = 0;
2 |
3 | for (i = 0; i < 10; i++) {
4 | a += i;
5 | }
6 |
7 | while (b++ < 5) c += b;
8 |
9 | while (d++ < 10) {
10 | if (d < 7) continue;
11 | e += d;
12 | break;
13 | }
14 |
15 | a === 45 && c === 15 && e === 7;
--------------------------------------------------------------------------------
/showmaps/test/queue/id:000016,orig:test_9.js:
--------------------------------------------------------------------------------
1 | let o = {};
2 | load('tests/module1.js');
3 | let a = o.foo === undefined;
4 | load('tests/module1.js', o);
5 | let b = o.foo === 1;
6 | a && b && foo + 2 + o.foo === 4;
7 |
--------------------------------------------------------------------------------
/showmaps/types.h:
--------------------------------------------------------------------------------
1 | /*
2 | american fuzzy lop - type definitions and minor macros
3 | ------------------------------------------------------
4 |
5 | Written and maintained by Michal Zalewski
6 |
7 | Copyright 2013, 2014, 2015 Google Inc. All rights reserved.
8 |
9 | Licensed under the Apache License, Version 2.0 (the "License");
10 | you may not use this file except in compliance with the License.
11 | You may obtain a copy of the License at:
12 |
13 | http://www.apache.org/licenses/LICENSE-2.0
14 |
15 | */
16 |
17 | #ifndef _HAVE_TYPES_H
18 | #define _HAVE_TYPES_H
19 |
20 | #include
21 | #include
22 |
23 | typedef uint8_t u8;
24 | typedef uint16_t u16;
25 | typedef uint32_t u32;
26 |
27 | /*
28 |
29 | Ugh. There is an unintended compiler / glibc #include glitch caused by
30 | combining the u64 type an %llu in format strings, necessitating a workaround.
31 |
32 | In essence, the compiler is always looking for 'unsigned long long' for %llu.
33 | On 32-bit systems, the u64 type (aliased to uint64_t) is expanded to
34 | 'unsigned long long' in , so everything checks out.
35 |
36 | But on 64-bit systems, it is #ifdef'ed in the same file as 'unsigned long'.
37 | Now, it only happens in circumstances where the type happens to have the
38 | expected bit width, *but* the compiler does not know that... and complains
39 | about 'unsigned long' being unsafe to pass to %llu.
40 |
41 | */
42 |
43 | #ifdef __x86_64__
44 | typedef unsigned long long u64;
45 | #else
46 | typedef uint64_t u64;
47 | #endif /* ^__x86_64__ */
48 |
49 | typedef int8_t s8;
50 | typedef int16_t s16;
51 | typedef int32_t s32;
52 | typedef int64_t s64;
53 |
54 | #ifndef MIN
55 | # define MIN(_a,_b) ((_a) > (_b) ? (_b) : (_a))
56 | # define MAX(_a,_b) ((_a) > (_b) ? (_a) : (_b))
57 | #endif /* !MIN */
58 |
59 | #define SWAP16(_x) ({ \
60 | u16 _ret = (_x); \
61 | (u16)((_ret << 8) | (_ret >> 8)); \
62 | })
63 |
64 | #define SWAP32(_x) ({ \
65 | u32 _ret = (_x); \
66 | (u32)((_ret << 24) | (_ret >> 24) | \
67 | ((_ret << 8) & 0x00FF0000) | \
68 | ((_ret >> 8) & 0x0000FF00)); \
69 | })
70 |
71 | #ifdef AFL_LLVM_PASS
72 | # define AFL_R(x) (random() % (x))
73 | #else
74 | # define R(x) (random() % (x))
75 | #endif /* ^AFL_LLVM_PASS */
76 |
77 | #define STRINGIFY_INTERNAL(x) #x
78 | #define STRINGIFY(x) STRINGIFY_INTERNAL(x)
79 |
80 | #define MEM_BARRIER() \
81 | asm volatile("" ::: "memory")
82 |
83 | #define likely(_x) __builtin_expect(!!(_x), 1)
84 | #define unlikely(_x) __builtin_expect(!!(_x), 0)
85 |
86 | #endif /* ! _HAVE_TYPES_H */
87 |
--------------------------------------------------------------------------------
/stat_plot/.gitignore:
--------------------------------------------------------------------------------
1 | test/out/
2 | test/data/
3 | test/out_boxplot/
4 | test/out_scatter/
5 | test/out_histogram/
6 | exp/
--------------------------------------------------------------------------------
/stat_plot/conf.py:
--------------------------------------------------------------------------------
1 | import toml
2 |
3 |
4 | def check_bucket(bucket):
5 | valid_buckets = ["sec", "s", "min", "m", "hour", "h"]
6 | bucket = bucket.lower()
7 |
8 | if bucket not in valid_buckets:
9 | print("[!] invalid bucket value: {}".format(bucket))
10 | return False, bucket
11 | else:
12 | bucket = bucket[0]
13 | return True, bucket
14 |
15 |
16 | def parse_config(config_path):
17 | config_valid = True
18 |
19 | with open(config_path) as config_file:
20 | conf_dict = toml.load(config_file)
21 |
22 | fuzzers_dict = conf_dict['fuzzers']
23 |
24 | misc_dict = conf_dict['misc']
25 |
26 | # sanitize the config
27 | for fuzzer_name in fuzzers_dict:
28 | fuzzer = fuzzers_dict[fuzzer_name]
29 | fuzzer['name'] = fuzzer_name
30 | if 'line_style' not in fuzzer:
31 | fuzzer['line_style'] = 'solid'
32 | # only for boxplot stat_type
33 | if 'box_color' not in fuzzer:
34 | fuzzer['box_color'] = 'white'
35 | if len(fuzzer["data_files"]) == 0:
36 | print("[!] {} has no data file!".format(fuzzer_name))
37 | config_valid = False
38 |
39 | if 'stat_type' not in misc_dict:
40 | print("[!] [misc] table misses 'stat_type'!")
41 | config_valid = False
42 |
43 | valid_stat_types = ['overall', 'stest', 'boxplot', 'scatterplot', 'histogram']
44 | if misc_dict['stat_type'] not in valid_stat_types:
45 | print("[!] invalid stat_type: {}".format(misc_dict['stat_type']))
46 | config_valid = False
47 |
48 | if misc_dict['stat_type'] == 'overall':
49 |
50 | if "bucket" not in misc_dict:
51 | misc_dict["bucket"] = ["s"]
52 | else:
53 | bucket_valid, bucket = check_bucket(misc_dict["bucket"])
54 | if not bucket_valid:
55 | config_valid = False
56 | misc_dict["bucket"] = bucket
57 |
58 | if "confidence_lvl" not in misc_dict:
59 | misc_dict["confidence_lvl"] = 0.95
60 |
61 | required_keys = ["out_dir", "ylabel", "file_postfix", "project", "max_time"]
62 |
63 | for r_key in required_keys:
64 | if r_key not in misc_dict:
65 | print("[!] {} (required) is missing is [misc]!".format(r_key))
66 | config_valid = False
67 |
68 | if 'x_log_scale' not in misc_dict:
69 | misc_dict['x_log_scale'] = False
70 | if 'y_log_scale' not in misc_dict:
71 | misc_dict['y_log_scale'] = False
72 |
73 | elif misc_dict['stat_type'] == 'stest':
74 |
75 | required_keys = ["out_dir", "project", "file_postfix"]
76 |
77 | for r_key in required_keys:
78 | if r_key not in misc_dict:
79 | print("[!] {} (required) is missing is [misc]!".format(r_key))
80 | config_valid = False
81 |
82 | elif misc_dict['stat_type'] == 'boxplot':
83 |
84 | required_keys = ["out_dir", "project", "file_postfix", "notch", 'plot_title']
85 |
86 | for r_key in required_keys:
87 | if r_key not in misc_dict:
88 | print("[!] {} (required) is missing is [misc]!".format(r_key))
89 | config_valid = False
90 |
91 | if 'ylim' in misc_dict:
92 | # TODO: add type check
93 | if len(misc_dict['ylim']) != 2:
94 | print('[!] invalid ylim: {} in [misc]!'.format(misc_dict['ylim']))
95 |
96 | elif misc_dict['stat_type'] == 'scatterplot':
97 |
98 | required_keys = ["out_dir", "project", "file_postfix", 'plot_title', 'xlabel', 'ylabel', 'large_font']
99 |
100 | for r_key in required_keys:
101 | if r_key not in misc_dict:
102 | print("[!] {} (required) is missing is [misc]!".format(r_key))
103 | config_valid = False
104 |
105 | elif misc_dict['stat_type'] == 'histogram':
106 |
107 | required_keys = ["out_dir", "project", "file_postfix", 'plot_title', 'xlabel', 'ylabel',
108 | 'large_font', 'n_bins']
109 |
110 | for r_key in required_keys:
111 | if r_key not in misc_dict:
112 | print("[!] {} (required) is missing is [misc]!".format(r_key))
113 | config_valid = False
114 |
115 | return config_valid, fuzzers_dict, misc_dict
116 |
--------------------------------------------------------------------------------
/stat_plot/confgen.py:
--------------------------------------------------------------------------------
1 | import toml
2 | import argparse
3 | import os
4 | import re
5 | from pathlib import Path
6 | import fnmatch
7 |
8 |
9 | def main():
10 | parser = argparse.ArgumentParser()
11 | parser.add_argument("--config", "-c", required=True, type=str)
12 | parser.add_argument("--verbose", "-v", required=False, action="store_true")
13 | parser.add_argument("--output", "-o", required=True, type=str)
14 | parser.add_argument("--inputs", "-i", action='append', required=True)
15 | args = parser.parse_args()
16 |
17 | config_path = os.path.abspath(args.config)
18 | verbose = args.verbose
19 |
20 | #print('inputs is %s' % (args.inputs))
21 | #print('output is %s' % (args.output))
22 | #exit(1)
23 | print("[*] config file is {}".format(config_path))
24 |
25 | conf_dict = {}
26 | with open(config_path) as config_file:
27 | conf_dict = toml.load(config_file)
28 | # TODO check config validity
29 |
30 | if not os.path.exists(args.output):
31 | os.makedirs(args.output)
32 |
33 | # find all the data files
34 | all_data_files = []
35 | for fname in conf_dict['objective_filenames']:
36 | for base_dir in args.inputs:
37 | for fpath in Path(base_dir).rglob(fname):
38 | if verbose:
39 | print(os.path.abspath(str(fpath)))
40 | all_data_files.append(fpath)
41 |
42 | # create one config for every target * obj
43 | for t, target_name in enumerate(conf_dict['target_names']):
44 | for o, objective in enumerate(conf_dict['objectives']):
45 |
46 | misc_dict = {
47 | "bucket": conf_dict["bucket"],
48 | "confidence_lvl": conf_dict["confidence_lvl"],
49 | "out_dir": args.output + "/" + "plot-"+target_name+"-"+objective+"-out/",
50 | "ylabel": conf_dict["objective_y_labels"][o],
51 | "file_postfix": conf_dict["file_postfixes"][o],
52 | "project": conf_dict["target_names"][t],
53 | "max_time": conf_dict["max_time"],
54 | "stat_type": conf_dict["stat_type"],
55 | "large_font": conf_dict["large_font"],
56 | "no_legend": conf_dict["no_legend"],
57 | "y_start_0": conf_dict["y_start_0"],
58 | "x_log_scale": conf_dict["x_log_scale"],
59 | "y_log_scale": conf_dict["y_log_scale"]
60 | }
61 |
62 | fuzzer_dict = {}
63 | for f, fuzzer_name in enumerate(conf_dict["fuzzer_names"]):
64 | data_files = [os.path.abspath(str(data_file)) for data_file in all_data_files
65 | if re.search(conf_dict['fuzzer_sigs'][f], str(data_file)) and
66 | re.search(conf_dict['target_sigs'][t], str(data_file)) and
67 | fnmatch.fnmatch(data_file.name, conf_dict['objective_filenames'][o])]
68 | if len(data_files) > 0:
69 | fuzzer_dict[fuzzer_name] = {
70 | "data_files": sorted(data_files),
71 | "line_style": conf_dict['fuzzer_line_styles'][f],
72 | "line_color": conf_dict['fuzzer_line_colors'][f]
73 | }
74 |
75 | out_dict = {
76 | "fuzzers": fuzzer_dict,
77 | "misc": misc_dict
78 | }
79 |
80 | plot_config_name = "plot-"+target_name+"-"+objective+".toml"
81 | plot_config_path = args.output + "/" + plot_config_name
82 |
83 | with open(plot_config_path, 'w') as handle:
84 | toml.dump(out_dict, handle)
85 |
86 |
87 | if __name__ == "__main__":
88 | main()
89 |
--------------------------------------------------------------------------------
/stat_plot/draw_boxplot.py:
--------------------------------------------------------------------------------
1 | ###################
2 | # draw boxplots based on plots generated by main.py
3 | ###################
4 |
5 | import toml
6 | import argparse
7 | import os
8 | import re
9 | from pathlib import Path
10 | import fnmatch
11 | import pathlib
12 | import seaborn as sns
13 | import matplotlib.pyplot as plt
14 | import pandas as pd
15 | import numpy as np
16 | from matplotlib.figure import figaspect
17 |
18 |
19 | def main():
20 | parser = argparse.ArgumentParser()
21 | parser.add_argument("--config", "-c", required=True, type=str)
22 | parser.add_argument("--verbose", "-v", required=False, action="store_true")
23 | parser.add_argument("--inputs", "-i", action='append', required=True)
24 | args = parser.parse_args()
25 |
26 | config_path = os.path.abspath(args.config)
27 | verbose = args.verbose
28 |
29 | print("[*] config file is {}".format(config_path))
30 |
31 | conf_dict = {}
32 | with open(config_path) as config_file:
33 | conf_dict = toml.load(config_file)
34 | # TODO check config validity
35 |
36 | # draw a set of box plots for every folder
37 | for plot_dir in args.inputs:
38 | if not os.path.isdir(plot_dir):
39 | print(f"{plot_dir} is not a dir, skip")
40 | continue
41 |
42 | filenames = os.listdir(plot_dir)
43 | config_files = []
44 |
45 | for filename in filenames:
46 | for config_sig in conf_dict['config_sigs']:
47 | if re.search(config_sig, filename):
48 | config_files.append(os.path.abspath(plot_dir + '/' + filename))
49 |
50 | # draw a set of boxplots for every target
51 | for config_file in config_files:
52 | if args.verbose:
53 | print(f"checking config file: {config_file}")
54 | plot_conf_dict = toml.load(open(config_file))
55 | # assume the out dir and the toml file are both in the root of args.in
56 | plot_out_path = os.path.abspath(plot_dir + '/' + pathlib.PurePath(plot_conf_dict['misc']['out_dir']).name)
57 | plot_aligned_dir = plot_out_path + '/aligned'
58 | plot_target = plot_conf_dict['misc']['project']
59 | plot_postfix = plot_conf_dict['misc']['file_postfix']
60 |
61 | fuzzers = os.listdir(plot_aligned_dir)
62 |
63 | # draw an individual boxplot for every data point
64 | for data_point in conf_dict['data_points']:
65 | out_dir_name = f'section-{data_point}-{plot_target}-{plot_postfix}'
66 | out_dir_path = os.path.abspath(plot_dir + '/' + out_dir_name)
67 | if not os.path.exists(out_dir_path):
68 | os.makedirs(out_dir_path)
69 |
70 | # key: fuzzer val: [val]
71 | fuzzer_data = {}
72 | min_item_no = -1
73 | for fuzzer in fuzzers:
74 | fuzzer_data[fuzzer] = []
75 | fuzzer_data_dir = plot_aligned_dir + '/' + fuzzer
76 | fuzzer_data_files = os.listdir(fuzzer_data_dir)
77 | if min_item_no == -1 or len(fuzzer_data_files) < min_item_no:
78 | min_item_no = len(fuzzer_data_files)
79 | for fuzzer_data_file in fuzzer_data_files:
80 | with open(fuzzer_data_dir + '/' + fuzzer_data_file) as data_file:
81 | lines = data_file.readlines()
82 | data_point = min(data_point, len(lines))
83 | fuzzer_data[fuzzer].append(int(lines[data_point-1]))
84 |
85 | # trim the fuzzer_data so that all of them aligns for pandas DataFrame
86 | # TODO this may not be a desired default behavior, make this configurable
87 | for fuzzer in fuzzer_data:
88 | fuzzer_data[fuzzer] = fuzzer_data[fuzzer][0:min_item_no]
89 |
90 | # data = np.array([fuzzer_data[fuzzer] for fuzzer in fuzzer_data]).T.tolist()
91 | try:
92 | data = pd.DataFrame(data=fuzzer_data)
93 | # TODO move duplicate code into functions; make more things configurable
94 | w, h = figaspect(0.618) # golden ratio
95 | fig, ax = plt.subplots(figsize=(w, h))
96 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label]):
97 | item.set_fontsize(16)
98 | for item in (ax.get_xticklabels()):
99 | item.set_fontsize(16)
100 | # item.set_rotation(45)
101 | for item in (ax.get_yticklabels()):
102 | item.set_fontsize(16)
103 | # for tick in ax.get_xticklabels():
104 | # tick.set_rotation(45)
105 | # palette: "Greys", "ch:.25",
106 | if conf_dict['y_start_0']:
107 | ax.set_ylim(ymin=0)
108 | box = sns.boxplot(ax=ax, data=data, orient="v", width=conf_dict['width'], palette=conf_dict['color_palette'], fliersize=0,
109 | dodge=False)
110 | swarm = sns.swarmplot(ax=ax, orient="v", data=data, color=".25", size=8)
111 |
112 | box.set_ylabel('# edges')
113 |
114 | out_file_name_base = f'boxplot-{data_point}-{plot_target}-{plot_postfix}'
115 |
116 | plt.savefig(out_dir_path+'/'+out_file_name_base+'.png')
117 | plt.savefig(out_dir_path+'/'+out_file_name_base+'.pdf')
118 | plt.clf()
119 | plt.close(fig)
120 |
121 | w, h = figaspect(0.618) # golden ratio
122 | fig, ax = plt.subplots(figsize=(w, h))
123 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label]):
124 | item.set_fontsize(16)
125 | for item in (ax.get_yticklabels()):
126 | item.set_fontsize(16)
127 | # for tick in ax.get_xticklabels():
128 | # tick.set_rotation(45)
129 | if conf_dict['y_start_0']:
130 | ax.set_ylim(ymin=0)
131 | violin = sns.violinplot(ax=ax, data=data, orient="v", width=conf_dict['width'], palette=conf_dict['color_palette'], dodge=False,
132 | scale='width')
133 | swarm = sns.swarmplot(ax=ax, orient="v", data=data, color=".25", size=8)
134 |
135 | violin.set_ylabel('# edges')
136 |
137 | out_file_name_base = f'violinplot-{data_point}-{plot_target}-{plot_postfix}'
138 |
139 | plt.savefig(out_dir_path+'/'+out_file_name_base+'.png')
140 | plt.savefig(out_dir_path+'/'+out_file_name_base+'.pdf')
141 | plt.clf()
142 |
143 | plt.close(fig)
144 | except Exception as e:
145 | print(e)
146 | print(f'skipping the plot for {out_dir_name}')
147 |
148 |
149 | if __name__ == "__main__":
150 | main()
151 |
--------------------------------------------------------------------------------
/stat_plot/main.py:
--------------------------------------------------------------------------------
1 | import argparse
2 | import os
3 |
4 | from conf import *
5 | from stat_plot import *
6 |
7 |
8 | def main():
9 | parser = argparse.ArgumentParser()
10 | parser.add_argument("--config", "-c", required=True, type=str)
11 | args = parser.parse_args()
12 |
13 | config_path = os.path.abspath(args.config)
14 |
15 | print("[*] config file is {}".format(config_path))
16 | config_valid, fuzzers_dict, misc_dict = parse_config(config_path)
17 |
18 | if not config_valid:
19 | print("[!] config: {} is not valid!".format(config_path))
20 | exit(1)
21 |
22 | if misc_dict['stat_type'] == 'overall':
23 | generate_plots(fuzzers_dict, misc_dict)
24 | elif misc_dict['stat_type'] == 'stest':
25 | generate_stat_data(fuzzers_dict, misc_dict)
26 | elif misc_dict['stat_type'] == 'boxplot':
27 | generate_box_plots(fuzzers_dict, misc_dict)
28 | elif misc_dict['stat_type'] == 'scatterplot':
29 | generate_scatter_plots(fuzzers_dict, misc_dict)
30 | elif misc_dict['stat_type'] == 'histogram':
31 | generate_histograms(fuzzers_dict, misc_dict)
32 |
33 |
34 | if __name__ == "__main__":
35 | main()
36 |
--------------------------------------------------------------------------------
/stat_plot/stat_plot.py:
--------------------------------------------------------------------------------
1 | import matplotlib.pyplot as plt
2 | import numpy as np
3 | import scipy.stats
4 | import os
5 |
6 | from matplotlib.patches import Polygon
7 |
8 |
9 | def convert_linestyle(linestyle):
10 | if linestyle == 'loosely dotted':
11 | return (0, (1, 5))
12 | elif linestyle == 'densely dotted':
13 | return (0, (1, 1))
14 | elif linestyle == 'loosely dashed':
15 | return (0, (5, 8))
16 | elif linestyle == 'densely dashed':
17 | return (0, (5, 1))
18 | elif linestyle == 'loosely dashdot':
19 | return (0, (3, 8, 1, 8))
20 | elif linestyle == 'densely dashdot':
