├── .gitignore ├── .idea ├── fuzzer-data-collector.iml ├── inspectionProfiles │ └── Project_Default.xml ├── misc.xml ├── modules.xml └── vcs.xml ├── README.md ├── requirements-3.8.txt ├── requirements.txt ├── showmaps ├── .gitignore ├── Makefile ├── alloc-inl.h ├── config.h ├── debug.h ├── hash.h ├── showmaps.c ├── test.sh ├── test │ ├── exiv2-afl │ ├── hang-exiv2 │ │ └── hang20may │ ├── mjs-afl │ └── queue │ │ ├── id:000000,orig:err1.js │ │ ├── id:000001,orig:err2.js │ │ ├── id:000002,orig:module1.js │ │ ├── id:000003,orig:module2.js │ │ ├── id:000004,orig:test_1.js │ │ ├── id:000005,orig:test_10.js │ │ ├── id:000006,orig:test_11.js │ │ ├── id:000007,orig:test_12.js │ │ ├── id:000008,orig:test_13.js │ │ ├── id:000009,orig:test_2.js │ │ ├── id:000010,orig:test_3.js │ │ ├── id:000011,orig:test_4.js │ │ ├── id:000012,orig:test_5.js │ │ ├── id:000013,orig:test_6.js │ │ ├── id:000014,orig:test_7.js │ │ ├── id:000015,orig:test_8.js │ │ └── id:000016,orig:test_9.js └── types.h └── stat_plot ├── .gitignore ├── conf.py ├── confgen.py ├── draw_boxplot.py ├── main.py ├── stat_plot.py ├── statistic_tester.py └── test ├── data_boxplot ├── out_afl.txt ├── out_aflfast.txt └── out_cerebro.txt ├── data_histo ├── test_afl.txt ├── test_aflfast.txt ├── test_mem.txt └── test_perffuzz.txt ├── data_scatter ├── test_afl.txt ├── test_aflfast.txt ├── test_mem.txt └── test_perffuzz.txt ├── statistics.csv ├── test_boxplot.toml ├── test_confgen.toml ├── test_config.toml ├── test_draw_boxplot.toml ├── test_generator.py ├── test_histo.toml └── test_scatter.toml /.gitignore: -------------------------------------------------------------------------------- 1 | # Created by .ignore support plugin (hsz.mobi) 2 | ### customized 3 | fdc-env/ 4 | .vscode/ 5 | 6 | 7 | ### C++ template 8 | # Prerequisites 9 | *.d 10 | 11 | # Compiled Object files 12 | *.slo 13 | *.lo 14 | *.o 15 | *.obj 16 | 17 | # Precompiled Headers 18 | *.gch 19 | *.pch 20 | 21 | # Compiled Dynamic libraries 22 | *.so 23 | *.dylib 24 | *.dll 25 | 26 | # Fortran module files 27 | *.mod 28 | *.smod 29 | 30 | # Compiled Static libraries 31 | *.lai 32 | *.la 33 | *.a 34 | *.lib 35 | 36 | # Executables 37 | *.exe 38 | *.out 39 | *.app 40 | ### Python template 41 | # Byte-compiled / optimized / DLL files 42 | __pycache__/ 43 | *.py[cod] 44 | *$py.class 45 | 46 | # C extensions 47 | 48 | # Distribution / packaging 49 | .Python 50 | build/ 51 | develop-eggs/ 52 | dist/ 53 | downloads/ 54 | eggs/ 55 | .eggs/ 56 | lib/ 57 | lib64/ 58 | parts/ 59 | sdist/ 60 | var/ 61 | wheels/ 62 | *.egg-info/ 63 | .installed.cfg 64 | *.egg 65 | MANIFEST 66 | 67 | # PyInstaller 68 | # Usually these files are written by a python script from a template 69 | # before PyInstaller builds the exe, so as to inject date/other infos into it. 70 | *.manifest 71 | *.spec 72 | 73 | # Installer logs 74 | pip-log.txt 75 | pip-delete-this-directory.txt 76 | 77 | # Unit test / coverage reports 78 | htmlcov/ 79 | .tox/ 80 | .coverage 81 | .coverage.