21 | return (0, (3, 1, 1, 1))
22 | elif linestyle == 'dashdotdot':
23 | return (0, (3, 5, 1, 5, 1, 5))
24 | elif linestyle == 'loosely dashdotdot':
25 | return (0, (3, 8, 1, 8, 1, 8))
26 | elif linestyle == 'densely dashdotdot':
27 | return (0, (3, 1, 1, 1, 1, 1))
28 | elif linestyle in ['solid', 'dotted', 'dashed', 'dashdot']:
29 | return linestyle
30 | # invalid linestyle
31 | else:
32 | return 'invalid'
33 |
34 | def mean_confidence_interval(data, confidence):
35 | a = 1.0 * np.array(data)
36 | n = len(a)
37 | m, se = np.mean(a), scipy.stats.sem(a)
38 | h = se * scipy.stats.t.ppf((1+confidence)/2., n-1)
39 | return m, m-h, m+h
40 |
41 |
42 | def row_to_col(rows):
43 | return [*zip(*rows)]
44 |
45 |
46 | def mkdirs(path):
47 | if not os.path.exists(path):
48 | os.makedirs(path)
49 |
50 |
51 | def display_bucket(bucket):
52 | if bucket[0] == 's':
53 | return 'sec'
54 | elif bucket[0] == 'm':
55 | return 'min'
56 | elif bucket[0] == 'h':
57 | return 'hour'
58 | else:
59 | # wrong bucket encoding
60 | return 'invalid_value'
61 |
62 |
63 | def get_step(misc_dict):
64 | step = 1
65 | if misc_dict['bucket'] == 'm':
66 | step = 60
67 | elif misc_dict['bucket'] == 'h':
68 | step = 3600
69 |
70 | return step
71 |
72 |
73 | # align data files
74 | def align_data(fuzzer_dict, misc_dict):
75 |
76 | fuzzer_name = fuzzer_dict['name']
77 | data_files = fuzzer_dict['data_files']
78 | out_dir = misc_dict['out_dir']
79 | aligned_dir = out_dir + "/aligned/" + fuzzer_name + '/'
80 | max_slot = int(misc_dict['max_time'] * 3600)
81 |
82 | mkdirs(aligned_dir)
83 |
84 | new_data_files = []
85 | last_vals = []
86 |
87 | print("[*] aligning data for {}".format(fuzzer_name))
88 |
89 | for (j, data_file) in enumerate(data_files):
90 | slots = []
91 | vals = []
92 | first = True
93 |
94 | if os.path.exists(data_file):
95 | with open(data_file) as df:
96 | lines = df.readlines()
97 |
98 | for line in lines:
99 | tokens = line.split(":")
100 | # skip illegal line
101 | if len(tokens) != 2:
102 | continue
103 | slot = int(tokens[0])
104 | val = int(tokens[1])
105 |
106 | if first:
107 | if slot != 0:
108 | slots.append(0)
109 | vals.append(0)
110 | first = False
111 |
112 | if slot > max_slot:
113 | break
114 | slots.append(slot)
115 | vals.append(val)
116 |
117 | # handle the case when the txt file is empty
118 | if len(slots) == 0:
119 | slots.append(0)
120 | vals.append(0)
121 | slots.append(1)
122 | vals.append(0)
123 | elif len(slots) == 1:
124 | slots.append(1)
125 | vals.append(vals[0])
126 |
127 | slot_idx = 1
128 | new_vals = []
129 | val_idx = 0
130 |
131 | for i in range(0, max_slot):
132 | if i > slots[slot_idx]:
133 | val_idx = min(len(vals)-1, val_idx + 1)
134 | slot_idx = min(len(slots)-1, slot_idx + 1)
135 | new_vals.append(vals[val_idx])
136 |
137 | new_data_file = aligned_dir + str(j) + ".txt"
138 | last_vals.append(new_vals[-1])
139 | with open(new_data_file, "w") as out_file:
140 | for val in new_vals:
141 | out_file.write(str(val)+'\n')
142 |
143 | new_data_files.append(new_data_file)
144 |
145 | fuzzer_dict['old_data_files'] = data_files
146 | fuzzer_dict['data_files'] = new_data_files
147 | fuzzer_dict['last_vals'] = last_vals
148 |
149 |
150 | # plot for every data file of the fuzzer; n is the id for the figure
151 | def detailed_plot(fuzzer_dict, misc_dict, n):
152 | fig = plt.figure(n)
153 | ax = fig.add_subplot(111)
154 |
155 | data_files = fuzzer_dict['data_files']
156 | fuzzer_name = fuzzer_dict['name']
157 | print('[*] generating detailed plots for {}'.format(fuzzer_name))
158 |
159 | step = get_step(misc_dict)
160 |
161 | for (i, data_file) in enumerate(data_files):
162 | with open(data_file) as df:
163 | lines = df.readlines()
164 | ys = [int(x) for x in lines]
165 | ys = ys[0::step]
166 | bins = range(0, len(ys))
167 | ax.plot(bins, ys, label=fuzzer_name + str(i))
168 |
169 | out_dir = misc_dict['out_dir'] + '/detailed/' + fuzzer_name + '/'
170 | mkdirs(out_dir)
171 | base_filename = out_dir + \
172 | misc_dict["project"] + "_detailed" + misc_dict["file_postfix"]
173 | filename_pdf = base_filename + '.pdf'
174 | filename_png = base_filename + '.png'
175 |
176 | ax.set(xlabel='time ({})'.format(display_bucket(
177 | misc_dict['bucket'])), ylabel=misc_dict['ylabel'])
178 | ax.legend()
179 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100)
180 | fig.savefig(filename_png, bbox_inches='tight', dpi=100)
181 |
182 |
183 | # add plots to ax; write the computed data out
184 | def plot_files(fuzzer_dict, misc_dict, ax, ax_s):
185 | entire_data_rows = []
186 |
187 | data_files = fuzzer_dict['data_files']
188 | fuzzer_name = fuzzer_dict['name']
189 |
190 | print('[*] generating overall plots for {}'.format(fuzzer_name))
191 |
192 | for data_file in data_files:
193 | data_row = []
194 | with open(data_file) as df:
195 | lines = df.readlines()
196 | for line in lines:
197 | data_row.append(int(line))
198 | entire_data_rows.append(data_row)
199 |
200 | entire_data_col = row_to_col(entire_data_rows)
201 |
202 | fuzzer_dict['final_vals'] = entire_data_col[-1]
203 |
204 | means = []
205 | mins = []
206 | maxs = []
207 | bins = []
208 |
209 | for col in entire_data_col:
210 | mean, min_, max_ = mean_confidence_interval(
211 | col, misc_dict['confidence_lvl'])
212 | means.append(mean)
213 | mins.append(max(min_, 0))
214 | maxs.append(max_)
215 |
216 | data_dir = misc_dict['out_dir'] + '/' + 'stat_data/'
217 | mkdirs(data_dir)
218 |
219 | with open(data_dir + fuzzer_name + "-mean-confi.txt", "w") as df:
220 | for (idx, mean) in enumerate(means):
221 | df.write("{},{},{}\n".format(mean, mins[idx], maxs[idx]))
222 | bins.append(idx)
223 |
224 | set_line_color = 'line_color' in fuzzer_dict
225 | set_line_style = 'line_style' in fuzzer_dict
226 | set_marker = 'marker' in fuzzer_dict
227 |
228 | step = get_step(misc_dict)
229 |
230 | bins = [int(x/step) for x in bins[0::step]]
231 |
232 | if set_line_color and set_line_style and set_marker:
233 | ax.plot(bins[0:], means[0::step], label=fuzzer_name, linestyle=convert_linestyle(fuzzer_dict['line_style'])
234 | , color=fuzzer_dict['line_color'], marker=fuzzer_dict['marker'], ms=6)
235 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name, linestyle=convert_linestyle(fuzzer_dict['line_style'])
236 | , color=fuzzer_dict['line_color'], marker=fuzzer_dict['marker'], ms=6)
237 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step], facecolor=fuzzer_dict['line_color'], alpha=0.2)
238 | elif set_line_color and set_line_style:
239 | ax.plot(bins[0:], means[0::step], label=fuzzer_name,
240 | linestyle=convert_linestyle(fuzzer_dict['line_style']), color=fuzzer_dict['line_color'])
241 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name,
242 | linestyle=convert_linestyle(fuzzer_dict['line_style']), color=fuzzer_dict['line_color'])
243 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step],
244 | facecolor=fuzzer_dict['line_color'], alpha=0.2)
245 | elif set_line_color:
246 | ax.plot(bins[0:], means[0::step], label=fuzzer_name,
247 | color=fuzzer_dict['line_color'])
248 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name,
249 | color=fuzzer_dict['line_color'])
250 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step],
251 | facecolor=fuzzer_dict['line_color'], alpha=0.2)
252 | elif set_line_style:
253 | ax.plot(bins[0:], means[0::step], label=fuzzer_name,
254 | linestyle=convert_linestyle(fuzzer_dict['line_style']))
255 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name,
256 | linestyle=convert_linestyle(fuzzer_dict['line_style']))
257 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step], alpha=0.2)
258 | else:
259 | ax.plot(bins[0:], means[0::step], label=fuzzer_name)
260 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name)
261 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step], alpha=0.2)
262 |
263 |
264 | def student_t_test(filename, open_mode, fuzzers_dict):
265 | with open(filename, open_mode) as gsf:
266 | checked = []
267 | gsf.write("### Student's t test ###\n")
268 | for fuzzer_name1 in fuzzers_dict:
269 | for fuzzer_name2 in fuzzers_dict:
270 | if not fuzzer_name1 == fuzzer_name2 and not (fuzzer_name1, fuzzer_name2) in checked:
271 | f1 = fuzzers_dict[fuzzer_name1]
272 | f2 = fuzzers_dict[fuzzer_name2]
273 | checked.append((fuzzer_name1, fuzzer_name2))
274 | checked.append((fuzzer_name2, fuzzer_name1))
275 |
276 | p_value = scipy.stats.ttest_ind(
277 | f1['final_vals'], f2['final_vals'])[1]
278 |
279 | gsf.write(
280 | "pvalue: {} --- {} : {}\n".format(fuzzer_name1, fuzzer_name2, p_value))
281 | gsf.write("------------------\n")
282 | gsf.write("\n")
283 |
284 |
285 | def mw_u_test(filename, open_mode, fuzzers_dict):
286 | with open(filename, open_mode) as gsf:
287 | checked = []
288 | gsf.write("### Mann Whitney u test ###\n")
289 | for fuzzer_name1 in fuzzers_dict:
290 | for fuzzer_name2 in fuzzers_dict:
291 | if not fuzzer_name1 == fuzzer_name2 and not (fuzzer_name1, fuzzer_name2) in checked:
292 | f1 = fuzzers_dict[fuzzer_name1]
293 | f2 = fuzzers_dict[fuzzer_name2]
294 | checked.append((fuzzer_name1, fuzzer_name2))
295 | checked.append((fuzzer_name2, fuzzer_name1))
296 | try:
297 | p_value = scipy.stats.mannwhitneyu(
298 | f1['final_vals'], f2['final_vals'])[1]
299 | gsf.write(
300 | "pvalue: {} --- {} : {}\n".format(fuzzer_name1, fuzzer_name2, p_value))
301 | except ValueError as e:
302 | gsf.write(
303 | "ERROR: {} --- {} : {}\n".format(fuzzer_name1, fuzzer_name2, e))
304 | gsf.write("------------------\n")
305 | gsf.write("\n")
306 |
307 |
308 | # calculate the chance of f1s < f2s
309 | def calculate_a12(max_pop, f1s, f2s):
310 | numerator = 0
311 | denominator = float(max_pop * max_pop)
312 | for first_val in f1s:
313 | for second_val in f2s:
314 | if first_val < second_val:
315 | numerator += 1
316 | elif first_val == second_val:
317 | numerator += 0.5
318 | a12 = numerator / denominator
319 | return a12
320 |
321 |
322 | def calculate_a12s(filename, open_mode, fuzzers_dict):
323 | with open(filename, open_mode) as gsf:
324 | checked = []
325 | gsf.write("### A12 values ###\n")
326 | for fuzzer_name1 in fuzzers_dict:
327 | for fuzzer_name2 in fuzzers_dict:
328 | if not fuzzer_name1 == fuzzer_name2 and not (fuzzer_name1, fuzzer_name2) in checked:
329 | f1 = fuzzers_dict[fuzzer_name1]
330 | f2 = fuzzers_dict[fuzzer_name2]
331 | checked.append((fuzzer_name1, fuzzer_name2))
332 | checked.append((fuzzer_name2, fuzzer_name1))
333 |
334 | # assume f1 and f2 have the same len
335 | a12 = calculate_a12(
336 | len(f1['final_vals']), f1['final_vals'], f2['final_vals'])
337 |
338 | gsf.write("A12: {} <= {} : {}\n".format(
339 | fuzzer_name1, fuzzer_name2, a12))
340 | gsf.write("A12: {} >= {} : {}\n".format(
341 | fuzzer_name1, fuzzer_name2, (1.0-a12)))
342 | gsf.write("------------------\n")
343 | gsf.write("\n")
344 |
345 |
346 | def generate_plots(fuzzers_dict, misc_dict):
347 | fig = plt.figure(len(fuzzers_dict))
348 | ax = fig.add_subplot(111)
349 |
350 | # fig_s does not plot the confidence interval
351 | fig_s = plt.figure(len(fuzzers_dict) + 1)
352 | ax_s = fig_s.add_subplot(111)
353 |
354 | if misc_dict['x_log_scale']:
355 | ax.set_xscale('log')
356 | ax_s.set_xscale('log')
357 |
358 | if misc_dict['y_log_scale']:
359 | ax.set_yscale('log')
360 | ax_s.set_yscale('log')
361 |
362 | for (n, fuzzer_name) in enumerate(fuzzers_dict):
363 | fuzzer_dict = fuzzers_dict[fuzzer_name]
364 | align_data(fuzzer_dict, misc_dict)
365 | detailed_plot(fuzzer_dict, misc_dict, n)
366 | plot_files(fuzzer_dict, misc_dict, ax, ax_s)
367 |
368 | out_dir = misc_dict['out_dir'] + '/'
369 | base_filename = out_dir + \
370 | misc_dict["project"] + "_overall" + misc_dict["file_postfix"]
371 | filename_pdf = base_filename + '.pdf'
372 | filename_png = base_filename + '.png'
373 | filename_pdf_s = base_filename + '_simple.pdf'
374 | filename_png_s = base_filename + '_simple.png'
375 | general_stats_file = out_dir + \
376 | misc_dict["project"] + "_overall_stats" + \
377 | misc_dict["file_postfix"] + ".txt"
378 |
379 | student_t_test(general_stats_file, 'w', fuzzers_dict)
380 |
381 | mw_u_test(general_stats_file, 'a', fuzzers_dict)
382 |
383 | calculate_a12s(general_stats_file, 'a', fuzzers_dict)
384 |
385 | with open(general_stats_file, 'a') as file_handle:
386 | for fuzzer_name in fuzzers_dict:
387 | fuzzer_dict = fuzzers_dict[fuzzer_name]
388 | old_data_files = fuzzer_dict['old_data_files']
389 | data_files = fuzzer_dict['data_files']
390 | last_vals = fuzzer_dict['last_vals']
391 |
392 | for (i, old_data_file) in enumerate(old_data_files):
393 | file_handle.write('fuzzer:{} orig_file:{} aligned_file:{} last_val:{} \n'
394 | .format(fuzzer_name, data_files[i], old_data_file, last_vals[i]))
395 |
396 | file_handle.write('\n')
397 |
398 | if 'y_start_0' in misc_dict and misc_dict['y_start_0']:
399 | ax.set_ylim(ymin=0)
400 | ax_s.set_ylim(ymin=0)
401 |
402 | ax.set(xlabel='time ({})'.format(display_bucket(
403 | misc_dict['bucket'])), ylabel=misc_dict['ylabel'])
404 | if 'plot_title' in misc_dict:
405 | ax.set(title=misc_dict['plot_title'])
406 | ax.set_title(misc_dict['plot_title'], fontsize=18, color='black')
407 | if 'no_legend' in misc_dict and misc_dict['no_legend']:
408 | pass
409 | else:
410 | if 'large_font' in misc_dict and misc_dict['large_font']:
411 | ax.legend(fontsize=20)
412 | else:
413 | ax.legend()
414 | if 'large_font' in misc_dict and misc_dict['large_font']:
415 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label] +
416 | ax.get_xticklabels()):
417 | item.set_fontsize(20)
418 |
419 | for item in (ax.get_yticklabels()):
420 | item.set_fontsize(20)
421 |
422 | for tick in ax.get_xticklabels():
423 | tick.set_rotation(45)
424 |
425 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100)
426 | fig.savefig(filename_png, bbox_inches='tight', dpi=100)
427 |
428 | ax_s.set(xlabel='time ({})'.format(display_bucket(
429 | misc_dict['bucket'])), ylabel=misc_dict['ylabel'])
430 | if 'no_legend' in misc_dict and misc_dict['no_legend']:
431 | pass
432 | else:
433 | if 'large_font' in misc_dict and misc_dict['large_font']:
434 | ax_s.legend(fontsize=20)
435 | else:
436 | ax_s.legend()
437 | if 'large_font' in misc_dict and misc_dict['large_font']:
438 | for item in ([ax_s.title, ax_s.xaxis.label, ax_s.yaxis.label] +
439 | ax_s.get_xticklabels()):
440 | item.set_fontsize(20)
441 |
442 | for tick in ax_s.get_xticklabels():
443 | tick.set_rotation(45)
444 |
445 | for item in (ax_s.get_yticklabels()):
446 | item.set_fontsize(20)
447 |
448 | fig_s.savefig(filename_pdf_s, bbox_inches='tight', dpi=100)
449 | fig_s.savefig(filename_png_s, bbox_inches='tight', dpi=100)
450 |
451 |
452 | def generate_stat_data(fuzzers_dict, misc_dict):
453 |
454 | # fill in the raw data
455 | for fuzzer_name in fuzzers_dict:
456 | fuzzer = fuzzers_dict[fuzzer_name]
457 | # use only the first data file
458 | data_file = fuzzer['data_files'][0]
459 | with open(data_file) as df:
460 | lines = df.readlines()
461 | fuzzer['final_vals'] = [float(x.strip()) for x in lines]
462 |
463 | out_dir = misc_dict['out_dir'] + '/'
464 | mkdirs(out_dir)
465 | general_stats_file = out_dir + \
466 | misc_dict["project"] + "_overall_stats" + \
467 | misc_dict["file_postfix"] + ".txt"
468 |
469 | student_t_test(general_stats_file, 'w', fuzzers_dict)
470 |
471 | mw_u_test(general_stats_file, 'a', fuzzers_dict)
472 |
473 | calculate_a12s(general_stats_file, 'a', fuzzers_dict)
474 |
475 | with open(general_stats_file, 'a') as file_handle:
476 | for fuzzer_name in fuzzers_dict:
477 | fuzzer_dict = fuzzers_dict[fuzzer_name]
478 | old_data_files = fuzzer_dict['old_data_files']
479 | data_files = fuzzer_dict['data_files']
480 | last_vals = fuzzer_dict['last_vals']
481 |
482 | for (i, old_data_file) in enumerate(old_data_files):
483 | file_handle.write('fuzzer:{} orig_file:{} aligned_file:{} last_val:{} \n'
484 | .format(fuzzer_name, data_files[i], old_data_file, last_vals[i]))
485 |
486 | file_handle.write('\n')
487 |
488 |
489 |
490 | def generate_box_plots(fuzzers_dict, misc_dict):
491 | fig = plt.figure(len(fuzzers_dict))
492 | ax = fig.add_subplot(111)
493 |
494 | # fill in the raw data
495 | # the data for the box plot
496 | box_data = []
497 | box_colors = []
498 | line_styles = []
499 | # marker = []
500 | fuzzer_names = list(fuzzers_dict.keys())
501 | fuzzer_names.sort()
502 | for fuzzer_name in fuzzer_names:
503 | fuzzer = fuzzers_dict[fuzzer_name]
504 | # use only the first data file
505 | data_file = fuzzer['data_files'][0]
506 |
507 | box_colors.append(fuzzer['box_color'])
508 |
509 | line_styles.append(fuzzer['line_style'])
510 |
511 | # marker.append(fuzzer['marker'])
512 |
513 | if not os.path.exists(data_file):
514 | fuzzer['final_vals'] = []
515 | box_data.append(fuzzer['final_vals'])
516 | continue
517 |
518 | with open(data_file) as df:
519 | lines = df.readlines()
520 | fuzzer['final_vals'] = [float(x) for x in lines]
521 | box_data.append(fuzzer['final_vals'])
522 |
523 | out_dir = misc_dict['out_dir'] + '/'
524 | mkdirs(out_dir)
525 | base_filename = out_dir + misc_dict["project"] + misc_dict["file_postfix"]
526 | filename_pdf = base_filename + '.pdf'
527 | filename_png = base_filename + '.png'
528 |
529 | # notch may look weird
530 | # https://stackoverflow.com/questions/26291082/weird-behavior-of-matplotlibs-boxplot-when-using-the-notch-shape
531 | bp = ax.boxplot(box_data, labels=fuzzer_names, sym='k+',
532 | notch=misc_dict['notch'], patch_artist=False, widths=0.5, showfliers=False)
533 |
534 | # this might be buggy as the order of bp['boxes'] may not follow the specified order
535 | # this is to set the color for the boxes
536 | # for box, color, line_style in zip(bp['boxes'], box_colors, line_styles):
537 | # box.set(facecolor=color)
538 | # box.set(linestyle=line_style)
539 |
540 | # this is buggy
541 | # ['whiskers', 'fliers', 'means', 'medians', 'caps']
542 | # for whisker, median, cap, line_style in zip(bp['whiskers'], bp['medians'], bp['caps'], line_styles):
543 | # whisker.set(linestyle=line_style)
544 | # median.set(linestyle=line_style)
545 | # cap.set(linestyle=line_style)
546 | # print("haha")
547 | # print(cap.get_linestyle())
548 |
549 | # this works, but it's for all boxes
550 | # for element in ['whiskers', 'means', 'medians', 'caps']:
551 | # plt.setp(bp[element], color='red', linestyle="dashed")
552 |
553 | for median in bp['medians']:
554 | median.set(color='k', linewidth=1.5)
555 | x, y = median.get_data()
556 | xn = (x-(x.sum()/2.))*0.5 + (x.sum()/2.)
557 | ax.plot(xn, y, color="k", linewidth=5, solid_capstyle="butt", zorder=4)
558 |
559 | # plot the dots (scatter)
560 | for (i, fuzzer_name) in enumerate(fuzzer_names):
561 | fuzzer = fuzzers_dict[fuzzer_name]
562 | y = fuzzer['final_vals']
563 | x = np.random.normal(1+i, 0.1, size=len(y))
564 | ax.scatter(x, y, c=fuzzer['box_color'], alpha=0.8, s=100)
565 |
566 | if 'ylim' in misc_dict:
567 | ax.set_ylim(misc_dict['ylim'])
568 |
569 | # ax.grid(which='major', axis='both', linestyle='--')
570 | ax.grid(False)
571 | if 'plot_title' in misc_dict:
572 | ax.set(title=misc_dict['plot_title'])
573 |
574 | for item in ([ax.title, ax.xaxis.label] +
575 | ax.get_xticklabels()):
576 | item.set_fontsize(30)
577 |
578 | for item in (ax.get_yticklabels()):
579 | item.set_fontsize(20)
580 |
581 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100)
582 | fig.savefig(filename_png, bbox_inches='tight', dpi=100)
583 |
584 |
585 | def generate_scatter_plots(fuzzers_dict, misc_dict):
586 | fig = plt.figure(len(fuzzers_dict))
587 | ax = fig.add_subplot(111)
588 |
589 | fuzzer_names = list(fuzzers_dict.keys())
590 | fuzzer_names.sort()
591 | for fuzzer_name in fuzzer_names:
592 | fuzzer = fuzzers_dict[fuzzer_name]
593 |
594 | # use only the first data file
595 | data_file = fuzzer['data_files'][0]
596 | with open(data_file) as df:
597 | lines = df.readlines()
598 | xs = []
599 | ys = []
600 | for line in lines:
601 | tokens = line.split(':')
602 | # skip invalid line
603 | if len(tokens) != 2:
604 | continue
605 | xs.append(int(tokens[0]))
606 | ys.append(int(tokens[1]))
607 |
608 | fuzzer['final_xs'] = xs
609 | fuzzer['final_ys'] = ys
610 |
611 | set_line_color = 'line_color' in fuzzer
612 |
613 | if set_line_color:
614 | ax.scatter(xs, ys, c=fuzzer['line_color'],
615 | alpha=1, s=20, label=fuzzer_name)
616 | else:
617 | ax.scatter(xs, ys, alpha=1, s=20, label=fuzzer_name)
618 |
619 | # ax.set_xscale('log')
620 | ax.set_yscale('log')
621 | if 'plot_title' in misc_dict:
622 | ax.set(title=misc_dict['plot_title'])
623 | ax.set(xlabel=misc_dict['xlabel'], ylabel=misc_dict['ylabel'])
624 |
625 | large_font = misc_dict['large_font']
626 |
627 | if large_font:
628 | ax.legend(fontsize=15)
629 | else:
630 | ax.legend()
631 |
632 | if large_font:
633 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label] + ax.get_xticklabels()):
634 | item.set_fontsize(15)
635 |
636 | for tick in ax.get_xticklabels():
637 | tick.set_rotation(45)
638 |
639 | for item in (ax.get_yticklabels()):
640 | item.set_fontsize(15)
641 |
642 | out_dir = misc_dict['out_dir'] + '/'
643 | mkdirs(out_dir)
644 | base_filename = out_dir + misc_dict["project"] + misc_dict["file_postfix"]
645 | filename_pdf = base_filename + '.pdf'
646 | filename_png = base_filename + '.png'
647 |
648 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100)
649 | fig.savefig(filename_png, bbox_inches='tight', dpi=100)
650 |
651 |
652 | def draw_histograms(histtype, figure_no, xss, colors, fuzzer_names, misc_dict):
653 | fig = plt.figure(figure_no)
654 | ax = fig.add_subplot(111)
655 | n_bins = misc_dict['n_bins']
656 | ax.hist(x=xss, bins=n_bins, histtype=histtype,
657 | color=colors, label=fuzzer_names)
658 |
659 | # ax.set_xscale('log')
660 | ax.set_yscale('log')
661 | if 'plot_title' in misc_dict:
662 | ax.set(title=misc_dict['plot_title'])
663 | ax.set(xlabel=misc_dict['xlabel'], ylabel=misc_dict['ylabel'])
664 | # scientific notation for x axis labels
665 | # ax.ticklabel_format(style='sci', axis='x', scilimits=(1, 4))
666 |
667 | large_font = misc_dict['large_font']
668 |
669 | if large_font:
670 | ax.legend(fontsize=15)
671 | else:
672 | ax.legend()
673 |
674 | if large_font:
675 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label] + ax.get_xticklabels()):
676 | item.set_fontsize(15)
677 |
678 | for tick in ax.get_xticklabels():
679 | tick.set_rotation(45)
680 |
681 | for item in (ax.get_yticklabels()):
682 | item.set_fontsize(15)
683 |
684 | out_dir = misc_dict['out_dir'] + '/'
685 | mkdirs(out_dir)
686 | base_filename = out_dir + \
687 | misc_dict["project"] + misc_dict["file_postfix"] + '-' + histtype
688 | filename_pdf = base_filename + '.pdf'
689 | filename_png = base_filename + '.png'
690 |
691 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100)
692 | fig.savefig(filename_png, bbox_inches='tight', dpi=100)
693 |
694 |
695 | def generate_histograms(fuzzers_dict, misc_dict):
696 |
697 | fuzzer_names = list(fuzzers_dict.keys())
698 | fuzzer_names.sort()
699 | xss = []
700 | colors = []
701 | for fuzzer_name in fuzzer_names:
702 | fuzzer = fuzzers_dict[fuzzer_name]
703 |
704 | # use only the first data file
705 | data_file = fuzzer['data_files'][0]
706 | with open(data_file) as df:
707 | lines = df.readlines()
708 | xs = []
709 | for line in lines:
710 | if len(line.strip()) > 0:
711 | xs.append(int(line))
712 |
713 | fuzzer['final_xs'] = xs
714 | xss.append(xs)
715 |
716 | set_line_color = 'line_color' in fuzzer
717 |
718 | if set_line_color:
719 | colors.append(fuzzer['line_color'])
720 | else:
721 | colors.append('xkcd:slate grey')
722 |
723 | draw_histograms('bar', 1, xss, colors, fuzzer_names, misc_dict)
724 | draw_histograms('barstacked', 2, xss, colors, fuzzer_names, misc_dict)
725 | draw_histograms('step', 3, xss, colors, fuzzer_names, misc_dict)
726 | draw_histograms('stepfilled', 4, xss, colors, fuzzer_names, misc_dict)
727 |
--------------------------------------------------------------------------------
/stat_plot/statistic_tester.py:
--------------------------------------------------------------------------------
1 | # generate statistic test results based on .csv files
2 | # the test/statistics.csv is generated by: https://onlinemathtools.com/generate-random-matrix
3 |
4 | import argparse
5 | import scipy.stats
6 | import numpy as np
7 | import json
8 |
9 |
10 | # currently support student t test, mann whitney u test and a12 results
11 | def statistic_tests(data_array):
12 | # TODO: later make these options
13 | p_value_sig_bar = 0.05
14 | a12_sig_bar = 0.71
15 |
16 | checked = []
17 | data_names = data_array.dtype.names
18 | student_t_results = {}
19 | student_t_sig_results = {}
20 | mw_u_results = {}
21 | mw_u_sig_results = {}
22 | a12_results = {}
23 | a12_sig_results = {}
24 | average_values = {}
25 | for dname1 in data_names:
26 | for dname2 in data_names:
27 | if not dname1 == dname2 and not (dname1, dname2) in checked:
28 | checked.append((dname1, dname2))
29 | checked.append((dname2, dname1))
30 |
31 | s_test_key = '{}-{}'.format(dname1, dname2)
32 |
33 | student_t_p_value = scipy.stats.ttest_ind(data_array[dname1], data_array[dname2])[1]
34 | mw_u_p_value = scipy.stats.mannwhitneyu(data_array[dname1], data_array[dname2])[1]
35 |
36 | student_t_results[s_test_key] = student_t_p_value
37 | mw_u_results[s_test_key] = mw_u_p_value
38 | if mw_u_p_value < p_value_sig_bar:
39 | mw_u_sig_results[s_test_key] = mw_u_p_value
40 | if student_t_p_value < p_value_sig_bar:
41 | student_t_sig_results[s_test_key] = student_t_p_value
42 |
43 | a12_key1 = '{}<{}'.format(dname1, dname2)
44 | a12_val1 = calculate_a12(data_array[dname1], data_array[dname2])
45 | a12_key2 = '{}<{}'.format(dname2, dname1)
46 | a12_val2 = calculate_a12(data_array[dname2], data_array[dname1])
47 | a12_results[a12_key1] = a12_val1
48 | a12_results[a12_key2] = a12_val2
49 |
50 | if a12_val1 > a12_sig_bar:
51 | a12_sig_results[a12_key1] = a12_val1
52 | if a12_val2 > a12_sig_bar:
53 | a12_sig_results[a12_key2] = a12_val2
54 |
55 | # do things that do not need comparison with another set of data
56 | average_values[dname1] = np.average(data_array[dname1])
57 |
58 | statistic_test_results = {
59 | "student_t_test": student_t_results,
60 | "mann_whitney_u_test": mw_u_results,
61 | "a12": a12_results,
62 | "average": average_values
63 | }
64 | statistic_test_sig_results = {
65 | "student_t_test": student_t_sig_results,
66 | "mann_whitney_u_test": mw_u_sig_results,
67 | "a12": a12_sig_results
68 | }
69 | results = {
70 | "all": statistic_test_results,
71 | "significant": statistic_test_sig_results
72 | }
73 | return results
74 |
75 |
76 | # calculate the chance of f1s < f2s
77 | def calculate_a12(f1s, f2s):
78 | numerator = 0
79 | denominator = float(len(f1s) * len(f2s))
80 | for first_val in f1s:
81 | for second_val in f2s:
82 | if first_val < second_val:
83 | numerator += 1
84 | elif first_val == second_val:
85 | numerator += 0.5
86 | a12 = numerator / denominator
87 | return a12
88 |
89 |
90 | def main():
91 | parser = argparse.ArgumentParser()
92 | parser.add_argument("--input", "-i", required=True, type=str, help="path to the input csv file")
93 | parser.add_argument("--output", "-o", required=True, type=str, help="path to the output file, in json format")
94 |
95 | args = parser.parse_args()
96 |
97 | data_array = np.genfromtxt(args.input, delimiter=',', names=True)
98 |
99 | results = statistic_tests(data_array)
100 |
101 | with open(args.output, 'w') as output_file:
102 | json.dump(results, indent=2, sort_keys=True, fp=output_file)
103 |
104 |
105 | if __name__ == "__main__":
106 | main()
107 |
--------------------------------------------------------------------------------
/stat_plot/test/data_boxplot/out_afl.txt:
--------------------------------------------------------------------------------
1 | 5.5
2 | 6.5
3 | 3.5
4 | 4.5
5 | 7.5
--------------------------------------------------------------------------------
/stat_plot/test/data_boxplot/out_aflfast.txt:
--------------------------------------------------------------------------------
1 | 6.6
2 | 7.8
3 | 9.4
4 | 8.4
5 | 7.6
--------------------------------------------------------------------------------
/stat_plot/test/data_boxplot/out_cerebro.txt:
--------------------------------------------------------------------------------
1 | 1.2
2 | 2.3
3 | 4.3
4 | 2.6
5 | 2.5
--------------------------------------------------------------------------------
/stat_plot/test/data_histo/test_aflfast.txt:
--------------------------------------------------------------------------------
1 | 10
2 | 10
3 | 10
4 | 10
5 | 10
6 | 10
7 | 10
8 | 10
9 | 10
10 | 10
11 | 10
12 | 12
13 | 10
14 | 10
15 | 10
16 | 10
17 | 10
18 | 10
19 | 10
20 | 10
21 | 10
22 | 10
23 | 10
24 | 10
25 | 10
26 | 10
27 | 12
28 | 10
29 | 10
30 | 12
31 | 10
32 | 10
33 | 10
34 | 10
35 | 12
36 | 10
37 | 10
38 | 10
39 | 10
40 | 10
41 | 10
42 | 10
43 | 10
44 | 10
45 | 10
46 | 10
47 | 10
48 | 10
49 | 10
50 | 18
51 | 10
52 | 10
53 | 10
54 | 10
55 | 10
56 | 10
57 | 10
58 | 10
59 | 10
60 | 10
61 | 10
62 | 10
63 | 10
64 | 10
65 | 10
66 | 10
67 | 10
68 | 11
69 | 10
70 | 10
71 | 12
72 | 10
73 | 10
74 | 12
75 | 10
76 | 10
77 | 10
78 | 10
79 | 10
80 | 10
81 | 10
82 | 10
83 | 10
84 | 12
85 | 10
86 | 10
87 | 10
88 | 12
89 | 10
90 | 10
91 | 10
92 | 10
93 | 10
94 | 10
95 | 10
96 | 10
97 | 10
98 | 10
99 | 10
100 | 10
101 | 12
102 | 10
103 | 10
104 | 11
105 | 12
106 | 10
107 | 10
108 | 12
109 | 10
110 | 10
111 | 10
112 | 10
113 | 10
114 | 12
115 | 13
116 | 12
117 | 10
118 | 10
119 | 10
120 | 12
121 | 10
122 | 10
123 | 10
124 | 10
125 | 10
126 | 10
127 | 12
128 | 10
129 | 10
130 | 10
131 | 11
132 | 10
133 | 10
134 | 10
135 | 10
136 | 10
137 | 10
138 | 12
139 | 10
140 | 10
141 | 10
142 | 10
143 | 10
144 | 10
145 | 12
146 | 10
147 | 10
148 | 10
149 | 10
150 | 12
151 | 10
152 | 10
153 | 10
154 | 10
155 | 10
156 | 12
157 | 10
158 | 10
159 | 10
160 | 12
161 | 10
162 | 10
163 | 10
164 | 10
165 | 10
166 | 10
167 | 10
168 | 12
169 | 10
170 | 10
171 | 10
172 | 10
173 | 10
174 | 10
175 | 10
176 | 10
177 | 12
178 | 10
179 | 10
180 | 10
181 | 10
182 | 18
183 | 10
184 | 10
185 | 12
186 | 10
187 | 10
188 | 12
189 | 10
190 | 10
191 | 10
192 | 10
193 | 10
194 | 13
195 | 10
196 | 10
197 | 10
198 | 13
199 | 10
200 | 10
201 | 10
202 | 10
203 | 10
204 | 10
205 | 10
206 | 12
207 | 10
208 | 10
209 | 10
210 | 10
211 | 12
212 | 10
213 | 10
214 | 10
215 | 10
216 | 10
217 | 12
218 | 10
219 | 11
220 | 10
221 | 10
222 | 10
223 | 10
224 | 11
225 | 12
226 | 10
227 | 12
228 | 10
229 | 12
230 | 10
231 | 10
232 | 10
233 | 10
234 | 10
235 | 10
236 | 12
237 | 10
238 | 12
239 | 12
240 | 10
241 | 10
242 | 10
243 | 12
244 | 12
245 | 10
246 | 12
247 | 10
248 | 10
249 | 12
250 | 12
251 | 10
252 | 10
253 | 10
254 | 10
255 | 11
256 | 10
257 | 10
258 | 10
259 | 10
260 | 10
261 | 10
262 | 10
263 | 10
264 | 10
265 | 10
266 | 12
267 | 10
268 | 12
269 | 10
270 | 10
271 | 12
272 | 10
273 | 10
274 | 12
275 | 10
276 | 10
277 | 10
278 | 10
279 | 10
280 | 12
281 | 12
282 | 10
283 | 10
284 | 10
285 | 10
286 | 10
287 | 10
288 | 12
289 | 12
290 | 10
291 | 10
292 | 13
293 | 10
294 | 10
295 | 10
296 | 10
297 | 10
298 | 10
299 | 10
300 | 10
301 | 10
302 | 10
303 | 10
304 | 10
305 | 10
306 | 11
307 | 10
308 | 13
309 | 10
310 | 12
311 | 10
312 | 12
313 | 10
314 | 10
315 | 10
316 | 10
317 | 10
318 | 12
319 | 12
320 | 10
321 | 10
322 | 10
323 | 10
324 | 10
325 | 10
326 | 10
327 | 10
328 | 10
329 | 12
330 | 10
331 | 10
332 | 12
333 | 10
334 | 10
335 | 10
336 | 10
337 | 10
338 | 10
339 | 10
340 | 10
341 | 12
342 | 10
343 | 10
344 | 10
345 | 10
346 | 10
347 | 10
348 | 10
349 | 12
350 | 12
351 | 12
352 | 10
353 | 12
354 | 12
355 | 10
356 | 12
357 | 10
358 | 10
359 | 10
360 | 10
361 | 12
362 | 12
363 | 10
364 | 10
365 | 12
366 | 10
367 | 12
368 | 10
369 | 10
370 | 10
371 | 10
372 | 10
373 | 10
374 | 10
375 | 10
376 | 10
377 | 12
378 | 10
379 | 10
380 | 10
381 | 10
382 | 12
383 | 10
384 | 12
385 | 10
386 | 10
387 | 10
388 | 10
389 | 10
390 | 12
391 | 10
392 | 10
393 | 10
394 | 10
395 | 10
396 | 10
397 | 10
398 | 10
399 | 10
400 | 12
401 | 10
402 | 10
403 | 10
404 | 11
405 | 10
406 | 10
407 | 12
408 | 10
409 | 10
410 | 10
411 | 10
412 | 10
413 | 10
414 | 10
415 | 10
416 | 10
417 | 10
418 | 10
419 | 12
420 | 10
421 | 10
422 | 10
423 | 11
424 | 10
425 | 10
426 | 10
427 | 10
428 | 10
429 | 10
430 | 10
431 | 10
432 | 12
433 | 10
434 | 10
435 | 10
436 | 10
437 | 10
438 | 10
439 | 11
440 | 10
441 | 12
442 | 12
443 | 12
444 | 10
445 | 13
446 | 12
447 | 12
448 | 12
449 | 10
450 | 12
451 | 12
452 | 10
453 | 12
454 | 12
455 | 12
456 | 12
457 | 10
458 | 12
459 | 12
460 | 12
461 | 10
462 | 12
463 | 12
464 | 10