* 82 | .cache 83 | nosetests.xml 84 | coverage.xml 85 | *.cover 86 | .hypothesis/ 87 | 88 | # Translations 89 | *.mo 90 | *.pot 91 | 92 | # Django stuff: 93 | *.log 94 | .static_storage/ 95 | .media/ 96 | local_settings.py 97 | 98 | # Flask stuff: 99 | instance/ 100 | .webassets-cache 101 | 102 | # Scrapy stuff: 103 | .scrapy 104 | 105 | # Sphinx documentation 106 | docs/_build/ 107 | 108 | # PyBuilder 109 | target/ 110 | 111 | # Jupyter Notebook 112 | .ipynb_checkpoints 113 | 114 | # pyenv 115 | .python-version 116 | 117 | # celery beat schedule file 118 | celerybeat-schedule 119 | 120 | # SageMath parsed files 121 | *.sage.py 122 | 123 | # Environments 124 | .env 125 | .venv 126 | env/ 127 | venv/ 128 | ENV/ 129 | env.bak/ 130 | venv.bak/ 131 | 132 | # Spyder project settings 133 | .spyderproject 134 | .spyproject 135 | 136 | # Rope project settings 137 | .ropeproject 138 | 139 | # mkdocs documentation 140 | /site 141 | 142 | # mypy 143 | .mypy_cache/ 144 | ### JetBrains template 145 | # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm 146 | # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839 147 | 148 | # User-specific stuff: 149 | .idea/**/workspace.xml 150 | .idea/**/tasks.xml 151 | .idea/dictionaries 152 | 153 | # Sensitive or high-churn files: 154 | .idea/**/dataSources/ 155 | .idea/**/dataSources.ids 156 | .idea/**/dataSources.xml 157 | .idea/**/dataSources.local.xml 158 | .idea/**/sqlDataSources.xml 159 | .idea/**/dynamic.xml 160 | .idea/**/uiDesigner.xml 161 | 162 | # Gradle: 163 | .idea/**/gradle.xml 164 | .idea/**/libraries 165 | 166 | # CMake 167 | cmake-build-debug/ 168 | 169 | # Mongo Explorer plugin: 170 | .idea/**/mongoSettings.xml 171 | 172 | ## File-based project format: 173 | *.iws 174 | 175 | ## Plugin-specific files: 176 | 177 | # IntelliJ 178 | out/ 179 | 180 | # mpeltonen/sbt-idea plugin 181 | .idea_modules/ 182 | 183 | # JIRA plugin 184 | atlassian-ide-plugin.xml 185 | 186 | # Cursive Clojure plugin 187 | .idea/replstate.xml 188 | 189 | # Crashlytics plugin (for Android Studio and IntelliJ) 190 | com_crashlytics_export_strings.xml 191 | crashlytics.properties 192 | crashlytics-build.properties 193 | fabric.properties 194 | ### C template 195 | # Prerequisites 196 | 197 | # Object files 198 | *.ko 199 | *.elf 200 | 201 | # Linker output 202 | *.ilk 203 | *.map 204 | *.exp 205 | 206 | # Precompiled Headers 207 | 208 | # Libraries 209 | 210 | # Shared objects (inc. Windows DLLs) 211 | *.so.* 212 | 213 | # Executables 214 | *.i*86 215 | *.x86_64 216 | *.hex 217 | 218 | # Debug files 219 | *.dSYM/ 220 | *.su 221 | *.idb 222 | *.pdb 223 | 224 | # Kernel Module Compile Results 225 | *.mod* 226 | *.cmd 227 | .tmp_versions/ 228 | modules.order 229 | Module.symvers 230 | Mkfile.old 231 | dkms.conf 232 | -------------------------------------------------------------------------------- /.idea/fuzzer-data-collector.iml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 13 | -------------------------------------------------------------------------------- /.idea/inspectionProfiles/Project_Default.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 20 | -------------------------------------------------------------------------------- /.idea/misc.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 36 | 37 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | ApexVCS 74 | 75 | 76 | -------------------------------------------------------------------------------- /.idea/modules.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /.idea/vcs.