465 | 12
466 | 12
467 | 12
468 | 10
469 | 12
470 | 10
471 | 10
472 | 12
473 | 10
474 | 12
475 | 10
476 | 13
477 | 10
478 | 12
479 | 10
480 | 10
481 | 10
482 | 12
483 | 12
484 | 10
485 | 10
486 | 10
487 | 10
488 | 12
489 | 12
490 | 10
491 | 12
492 | 10
493 | 12
494 | 10
495 | 12
496 | 13
497 | 10
498 | 10
499 | 11
500 | 13
501 | 12
502 | 13
503 | 19
504 | 10
505 | 10
506 | 10
507 | 12
508 | 12
509 | 12
510 | 12
511 | 10
512 | 12
513 | 12
514 | 12
515 | 12
516 | 12
517 | 10
518 | 12
519 | 12
520 | 10
521 | 12
522 | 12
523 | 12
524 | 12
525 | 12
526 | 12
527 | 10
528 | 10
529 | 10
530 | 10
531 | 10
532 | 10
533 | 10
534 | 10
535 | 10
536 | 10
537 | 10
538 | 10
539 | 10
540 | 10
541 | 10
542 | 12
543 | 10
544 | 10
545 | 10
546 | 12
547 | 10
548 | 10
549 | 12
550 | 10
551 | 10
552 | 10
553 | 10
554 | 10
555 | 10
556 | 10
557 | 10
558 | 10
559 | 10
560 | 12
561 | 12
562 | 12
563 | 10
564 | 10
565 | 12
566 | 12
567 | 12
568 | 10
569 | 12
570 | 10
571 | 10
572 | 10
573 | 12
574 | 10
575 | 10
576 | 10
577 | 10
578 | 10
579 | 10
580 | 10
581 | 11
582 | 10
583 | 12
584 | 10
585 | 10
586 | 10
587 | 13
588 | 10
589 | 10
590 | 10
591 | 10
592 | 10
593 | 12
594 | 12
595 | 10
596 | 12
597 | 12
598 | 10
599 | 12
600 | 11
601 | 12
602 | 12
603 | 13
604 | 14
605 | 10
606 | 18
607 | 12
608 | 12
609 | 12
610 | 10
611 | 12
612 | 10
613 | 10
614 | 12
615 | 12
616 | 12
617 | 12
618 | 11
619 | 12
620 | 12
621 | 12
622 | 12
623 | 10
624 | 10
625 | 10
626 | 10
627 | 10
628 | 13
629 | 10
630 | 10
631 | 12
632 | 10
633 | 12
634 | 10
635 | 10
636 | 10
637 | 13
638 | 10
639 | 10
640 | 10
641 | 10
642 | 10
643 | 10
644 | 13
645 | 12
646 | 13
647 | 10
648 | 10
649 | 10
650 | 10
651 | 10
652 | 10
653 | 10
654 | 10
655 | 10
656 | 10
657 | 10
658 | 13
659 | 14
660 | 10
661 | 10
662 | 10
663 | 10
664 | 12
665 | 10
666 | 12
667 | 12
668 | 10
669 | 10
670 | 10
671 | 10
672 | 12
673 | 12
674 | 12
675 | 10
676 | 12
677 | 10
678 | 10
679 | 10
680 | 12
681 | 12
682 | 10
683 | 10
684 | 10
685 | 10
686 | 10
687 | 10
688 | 10
689 | 10
690 | 10
691 | 10
692 | 10
693 | 10
694 | 11
695 | 11
696 | 11
697 | 12
698 | 12
699 | 11
700 | 11
701 | 12
702 | 11
703 | 10
704 | 10
705 | 11
706 | 12
707 | 11
708 | 10
709 | 11
710 | 12
711 | 11
712 | 10
713 | 11
714 | 11
715 | 10
716 | 10
717 | 10
718 | 12
719 | 12
720 | 12
721 | 12
722 | 10
723 | 12
724 | 12
725 | 10
726 | 12
727 | 12
728 | 10
729 | 12
730 | 12
731 | 10
732 | 10
733 | 10
734 | 10
735 | 10
736 | 10
737 | 10
738 | 10
739 | 10
740 | 10
741 | 10
742 | 12
743 | 10
744 | 10
745 | 12
746 | 10
747 | 12
748 | 10
749 | 13
750 | 13
751 | 13
752 | 13
753 | 10
754 | 10
755 | 10
756 | 10
757 | 12
758 | 12
759 | 12
760 | 10
761 | 10
762 | 12
763 | 10
764 | 12
765 | 10
766 | 12
767 | 12
768 | 12
769 | 10
770 | 10
771 | 12
772 | 12
773 | 18
774 | 12
775 | 12
776 | 14
777 | 13
778 | 13
779 | 12
780 | 12
781 | 12
782 | 12
783 | 10
784 | 10
785 | 10
786 | 10
787 | 10
788 | 10
789 | 12
790 | 14
791 | 13
792 | 14
793 | 13
794 | 13
795 | 12
796 | 12
797 | 12
798 | 14
799 | 13
800 | 13
801 | 18
802 | 12
803 | 12
804 | 12
805 | 12
806 | 12
807 | 12
808 | 12
809 | 12
810 | 12
811 | 12
812 | 12
813 | 12
814 | 12
815 | 12
816 | 12
817 | 11
818 | 12
819 | 12
820 | 10
821 | 10
822 | 18
823 | 10
824 | 10
825 | 10
826 | 18
827 | 10
828 | 15
829 | 10
830 | 10
831 | 10
832 | 10
833 | 10
834 | 10
835 | 10
836 | 10
837 | 10
838 | 18
839 | 10
840 | 14
841 | 16
842 | 14
843 | 16
844 | 13
845 | 14
846 | 15
847 | 14
848 | 13
849 | 13
850 | 16
851 | 14
852 | 16
853 | 15
854 | 14
855 | 14
856 | 13
857 | 14
858 | 16
859 | 14
860 | 14
861 | 13
862 | 14
863 | 14
864 | 14
865 | 14
866 | 13
867 | 13
868 | 12
869 | 13
870 | 15
871 | 14
872 | 14
873 | 14
874 | 14
875 | 16
876 | 15
877 | 14
878 | 15
879 | 14
880 | 14
881 | 14
882 | 12
883 | 14
884 | 10
885 | 12
886 | 12
887 | 12
888 | 12
889 | 12
890 | 10
891 | 19
892 | 16
893 | 25
894 | 15
895 | 17
896 | 16
897 | 15
898 | 18
899 | 19
900 | 15
901 | 16
902 | 10
903 | 10
904 | 16
905 | 18
906 | 19
907 | 15
908 | 20
909 | 18
910 | 16
911 | 19
912 | 16
913 | 18
914 | 25
915 | 19
916 | 18
917 | 22
918 | 25
919 | 11
920 | 19
921 | 14
922 | 12
923 | 12
924 | 12
925 | 12
926 | 12
927 | 10
928 | 12
929 | 12
930 | 12
931 | 12
932 | 12
933 | 12
934 | 11
935 | 11
936 | 10
937 | 11
938 | 10
939 | 11
940 | 10
941 | 11
942 | 12
943 | 12
944 | 10
945 | 11
946 | 10
947 | 10
948 | 12
949 | 10
950 | 10
951 | 11
952 | 10
953 | 12
954 | 10
955 | 10
956 | 10
957 | 10
958 | 10
959 | 10
960 | 10
961 | 10
962 | 10
963 | 10
964 | 10
965 | 10
966 | 10
967 | 10
968 | 10
969 | 10
970 | 10
971 | 12
972 | 10
973 | 10
974 | 12
975 | 10
976 | 10
977 | 12
978 | 12
979 | 10
980 | 10
981 | 10
982 | 10
983 | 10
984 | 10
985 | 10
986 | 10
987 | 10
988 | 10
989 | 10
990 | 10
991 | 10
992 | 10
993 | 10
994 | 12
995 | 10
996 | 10
997 | 10
998 | 12
999 | 12
1000 | 10
1001 | 10
1002 | 10
1003 | 12
1004 | 12
1005 | 12
1006 | 12
1007 | 12
1008 | 10
1009 | 12
1010 | 11
1011 | 11
1012 | 14
1013 | 13
1014 | 12
1015 | 12
1016 | 12
1017 | 12
1018 | 12
1019 | 12
1020 | 10
1021 | 12
1022 | 12
1023 | 12
1024 | 18
1025 | 18
1026 | 12
1027 | 11
1028 | 11
1029 | 11
1030 | 15
1031 | 12
1032 | 14
1033 | 18
1034 | 15
1035 | 14
1036 | 10
1037 | 10
1038 | 16
1039 | 10
1040 | 15
1041 | 14
1042 | 10
1043 | 19
1044 | 11
1045 | 14
1046 | 10
1047 | 18
1048 | 15
1049 | 14
1050 | 10
1051 | 18
1052 | 19
1053 | 16
1054 | 18
1055 | 18
1056 | 18
1057 | 18
1058 | 18
1059 | 18
1060 | 11
1061 | 10
1062 | 10
1063 | 10
1064 | 10
1065 | 10
1066 | 10
1067 | 10
1068 | 10
1069 | 10
1070 | 10
1071 | 18
1072 | 33
1073 | 12
1074 | 16
1075 | 15
1076 | 14
1077 | 20
1078 | 17
1079 | 15
1080 | 13
1081 | 16
1082 | 15
1083 | 15
1084 | 15
1085 | 20
1086 | 16
1087 | 18
1088 | 17
1089 | 14
1090 | 16
1091 | 12
1092 | 12
1093 | 12
1094 | 12
1095 | 12
1096 | 12
1097 | 12
1098 | 12
1099 | 12
1100 | 12
1101 | 12
1102 | 12
1103 | 12
1104 | 12
1105 | 12
1106 | 12
1107 | 12
1108 | 12
1109 | 12
1110 | 12
1111 | 12
1112 | 12
1113 | 12
1114 | 10
1115 | 12
1116 | 10
1117 | 10
1118 | 10
1119 | 10
1120 | 12
1121 | 12
1122 | 12
1123 | 10
1124 | 12
1125 | 10
1126 | 12
1127 | 10
1128 | 10
1129 | 10
1130 | 10
1131 | 10
1132 | 10
1133 | 10
1134 | 10
1135 | 12
1136 | 10
1137 | 12
1138 | 10
1139 | 16
1140 | 14
1141 | 15
1142 | 14
1143 | 14
1144 | 17
1145 | 18
1146 | 10
1147 | 10
1148 | 10
1149 | 10
1150 | 12
1151 | 10
1152 | 13
1153 | 12
1154 | 10
1155 | 17
1156 | 21
1157 | 16
1158 | 20
1159 | 18
1160 | 20
1161 | 20
1162 | 18
1163 | 18
1164 | 16
1165 | 13
1166 | 16
1167 | 16
1168 | 18
1169 | 17
1170 | 23
1171 | 18
1172 | 16
1173 | 18
1174 | 18
1175 | 17
1176 | 18
1177 | 19
1178 | 10
1179 | 10
1180 | 10
1181 | 10
1182 | 10
1183 | 10
1184 | 10
1185 | 10
1186 | 10
1187 | 10
1188 | 10
1189 | 10
1190 | 12
1191 | 10
1192 | 10
1193 | 10
1194 | 10
1195 | 10
1196 | 10
1197 | 10
1198 | 12
1199 | 19
1200 | 12
1201 | 12
1202 | 12
1203 | 12
1204 | 12
1205 | 12
1206 | 12
1207 | 12
1208 | 12
1209 | 12
1210 | 12
1211 | 12
1212 | 12
1213 | 10
1214 | 12
1215 | 19
1216 | 21
1217 | 19
1218 | 19
1219 | 20
1220 | 12
1221 | 18
1222 | 21
1223 | 10
1224 | 15
1225 | 19
1226 | 18
1227 | 18
1228 | 12
1229 | 12
1230 | 17
1231 | 10
1232 | 12
1233 | 18
1234 | 10
1235 | 10
1236 | 12
1237 | 12
1238 | 10
1239 | 12
1240 | 14
1241 | 12
1242 | 14
1243 | 10
1244 | 10
1245 | 10
1246 | 10
1247 | 10
1248 | 12
1249 | 10
1250 | 12
1251 | 10
1252 | 12
1253 | 11
1254 | 10
1255 | 10
1256 | 10
1257 | 10
1258 | 10
1259 | 10
1260 | 14
1261 | 10
1262 | 10
1263 | 10
1264 | 10
1265 | 10
1266 | 14
1267 | 13
1268 | 13
1269 | 14
1270 | 12
1271 | 13
1272 | 12
1273 | 10
1274 | 14
1275 | 12
1276 | 12
1277 | 12
1278 | 14
1279 | 13
1280 | 12
1281 | 12
1282 | 12
1283 | 10
1284 | 10
1285 | 12
1286 | 12
1287 | 12
1288 | 12
1289 | 12
1290 | 12
1291 | 12
1292 | 10
1293 | 25
1294 | 10
1295 | 12
1296 | 12
1297 | 12
1298 | 12
1299 | 12
1300 | 12
1301 | 18
1302 | 16
1303 | 21
1304 | 21
1305 | 26
1306 | 18
1307 | 23
1308 | 18
1309 | 22
1310 | 22
1311 | 20
1312 | 23
1313 | 23
1314 | 23
1315 | 23
1316 | 23
1317 | 26
1318 | 23
1319 | 18
1320 | 25
1321 | 22
1322 | 21
1323 | 22
1324 | 12
1325 | 12
1326 | 12
1327 | 12
1328 | 12
1329 | 12
1330 | 12
1331 | 12
1332 | 12
1333 | 12
1334 | 12
1335 | 12
1336 | 12
1337 | 10
1338 | 10
1339 | 20
1340 | 12
1341 | 10
1342 | 10
1343 | 10
1344 | 12
1345 | 10
1346 | 12
1347 | 12
1348 | 10
1349 | 12
1350 | 11
1351 | 10
1352 | 10
1353 | 10
1354 | 10
1355 | 10
1356 | 13
1357 | 13
1358 | 12
1359 | 12
1360 | 14
1361 | 10
1362 | 10
1363 | 10
1364 | 13
1365 | 13
1366 | 13
1367 | 13
1368 | 13
1369 | 12
1370 | 13
1371 | 10
1372 | 12
1373 | 12
1374 | 10
1375 | 16
1376 | 18
1377 | 18
1378 | 18
1379 | 18
1380 | 16
1381 | 16
1382 | 15
1383 | 10
1384 | 15
1385 | 16
1386 | 12
1387 | 10
1388 | 10
1389 | 12
1390 | 10
1391 | 10
1392 | 10
1393 | 11
1394 | 10
1395 | 10
1396 | 12
1397 | 12
1398 | 12
1399 | 12
1400 | 12
1401 | 12
1402 | 12
1403 | 12
1404 | 12
1405 | 12
1406 | 12
1407 | 12
1408 | 12
1409 | 12
1410 | 12
1411 | 10
1412 | 12
1413 | 12
1414 | 12
1415 | 12
1416 | 10
1417 | 12
1418 | 15
1419 | 15
1420 | 10
1421 | 15
1422 | 15
1423 | 15
1424 | 15
1425 | 15
1426 | 15
1427 | 10
1428 | 15
1429 | 12
1430 | 12
1431 | 10
1432 | 12
1433 | 20
1434 | 18
1435 | 22
1436 | 21
1437 | 20
1438 | 19
1439 | 25
1440 | 15
1441 | 20
1442 | 21
1443 | 20
1444 | 20
1445 | 20
1446 | 20
1447 | 21
1448 | 20
1449 | 21
1450 | 23
1451 | 18
1452 | 14
1453 | 20
1454 | 21
1455 | 16
1456 | 16
1457 | 20
1458 | 21
1459 | 20
1460 | 19
1461 | 20
1462 | 21
1463 | 22
1464 | 18
1465 | 22
1466 | 20
1467 | 21
1468 | 12
1469 | 18
1470 | 19
1471 | 12
1472 | 16
1473 | 15
1474 | 16
1475 | 16
1476 | 16
1477 | 19
1478 | 16
1479 | 19
1480 | 25
1481 | 26
1482 | 25
1483 | 26
1484 | 25
1485 | 36
1486 | 25
1487 | 25
1488 | 25
1489 | 22
1490 | 25
1491 | 25
1492 | 22
1493 | 25
1494 | 22
1495 | 25
1496 | 25
1497 | 22
1498 | 25
1499 | 25
1500 | 25
1501 | 11
1502 | 22
1503 | 26
1504 | 25
1505 | 25
1506 | 25
1507 | 25
1508 | 25
1509 | 25
1510 | 25
1511 | 25
1512 | 25
1513 | 22
1514 | 22
1515 | 25
1516 | 25
1517 | 25
1518 | 11
1519 | 11
1520 | 11
1521 | 11
1522 | 11
1523 | 11
1524 | 12
1525 | 11
1526 | 14
1527 | 29
1528 | 25
1529 | 25
1530 | 26
1531 | 25
1532 | 27
1533 | 25
1534 | 25
1535 | 22
1536 | 21
1537 | 14
1538 | 15
1539 | 25
1540 | 20
1541 | 24
1542 | 28
1543 | 17
1544 | 21
1545 | 20
1546 | 48
1547 | 19
1548 | 22
1549 | 29
1550 | 25
1551 | 25
1552 | 23
1553 | 25
1554 | 28
1555 | 17
1556 | 33
1557 | 20
1558 | 16
1559 | 19
1560 | 39
1561 | 39
1562 | 37
1563 | 18
1564 | 19
1565 | 25
1566 | 12
1567 | 20
1568 | 18
1569 | 12
1570 | 10
1571 | 10
1572 | 13
1573 | 12
1574 | 12
1575 | 12
1576 | 20
1577 | 20
1578 | 27
1579 | 22
1580 | 23
1581 | 23
1582 | 20
1583 | 23
1584 | 17
1585 | 22
1586 | 27
1587 | 28
1588 | 22
1589 | 24
1590 | 24
1591 | 25
1592 | 23
1593 | 12
1594 | 24
1595 | 22
1596 | 22
1597 | 23
1598 | 23
1599 | 22
1600 | 24
1601 | 23
1602 | 27
1603 | 24
1604 | 15
1605 | 21
1606 | 12
1607 | 12
1608 | 12
1609 | 10
1610 | 10
1611 | 12
1612 | 12
1613 | 12
1614 | 12
1615 | 12
1616 | 12
1617 | 12
1618 | 10
1619 | 10
1620 | 12
1621 | 10
1622 | 12
1623 | 12
1624 | 12
1625 | 12
1626 | 10
1627 | 12
1628 | 12
1629 | 10
1630 | 12
1631 | 12
1632 | 10
1633 | 12
1634 | 12
1635 | 12
1636 | 10
1637 | 12
1638 | 12
1639 | 12
1640 | 10
1641 | 12
1642 | 12
1643 | 12
1644 | 12
1645 | 12
1646 | 12
1647 | 11
1648 | 11
1649 | 12
1650 | 12
1651 | 12
1652 | 12
1653 | 12
1654 | 12
1655 | 12
1656 | 12
1657 | 12
1658 | 10
1659 | 10
1660 | 12
1661 | 25
1662 | 31
1663 | 24
1664 | 26
1665 | 25
1666 | 10
1667 | 14
1668 | 19
1669 | 15
1670 | 18
1671 | 18
1672 | 18
1673 | 18
1674 | 18
1675 | 12
1676 | 12
1677 | 12
1678 | 12
1679 | 18
1680 | 11
1681 | 18
1682 | 18
1683 | 18
1684 | 10
1685 | 10
1686 | 15
1687 | 14
1688 | 19
1689 | 12
1690 | 37
1691 | 10
1692 | 10
1693 | 10
1694 | 18
1695 | 20
1696 | 15
1697 | 15
1698 | 17
1699 | 16
1700 | 22
1701 | 23
1702 | 21
1703 | 17
1704 | 21
1705 | 10
1706 | 15
1707 | 14
1708 | 10
1709 | 17
1710 | 44
1711 | 22
1712 | 25
1713 | 27
1714 | 15
1715 | 14
1716 | 17
1717 | 17
1718 | 17
1719 | 17
1720 | 15
1721 | 16
1722 | 15
1723 | 15
1724 | 10
1725 | 14
1726 | 16
1727 | 14
1728 | 30
1729 | 18
1730 | 18
1731 | 12
1732 | 14
1733 | 17
1734 | 10
1735 | 15
1736 | 18
1737 | 14
1738 | 13
1739 | 13
1740 | 21
1741 | 13
1742 | 10
1743 | 15
1744 | 15
1745 | 14
1746 | 10
1747 | 20
1748 | 29
1749 | 29
1750 | 28
1751 | 29
1752 | 27
1753 | 26
1754 | 24
1755 | 21
1756 | 26
1757 | 22
1758 | 30
1759 | 10
1760 | 10
1761 | 10
1762 | 16
1763 | 18
1764 | 18
1765 | 18
1766 | 18
1767 | 24
1768 | 18
1769 | 18
1770 | 18
1771 | 18
1772 | 18
1773 | 18
1774 | 18
1775 | 18
1776 | 18
1777 | 18
1778 | 14
1779 | 15
1780 | 15
1781 | 18
1782 | 15
1783 | 18
1784 | 12
1785 | 15
1786 | 18
1787 | 14
1788 | 14
1789 | 18
1790 | 14
1791 | 21
1792 | 17
1793 | 13
1794 | 15
1795 | 13
1796 | 13
1797 | 12
1798 | 12
1799 | 12
1800 | 12
1801 | 12
1802 | 12
1803 | 12
1804 | 12
1805 | 12
1806 | 12
1807 | 12
1808 | 16
1809 | 10
1810 | 12
1811 | 12
1812 | 26
1813 | 10
1814 | 12
1815 | 11
1816 | 12
1817 | 12
1818 | 10
1819 | 10
1820 | 10
1821 | 10
1822 | 10
1823 | 12
1824 | 10
1825 | 10
1826 | 10
1827 | 12
1828 | 10
1829 | 14
1830 | 12
1831 | 10
1832 | 10
1833 | 12
1834 | 10
1835 | 14
1836 | 14
1837 | 15
1838 | 15
1839 | 15
1840 | 18
1841 | 10
1842 | 10
1843 | 10
1844 | 10
1845 | 21
1846 | 21
1847 | 13
1848 | 13
1849 | 12
1850 | 13
1851 | 13
1852 | 14
1853 | 12
1854 | 14
1855 | 13
1856 | 13
1857 | 13
1858 | 12
1859 | 17
1860 | 15
1861 | 12
1862 | 12
1863 | 12
1864 | 12
1865 | 10
1866 | 12
1867 | 12
1868 | 12
1869 | 18
1870 | 10
1871 | 19
1872 | 16
1873 | 16
1874 | 15
1875 | 15
1876 | 16
1877 | 19
1878 | 16
1879 | 19
1880 | 10
1881 | 19
1882 | 12
1883 | 12
1884 | 12
1885 | 12
1886 | 12
1887 | 12
1888 | 12
1889 | 12
1890 | 12
1891 | 23
1892 | 10
1893 | 11
1894 | 10
1895 | 10
1896 | 10
1897 | 10
1898 | 12
1899 | 10
1900 | 10
1901 | 10
1902 | 12
1903 | 12
1904 | 10
1905 | 12
1906 | 10
1907 | 10
1908 | 10
1909 | 13
1910 | 12
1911 | 16
1912 | 18
1913 | 16
1914 | 16
1915 | 16
1916 | 16
1917 | 15
1918 | 16
1919 | 16
1920 | 36
1921 | 20
1922 | 16
1923 | 12
1924 | 18
1925 | 15
1926 | 18
1927 | 10
1928 | 15
1929 | 18
1930 | 15
1931 | 15
1932 | 18
1933 | 16
1934 | 18
1935 | 18
1936 | 16
1937 | 18
1938 | 16
1939 | 18
1940 | 18
1941 | 16
1942 | 16
1943 | 18
1944 | 16
1945 | 18
1946 | 18
1947 | 27
1948 | 16
1949 | 16
1950 | 12
1951 | 12
1952 | 12
1953 | 13
1954 | 12
1955 | 12
1956 | 12
1957 | 12
1958 | 12
1959 | 12
1960 | 12
1961 | 12
1962 | 10
1963 | 12
1964 | 12
1965 | 12
1966 | 12
1967 | 12
1968 | 12
1969 | 12
1970 | 12
1971 | 12
1972 | 12
1973 | 12
1974 | 18
1975 | 12
1976 | 12
1977 | 12
1978 | 12
1979 | 12
1980 | 12
1981 | 12
1982 | 12
1983 | 12
1984 | 12
1985 | 12
1986 | 12
1987 | 12
1988 | 12
1989 | 12
1990 | 12
1991 | 12
1992 | 12
1993 | 19
1994 | 15
1995 | 18
1996 | 19
1997 | 19
1998 | 19
1999 | 15
2000 | 15
2001 | 15
2002 | 15
2003 | 18
2004 | 14
2005 | 14
2006 | 14
2007 | 16
2008 | 15
2009 | 14
2010 | 14
2011 | 14
2012 | 14
2013 | 14
2014 | 14
2015 | 14
2016 | 18
2017 | 15
2018 | 18
2019 | 18
2020 | 19
2021 | 19
2022 | 19
2023 | 31
2024 | 16
2025 | 16
2026 | 35
2027 | 19
2028 | 16
2029 | 18
2030 | 21
2031 | 18
2032 | 16
2033 | 19
2034 | 25
2035 | 18
2036 | 18
2037 | 24
2038 | 18
2039 | 19
2040 | 16
2041 | 17
2042 | 19
2043 | 16
2044 | 16
2045 | 25
2046 | 18
2047 | 25
2048 | 25
2049 | 25
2050 | 25
2051 | 22
2052 | 21
2053 | 25
2054 | 25
2055 | 25
2056 | 26
2057 | 25
2058 | 25
2059 | 27
2060 | 25
2061 | 25
2062 | 25
2063 | 25
2064 | 22
2065 | 10
2066 | 12
2067 | 13
2068 | 25
2069 | 25
2070 | 25
2071 | 25
2072 | 25
2073 | 25
2074 | 25
2075 | 25
2076 | 25
2077 | 25
2078 | 25
2079 | 25
2080 | 25
2081 | 25
2082 | 25
2083 | 25
2084 | 25
2085 | 25
2086 | 25
2087 | 11
2088 | 12
2089 | 11
2090 | 11
2091 | 18
2092 | 14
2093 | 21
2094 | 23
2095 | 23
2096 | 23
2097 | 23
2098 | 23
2099 | 20
2100 | 12
2101 | 12
2102 | 10
2103 | 12
2104 | 12
2105 | 14
2106 | 14
2107 | 12
2108 | 12
2109 | 12
2110 | 12
2111 | 12
2112 | 14
2113 | 14
2114 | 14
2115 | 12
2116 | 12
2117 | 12
2118 | 12
2119 | 15
2120 | 22
2121 | 12
2122 | 12
2123 | 10
2124 | 12
2125 | 10
2126 | 10
2127 | 12
2128 | 12
2129 | 12
2130 | 12
2131 | 12
2132 | 10
2133 | 12
2134 | 12
2135 | 12
2136 | 12
2137 | 10
2138 | 11
2139 | 12
2140 | 11
2141 | 10
2142 | 12
2143 | 24
2144 | 23
2145 | 12
2146 | 18
2147 | 10
2148 | 10
2149 | 10
2150 | 10
2151 | 10
2152 | 10
2153 | 10
2154 | 54
2155 | 15
2156 | 18
2157 | 18
2158 | 15
2159 | 18
2160 | 14
2161 | 23
2162 | 15
2163 | 14
2164 | 15
2165 | 18
2166 | 192
2167 | 14
2168 | 28
2169 | 14
2170 | 15
2171 | 15
2172 | 27
2173 | 27
2174 | 27
2175 | 27
2176 | 25
2177 | 24
2178 | 28
2179 | 28
2180 | 26
2181 | 26
2182 | 26
2183 | 27
2184 | 29
2185 | 27
2186 | 26
2187 | 23
2188 | 15
2189 | 18
2190 | 12
2191 | 19
2192 | 10
2193 | 10
2194 | 24
2195 | 25
2196 | 25
2197 | 26
2198 | 25
2199 | 23
2200 | 25
2201 | 27
2202 | 22
2203 | 18
2204 | 12
2205 | 13
2206 | 13
2207 | 13
2208 | 10
2209 | 30
2210 | 18
2211 | 10
2212 | 10
2213 | 12
2214 | 10
2215 | 10
2216 | 10
2217 | 10
2218 | 10
2219 | 14
2220 | 10
2221 | 10
2222 | 10
2223 | 10
2224 | 21
2225 | 12
2226 | 14
2227 | 20
2228 | 10
2229 | 21
2230 | 12
2231 | 15
2232 | 18
2233 | 14
2234 | 10
2235 | 14
2236 | 14
2237 | 10
2238 | 14
2239 | 10
2240 | 10
2241 | 10
2242 | 14
2243 | 18
2244 | 10
2245 | 18
2246 | 17
2247 | 26
2248 | 24
2249 | 54
2250 | 37
2251 | 22
2252 | 16
2253 | 16
2254 | 18
2255 | 16
2256 | 18
2257 | 18
2258 | 14
2259 | 14
2260 | 18
2261 | 18
2262 | 14
2263 | 18
2264 | 18
2265 | 18
2266 | 14
2267 | 18
2268 | 18
2269 | 18
2270 | 18
2271 | 18
2272 | 15
2273 | 10
2274 | 12
2275 | 18
2276 | 15
2277 | 18
2278 | 14
2279 | 14
2280 | 14
2281 | 19
2282 | 16
2283 | 18
2284 | 14
2285 | 14
2286 | 14
2287 | 13
2288 | 13
2289 | 14
2290 | 14
2291 | 17
2292 | 17
2293 | 17
2294 | 12
2295 | 12
2296 | 12
2297 | 12
2298 | 12
2299 | 12
2300 | 12
2301 | 12
2302 | 10
2303 | 10
2304 | 10
2305 | 12
2306 | 12
2307 | 17
2308 | 10
2309 | 12
2310 | 12
2311 | 13
2312 | 16
2313 | 16
2314 | 16
2315 | 13
2316 | 16
2317 | 14
2318 | 16
2319 | 16
2320 | 17
2321 | 15
2322 | 14
2323 | 42
2324 | 14
2325 | 15
2326 | 14
2327 | 18
2328 | 18
2329 | 18
2330 | 10
2331 | 10
2332 | 10
2333 | 10
2334 | 25
2335 | 13
2336 | 10
2337 | 13
2338 | 13
2339 | 10
2340 | 13
2341 | 10
2342 | 10
2343 | 10
2344 | 10
2345 | 12
2346 | 12
2347 | 12
2348 | 12
2349 | 12
2350 | 16
2351 | 12
2352 | 12
2353 | 12
2354 | 12
2355 | 12
2356 | 15
2357 | 11
2358 | 12
2359 | 16
2360 | 19
2361 | 15
2362 | 16
2363 | 16
2364 | 16
2365 | 16
2366 | 16
2367 | 15
2368 | 16
2369 | 16
2370 | 16
2371 | 19
2372 | 16
2373 | 16
2374 | 19
2375 | 19
2376 | 11
2377 | 19
2378 | 16
2379 | 15
2380 | 19
2381 | 12
2382 | 14
2383 | 12
2384 | 12
2385 | 12
2386 | 18
2387 | 16
2388 | 28
2389 | 16
2390 | 12
2391 | 16
2392 | 16
2393 | 18
2394 | 15
2395 | 25
2396 | 18
2397 | 16
2398 | 16
2399 | 18
2400 | 29
2401 | 18
2402 | 15
2403 | 18
2404 | 18
2405 | 18
2406 | 15
2407 | 15
2408 | 10
2409 | 18
2410 | 18
2411 | 45
2412 | 18
2413 | 12
2414 | 12
2415 | 12
2416 | 18
2417 | 12
2418 | 10
2419 | 10
2420 | 12
2421 | 12
2422 | 12
2423 | 12
2424 | 12
2425 | 12
2426 | 12
2427 | 12
2428 | 12
2429 | 12
2430 | 12
2431 | 12
2432 | 10
2433 | 12
2434 | 12
2435 | 12
2436 | 17
2437 | 12
2438 | 18
2439 | 12
2440 | 12
2441 | 12
2442 | 10
2443 | 12
2444 | 12
2445 | 12
2446 | 12
2447 | 19
2448 | 19
2449 | 10
2450 | 16
2451 | 19
2452 | 15
2453 | 14
2454 | 14
2455 | 18
2456 | 14
2457 | 15
2458 | 14
2459 | 14
2460 | 14
2461 | 18
2462 | 14
2463 | 12
2464 | 14
2465 | 10
2466 | 14
2467 | 14
2468 | 15
2469 | 13
2470 | 16
2471 | 15
2472 | 18
2473 | 16
2474 | 16
2475 | 16
2476 | 16
2477 | 19
2478 | 19
2479 | 19
2480 | 19
2481 | 10
2482 | 18
2483 | 16
2484 | 16
2485 | 19
2486 | 19
2487 | 19
2488 | 19
2489 | 19
2490 | 19
2491 | 19
2492 | 19
2493 | 19
2494 | 16
2495 | 16
2496 | 16
2497 | 19
2498 | 19
2499 | 19
2500 | 19
2501 | 19
2502 | 18
2503 | 19
2504 | 19
2505 | 19
2506 | 19
2507 | 16
2508 | 18
2509 | 16
2510 | 16
2511 | 16
2512 | 16
2513 | 16
2514 | 26
2515 | 26
2516 | 26
2517 | 26
2518 | 25
2519 | 25
2520 | 12
2521 | 14
2522 | 22
2523 | 22
2524 | 10
2525 | 10
2526 | 12
2527 | 10
2528 | 12
2529 | 10
2530 | 27
2531 | 26
2532 | 20
2533 | 26
2534 | 13
2535 | 13
2536 | 13
2537 | 13
2538 | 25
2539 | 13
2540 | 25
2541 | 25
2542 | 25
2543 | 25
2544 | 51
2545 | 17
2546 | 15
2547 | 10
2548 | 10
2549 | 10
2550 | 10
2551 | 10
2552 | 15
2553 | 23
2554 | 23
2555 | 12
2556 | 27
2557 | 12
2558 | 12
2559 | 10
2560 | 12
2561 | 12
2562 | 12
2563 | 10
2564 | 12
2565 | 12
2566 | 10
2567 | 12
2568 | 10
2569 | 10
2570 | 15
2571 | 14
2572 | 18
2573 | 18
2574 | 18
2575 | 14
2576 | 15
2577 | 14
2578 | 14
2579 | 14
2580 | 14
2581 | 14
2582 | 14
2583 | 14
2584 | 14
2585 | 14
2586 | 15
2587 | 15
2588 | 15
2589 | 18
2590 | 15
2591 | 18
2592 | 14
2593 | 18
2594 | 18
2595 | 10
2596 | 12
2597 | 10
2598 | 10
2599 | 19
2600 | 10
2601 | 15
2602 | 15
2603 | 18
2604 | 18
2605 | 14
2606 | 14
2607 | 14
2608 | 10
2609 | 15
2610 | 12
2611 | 14
2612 | 14
2613 | 18
2614 | 18
2615 | 18
2616 | 18
2617 | 15
2618 | 27
2619 | 18
2620 | 13
2621 | 13
2622 | 14
2623 | 13
2624 | 13
2625 | 13
2626 | 12
2627 | 14
2628 | 10
2629 | 12
2630 | 12
2631 | 12
2632 | 10
2633 | 10
2634 | 14
2635 | 10
2636 | 12
2637 | 12
2638 | 14
2639 | 12
2640 | 13
2641 | 10
2642 | 13
2643 | 10
2644 | 10
2645 | 10
2646 | 13
2647 | 13
2648 | 13
2649 | 14
2650 | 10
2651 | 13
2652 | 10
2653 | 13
2654 | 10
2655 | 18
2656 | 10
2657 | 10
2658 | 10
2659 | 10
2660 | 13
2661 | 13
2662 | 10
2663 | 10
2664 | 13
2665 | 10
2666 | 10
2667 | 14
2668 | 10
2669 | 10
2670 | 14
2671 | 10
2672 | 14
2673 | 14
2674 | 16
2675 | 15
2676 | 14
2677 | 10
2678 | 10
2679 | 14
2680 | 14
2681 | 18
2682 | 13
2683 | 14
2684 | 14
2685 | 27
2686 | 17
2687 | 15
2688 | 14
2689 | 15
2690 | 15
2691 | 10
2692 | 18
2693 | 14
2694 | 14
2695 | 23
2696 | 21
2697 | 21
2698 | 19
2699 | 23
2700 | 15
2701 | 18
2702 | 14
2703 | 14
2704 | 15
2705 | 14
2706 | 19
2707 | 18
2708 | 15
2709 | 15
2710 | 15
2711 | 15
2712 | 15
2713 | 19
2714 | 12
2715 | 12
2716 | 12
2717 | 12
2718 | 12
2719 | 12
2720 | 12
2721 | 14
2722 | 14
2723 | 13
2724 | 12
2725 | 10
2726 | 14
2727 | 14
2728 | 12
2729 | 12
2730 | 18
2731 | 16
2732 | 16
2733 | 16
2734 | 16
2735 | 16
2736 | 16
2737 | 16
2738 | 10
2739 | 16
2740 | 15
2741 | 19
2742 | 14
2743 | 12
2744 | 12
2745 | 12
2746 | 10
2747 | 10
2748 | 10
2749 | 16
2750 | 16
2751 | 18
2752 | 18
2753 | 18
2754 | 18
2755 | 18
2756 | 18
2757 | 12
2758 | 12
2759 | 12
2760 | 12
2761 | 12
2762 | 12
2763 | 12
2764 | 12
2765 | 12
2766 | 12
2767 | 12
2768 | 10
2769 | 12
2770 | 12
2771 | 10
2772 | 27
2773 | 12
2774 | 12
2775 | 23
2776 | 12
2777 | 12
2778 | 12
2779 | 15
2780 | 19
2781 | 14
2782 | 14
2783 | 14
2784 | 15
2785 | 10
2786 | 18
2787 | 10
2788 | 14
2789 | 14
2790 | 13
2791 | 18
2792 | 16
2793 | 18
2794 | 18
2795 | 18
2796 | 16
2797 | 19
2798 | 15
2799 | 15
2800 | 18
2801 | 10
2802 | 15
2803 | 15
2804 | 15
2805 | 18
2806 | 16
2807 | 16
2808 | 26
2809 | 12
2810 | 25
2811 | 25
2812 | 25
2813 | 25
2814 | 25
2815 | 22
2816 | 13
2817 | 18
2818 | 13
2819 | 25
2820 | 25
2821 | 25
2822 | 25
2823 | 10
2824 | 11
2825 | 12
2826 | 12
2827 | 20
2828 | 18
2829 | 19
2830 | 12
2831 | 12
2832 | 10
2833 | 18
2834 | 12
2835 | 15
2836 | 15
2837 | 14
2838 | 15
2839 | 15
2840 | 15
2841 | 18
2842 | 14
2843 | 15
2844 | 10
2845 | 13
2846 | 10
2847 | 13
2848 | 10
2849 | 13
2850 | 12
2851 | 13
2852 | 13
2853 | 13
2854 | 18
2855 | 19
2856 | 19
2857 | 17
2858 | 10
2859 | 19
2860 | 10
2861 | 14
2862 | 15
2863 | 14
2864 | 25
2865 | 14
2866 | 14
2867 | 14
2868 | 15
2869 | 14
2870 | 14
2871 | 10
2872 | 14
2873 | 10
2874 | 10
2875 | 10
2876 | 10
2877 | 25
2878 | 10
2879 | 10
2880 | 18
2881 | 18
2882 | 10
2883 | 10
2884 | 18
2885 | 18
2886 | 10
2887 | 18
2888 | 18
2889 | 18
2890 | 13
2891 | 13
2892 | 13
2893 | 10
2894 | 14
2895 | 14
2896 | 10
2897 | 13
2898 | 14
2899 | 10
2900 | 12
2901 | 15
2902 | 10
2903 | 14
2904 | 10
2905 | 10
2906 | 13
2907 | 10
2908 | 10
2909 | 10
2910 | 14
2911 | 10
2912 | 10
2913 | 14
2914 | 18
2915 | 19
2916 | 10
2917 | 12
2918 | 12
2919 | 18
2920 | 18
2921 | 18
2922 | 18
2923 | 10
2924 | 14
2925 | 14
2926 | 39
2927 | 19
2928 | 28
2929 | 32
2930 | 62
2931 | 31
2932 | 43
2933 | 14
2934 | 22
2935 | 20
2936 | 22
2937 | 55
2938 | 22
2939 | 22
2940 | 18
2941 | 25
2942 | 15
2943 | 15
2944 | 14
2945 | 18
2946 | 12
2947 | 14
2948 | 12
2949 | 12
2950 | 12
2951 | 12
2952 | 18
2953 | 15
2954 | 15
2955 | 15
2956 | 15
2957 | 15
2958 | 15
2959 | 15
2960 | 16
2961 | 18
2962 | 18
2963 | 16
2964 | 18
2965 | 18
2966 | 18
2967 | 16
2968 | 16
2969 | 18
2970 | 12
2971 | 12
2972 | 12
2973 | 12
2974 | 12
2975 | 10
2976 | 12
2977 | 12
2978 | 10
2979 | 12
2980 | 10
2981 | 10
2982 | 10
2983 | 10
2984 | 10
2985 | 10
2986 | 10
2987 | 10
2988 | 36
2989 | 14
2990 | 14
2991 | 14
2992 | 18
2993 | 17
2994 | 14
2995 | 15
2996 | 15
2997 | 22
2998 | 16
2999 | 19
3000 | 15
3001 | 15
3002 | 12
3003 | 12
3004 | 25
3005 | 13
3006 | 10
3007 | 25
3008 | 25
3009 | 25
3010 | 14
3011 | 14
3012 | 15
3013 | 15
3014 | 14
3015 | 14
3016 | 14
3017 | 10
3018 | 10
3019 | 10
3020 | 19
3021 | 10
3022 | 19
3023 | 15
3024 | 10
3025 | 10
3026 | 10
3027 | 24
3028 | 10
3029 | 12
3030 | 19
3031 | 20
3032 | 19
3033 | 18
3034 | 10
3035 | 13
3036 | 10
3037 | 14
3038 | 14
3039 | 15
3040 | 17
3041 | 14
3042 | 18
3043 | 18
3044 | 13
3045 | 10
3046 | 62
3047 | 18
3048 | 10
3049 | 10
3050 | 13
3051 | 10
3052 | 18
3053 | 10
3054 | 10
3055 | 14
3056 | 14
3057 | 13
3058 | 14
3059 | 10
3060 | 14
3061 | 17
3062 | 10
3063 | 13
3064 | 10
3065 | 13
3066 | 13
3067 | 14
3068 | 10
3069 | 12
3070 | 14
3071 | 14
3072 | 12
3073 | 10
3074 | 14
3075 | 12
3076 | 14
3077 | 12
3078 | 13
3079 | 10
3080 | 10
3081 | 10
3082 | 16
3083 | 16
3084 | 16
3085 | 19
3086 | 16
3087 | 19
3088 | 19
3089 | 16
3090 | 10
3091 | 23
3092 | 23
3093 | 10
3094 | 10
3095 | 10
3096 | 10
3097 | 10
3098 | 18
3099 | 10
3100 | 14
3101 | 18
3102 | 18
3103 | 18
3104 | 18
3105 | 18
3106 | 18
3107 | 10
3108 | 15
3109 | 18
3110 | 12
3111 | 30
3112 | 22
3113 | 14
3114 | 14
3115 | 15
3116 | 14
3117 | 14
3118 | 14
3119 | 25
3120 | 22
3121 | 16
3122 | 13
3123 | 17
3124 | 16
3125 | 13
3126 | 26
3127 | 16
3128 | 12
3129 | 13
3130 | 18
3131 | 18
3132 | 18
3133 | 18
3134 | 18
3135 | 12
3136 | 12
3137 | 12
3138 | 12
3139 | 10
3140 | 10
3141 | 31
3142 | 27
3143 | 14
3144 | 14
3145 | 10
3146 | 109
3147 | 14
3148 | 13
3149 | 25
3150 | 25
3151 | 25
3152 | 25
3153 | 14
3154 | 14
3155 | 14
3156 | 24
3157 | 14
3158 | 10
3159 | 19
3160 | 10
3161 | 10
3162 | 10
3163 | 13
3164 | 15
3165 | 13
3166 | 14
3167 | 18
3168 | 16
3169 | 30
3170 | 10
3171 | 13
3172 | 10
3173 | 10
3174 | 13
3175 | 10
3176 | 18
3177 | 15
3178 | 18
3179 | 15
3180 | 14
3181 | 13
3182 | 12
3183 | 12
3184 | 12
3185 | 10
3186 | 10
3187 | 14
3188 | 12
3189 | 10
3190 | 10
3191 | 10
3192 | 10
3193 | 10
3194 | 10
3195 | 12
3196 | 10
3197 | 14
3198 | 14
3199 | 14
3200 | 14
3201 | 14
3202 | 14
3203 | 10
3204 | 10
3205 | 19
3206 | 10
3207 | 16
3208 | 16
3209 | 15
3210 | 16
3211 | 16
3212 | 19
3213 | 16
3214 | 16
3215 | 16
3216 | 16
3217 | 16
3218 | 16
3219 | 16
3220 | 18
3221 | 18
3222 | 18
3223 | 10
3224 | 16
3225 | 16
3226 | 16
3227 | 18
3228 | 16
3229 | 19
3230 | 10
3231 | 19
3232 | 19
3233 | 19
3234 | 19
3235 | 19
3236 | 12
3237 | 10
3238 | 18
3239 | 14
3240 | 14
3241 | 16
3242 | 10
3243 | 18
3244 | 18
3245 | 18
3246 | 18
3247 | 18
3248 | 19
3249 | 18
3250 | 15
3251 | 18
3252 | 18
3253 | 10
3254 | 10
3255 | 15
3256 | 15
3257 | 19
3258 | 20
3259 | 18
3260 | 19
3261 | 14
3262 | 10
3263 | 15
3264 | 18
3265 | 15
3266 | 14
3267 | 14
3268 | 18
3269 | 15
3270 | 14
3271 | 13
3272 | 13
3273 | 14
3274 | 18
3275 | 12
3276 | 18
3277 | 10
3278 | 12
3279 | 12
3280 | 14
3281 | 14
3282 | 15
3283 | 15
3284 | 15
3285 | 15
3286 | 18
3287 | 25
3288 | 19
3289 | 14
3290 | 15
3291 | 14
3292 | 15
3293 | 18
3294 | 10
3295 | 23
3296 | 22
3297 | 10
3298 | 10
3299 | 13
3300 | 13
3301 | 11
3302 | 10
3303 | 10
3304 | 12
3305 | 12
3306 | 12
3307 | 18
3308 | 14
3309 | 18
3310 | 14
3311 | 14
3312 | 13
3313 | 10
3314 | 10
3315 | 14
3316 | 23
3317 | 10
3318 | 10
3319 | 10
3320 | 10
3321 | 16
3322 | 15
3323 | 16
3324 | 16
3325 | 16
3326 | 16
3327 | 16
3328 | 16
3329 | 16
3330 | 19
3331 | 19
3332 | 19
3333 | 18
3334 | 18
3335 | 22
3336 | 19
3337 | 17
3338 | 19
3339 | 15
3340 | 14
3341 | 18