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # fuzzer-data-collector 2 | Overall workflow: 3 | 1. use the `showmaps` program to generate the raw data 4 | 2. use the python scripts under `stats_plot` to draw the plots & generate statistic analysis results 5 | 6 | ## showmaps 7 | 8 | ```bash 9 | # build (under the showmaps folder) 10 | make 11 | 12 | # generate the raw data in the format ("time slot":"edge/path number") 13 | # the usage of showmaps is very similar to afl-showmap 14 | # -q means quite mode, will "eat" the output of the original program 15 | # -s means skipping individual seed trace generation (will not generate a trace file for each seed) 16 | # -S means skipping the first 'n' files (useful when we only want to calculate the increment in code coverage) 17 | # everything after "--" is the same as how you run AFL 18 | ./showmaps -i $PATH_TO_QUEUE_FOLDER -o data/queue -q -s -S 0 -- $AFL_INSTRUMENTED_PROGRAM @@ 19 | ``` 20 | 21 | ## stat_plot 22 | 23 | ```bash 24 | # install the environment 25 | virtualenv -p python3 venv 26 | 27 | source venv/bin/activate 28 | 29 | pip install -r requirements.txt 30 | 31 | # run the script under the virtual environment 32 | # before running the script, you need to prepare the .toml config file 33 | python main.py -c $PATH_TO_TOML_CONFIG 34 | ``` 35 | 36 | ## Toml Config 37 | Example configs are available under the `stat_plot/test` folder. 38 | 39 | The example for plotting the line chart is the `test_config.toml` file. 40 | 41 | The `data_files` option should point to the files generated by `showmaps`. 42 | 43 | 44 | -------------------------------------------------------------------------------- /requirements-3.8.txt: -------------------------------------------------------------------------------- 1 | cycler==0.11.0 2 | fonttools==4.28.5 3 | kiwisolver==1.3.2 4 | matplotlib==3.5.1 5 | numpy==1.22.0 6 | packaging==21.3 7 | pandas==1.4.0 8 | Pillow==9.0.0 9 | pyparsing==3.0.6 10 | python-dateutil==2.8.2 11 | pytz==2021.3 12 | scipy==1.7.3 13 | seaborn==0.11.2 14 | six==1.12.0 15 | toml==0.10.0 16 | -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | cycler==0.10.0 2 | kiwisolver==1.0.1 3 | matplotlib==3.0.2 4 | numpy==1.15.4 5 | pyparsing==2.3.0 6 | python-dateutil==2.7.5 7 | scipy==1.2.0 8 | six==1.12.0 9 | toml==0.10.0 10 | -------------------------------------------------------------------------------- /showmaps/.gitignore: -------------------------------------------------------------------------------- 1 | # Created by .ignore support plugin (hsz.mobi) 2 | ### Custom 3 | showmaps 4 | test/out/ 5 | test/out-simple/ 6 | test/out-entry/ 7 | temp/ 8 | 9 | ### C template 10 | # Prerequisites 11 | *.d 12 | 13 | # Object files 14 | *.o 15 | *.ko 16 | *.obj 17 | *.elf 18 | 19 | # Linker output 20 | *.ilk 21 | *.map 22 | *.exp 23 | 24 | # Precompiled Headers 25 | *.gch 26 | *.pch 27 | 28 | # Libraries 29 | *.lib 30 | *.a 31 | *.la 32 | *.lo 33 | 34 | # Shared objects (inc. Windows DLLs) 35 | *.dll 36 | *.so 37 | *.so.* 38 | *.dylib 39 | 40 | # Executables 41 | *.exe 42 | *.out 43 | *.app 44 | *.i*86 45 | *.x86_64 46 | *.hex 47 | 48 | # Debug files 49 | *.dSYM/ 50 | *.su 51 | *.idb 52 | *.pdb 53 | 54 | # Kernel Module Compile Results 55 | *.mod* 56 | *.cmd 57 | .tmp_versions/ 58 | modules.order 59 | Module.symvers 60 | Mkfile.old 61 | dkms.conf 62 | 63 | -------------------------------------------------------------------------------- /showmaps/Makefile: -------------------------------------------------------------------------------- 1 | VERSION = $(shell grep '^\#define VERSION ' config.h | cut -d '"' -f2) 2 | 3 | PROGS = showmaps 4 | 5 | CFLAGS ?= -O3 -funroll-loops 6 | CFLAGS += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign 7 | 8 | ifneq "$(filter Linux GNU%,$(shell uname))" "" 9 | LDFLAGS += -ldl 10 | endif 11 | 12 | COMM_HDR = alloc-inl.h config.h debug.h types.h 13 | 14 | all: $(PROGS) 15 | 16 | showmaps: showmaps.c $(COMM_HDR) 17 | $(CC) $(CFLAGS) $@.c -o $@ $(LDFLAGS) 18 | 19 | .NOTPARALLEL: clean 20 | 21 | clean: 22 | rm -f $(PROGS) *.o *~ a.out core core.[1-9][0-9]* *.stackdump -------------------------------------------------------------------------------- /showmaps/alloc-inl.h: -------------------------------------------------------------------------------- 1 | /* 2 | american fuzzy lop - error-checking, memory-zeroing alloc routines 3 | ------------------------------------------------------------------ 4 | 5 | Written and maintained by Michal Zalewski 6 | 7 | Copyright 2013, 2014, 2015 Google Inc. All rights reserved. 8 | 9 | Licensed under the Apache License, Version 2.0 (the "License"); 10 | you may not use this file except in compliance with the License. 11 | You may obtain a copy of the License at: 12 | 13 | http://www.apache.org/licenses/LICENSE-2.0 14 | 15 | This allocator is not designed to resist malicious attackers (the canaries 16 | are small and predictable), but provides a robust and portable way to detect 17 | use-after-free, off-by-one writes, stale pointers, and so on. 18 | 19 | */ 20 | 21 | #ifndef _HAVE_ALLOC_INL_H 22 | #define _HAVE_ALLOC_INL_H 23 | 24 | #include 25 | #include 26 | #include 27 | 28 | #include "config.h" 29 | #include "types.h" 30 | #include "debug.h" 31 | 32 | /* User-facing macro to sprintf() to a dynamically allocated buffer. */ 33 | 34 | #define alloc_printf(_str...) ({ \ 35 | u8* _tmp; \ 36 | s32 _len = snprintf(NULL, 0, _str); \ 37 | if (_len < 0) FATAL("Whoa, snprintf() fails?!"); \ 38 | _tmp = ck_alloc(_len + 1); \ 39 | snprintf((char*)_tmp, _len + 1, _str); \ 40 | _tmp; \ 41 | }) 42 | 43 | /* Macro to enforce allocation limits as a last-resort defense against 44 | integer overflows. */ 45 | 46 | #define ALLOC_CHECK_SIZE(_s) do { \ 47 | if ((_s) > MAX_ALLOC) \ 48 | ABORT("Bad alloc request: %u bytes", (_s)); \ 49 | } while (0) 50 | 51 | /* Macro to check malloc() failures and the like. */ 52 | 53 | #define ALLOC_CHECK_RESULT(_r, _s) do { \ 54 | if (!(_r)) \ 55 | ABORT("Out of memory: can't allocate %u bytes", (_s)); \ 56 | } while (0) 57 | 58 | /* Magic tokens used to mark used / freed chunks. */ 59 | 60 | #define ALLOC_MAGIC_C1 0xFF00FF00 /* Used head (dword) */ 61 | #define ALLOC_MAGIC_F 0xFE00FE00 /* Freed head (dword) */ 62 | #define ALLOC_MAGIC_C2 0xF0 /* Used tail (byte) */ 63 | 64 | /* Positions of guard tokens in relation to the user-visible pointer. */ 65 | 66 | #define ALLOC_C1(_ptr) (((u32*)(_ptr))[-2]) 67 | #define ALLOC_S(_ptr) (((u32*)(_ptr))[-1]) 68 | #define ALLOC_C2(_ptr) (((u8*)(_ptr))[ALLOC_S(_ptr)]) 69 | 70 | #define ALLOC_OFF_HEAD 8 71 | #define ALLOC_OFF_TOTAL (ALLOC_OFF_HEAD + 1) 72 | 73 | /* Allocator increments for ck_realloc_block(). */ 74 | 75 | #define ALLOC_BLK_INC 256 76 | 77 | /* Sanity-checking macros for pointers. */ 78 | 79 | #define CHECK_PTR(_p) do { \ 80 | if (_p) { \ 81 | if (ALLOC_C1(_p) ^ ALLOC_MAGIC_C1) {\ 82 | if (ALLOC_C1(_p) == ALLOC_MAGIC_F) \ 83 | ABORT("Use after free."); \ 84 | else ABORT("Corrupted head alloc canary."); \ 85 | } \ 86 | if (ALLOC_C2(_p) ^ ALLOC_MAGIC_C2) \ 87 | ABORT("Corrupted tail alloc canary."); \ 88 | } \ 89 | } while (0) 90 | 91 | #define CHECK_PTR_EXPR(_p) ({ \ 92 | typeof (_p) _tmp = (_p); \ 93 | CHECK_PTR(_tmp); \ 94 | _tmp; \ 95 | }) 96 | 97 | 98 | /* Allocate a buffer, explicitly not zeroing it. Returns NULL for