3342 | 18
3343 | 17
3344 | 17
3345 | 16
3346 | 41
3347 | 16
3348 | 13
3349 | 14
3350 | 16
3351 | 13
3352 | 14
3353 | 12
3354 | 12
3355 | 15
3356 | 15
3357 | 19
3358 | 15
3359 | 15
3360 | 15
3361 | 18
3362 | 18
3363 | 18
3364 | 18
3365 | 18
3366 | 25
3367 | 14
3368 | 14
3369 | 15
3370 | 14
3371 | 14
3372 | 14
3373 | 14
3374 | 18
3375 | 12
3376 | 12
3377 | 18
3378 | 12
3379 | 22
3380 | 22
3381 | 22
3382 | 21
3383 | 22
3384 | 13
3385 | 11
3386 | 11
3387 | 10
3388 | 10
3389 | 10
3390 | 11
3391 | 12
3392 | 10
3393 | 10
3394 | 15
3395 | 15
3396 | 19
3397 | 19
3398 | 14
3399 | 14
3400 | 15
3401 | 14
3402 | 18
3403 | 15
3404 | 17
3405 | 29
3406 | 15
3407 | 18
3408 | 18
3409 | 18
3410 | 18
3411 | 18
3412 | 18
3413 | 16
3414 | 14
3415 | 15
3416 | 17
3417 | 21
3418 | 12
3419 | 15
3420 | 18
3421 | 19
3422 | 15
3423 | 15
3424 | 19
3425 | 15
3426 | 15
3427 | 18
3428 | 10
3429 | 10
3430 | 10
3431 | 10
3432 | 10
3433 | 15
3434 | 19
3435 | 15
3436 | 18
3437 | 15
3438 | 15
3439 | 14
3440 | 15
3441 | 18
3442 | 18
3443 | 14
3444 | 14
3445 | 18
3446 | 10
3447 | 10
3448 | 15
3449 | 18
3450 | 15
3451 | 18
3452 | 15
3453 | 19
3454 | 15
3455 | 18
3456 | 18
3457 | 21
3458 | 17
3459 | 18
3460 | 15
3461 | 22
3462 | 21
3463 | 20
3464 | 20
3465 | 20
3466 | 21
3467 | 15
3468 | 15
3469 | 15
3470 | 15
3471 | 15
3472 | 15
3473 | 15
3474 | 15
3475 | 21
3476 | 27
3477 | 20
3478 | 20
3479 | 21
3480 | 21
3481 | 12
3482 | 15
3483 | 19
3484 | 19
3485 | 19
3486 | 15
3487 | 15
3488 | 15
3489 | 15
3490 | 15
3491 | 13
3492 | 15
3493 | 15
3494 | 15
3495 | 15
3496 | 10
3497 | 10
3498 | 10
3499 | 10
3500 | 10
3501 | 10
3502 | 15
3503 | 15
3504 | 18
3505 | 15
3506 | 15
3507 | 16
3508 | 18
3509 | 15
3510 | 15
3511 | 18
3512 | 18
3513 | 15
3514 | 15
3515 | 19
3516 | 15
3517 | 15
3518 | 17
3519 | 17
3520 | 18
3521 | 17
3522 | 18
3523 | 18
3524 | 18
3525 | 18
3526 | 18
3527 | 22
3528 | 12
3529 | 17
3530 | 12
3531 | 12
3532 | 12
3533 | 12
3534 | 17
3535 | 19
3536 | 14
3537 | 17
3538 | 17
3539 | 19
3540 | 15
3541 | 19
3542 | 18
3543 | 18
3544 | 15
3545 | 15
3546 | 18
3547 | 13
3548 | 13
3549 | 13
3550 | 13
3551 | 13
3552 | 15
3553 | 15
3554 | 18
3555 | 18
3556 | 15
3557 | 18
3558 | 18
3559 | 18
3560 | 18
3561 | 18
3562 | 16
3563 | 17
3564 | 18
3565 | 18
3566 | 18
3567 | 18
3568 | 18
3569 | 18
3570 | 18
3571 | 15
3572 | 15
3573 | 17
3574 | 18
3575 | 12
3576 | 17
3577 | 14
3578 | 14
3579 | 17
3580 | 15
3581 | 25
3582 | 25
3583 | 25
3584 | 25
3585 | 25
3586 | 29
3587 | 18
3588 | 18
3589 | 18
3590 | 19
3591 | 20
3592 | 18
3593 | 16
3594 | 18
3595 | 18
3596 | 15
3597 | 32
3598 | 32
3599 | 28
3600 | 27
3601 | 32
3602 | 17
3603 | 17
3604 | 15
3605 | 15
3606 | 16
3607 | 16
3608 | 16
3609 | 15
3610 | 25
3611 | 25
3612 | 15
3613 | 15
3614 | 11
3615 | 15
3616 | 18
3617 | 18
3618 | 18
3619 | 18
3620 | 18
3621 | 18
3622 | 16
3623 | 20
3624 | 16
3625 | 15
3626 | 12
3627 | 14
3628 | 15
3629 | 27
3630 | 42
3631 | 18
3632 | 15
3633 | 18
3634 | 15
3635 | 26
3636 | 24
3637 | 21
3638 | 27
3639 | 22
3640 | 11
3641 | 18
3642 | 18
3643 | 18
3644 | 18
3645 | 19
3646 | 19
3647 | 16
3648 | 14
3649 | 14
3650 | 14
3651 | 28
3652 | 18
3653 | 19
3654 | 18
3655 | 18
3656 | 18
3657 | 18
3658 | 20
3659 | 18
3660 | 18
3661 | 18
3662 | 19
3663 | 18
3664 | 18
3665 | 18
3666 | 18
3667 | 19
3668 | 19
3669 | 18
3670 | 18
3671 | 18
3672 | 18
3673 | 18
3674 | 14
3675 | 20
3676 | 25
3677 | 25
3678 | 18
3679 | 18
3680 | 19
3681 | 18
3682 | 18
3683 | 18
3684 | 18
3685 | 18
3686 | 18
3687 | 14
3688 | 18
3689 | 15
3690 | 18
3691 | 18
3692 | 18
3693 | 10
3694 | 18
3695 | 18
3696 | 18
3697 | 16
3698 | 18
3699 | 20
3700 | 19
3701 | 18
3702 | 15
3703 | 15
3704 | 18
3705 | 18
3706 | 18
3707 | 20
3708 | 18
3709 | 18
3710 | 18
3711 | 18
3712 | 14
3713 | 18
3714 | 14
3715 | 14
3716 | 15
3717 | 14
3718 | 14
3719 | 18
3720 | 14
3721 | 18
3722 | 20
3723 | 20
3724 | 20
3725 | 20
3726 | 20
3727 | 20
3728 | 18
3729 | 18
3730 | 16
3731 | 16
3732 | 10
3733 | 10
3734 | 10
3735 | 10
3736 | 19
3737 | 19
3738 | 10
3739 | 18
3740 | 18
3741 | 18
3742 | 18
3743 | 19
3744 | 19
3745 | 19
3746 | 27
3747 | 27
3748 | 27
3749 | 19
3750 | 19
3751 | 19
3752 | 18
3753 | 16
3754 | 19
3755 | 18
3756 | 15
3757 | 18
3758 | 15
3759 | 14
3760 | 14
3761 | 14
3762 | 14
3763 | 14
3764 | 18
3765 | 18
3766 | 20
3767 | 20
3768 | 15
3769 | 15
3770 | 18
3771 | 19
3772 | 10
3773 | 18
3774 | 19
3775 | 19
3776 | 18
3777 | 16
3778 | 19
3779 | 16
3780 | 20
3781 | 18
3782 | 19
3783 | 18
3784 | 19
3785 | 18
3786 | 14
3787 | 14
3788 | 19
3789 | 19
3790 | 18
3791 | 19
3792 | 16
3793 | 18
3794 | 15
3795 | 18
3796 | 19
3797 | 19
3798 | 14
3799 | 19
3800 | 14
3801 | 18
3802 | 14
3803 | 18
3804 | 18
3805 | 18
3806 | 18
3807 | 14
3808 | 14
3809 | 14
3810 | 18
3811 | 18
3812 | 14
3813 | 15
3814 | 10
3815 | 10
3816 | 19
3817 | 19
3818 | 19
3819 | 19
3820 | 232
3821 | 267
3822 | 18
3823 | 18
3824 | 18
3825 | 15
3826 | 15
3827 | 15
3828 | 14
3829 | 19
3830 | 19
3831 | 19
3832 | 18
3833 | 18
3834 | 14
3835 | 14
3836 | 18
3837 | 18
3838 | 14
3839 | 14
3840 | 14
3841 | 18
3842 | 14
3843 | 14
3844 | 18
3845 | 19
3846 | 14
3847 | 14
3848 | 16
3849 | 19
3850 | 16
3851 | 16
3852 | 19
3853 | 18
3854 | 18
3855 | 18
3856 | 18
3857 | 12
3858 | 19
3859 | 10
3860 | 10
3861 | 15
3862 | 19
3863 | 19
3864 | 19
3865 | 18
3866 | 15
3867 | 15
3868 | 14
3869 | 18
3870 | 18
3871 | 14
3872 | 14
3873 | 14
3874 | 15
3875 | 14
3876 | 18
3877 | 18
3878 | 19
3879 | 18
3880 | 18
3881 | 14
3882 | 18
3883 | 18
3884 | 14
3885 | 14
3886 | 15
3887 | 16
3888 | 16
3889 | 19
3890 | 15
3891 | 15
3892 | 16
3893 | 12
3894 | 11
3895 | 19
3896 | 19
3897 | 19
3898 | 19
3899 | 17
3900 | 18
3901 | 21
3902 | 19
3903 | 19
3904 | 19
3905 | 15
3906 | 19
3907 | 15
3908 | 50
3909 | 15
3910 | 14
3911 | 14
3912 | 15
3913 | 16
3914 | 18
3915 | 14
3916 | 14
3917 | 15
3918 | 14
3919 | 18
3920 | 18
3921 | 18
3922 | 18
3923 | 15
3924 | 19
3925 | 14
3926 | 19
3927 | 19
3928 | 14
3929 | 18
3930 | 15
3931 | 14
3932 | 15
3933 | 18
3934 | 15
3935 | 15
3936 | 15
3937 | 15
3938 | 12
3939 | 12
3940 | 12
3941 | 12
3942 | 12
3943 | 21
3944 | 19
3945 | 16
3946 | 19
3947 | 19
3948 | 18
3949 | 19
3950 | 18
3951 | 19
3952 | 15
3953 | 15
3954 | 14
3955 | 18
3956 | 18
3957 | 18
3958 | 18
3959 | 18
3960 | 18
3961 | 18
3962 | 19
3963 | 15
3964 | 15
3965 | 15
3966 | 15
3967 | 15
3968 | 15
3969 | 14
3970 | 15
3971 | 15
3972 | 15
3973 | 15
3974 | 18
3975 | 12
3976 | 12
3977 | 18
3978 | 25
3979 | 25
3980 | 18
3981 | 18
3982 | 18
3983 | 18
3984 | 18
3985 | 15
3986 | 18
3987 | 18
3988 | 13
3989 | 14
3990 | 18
3991 | 49
3992 | 18
3993 | 15
3994 | 15
3995 | 15
3996 | 19
3997 | 19
3998 | 15
3999 | 15
4000 | 18
4001 | 15
4002 | 14
4003 | 14
4004 | 10
4005 | 10
4006 | 10
4007 | 15
4008 | 25
4009 | 18
4010 | 18
4011 | 18
4012 | 18
4013 | 18
4014 | 18
4015 | 18
4016 | 18
4017 | 15
4018 | 13
4019 | 14
4020 | 14
4021 | 14
4022 | 18
4023 | 18
4024 | 15
4025 | 18
4026 | 15
4027 | 15
4028 | 15
4029 | 15
4030 | 14
4031 | 10
4032 | 18
4033 | 18
4034 | 18
4035 | 18
4036 | 27
4037 | 28
4038 | 27
4039 | 31
4040 | 13
4041 | 13
4042 | 14
4043 | 18
4044 | 14
4045 | 14
4046 | 15
4047 | 15
4048 | 15
4049 | 15
4050 | 18
4051 | 18
4052 | 14
4053 | 14
4054 | 10
4055 | 10
4056 | 10
4057 | 18
4058 | 18
4059 | 16
4060 | 16
4061 | 16
4062 | 13
4063 | 14
4064 | 14
4065 | 18
4066 | 15
4067 | 18
4068 | 18
4069 | 18
4070 | 18
4071 | 18
4072 | 15
4073 | 18
4074 | 15
4075 | 18
4076 | 18
4077 | 18
4078 | 10
4079 | 10
4080 | 16
4081 | 15
4082 | 16
4083 | 16
4084 | 17
4085 | 15
4086 | 18
4087 | 18
4088 | 18
4089 | 18
4090 | 18
4091 | 14
4092 | 15
4093 | 18
4094 | 15
4095 | 10
4096 | 16
4097 | 17
4098 | 15
4099 | 18
4100 | 19
4101 | 19
4102 | 15
4103 | 15
4104 | 15
4105 | 15
4106 | 18
4107 | 18
4108 | 18
4109 | 15
4110 | 16
4111 | 15
4112 | 15
4113 | 18
4114 | 15
4115 | 18
4116 | 15
4117 | 15
4118 | 16
4119 | 10
4120 | 18
4121 | 18
4122 | 15
4123 | 15
4124 | 18
4125 | 18
4126 | 18
4127 | 15
4128 | 15
4129 | 18
4130 | 18
4131 | 18
4132 | 15
4133 | 15
4134 | 15
4135 | 12
4136 | 15
4137 | 10
4138 | 11
4139 | 10
4140 | 12
4141 | 22
4142 | 25
4143 | 10
4144 | 25
4145 | 22
4146 | 12
4147 | 13
4148 | 18
4149 | 25
4150 | 18
4151 | 12
4152 | 12
4153 | 14
4154 | 10
4155 | 19
4156 | 18
4157 | 16
4158 | 16
4159 | 15
4160 | 14
4161 | 14
4162 | 12
4163 | 15
4164 | 18
4165 | 10
4166 | 14
4167 | 10
4168 | 14
4169 | 10
4170 | 14
4171 | 14
4172 | 10
4173 | 15
4174 | 15
4175 | 15
4176 | 18
4177 | 18
4178 | 18
4179 | 18
4180 | 15
4181 | 18
4182 | 18
4183 | 18
4184 | 18
4185 | 18
4186 | 18
4187 | 18
4188 | 16
4189 | 20
4190 | 19
4191 | 18
4192 | 14
4193 | 14
4194 | 14
4195 | 15
4196 | 14
4197 | 15
4198 | 19
4199 | 15
4200 | 14
4201 | 15
4202 | 18
4203 | 18
4204 | 18
4205 | 18
4206 | 18
4207 | 17
4208 | 10
4209 | 25
4210 | 25
4211 | 25
4212 | 25
4213 | 25
4214 | 25
4215 | 25
4216 | 25
4217 | 25
4218 | 12
4219 | 12
4220 | 15
4221 | 15
4222 | 15
4223 | 19
4224 | 18
4225 | 19
4226 | 87
4227 | 19
4228 | 19
4229 | 18
4230 | 20
4231 | 18
4232 | 14
4233 | 18
4234 | 18
4235 | 15
4236 | 14
4237 | 15
4238 | 14
4239 | 10
4240 | 10
4241 | 18
4242 | 10
4243 | 10
4244 | 18
4245 | 14
4246 | 14
4247 | 10
4248 | 18
4249 | 10
4250 | 10
4251 | 18
4252 | 20
4253 | 18
4254 | 18
4255 | 18
4256 | 18
4257 | 18
4258 | 18
4259 | 19
4260 | 19
4261 | 19
4262 | 19
4263 | 14
4264 | 15
4265 | 14
4266 | 14
4267 | 14
4268 | 18
4269 | 18
4270 | 18
4271 | 18
4272 | 15
4273 | 25
4274 | 15
4275 | 15
4276 | 15
4277 | 18
4278 | 18
4279 | 14
4280 | 18
4281 | 19
4282 | 18
4283 | 18
4284 | 10
4285 | 19
4286 | 18
4287 | 16
4288 | 12
4289 | 18
4290 | 18
4291 | 15
4292 | 10
4293 | 18
4294 | 10
4295 | 14
4296 | 13
4297 | 14
4298 | 14
4299 | 13
4300 | 13
4301 | 13
4302 | 10
4303 | 13
4304 | 13
4305 | 18
4306 | 18
4307 | 14
4308 | 18
4309 | 14
4310 | 14
4311 | 18
4312 | 18
4313 | 18
4314 | 18
4315 | 18
4316 | 18
4317 | 14
4318 | 14
4319 | 14
4320 | 14
4321 | 14
4322 | 10
4323 | 15
4324 | 19
4325 | 19
4326 | 19
4327 | 19
4328 | 19
4329 | 19
4330 | 19
4331 | 19
4332 | 19
4333 | 14
4334 | 19
4335 | 15
4336 | 15
4337 | 14
4338 | 14
4339 | 18
4340 | 18
4341 | 18
4342 | 18
4343 | 18
4344 | 18
4345 | 15
4346 | 18
4347 | 18
4348 | 18
4349 | 18
4350 | 18
4351 | 25
4352 | 30
4353 | 18
4354 | 18
4355 | 18
4356 | 18
4357 | 18
4358 | 18
4359 | 18
4360 | 18
4361 | 18
4362 | 19
4363 | 16
4364 | 19
4365 | 19
4366 | 10
4367 | 18
4368 | 14
4369 | 14
4370 | 20
4371 | 14
4372 | 14
4373 | 14
4374 | 14
4375 | 14
4376 | 14
4377 | 14
4378 | 10
4379 | 14
4380 | 14
4381 | 18
4382 | 14
4383 | 10
4384 | 18
4385 | 18
4386 | 19
4387 | 18
4388 | 18
4389 | 18
4390 | 18
4391 | 18
4392 | 18
4393 | 18
4394 | 14
4395 | 14
4396 | 14
4397 | 15
4398 | 15
4399 | 15
4400 | 15
4401 | 18
4402 | 15
4403 | 15
4404 | 15
4405 | 15
4406 | 15
4407 | 15
4408 | 15
4409 | 18
4410 | 15
4411 | 26
4412 | 26
4413 | 12
4414 | 10
4415 | 21
4416 | 19
4417 | 19
4418 | 15
4419 | 15
4420 | 19
4421 | 15
4422 | 19
4423 | 12
4424 | 12
4425 | 12
4426 | 18
4427 | 18
4428 | 18
4429 | 18
4430 | 25
4431 | 25
4432 | 25
4433 | 12
4434 | 18
4435 | 18
4436 | 18
4437 | 18
4438 | 18
4439 | 18
4440 | 18
4441 | 25
4442 | 25
4443 | 25
4444 | 14
4445 | 14
4446 | 18
4447 | 14
4448 | 18
4449 | 18
4450 | 14
4451 | 14
4452 | 15
4453 | 18
4454 | 18
4455 | 18
4456 | 18
4457 | 18
4458 | 14
4459 | 14
4460 | 14
4461 | 18
4462 | 14
4463 | 10
4464 | 10
4465 | 12
4466 | 19
4467 | 15
4468 | 15
4469 | 18
4470 | 18
4471 | 14
4472 | 14
4473 | 14
4474 | 14
4475 | 15
4476 | 18
4477 | 18
4478 | 12
4479 | 12
4480 | 12
4481 | 10
4482 | 10
4483 | 12
4484 | 12
4485 | 28
4486 | 32
4487 | 30
4488 | 37
4489 | 10
4490 | 10
4491 | 18
4492 | 25
4493 | 25
4494 | 25
4495 | 12
4496 | 12
4497 | 15
4498 | 18
4499 | 15
4500 | 19
4501 | 19
4502 | 12
4503 | 18
4504 | 18
4505 | 18
4506 | 18
4507 | 18
4508 | 31
4509 | 31
4510 | 31
4511 | 18
4512 | 31
4513 | 31
4514 | 31
4515 | 12
4516 | 12
4517 | 12
4518 | 10
4519 | 10
4520 | 10
4521 | 18
4522 | 12
4523 | 25
4524 | 19
4525 | 10
4526 | 18
4527 | 18
4528 | 18
4529 | 18
4530 | 18
4531 | 18
4532 | 18
4533 | 25
4534 | 25
4535 | 18
4536 | 14
4537 | 14
4538 | 14
4539 | 13
4540 | 14
4541 | 14
4542 | 14
4543 | 14
4544 | 14
4545 | 18
4546 | 15
4547 | 15
4548 | 18
4549 | 15
4550 | 15
4551 | 18
4552 | 15
4553 | 15
4554 | 15
4555 | 18
4556 | 15
4557 | 18
4558 | 12
4559 | 12
4560 | 12
4561 | 12
4562 | 28
4563 | 29
4564 | 30
4565 | 27
4566 | 35
4567 | 27
4568 | 30
4569 | 18
4570 | 18
4571 | 20
4572 | 18
4573 | 18
4574 | 18
4575 | 12
4576 | 18
4577 | 25
4578 | 907
4579 | 18
4580 | 12
4581 | 12
4582 | 12
4583 | 19
4584 | 19
4585 | 19
4586 | 18
4587 | 18
4588 | 19
4589 | 19
4590 | 23
4591 | 31
4592 | 18
4593 | 31
4594 | 31
4595 | 31
4596 | 31
4597 | 31
4598 | 31
4599 | 24
4600 | 31
4601 | 31
4602 | 19
4603 | 18
4604 | 25
4605 | 13
4606 | 13
4607 | 14
4608 | 14
4609 | 18
4610 | 18
4611 | 10
4612 | 10
4613 | 10
4614 | 10
4615 | 10
4616 | 10
4617 | 10
4618 | 14
4619 | 18
4620 | 14
4621 | 12
4622 | 12
4623 | 25
4624 | 25
4625 | 13
4626 | 10
4627 | 10
4628 | 10
4629 | 10
4630 | 10
4631 | 10
4632 | 10
4633 | 10
4634 | 10
4635 | 10
4636 | 17
4637 | 18
4638 | 18
4639 | 18
4640 | 18
4641 | 18
4642 | 18
4643 | 15
4644 | 19
4645 | 19
4646 | 121
4647 | 13
4648 | 14
4649 | 18
4650 | 18
4651 | 18
4652 | 18
4653 | 18
4654 | 25
4655 | 14
4656 | 14
4657 | 14
4658 | 14
4659 | 15
4660 | 18
4661 | 15
4662 | 15
4663 | 18
4664 | 15
4665 | 15
4666 | 15
4667 | 15
4668 | 12
4669 | 26
4670 | 26
4671 | 23
4672 | 25
4673 | 18
4674 | 25
4675 | 19
4676 | 19
4677 | 15
4678 | 18
4679 | 19
4680 | 15
4681 | 14
4682 | 15
4683 | 14
4684 | 15
4685 | 18
4686 | 10
4687 | 10
4688 | 10
4689 | 12
4690 | 12
4691 | 10
4692 | 10
4693 | 18
4694 | 10
4695 | 10
4696 | 10
4697 | 14
4698 | 18
4699 | 18
4700 | 19
4701 | 18
4702 | 25
4703 | 14
4704 | 14
4705 | 14
4706 | 18
4707 | 15
4708 | 26
4709 | 26
4710 | 12
4711 | 12
4712 | 18
4713 | 19
4714 | 20
4715 | 20
4716 | 16
4717 | 15
4718 | 18
4719 | 18
4720 | 15
4721 | 18
4722 | 18
4723 | 18
4724 | 18
4725 | 18
4726 | 10
4727 | 10
4728 | 10
4729 | 15
4730 | 15
4731 | 19
4732 | 10
4733 | 14
4734 | 18
4735 | 18
4736 | 18
4737 | 18
4738 | 18
4739 | 15
4740 | 12
4741 | 20
4742 | 20
4743 | 22
4744 | 22
4745 | 18
4746 | 18
4747 | 19
4748 | 18
4749 | 18
4750 | 18
4751 | 18
4752 | 10
4753 | 18
4754 | 18
4755 | 18
4756 | 15
4757 | 19
4758 | 15
4759 | 20
4760 | 10
4761 | 10
4762 | 10
4763 | 10
4764 | 10
4765 | 18
4766 | 18
4767 | 18
4768 | 18
4769 | 18
4770 | 14
4771 | 14
4772 | 18
4773 | 10
4774 | 10
4775 | 10
4776 | 10
4777 | 10
4778 | 10
4779 | 10
4780 | 10
4781 | 10
4782 | 10
4783 | 10
4784 | 18
4785 | 21
4786 | 18
4787 | 18
4788 | 18
4789 | 18
4790 | 12
4791 | 12
4792 | 14
4793 | 14
4794 | 12
4795 | 18
4796 | 21
4797 | 18
4798 | 18
4799 | 18
4800 | 14
4801 | 18
4802 | 18
4803 | 18
4804 | 19
4805 | 18
4806 | 18
4807 | 18
4808 | 21
4809 | 18
4810 | 19
4811 | 19
4812 | 18
4813 | 18
4814 | 18
4815 | 12
4816 | 10
4817 | 10
4818 | 10
4819 | 10
4820 | 10
4821 | 10
4822 | 10
4823 | 10
4824 | 10
4825 | 25
4826 | 25
4827 | 25
4828 | 25
4829 | 25
4830 | 25
4831 | 25
4832 | 25
4833 | 25
4834 | 25
4835 | 12
4836 | 13
4837 | 12
4838 | 18
4839 | 18
4840 | 18
4841 | 18
4842 | 18
4843 | 18
4844 | 34
4845 | 12
4846 | 18
4847 | 15
4848 | 22
4849 | 22
4850 | 22
4851 | 22
4852 | 12
4853 | 12
4854 | 12
4855 | 12
4856 | 12
4857 | 12
4858 | 12
4859 | 12
4860 | 12
4861 | 25
4862 | 25
4863 | 25
4864 | 17
4865 | 15
4866 | 12
4867 | 12
4868 | 12
4869 | 18
4870 | 11
4871 | 10
4872 | 23
4873 | 31
4874 | 14
4875 | 14
4876 | 18
4877 | 14
4878 | 10
4879 | 27
4880 | 19
4881 | 12
4882 | 19
4883 | 12
4884 | 12
4885 | 18
4886 | 16
4887 | 18
4888 | 10
4889 | 12
4890 | 16
4891 | 10
4892 | 18
4893 | 24
4894 | 18
4895 | 14
4896 | 10
4897 | 12
4898 | 13
4899 | 10
4900 | 12
4901 | 12
4902 | 12
4903 | 12
4904 | 25
4905 | 23
4906 | 18
4907 | 19
4908 | 19
4909 | 19
4910 | 19
4911 | 19
4912 | 19
4913 | 19
4914 | 18
4915 | 18
4916 | 15
4917 | 19
4918 | 19
4919 | 19
4920 | 16
4921 | 15
4922 | 15
4923 | 15
4924 | 15
4925 | 15
4926 | 18
4927 | 15
4928 | 15
4929 | 15
4930 | 15
4931 | 15
4932 | 15
4933 | 25
4934 | 25
4935 | 15
4936 | 15
4937 | 18
4938 | 14
4939 | 14
4940 | 19
4941 | 19
4942 | 19
4943 | 19
4944 | 19
4945 | 16
4946 | 21
4947 | 18
4948 | 19
4949 | 18
4950 | 18
4951 | 16
4952 | 14
4953 | 14
4954 | 15
4955 | 15
4956 | 14
4957 | 15
4958 | 15
4959 | 15
4960 | 15
4961 | 15
4962 | 14
4963 | 15
4964 | 12
4965 | 15
4966 | 18
4967 | 18
4968 | 18
4969 | 18
4970 | 18
4971 | 18
4972 | 18
4973 | 18
4974 | 18
4975 | 18
4976 | 18
4977 | 19
4978 | 18
4979 | 18
4980 | 18
4981 | 18
4982 | 18
4983 | 18
4984 | 18
4985 | 14
4986 | 14
4987 | 18
4988 | 14
4989 | 15
4990 | 15
4991 | 12
4992 | 18
4993 | 18
4994 | 102
4995 | 520
4996 | 10
4997 | 25
4998 | 26
4999 | 25
5000 | 25
5001 | 25
5002 | 20
5003 | 12
5004 | 10
5005 | 25
5006 | 25
5007 | 25
5008 | 25
5009 | 25
5010 | 25
5011 | 25
5012 | 19
5013 | 12
5014 | 12
5015 | 12
5016 | 12
5017 | 15
5018 | 14
5019 | 15
5020 | 15
5021 | 15
5022 | 18
5023 | 18
5024 | 18
5025 | 18
5026 | 18
5027 | 18
5028 | 25
5029 | 25
5030 | 25
5031 | 22
5032 | 22
5033 | 18
5034 | 12
5035 | 12
5036 | 12
5037 | 12
5038 | 12
5039 | 12
5040 | 12
5041 | 12
5042 | 18
5043 | 31
5044 | 31
5045 | 31
5046 | 31
5047 | 31
5048 | 12
5049 | 18
5050 | 18
5051 | 27
5052 | 12
5053 | 12
5054 | 12
5055 | 12
5056 | 18
5057 | 18
5058 | 90
5059 | 19
5060 | 19
5061 | 31
5062 | 12
5063 | 12
5064 | 12
5065 | 12
5066 | 12
5067 | 18
5068 | 12
5069 | 16
5070 | 18
5071 | 18
5072 | 20
5073 | 12
5074 | 12
5075 | 12
5076 | 12
5077 | 12
5078 | 18
5079 | 19
5080 | 18
5081 | 18
5082 | 18
5083 | 18
5084 | 19
5085 | 16
5086 | 16
5087 | 18
5088 | 18
5089 | 18
5090 | 16
5091 | 22
5092 | 16
5093 | 16
5094 | 16
5095 | 21
5096 | 14
5097 | 18
5098 | 18
5099 | 12
5100 | 12
5101 | 12
5102 | 15
5103 | 15
5104 | 18
5105 | 18
5106 | 18
5107 | 18
5108 | 25
5109 | 10
5110 | 10
5111 | 13
5112 | 14
5113 | 18
5114 | 18
5115 | 18
5116 | 18
5117 | 19
5118 | 19
5119 | 18
5120 | 19
5121 | 18
5122 | 18
5123 | 18
5124 | 18
5125 | 18
5126 | 18
5127 | 18
5128 | 11
5129 | 18
5130 | 18
5131 | 18
5132 | 14
5133 | 14
5134 | 14
5135 | 18
5136 | 11
5137 | 12
5138 | 12
5139 | 12
5140 | 18
5141 | 18
5142 | 15
5143 | 18
5144 | 15
5145 | 15
5146 | 18
5147 | 20
5148 | 20
5149 | 20
5150 | 25
5151 | 25
5152 | 25
5153 | 12
5154 | 12
5155 | 12
5156 | 12
5157 | 12
5158 | 18
5159 | 18
5160 | 18
5161 | 18
5162 | 18
5163 | 19
5164 | 18
5165 | 25
5166 | 25
5167 | 26
5168 | 25
5169 | 25
5170 | 25
5171 | 25
5172 | 25
5173 | 25
5174 | 25
5175 | 25
5176 | 25
5177 | 25
5178 | 25
5179 | 25
5180 | 25
5181 | 25
5182 | 25
5183 | 25
5184 | 22
5185 | 22
5186 | 22
5187 | 25
5188 | 22
5189 | 12
5190 | 20
5191 | 12
5192 | 31
5193 | 31
5194 | 16
5195 | 30
5196 | 31
5197 | 414
5198 | 12
5199 | 18
5200 | 18
5201 | 18
5202 | 19
5203 | 18
5204 | 18
5205 | 18
5206 | 18
5207 | 18
5208 | 18
5209 | 18
5210 | 18
5211 | 18
5212 | 25
5213 | 18
5214 | 12
5215 | 12
5216 | 12
5217 | 12
5218 | 12
5219 | 12
5220 | 12
5221 | 12
5222 | 18
5223 | 18
5224 | 16
5225 | 19
5226 | 19
5227 | 19
5228 | 31
5229 | 31
5230 | 31
5231 | 31
5232 | 31
5233 | 31
5234 | 31
5235 | 18
5236 | 18
5237 | 18
5238 | 18
5239 | 18
5240 | 18
5241 | 20
5242 | 12
5243 | 12
5244 | 12
5245 | 18
5246 | 18
5247 | 18
5248 | 18
5249 | 18
5250 | 18
5251 | 18
5252 | 18
5253 | 18
5254 | 18
5255 | 18
5256 | 18
5257 | 18
5258 | 18
5259 | 19
5260 | 19
5261 | 19
5262 | 18
5263 | 18
5264 | 19
5265 | 16
5266 | 26
5267 | 18
5268 | 18
5269 | 18
5270 | 18
5271 | 18
5272 | 18
5273 | 18
5274 | 18
5275 | 18
5276 | 18
5277 | 18
5278 | 18
5279 | 18
5280 | 18
5281 | 18
5282 | 16
5283 | 24
5284 | 23
5285 | 32
5286 | 23
5287 | 25
5288 | 24
5289 | 27
5290 | 24
5291 | 24
5292 | 21
5293 | 24
5294 | 22
5295 | 16
5296 | 14
5297 | 18
5298 | 18
5299 | 18
5300 | 14
5301 | 18
5302 | 15
5303 | 15
5304 | 15
5305 | 18
5306 | 87
5307 | 14
5308 | 12
5309 | 18
5310 | 18
5311 | 18
5312 | 18
5313 | 18
5314 | 25
5315 | 14
5316 | 18
5317 | 18
5318 | 18
5319 | 12
5320 | 12
5321 | 12
5322 | 14
5323 | 20
5324 | 20
5325 | 20
5326 | 20
5327 | 12
5328 | 18
5329 | 18
5330 | 18
5331 | 19
5332 | 18
5333 | 19
5334 | 15
5335 | 20
5336 | 25
5337 | 25
5338 | 25
5339 | 25
5340 | 25
5341 | 25
5342 | 16
5343 | 25
5344 | 18
5345 | 12
5346 | 18
5347 | 25
5348 | 12
5349 | 12
5350 | 18
5351 | 18
5352 | 18
5353 | 18
5354 | 18
5355 | 18
5356 | 18
5357 | 18
5358 | 18
5359 | 16
5360 | 16
5361 | 20
5362 | 19
5363 | 19
5364 | 31
5365 | 32
5366 | 160
5367 | 31
5368 | 31
5369 | 31
5370 | 31
5371 | 31
5372 | 31
5373 | 79
5374 | 31
5375 | 31
5376 | 1171
5377 | 12
5378 | 18
5379 | 18
5380 | 18
5381 | 18
5382 | 12
5383 | 18
5384 | 18
5385 | 18
5386 | 18
5387 | 18
5388 | 19
5389 | 19
5390 | 19
5391 | 18
5392 | 18
5393 | 18
5394 | 18
5395 | 16
5396 | 16
5397 | 20
5398 | 17
5399 | 18
5400 | 18
5401 | 18
5402 | 18
5403 | 18
5404 | 19
5405 | 18
5406 | 18
5407 | 18
5408 | 18
5409 | 18
5410 | 19
5411 | 14
5412 | 160
5413 | 122
5414 | 282
5415 | 160
5416 | 18
5417 | 14
5418 | 18
5419 | 19
5420 | 19
5421 | 25
5422 | 14
5423 | 14
5424 | 19
5425 | 19
5426 | 19
5427 | 19
5428 | 19
5429 | 19
5430 | 19
5431 | 19
5432 | 19
5433 | 19
5434 | 19
5435 | 25
5436 | 25
5437 | 25
5438 | 18
5439 | 18
5440 | 12
5441 | 12
5442 | 14
5443 | 19
5444 | 19
5445 | 19
5446 | 19
5447 | 19
5448 | 19
5449 | 18
5450 | 18
5451 | 18
5452 | 15
5453 | 20
5454 | 20
5455 | 25
5456 | 25
5457 | 25
5458 | 25
5459 | 18
5460 | 19
5461 | 19
5462 | 19
5463 | 19
5464 | 19
5465 | 19
5466 | 19
5467 | 18
5468 | 19
5469 | 19
5470 | 18
5471 | 20
5472 | 20
5473 | 20
5474 | 15
5475 | 16
5476 | 19
5477 | 19
5478 | 14
5479 | 15
5480 | 43
5481 | 34
5482 | 31
5483 | 31
5484 | 31
5485 | 31
5486 | 31
5487 | 31
5488 | 32
5489 | 19
5490 | 18
5491 | 19
5492 | 18
5493 | 18
5494 | 18
5495 | 18
5496 | 12
5497 | 18
5498 | 12
5499 | 13
5500 | 12
5501 | 12
5502 | 18
5503 | 18
5504 | 18
5505 | 18
5506 | 18
5507 | 18
5508 | 18
5509 | 18
5510 | 18
5511 | 18
5512 | 18
5513 | 19
5514 | 18
5515 | 18
5516 | 25
5517 | 25
5518 | 18
5519 | 18
5520 | 18
5521 | 18
5522 | 18
5523 | 16
5524 | 16
5525 | 16
5526 | 16
5527 | 16
5528 | 16
5529 | 18
5530 | 18
5531 | 19
5532 | 19
5533 | 18
5534 | 22
5535 | 18
5536 | 19
5537 | 18
5538 | 18
5539 | 18
5540 | 18
5541 | 18
5542 | 18
5543 | 21
5544 | 18
5545 | 18
5546 | 18
5547 | 14
5548 | 14
5549 | 14
5550 | 19
5551 | 18
5552 | 14
5553 | 14
5554 | 14
5555 | 19
5556 | 19
5557 | 19
5558 | 19
5559 | 19
5560 | 19
5561 | 20
5562 | 19
5563 | 20
5564 | 19
5565 | 23
5566 | 19
5567 | 19
5568 | 19
5569 | 20
5570 | 20
5571 | 25
5572 | 25
5573 | 26
5574 | 25
5575 | 18
5576 | 18
5577 | 25
5578 | 18
5579 | 18
5580 | 18
5581 | 18
5582 | 18
5583 | 18
5584 | 97
5585 | 18
5586 | 20
5587 | 20
5588 | 20
5589 | 20
5590 | 16
5591 | 16
5592 | 19
5593 | 19
5594 | 25
5595 | 19
5596 | 43
5597 | 43
5598 | 25
5599 | 25
5600 | 20
5601 | 25
5602 | 25
5603 | 18
5604 | 19
5605 | 19
5606 | 19
5607 | 19
5608 | 19
5609 | 19
5610 | 35
5611 | 35
5612 | 35
5613 | 35
5614 | 35
5615 | 35
5616 | 35
5617 | 35
5618 | 33
5619 | 18
5620 | 19
5621 | 18
5622 | 18
5623 | 18
5624 | 25
5625 | 25
5626 | 18
5627 | 18
5628 | 12
5629 | 12
5630 | 12
5631 | 25
5632 | 18
5633 | 18
5634 | 20
5635 | 18
5636 | 18
5637 | 20
5638 | 308
5639 | 25
5640 | 18
5641 | 18
5642 | 18
5643 | 19
5644 | 19
5645 | 19
5646 | 19
5647 | 19
5648 | 18
5649 | 18
5650 | 18
5651 | 18
5652 | 18
5653 | 18
5654 | 18
5655 | 18
5656 | 18
5657 | 18
5658 | 18
5659 | 18
5660 | 18
5661 | 18
5662 | 18
5663 | 18
5664 | 18
5665 | 14
5666 | 14
5667 | 18
5668 | 18
5669 | 18
5670 | 18
5671 | 18
5672 | 14
5673 | 19
5674 | 20
5675 | 24
5676 | 19
5677 | 19
5678 | 20
5679 | 24
5680 | 24
5681 | 19
5682 | 20
5683 | 20
5684 | 25
5685 | 25
5686 | 18
5687 | 18
5688 | 18
5689 | 89
5690 | 20
5691 | 15
5692 | 12
5693 | 12
5694 | 12
5695 | 12
5696 | 12
5697 | 12
5698 | 18
5699 | 19
5700 | 19
5701 | 19
5702 | 25
5703 | 20
5704 | 18
5705 | 25
5706 | 18
5707 | 19
5708 | 19
5709 | 18
5710 | 18
5711 | 31
5712 | 18
5713 | 18
5714 | 18
5715 | 35
5716 | 12
5717 | 18
5718 | 15
5719 | 18
5720 | 18
5721 | 18
5722 | 18
5723 | 18
5724 | 20
5725 | 18
5726 | 18
5727 | 19
5728 | 18
5729 | 18
5730 | 26
5731 | 18
5732 | 18
5733 | 19
5734 | 18
5735 | 18
5736 | 19
5737 | 19
5738 | 19
5739 | 19
5740 | 18
5741 | 18
5742 | 14
5743 | 18
5744 | 14
5745 | 14
5746 | 18
5747 | 19
5748 | 19
5749 | 19
5750 | 19
5751 | 19
5752 | 19
5753 | 19
5754 | 19
5755 | 8048
5756 | 20
5757 | 20
5758 | 25
5759 | 25
5760 | 25
5761 | 25
5762 | 18
5763 | 59
5764 | 59
5765 | 20
5766 | 15
5767 | 18
5768 | 19
5769 | 25
5770 | 25
5771 | 15
5772 | 25
5773 | 25
5774 | 18
5775 | 18
5776 | 18
5777 | 18
5778 | 19
5779 | 19
5780 | 18
5781 | 19
5782 | 31
5783 | 31
5784 | 31
5785 | 31
5786 | 12
5787 | 18
5788 | 19
5789 | 15
5790 | 18
5791 | 18
5792 | 15
5793 | 15
5794 | 19
5795 | 18
5796 | 255
5797 | 18
5798 | 18
5799 | 19
5800 | 18
5801 | 18
5802 | 18
5803 | 89
5804 | 18
5805 | 18
5806 | 18
5807 | 18
5808 | 26
5809 | 26
5810 | 26
5811 | 26
5812 | 18
5813 | 18
5814 | 18
5815 | 18
5816 | 19
5817 | 18
5818 | 18
5819 | 18
5820 | 18
5821 | 18
5822 | 18
5823 | 18
5824 | 18
5825 | 18
5826 | 18
5827 | 18
5828 | 16
5829 | 18
5830 | 18
5831 | 18
5832 | 18
5833 | 18
5834 | 2620
5835 | 25
5836 | 25
5837 | 25
5838 | 15
5839 | 15
5840 | 18
5841 | 19
5842 | 19
5843 | 19
5844 | 19
5845 | 19
5846 |
--------------------------------------------------------------------------------
/stat_plot/test/data_scatter/test_afl.txt:
--------------------------------------------------------------------------------
1 | 10:1063
2 | 11:92
3 | 12:1056
4 | 13:194
5 | 14:266
6 | 15:434
7 | 16:171
8 | 17:43
9 | 18:740
10 | 19:356
11 | 20:367
12 | 21:161
13 | 22:37
14 | 23:35
15 | 24:7
16 | 25:406
17 | 26:215
18 | 27:34
19 | 28:34
20 | 29:32
21 | 30:3
22 | 31:7
23 | 32:6
24 | 33:4
25 | 34:2
26 | 36:25
27 | 38:5
28 | 39:4
29 | 40:4
30 | 41:2
31 | 42:2
32 | 43:1
33 | 44:4
34 | 46:1
35 | 49:2
36 | 50:3
37 | 51:1
38 | 52:1
39 | 53:3
40 | 54:1
41 | 55:1
42 | 57:2
43 | 59:1
44 | 60:2
45 | 61:2
46 | 63:2
47 | 67:1
48 | 68:1
49 | 69:1
50 | 73:1
51 | 74:1
52 | 1037:1
53 | 80:2
54 | 351:1
55 | 99:1
56 | 100:3
57 | 104:1
58 | 110:1
59 | 113:1
60 | 1146:1
61 | 123:1
62 | 132:1
63 | 135:1
64 | 141:1
65 | 143:1
66 | 28056:1
67 | 152:1
68 | 1092:1
69 | 154:3
70 | 667:1
71 | 3484:1
72 | 1950:1
73 | 161:1
74 | 1443:1
75 | 4260:1
76 | 168:2
77 | 1194:1
78 | 171:1
79 | 175:1
80 | 186:1
81 | 6851:1
82 | 975:1
83 | 1494:1
84 | 249:1
85 | 218:1
86 | 1508:1
87 | 505:1
88 |
--------------------------------------------------------------------------------
/stat_plot/test/data_scatter/test_aflfast.txt:
--------------------------------------------------------------------------------
1 | 282:1
2 | 520:1
3 | 10:1157
4 | 267:1
5 | 12:906
6 | 13:170
7 | 14:474
8 | 15:462
9 | 16:244
10 | 17:62
11 | 18:1093
12 | 19:391
13 | 20:109
14 | 21:50
15 | 22:67
16 | 23:44
17 | 24:27
18 | 25:265
19 | 26:41
20 | 27:35
21 | 28:14
22 | 29:10
23 | 30:10
24 | 31:57
25 | 32:8
26 | 33:3
27 | 34:2
28 | 35:11
29 | 36:3
30 | 37:4
31 | 39:3
32 | 41:1
33 | 42:2
34 | 43:4
35 | 44:1
36 | 45:1
37 | 48:1
38 | 49:1
39 | 50:1
40 | 51:1
41 | 308:1
42 | 414:1
43 | 54:2
44 | 55:1
45 | 59:2
46 | 2620:1
47 | 62:2
48 | 192:1
49 | 160:3
50 | 11:77
51 | 79:1
52 | 87:2
53 | 89:2
54 | 90:1
55 | 97:1
56 | 102:1
57 | 232:1
58 | 907:1
59 | 109:1
60 | 8048:1
61 | 1171:1
62 | 121:1
63 | 122:1
64 | 255:1
65 |
--------------------------------------------------------------------------------
/stat_plot/test/data_scatter/test_perffuzz.txt:
--------------------------------------------------------------------------------
1 | 3073:1
2 | 1027:1
3 | 2663:1
4 | 10:1980
5 | 11:181
6 | 12:2085
7 | 13:202
8 | 14:269
9 | 15:362
10 | 16:36
11 | 17:17
12 | 18:260
13 | 19:77
14 | 532:1
15 | 21:24
16 | 22:8
17 | 23:16
18 | 24:5
19 | 25:316
20 | 26:11
21 | 539:3
22 | 28:1
23 | 29:3
24 | 1054:1
25 | 31:3
26 | 32:5
27 | 545:1
28 | 35:4
29 | 36:3
30 | 37:1
31 | 38:2
32 | 39:12
33 | 2088:1
34 | 41:1
35 | 42:4
36 | 43:2
37 | 44:5
38 | 1069:1
39 | 46:5
40 | 560:1
41 | 49:2
42 | 50:1
43 | 51:3
44 | 52:1
45 | 53:1
46 | 55:1
47 | 56:1
48 | 58:1
49 | 61:1
50 | 62:2
51 | 63:3
52 | 481:1
53 | 577:1
54 | 66:1
55 | 67:1
56 | 70:1
57 | 71:1
58 | 72:1
59 | 73:2
60 | 74:2
61 | 76:3
62 | 2125:1
63 | 79:1
64 | 80:1
65 | 81:2
66 | 82:3
67 | 1619:1
68 | 84:1
69 | 86:1
70 | 2647:1
71 | 88:3
72 | 7743:1
73 | 1114:1
74 | 91:1
75 | 92:2
76 | 97:1
77 | 98:1
78 | 99:2
79 | 100:2
80 | 6245:1
81 | 102:1
82 | 103:1
83 | 104:3
84 | 105:1
85 | 106:2