zero-sized 99 | requests. */ 100 | 101 | static inline void* DFL_ck_alloc_nozero(u32 size) { 102 | 103 | void* ret; 104 | 105 | if (!size) return NULL; 106 | 107 | ALLOC_CHECK_SIZE(size); 108 | ret = malloc(size + ALLOC_OFF_TOTAL); 109 | ALLOC_CHECK_RESULT(ret, size); 110 | 111 | ret += ALLOC_OFF_HEAD; 112 | 113 | ALLOC_C1(ret) = ALLOC_MAGIC_C1; 114 | ALLOC_S(ret) = size; 115 | ALLOC_C2(ret) = ALLOC_MAGIC_C2; 116 | 117 | return ret; 118 | 119 | } 120 | 121 | 122 | /* Allocate a buffer, returning zeroed memory. */ 123 | 124 | static inline void* DFL_ck_alloc(u32 size) { 125 | 126 | void* mem; 127 | 128 | if (!size) return NULL; 129 | mem = DFL_ck_alloc_nozero(size); 130 | 131 | return memset(mem, 0, size); 132 | 133 | } 134 | 135 | 136 | /* Free memory, checking for double free and corrupted heap. When DEBUG_BUILD 137 | is set, the old memory will be also clobbered with 0xFF. */ 138 | 139 | static inline void DFL_ck_free(void* mem) { 140 | 141 | if (!mem) return; 142 | 143 | CHECK_PTR(mem); 144 | 145 | #ifdef DEBUG_BUILD 146 | 147 | /* Catch pointer issues sooner. */ 148 | memset(mem, 0xFF, ALLOC_S(mem)); 149 | 150 | #endif /* DEBUG_BUILD */ 151 | 152 | ALLOC_C1(mem) = ALLOC_MAGIC_F; 153 | 154 | free(mem - ALLOC_OFF_HEAD); 155 | 156 | } 157 | 158 | 159 | /* Re-allocate a buffer, checking for issues and zeroing any newly-added tail. 160 | With DEBUG_BUILD, the buffer is always reallocated to a new addresses and the 161 | old memory is clobbered with 0xFF. */ 162 | 163 | static inline void* DFL_ck_realloc(void* orig, u32 size) { 164 | 165 | void* ret; 166 | u32 old_size = 0; 167 | 168 | if (!size) { 169 | 170 | DFL_ck_free(orig); 171 | return NULL; 172 | 173 | } 174 | 175 | if (orig) { 176 | 177 | CHECK_PTR(orig); 178 | 179 | #ifndef DEBUG_BUILD 180 | ALLOC_C1(orig) = ALLOC_MAGIC_F; 181 | #endif /* !DEBUG_BUILD */ 182 | 183 | old_size = ALLOC_S(orig); 184 | orig -= ALLOC_OFF_HEAD; 185 | 186 | ALLOC_CHECK_SIZE(old_size); 187 | 188 | } 189 | 190 | ALLOC_CHECK_SIZE(size); 191 | 192 | #ifndef DEBUG_BUILD 193 | 194 | ret = realloc(orig, size + ALLOC_OFF_TOTAL); 195 | ALLOC_CHECK_RESULT(ret, size); 196 | 197 | #else 198 | 199 | /* Catch pointer issues sooner: force relocation and make sure that the 200 | original buffer is wiped. */ 201 | 202 | ret = malloc(size + ALLOC_OFF_TOTAL); 203 | ALLOC_CHECK_RESULT(ret, size); 204 | 205 | if (orig) { 206 | 207 | memcpy(ret + ALLOC_OFF_HEAD, orig + ALLOC_OFF_HEAD, MIN(size, old_size)); 208 | memset(orig + ALLOC_OFF_HEAD, 0xFF, old_size); 209 | 210 | ALLOC_C1(orig + ALLOC_OFF_HEAD) = ALLOC_MAGIC_F; 211 | 212 | free(orig); 213 | 214 | } 215 | 216 | #endif /* ^!DEBUG_BUILD */ 217 | 218 | ret += ALLOC_OFF_HEAD; 219 | 220 | ALLOC_C1(ret) = ALLOC_MAGIC_C1; 221 | ALLOC_S(ret) = size; 222 | ALLOC_C2(ret) = ALLOC_MAGIC_C2; 223 | 224 | if (size > old_size) 225 | memset(ret + old_size, 0, size - old_size); 226 | 227 | return ret; 228 | 229 | } 230 | 231 | 232 | /* Re-allocate a buffer with ALLOC_BLK_INC increments (used to speed up 233 | repeated small reallocs without complicating the user code). */ 234 | 235 | static inline void* DFL_ck_realloc_block(void* orig, u32 size) { 236 | 237 | #ifndef DEBUG_BUILD 238 | 239 | if (orig) { 240 | 241 | CHECK_PTR(orig); 242 | 243 | if (ALLOC_S(orig) >= size) return orig; 244 | 245 | size += ALLOC_BLK_INC; 246 | 247 | } 248 | 249 | #endif /* !DEBUG_BUILD */ 250 | 251 | return DFL_ck_realloc(orig, size); 252 | 253 | } 254 | 255 | 256 | /* Create a