86 | 107:2
87 | 109:15
88 | 111:11
89 | 113:14
90 | 531:2
91 | 116:1
92 | 4725:1
93 | 118:1
94 | 119:3
95 | 120:2
96 | 20:32
97 | 123:1
98 | 24700:1
99 | 126:10
100 | 533:1
101 | 128:8
102 | 129:6
103 | 130:5
104 | 1131:1
105 | 132:1
106 | 133:2
107 | 1159:1
108 | 137:2
109 | 138:1
110 | 6795:1
111 | 192:1
112 | 141:1
113 | 142:8
114 | 8847:1
115 | 144:2
116 | 145:1
117 | 147:7
118 | 90:4
119 | 149:1
120 | 281:47
121 | 20122:1
122 | 2927:4
123 | 156:1
124 | 795:1
125 | 164:2
126 | 165:2
127 | 1308:1
128 | 1710:1
129 | 8883:1
130 | 30:5
131 | 1796:2
132 | 40:5
133 | 697:1
134 | 1722:1
135 | 2069:1
136 | 117:1
137 | 3416:1
138 | 6944:1
139 | 3740:1
140 | 4804:1
141 | 1151:1
142 | 204:1
143 | 5325:1
144 | 206:1
145 | 208:1
146 | 721:1
147 | 210:2
148 | 213:1
149 | 5334:1
150 | 215:2
151 | 728:1
152 | 548:1
153 | 174:1
154 | 4440:1
155 | 1505:1
156 | 4065:1
157 | 228:2
158 | 7911:1
159 | 5355:1
160 | 241:3
161 | 8435:1
162 | 7697:1
163 | 246:1
164 | 127:1
165 | 5845:1
166 | 7938:1
167 | 260:1
168 | 214:1
169 | 266:1
170 | 4311:1
171 | 781:1
172 | 77:2
173 | 45:1
174 | 3346:1
175 | 131:1
176 | 7272:1
177 | 155:1
178 | 283:1
179 | 284:5
180 | 288:1
181 | 48:1
182 | 290:1
183 | 1315:1
184 | 6438:1
185 | 807:1
186 | 297:1
187 | 3884:1
188 | 5426:1
189 | 814:1
190 | 3887:1
191 | 27:4
192 | 305:1
193 | 306:1
194 | 309:1
195 | 5769:1
196 | 8505:1
197 | 826:1
198 | 315:1
199 | 3210:1
200 | 8001:1
201 | 139:7
202 | 23876:1
203 | 4577:1
204 | 1352:1
205 | 5965:1
206 | 5967:1
207 | 1080:1
208 | 4946:1
209 | 20308:1
210 | 654:1
211 | 856:1
212 | 4410:1
213 | 349:1
214 | 4958:1
215 | 354:1
216 | 1379:1
217 | 868:1
218 | 362:1
219 | 1899:1
220 | 7022:1
221 | 1341:1
222 | 1000:1
223 | 6514:1
224 | 884:1
225 | 574:1
226 | 1911:1
227 | 27003:1
228 | 26492:1
229 | 7550:1
230 | 6527:1
231 | 8312:1
232 | 5000:1
233 | 4499:1
234 | 1432:1
235 | 6043:1
236 | 413:1
237 | 8611:1
238 | 8612:1
239 | 421:1
240 | 422:4
241 | 425:1
242 | 8690:1
243 | 6062:1
244 | 87:2
245 | 6580:1
246 | 3000:1
247 | 1465:1
248 | 443:1
249 | 446:9
250 | 508:4
251 | 969:1
252 | 1115:1
253 | 333:1
254 | 471:18
255 | 2520:1
256 | 8161:1
257 | 2019:1
258 | 3560:1
259 | 489:1
260 | 497:2
261 | 5618:1
262 | 12282:1
263 | 6911:1
264 | 8188:1
265 |
--------------------------------------------------------------------------------
/stat_plot/test/statistics.csv:
--------------------------------------------------------------------------------
1 | haha,hehe,gaga,gege
2 | 2.55140,4.31765,7.83499,3.79665
3 | 3.99810,1.57894,9.88904,3.24420
4 | 8.54579,6.02648,8.40535,8.91523
5 | 0.02654,4.19968,6.74083,4.29216
6 | 5.22639,6.92802,8.72477,3.10729
7 | 6.18859,0.60225,7.86978,3.38870
8 | 3.61440,4.25484,5.73651,2.34155
9 | 3.99494,8.31530,8.93549,1.99480
10 | 1.50198,4.30140,7.02114,5.45818
11 | 3.78433,3.03363,8.48128,5.06236
12 |
--------------------------------------------------------------------------------
/stat_plot/test/test_boxplot.toml:
--------------------------------------------------------------------------------
1 | [fuzzers]
2 | # sub-tables use "." to connect
3 | [fuzzers.afl]
4 | data_files = [
5 | "test/data_boxplot/out_afl.txt"
6 | ]
7 | line_style = "dashed"
8 | box_color = "xkcd:slate blue"
9 |
10 | [fuzzers.aflfast]
11 | data_files = [
12 | "test/data_boxplot/out_aflfast.txt"
13 | ]
14 | line_style = "dashdot"
15 | box_color = "xkcd:olive yellow"
16 |
17 | [fuzzers.cerebro]
18 | data_files = [
19 | "test/data_boxplot/out_cerebro.txt"
20 | ]
21 | line_style = "solid"
22 | box_color = "xkcd:scarlet"
23 |
24 | [misc]
25 | out_dir = "test/out_boxplot"
26 | file_postfix = "-time-to-exposure"
27 | project = "mjs-bug1"
28 | stat_type = "boxplot"
29 | notch = false
30 | plot_title = "mjs-bug1 time-to-exposure (hour)"
31 | ylim = [0, 20]
--------------------------------------------------------------------------------
/stat_plot/test/test_confgen.toml:
--------------------------------------------------------------------------------
1 | bucket = "min"
2 | # confidence interval to be used
3 | confidence_lvl = 0.95
4 | # out_dir = "out/plots-1/djpeg-edge"
5 | # ylabel = "edge N.O."
6 | # file_postfix = "-edge-time"
7 | # project = "djpeg"
8 | # max_time is in hours
9 | max_time = 24
10 | stat_type = "overall"
11 | large_font = true
12 | no_legend = false
13 | y_start_0 = true
14 | x_log_scale = false
15 | y_log_scale = false
16 |
17 | # the base dir to search the datagen files from
18 | #base_dir = "out"
19 | #out_dir = "out/plots-1/test"
20 |
21 | # must be UNIQUE (uniq identifier on the path of the output dir for the fuzzer); can use regex pattern
22 | fuzzer_sigs = [
23 | "/greedy\\d+/",
24 | # "/la-greedy\\d+/",
25 | # "/greedy-rr\\d+/",
26 | # "/la-greedy-rr\\d+/",
27 | # "/random-rr\\d+/",
28 | "/random\\d+/",
29 | "/exp3\\d+/",
30 | # "/la-exp3\\d+/",
31 | # "/fixed\\d+/"
32 | # "/greedy_ts15m\\d+/",
33 | # "/random_ts15m\\d+/",
34 | # "/exp3_ts15m\\d+/",
35 | # "/la-greedy_ts15m\\d+/",
36 | # "/random-rr_ts15m\\d+/",
37 | # "/la-exp3_ts15m\\d+/",
38 | # "/greedy_ts1h\\d+/",
39 | # "/random_ts1h\\d+/",
40 | # "/exp3_ts1h\\d+/",
41 | # "/la-greedy_ts1h\\d+/",
42 | # "/random-rr_ts1h\\d+/",
43 | # "/la-exp3_ts1h\\d+/",
44 | ]
45 | # may not be uniq
46 | fuzzer_names = [
47 | "greedy_ts30m",
48 | # "la-greedy_ts30m",
49 | # "greedy-rr_ts30m",
50 | # "la-greedy-rr_ts30m",
51 | # "random-rr_ts30m",
52 | "random_ts30m",
53 | "exp3_ts30m",
54 | # "la-exp3_ts30m",
55 | # "fixed_ts30m"
56 | # "greedy_ts15m",
57 | # "random_ts15m",
58 | # "exp3_ts15m",
59 | # "la-greedy_ts15m",
60 | # "random-rr_ts15m",
61 | # "la-exp3_ts15m",
62 | # "greedy_ts1h",
63 | # "random_ts1h",
64 | # "exp3_ts1h",
65 | # "la-greedy_ts1h",
66 | # "random-rr_ts1h",
67 | # "la-exp3_ts1h",
68 | ]
69 | fuzzer_line_styles = [
70 | "solid",
71 | "dashed",
72 | "dashdot",
73 | # "solid",
74 | # "dashed",
75 | # "dashdot",
76 | # "solid",
77 | # "dashed",
78 | # "dashdot"
79 | ]
80 | fuzzer_line_colors = [
81 | "xkcd:scarlet",
82 | # "xkcd:deep red",
83 | # "xkcd:wine red",
84 | "xkcd:olive yellow",
85 | # "xkcd:dirty yellow",
86 | # "xkcd:bright yellow",
87 | "xkcd:slate blue",
88 | # "xkcd:sea blue",
89 | # "xkcd:green blue"
90 | ]
91 |
92 | # must be UNIQUE
93 | target_sigs = [
94 | "objcopy-2.32",
95 | "objdump-2.32",
96 | "lame-3.99.5",
97 | "nm-2.32",
98 | # "exiv2-0.26",
99 | "djpeg-1.5.3",
100 | # "size-2.32",
101 | "readelf-2.32",
102 | # "tcpdump-5830e58aa0",
103 | # "sam2p-0.49.4",
104 | "tiff2bw-4.0.10",
105 | "tiff2ps-4.0.10",
106 | "xmllint-2.9.9",
107 | "flvmeta-1.2.1",
108 | # "radare2-5.5.4",
109 | # "MP4Box-41e48716e0",
110 | ]
111 | target_names = [
112 | "objcopy-2.32",
113 | "objdump-2.32",
114 | "lame-3.99.5",
115 | "nm-2.32",
116 | # "exiv2-0.26",
117 | "djpeg-1.5.3",
118 | # "size-2.32",
119 | "readelf-2.32",
120 | # "tcpdump-5830e58aa0",
121 | # "sam2p-0.49.4",
122 | "tiff2bw-4.0.10",
123 | "tiff2ps-4.0.10",
124 | "xmllint-2.9.9",
125 | "flvmeta-1.2.1",
126 | # "radare2-5.5.4",
127 | # "MP4Box-41e48716e0",
128 | ]
129 |
130 | # the filename can have wildcard
131 | objective_filenames = [
132 | "edge_fuzz_time.txt",
133 | "crash_fuzz_time.txt"
134 | ]
135 | # collect edge or crash?
136 | objectives = [
137 | "edge",
138 | "crash"
139 | ]
140 | objective_y_labels = [
141 | "edge N.O.",
142 | "crash N.O."
143 | ]
144 | file_postfixes = [
145 | "-edge-time",
146 | "-crash-time"
147 | ]
148 |
149 |
--------------------------------------------------------------------------------
/stat_plot/test/test_config.toml:
--------------------------------------------------------------------------------
1 | [fuzzers]
2 | # sub-tables use "." to connect
3 | [fuzzers.cerebro]
4 | # the content in data files are "time(sec):data number"
5 | data_files = [
6 | "test/data/cerebro/out-0.txt",
7 | "test/data/cerebro/out-1.txt",
8 | "test/data/cerebro/out-2.txt",
9 | "test/data/cerebro/out-3.txt",
10 | "test/data/cerebro/out-4.txt",
11 | "test/data/cerebro/out-5.txt",
12 | "test/data/cerebro/out-6.txt",
13 | "test/data/cerebro/out-7.txt",
14 | "test/data/cerebro/out-8.txt",
15 | "test/data/cerebro/out-9.txt"
16 | ]
17 | line_style = "solid"
18 | line_color = "xkcd:scarlet"
19 |
20 | [fuzzers.afl]
21 | # the content in data files are "time(sec):data number"
22 | data_files = [
23 | "test/data/afl/out-0.txt",
24 | "test/data/afl/out-1.txt",
25 | "test/data/afl/out-2.txt",
26 | "test/data/afl/out-3.txt",
27 | "test/data/afl/out-4.txt",
28 | "test/data/afl/out-5.txt",
29 | "test/data/afl/out-6.txt",
30 | "test/data/afl/out-7.txt",
31 | "test/data/afl/out-8.txt",
32 | "test/data/afl/out-9.txt"
33 | ]
34 | line_style = "dashed"
35 | line_color = "xkcd:slate blue"
36 |
37 | [fuzzers.aflfast]
38 | # the content in data files are "time(sec):data number"
39 | data_files = [
40 | "test/data/aflfast/out-0.txt",
41 | "test/data/aflfast/out-1.txt",
42 | "test/data/aflfast/out-2.txt",
43 | "test/data/aflfast/out-3.txt",
44 | "test/data/aflfast/out-4.txt",
45 | "test/data/aflfast/out-5.txt",
46 | "test/data/aflfast/out-6.txt",
47 | "test/data/aflfast/out-7.txt",
48 | "test/data/aflfast/out-8.txt",
49 | "test/data/aflfast/out-9.txt"
50 | ]
51 | line_style = "dashdot"
52 | line_color = "xkcd:olive yellow"
53 |
54 | [misc]
55 | # should be one of the followings: "sec", "s", "min", "m", "hour", "h"
56 | bucket = "min"
57 | # confidence interval to be used
58 | confidence_lvl = 0.95
59 | out_dir = "test/out"
60 | ylabel = "edge N.O."
61 | file_postfix = "-edge-time"
62 | project = "mjs"
63 | # max_time is in hours
64 | max_time = 24
65 | stat_type = "overall"
66 | large_font = false
67 | no_legend = false
68 | y_start_0 = true
69 | x_log_scale = false
70 | y_log_scale = true
--------------------------------------------------------------------------------
/stat_plot/test/test_draw_boxplot.toml:
--------------------------------------------------------------------------------
1 | # only for the config filename, not the path!
2 | config_sigs = [
3 | '.*-edge.toml',
4 | # '.*-crash.toml'
5 | ]
6 |
7 | # in seconds
8 | data_points = [
9 | 14400,
10 | 43200,
11 | 86400
12 | ]
13 |
14 | # the color palette
15 | # https://i2.wp.com/datavizpyr.com/wp-content/uploads/2020/01/RColorBrewer_colorblind_friendly_palettes.jpeg?fit=598%2C897&ssl=1
16 | color_palette = "YlGnBu"
17 |
18 | # width of the box
19 | width = 0.8
20 |
21 | # y start from 0?
22 | y_start_0 = false
--------------------------------------------------------------------------------
/stat_plot/test/test_generator.py:
--------------------------------------------------------------------------------
1 | # run this script under the "test" folder
2 | import random
3 | import os
4 |
5 |
6 | def main():
7 | fuzzer_list = ['cerebro', 'afl', 'aflfast']
8 |
9 | for (f, fuzzer) in enumerate(fuzzer_list):
10 | if not os.path.exists("data/"+fuzzer):
11 | os.makedirs("data/"+fuzzer)
12 | # generate 10 data files for each fuzzer
13 | for i in range(0, 10):
14 | file_name = "data/" + fuzzer + "/out-" + str(i) + ".txt"
15 |
16 | # randomly generate 900 - 1000 "seeds"
17 | seeds_no = random.randrange(900, 1001)
18 |
19 | # generate time slots (sec) for the seeds within 24 hours (86400s)
20 | slots = random.sample(range(0, 86400), seeds_no)
21 |
22 | if 0 not in slots:
23 | slots[0] = 0
24 |
25 | slots.sort()
26 |
27 | # generate the data no for the seeds
28 | data_nos = random.sample(range(5, 3000 - f * 100), seeds_no)
29 |
30 | if 5 not in data_nos:
31 | data_nos[0] = 5
32 |
33 | data_nos.sort()
34 |
35 | # write the slots and data_nos to file
36 | with open(file_name, 'w') as out_file:
37 | for (j, slot) in enumerate(slots):
38 | out_file.write('{slot:{fill}{align}{width}}:{data}\n'.format(slot=slot, fill=' ', align=">"
39 | , width=10, data=data_nos[j]))
40 |
41 |
42 | if __name__ == "__main__":
43 | main()
44 |
--------------------------------------------------------------------------------
/stat_plot/test/test_histo.toml:
--------------------------------------------------------------------------------
1 | [fuzzers]
2 | # sub-tables use "." to connect
3 | [fuzzers.memfuzz]
4 | data_files = [
5 | "test/data_histo/test_mem.txt"
6 | ]
7 | line_color = "xkcd:scarlet"
8 |
9 | [fuzzers.afl]
10 | data_files = [
11 | "test/data_histo/test_afl.txt"
12 | ]
13 | line_color = "xkcd:slate blue"
14 |
15 | [fuzzers.aflfast]
16 | data_files = [
17 | "test/data_histo/test_aflfast.txt"
18 | ]
19 | line_color = "xkcd:marigold"
20 |
21 | [fuzzers.perffuzz]
22 | data_files = [
23 | "test/data_histo/test_perffuzz.txt"
24 | ]
25 | line_color = "xkcd:jade green"
26 |
27 | [misc]
28 | out_dir = "test/out_histogram"
29 | ylabel = "# of seed in queue"
30 | xlabel = "stack length"
31 | file_postfix = "-histo"
32 | plot_title = "nasm-16m stack length distribution"
33 | project = "nasm-16m"
34 | stat_type = "histogram"
35 | n_bins = 10
36 | large_font = true
--------------------------------------------------------------------------------
/stat_plot/test/test_scatter.toml:
--------------------------------------------------------------------------------
1 | [fuzzers]
2 | # sub-tables use "." to connect
3 | [fuzzers.memfuzz]
4 | # the content in data files are "mem_val:count"
5 | data_files = [
6 | "test/data_scatter/test_mem.txt"
7 | ]
8 | line_color = "xkcd:scarlet"
9 |
10 | [fuzzers.afl]
11 | # the content in data files are "mem_val:count"
12 | data_files = [
13 | "test/data_scatter/test_afl.txt"
14 | ]
15 | line_color = "xkcd:slate blue"
16 |
17 | [fuzzers.aflfast]
18 | # the content in data files are "mem_val:count"
19 | data_files = [
20 | "test/data_scatter/test_aflfast.txt"
21 | ]
22 | line_color = "xkcd:marigold"
23 |
24 | [fuzzers.perffuzz]
25 | # the content in data files are "mem_val:count"
26 | data_files = [
27 | "test/data_scatter/test_perffuzz.txt"
28 | ]
29 | line_color = "xkcd:jade green"
30 |
31 | [misc]
32 | out_dir = "test/out_scatter"
33 | ylabel = "# of seed in queue"
34 | xlabel = "stack length"
35 | file_postfix = "-scatter"
36 | plot_title = "nasm-16m stack length distribution"
37 | project = "nasm-16m"
38 | stat_type = "scatterplot"
39 | large_font = true
--------------------------------------------------------------------------------