buffer with a copy of a string. Returns NULL for NULL inputs. */ 257 | 258 | static inline u8* DFL_ck_strdup(u8* str) { 259 | 260 | void* ret; 261 | u32 size; 262 | 263 | if (!str) return NULL; 264 | 265 | size = strlen((char*)str) + 1; 266 | 267 | ALLOC_CHECK_SIZE(size); 268 | ret = malloc(size + ALLOC_OFF_TOTAL); 269 | ALLOC_CHECK_RESULT(ret, size); 270 | 271 | ret += ALLOC_OFF_HEAD; 272 | 273 | ALLOC_C1(ret) = ALLOC_MAGIC_C1; 274 | ALLOC_S(ret) = size; 275 | ALLOC_C2(ret) = ALLOC_MAGIC_C2; 276 | 277 | return memcpy(ret, str, size); 278 | 279 | } 280 | 281 | 282 | /* Create a buffer with a copy of a memory block. Returns NULL for zero-sized 283 | or NULL inputs. */ 284 | 285 | static inline void* DFL_ck_memdup(void* mem, u32 size) { 286 | 287 | void* ret; 288 | 289 | if (!mem || !size) return NULL; 290 | 291 | ALLOC_CHECK_SIZE(size); 292 | ret = malloc(size + ALLOC_OFF_TOTAL); 293 | ALLOC_CHECK_RESULT(ret, size); 294 | 295 | ret += ALLOC_OFF_HEAD; 296 | 297 | ALLOC_C1(ret) = ALLOC_MAGIC_C1; 298 | ALLOC_S(ret) = size; 299 | ALLOC_C2(ret) = ALLOC_MAGIC_C2; 300 | 301 | return memcpy(ret, mem, size); 302 | 303 | } 304 | 305 | 306 | /* Create a buffer with a block of text, appending a NUL terminator at the end. 307 | Returns NULL for zero-sized or NULL inputs. */ 308 | 309 | static inline u8* DFL_ck_memdup_str(u8* mem, u32 size) { 310 | 311 | u8* ret; 312 | 313 | if (!mem || !size) return NULL; 314 | 315 | ALLOC_CHECK_SIZE(size); 316 | ret = malloc(size + ALLOC_OFF_TOTAL + 1); 317 | ALLOC_CHECK_RESULT(ret, size); 318 | 319 | ret += ALLOC_OFF_HEAD; 320 | 321 | ALLOC_C1(ret) = ALLOC_MAGIC_C1; 322 | ALLOC_S(ret) = size; 323 | ALLOC_C2(ret) = ALLOC_MAGIC_C2; 324 | 325 | memcpy(ret, mem, size); 326 | ret[size] = 0; 327 | 328 | return ret; 329 | 330 | } 331 | 332 | 333 | #ifndef DEBUG_BUILD 334 | 335 | /* In non-debug mode, we just do straightforward aliasing of the above functions 336 | to user-visible names such as ck_alloc(). */ 337 | 338 | #define ck_alloc DFL_ck_alloc 339 | #define ck_alloc_nozero DFL_ck_alloc_nozero 340 | #define ck_realloc DFL_ck_realloc 341 | #define ck_realloc_block DFL_ck_realloc_block 342 | #define ck_strdup DFL_ck_strdup 343 | #define ck_memdup DFL_ck_memdup 344 | #define ck_memdup_str DFL_ck_memdup_str 345 | #define ck_free DFL_ck_free 346 | 347 | #define alloc_report() 348 | 349 | #else 350 | 351 | /* In debugging mode, we also track allocations to detect memory leaks, and the 352 | flow goes through one more layer of indirection. */ 353 | 354 | /* Alloc tracking data structures: */ 355 | 356 | #define ALLOC_BUCKETS 4096 357 | 358 | struct TRK_obj { 359 | void *ptr; 360 | char *file, *func; 361 | u32 line; 362 | }; 363 | 364 | #ifdef AFL_MAIN 365 | 366 | struct TRK_obj* TRK[ALLOC_BUCKETS]; 367 | u32 TRK_cnt[ALLOC_BUCKETS]; 368 | 369 | # define alloc_report() TRK_report() 370 | 371 | #else 372 | 373 | extern struct TRK_obj* TRK[ALLOC_BUCKETS]; 374 | extern u32 TRK_cnt[ALLOC_BUCKETS]; 375 | 376 | # define alloc_report() 377 | 378 | #endif /* ^AFL_MAIN */ 379 | 380 | /* Bucket-assigning function for a given pointer: */ 381 | 382 | #define TRKH(_ptr) (((((u32)(_ptr)) >> 16) ^ ((u32)(_ptr))) % ALLOC_BUCKETS) 383 | 384 | 385 | /* Add a new entry to the list of allocated objects. */ 386 | 387 | static inline void TRK_alloc_buf(void* ptr, const char* file, const char* func, 388 | u32 line) { 389 | 390 | u32 i, bucket; 391 | 392 | if (!ptr) return; 393 | 394 | bucket = TRKH(ptr); 395 | 396 | /* Find a free slot in the list of entries for that bucket. */ 397 | 398 | for (i = 0; i < TRK_cnt[bucket]; i++) 399 | 400 | if (!TRK[bucket][i].ptr) { 401 | 402 | TRK[bucket][i].ptr = ptr; 403 | TRK[bucket][i].file = (char*)file; 404 | TRK[bucket][i].func = (char*)func; 405 | TRK[bucket][i].line = line; 406 | return; 407 | 408 | } 409 | 410 | /* No space available - allocate more. */ 411 | 412 | TRK[bucket] = DFL_ck_realloc_block(TRK[bucket], 413 | (TRK_cnt[bucket] + 1) * sizeof(struct TRK_obj)); 414 | 415 | TRK[bucket][i].ptr = ptr; 416 | TRK[bucket][i].file = (char*)file; 417 | TRK[bucket][i].func = (char*)func; 418 | TRK[bucket][i].line = line; 419 | 420 | TRK_cnt[bucket]++; 421 | 422 | } 423 | 424 | 425 | /* Remove entry from the list of allocated objects. */ 426 | 427 | static inline void TRK_free_buf(void* ptr, const char* file, const char* func, 428 | u32 line) { 429 | 430 | u32 i, bucket; 431 | 432 | if (!ptr) return; 433 | 434 | bucket = TRKH(ptr); 435 | 436 | /* Find the element on the list... */ 437 | 438 | for (i = 0; i < TRK_cnt[bucket]; i++) 439 | 440 | if (TRK[bucket][i].ptr == ptr) { 441 | 442 | TRK[bucket][i].ptr = 0; 443 | return; 444 | 445 | } 446 | 447 | WARNF("ALLOC: Attempt to free non-allocated memory in %s (%s:%u)", 448 | func, file, line); 449 | 450 | } 451 | 452 | 453 | /* Do a final report on all non-deallocated objects. */ 454 | 455 | static inline void TRK_report(void) { 456 | 457 | u32 i, bucket; 458 | 459 | fflush(0); 460 | 461 | for (bucket = 0; bucket < ALLOC_BUCKETS; bucket++) 462 | for (i = 0; i < TRK_cnt[bucket]; i++) 463 | if (TRK[bucket][i].ptr) 464 | WARNF("ALLOC: Memory never freed, created in %s (%s:%u)", 465 | TRK[bucket][i].func, TRK[bucket][i].file, TRK[bucket][i].line); 466 | 467 | } 468 | 469 | 470 | /* Simple wrappers for non-debugging functions: */ 471 | 472 | static inline void* TRK_ck_alloc(u32 size, const char* file, const char* func, 473 | u32 line) { 474 | 475 | void* ret = DFL_ck_alloc(size); 476 | TRK_alloc_buf(ret, file, func, line); 477 | return ret; 478 | 479 | } 480 | 481 | 482 | static inline void* TRK_ck_realloc(void* orig, u32 size, const char* file, 483 | const char* func, u32 line) { 484 | 485 | void* ret = DFL_ck_realloc(orig, size); 486 | TRK_free_buf(orig, file, func, line); 487 | TRK_alloc_buf(ret, file, func, line); 488 | return ret; 489 | 490 | } 491 | 492 | 493 | static inline void* TRK_ck_realloc_block(void* orig, u32 size, const char* file, 494 | const char* func, u32 line) { 495 | 496 | void* ret = DFL_ck_realloc_block(orig, size); 497 | TRK_free_buf(orig, file, func, line); 498 | TRK_alloc_buf(ret, file, func, line); 499 | return ret; 500 | 501 | } 502 | 503 | 504 | static inline void* TRK_ck_strdup(u8* str, const char* file, const char* func, 505 | u32 line) { 506 | 507 | void* ret = DFL_ck_strdup(str); 508 | TRK_alloc_buf(ret, file, func, line); 509 | return ret; 510 | 511 | } 512 | 513 | 514 | static inline void* TRK_ck_memdup(void* mem, u32 size, const char* file, 515 | const char* func, u32 line) { 516 | 517 | void* ret = DFL_ck_memdup(mem, size); 518 | TRK_alloc_buf(ret, file, func, line); 519 | return ret; 520 | 521 | } 522 | 523 | 524 | static inline void* TRK_ck_memdup_str(void* mem, u32 size, const char* file, 525 | const char* func, u32 line) { 526 | 527 | void* ret = DFL_ck_memdup_str(mem, size); 528 | TRK_alloc_buf(ret, file, func, line); 529 | return ret; 530 | 531 | } 532 | 533 | 534 | static inline void TRK_ck_free(void* ptr, const char* file, 535 | const char* func, u32 line) { 536 | 537 | TRK_free_buf(ptr, file, func, line); 538 | DFL_ck_free(ptr); 539 | 540 | } 541 | 542 | /* Aliasing user-facing names to tracking functions: */ 543 | 544 | #define ck_alloc(_p1) \ 545 | TRK_ck_alloc(_p1, __FILE__, __FUNCTION__, __LINE__) 546 | 547 | #define ck_alloc_nozero(_p1) \ 548 | TRK_ck_alloc(_p1, __FILE__, __FUNCTION__, __LINE__) 549 | 550 | #define ck_realloc(_p1, _p2) \ 551 | TRK_ck_realloc(_p1, _p2, __FILE__, __FUNCTION__, __LINE__) 552 | 553 | #define ck_realloc_block(_p1, _p2) \ 554 | TRK_ck_realloc_block(_p1, _p2, __FILE__, __FUNCTION__, __LINE__) 555 | 556 | #define ck_strdup(_p1) \ 557 | TRK_ck_strdup(_p1, __FILE__, __FUNCTION__, __LINE__) 558 | 559 | #define ck_memdup(_p1, _p2) \ 560 | TRK_ck_memdup(_p1, _p2, __FILE__, __FUNCTION__, __LINE__) 561 | 562 | #define ck_memdup_str(_p1, _p2) \ 563 | TRK_ck_memdup_str(_p1, _p2, __FILE__, __FUNCTION__, __LINE__) 564 | 565 | #define ck_free(_p1) \ 566 | TRK_ck_free(_p1, __FILE__, __FUNCTION__, __LINE__) 567 | 568 | #endif /* ^!DEBUG_BUILD */ 569 | 570 | #endif /* ! _HAVE_ALLOC_INL_H */ 571 | -------------------------------------------------------------------------------- /showmaps/config.h: -------------------------------------------------------------------------------- 1 | /* 2 | american fuzzy lop - vaguely configurable bits 3 | ---------------------------------------------- 4 | 5 | Written and maintained by Michal Zalewski 6 | 7 | Copyright 2013, 2014, 2015, 2016 Google Inc. All rights reserved. 8 | 9 | Licensed under the Apache License, Version 2.0 (the "License"); 10 | you may not use this file except in compliance with the License. 11 | You may obtain a copy of the License at: 12 | 13 | http://www.apache.org/licenses/LICENSE-2.0 14 | 15 | */ 16 | 17 | #ifndef _HAVE_CONFIG_H 18 | #define _HAVE_CONFIG_H 19 | 20 | #include "types.h" 21 | 22 | /* Version string: */ 23 | 24 | #define VERSION "2.52b" 25 | 26 | /****************************************************** 27 | * * 28 | * Settings that may be of interest to power users: * 29 | * * 30 | ******************************************************/ 31 | 32 | /* Comment out to disable terminal colors (note that this makes afl-analyze 33 | a lot less nice): */ 34 | 35 | #define USE_COLOR 36 | 37 | /* Comment out to disable fancy ANSI boxes and use poor man's 7-bit UI: */ 38 | 39 | #define FANCY_BOXES 40 | 41 | /* Default timeout for fuzzed code (milliseconds). This is the upper bound, 42 | also used for detecting hangs; the actual value is auto-scaled: */ 43 | 44 | #define EXEC_TIMEOUT 1000 45 | 46 | /* Timeout rounding factor when auto-scaling (milliseconds): */ 47 | 48 | #define EXEC_TM_ROUND 20 49 | 50 | /* Default memory limit for child process (MB): */ 51 | 52 | #ifndef __x86_64__ 53 | # define MEM_LIMIT 25 54 | #else 55 | # define MEM_LIMIT 50 56 | #endif /* ^!__x86_64__ */ 57 | 58 | /* Default memory limit when running in QEMU mode (MB): */ 59 | 60 | #define MEM_LIMIT_QEMU 200 61 | 62 | /* Number of calibration cycles per every new test case (and for test 63 | cases that show variable behavior): */ 64 | 65 | #define CAL_CYCLES 8 66 | #define CAL_CYCLES_LONG 40 67 | 68 | /* Number of subsequent timeouts before abandoning an input file: */ 69 | 70 | #define TMOUT_LIMIT 250 71 | 72 | /* Maximum number of unique hangs or crashes to record: */ 73 | 74 | #define KEEP_UNIQUE_HANG 500 75 | #define KEEP_UNIQUE_CRASH 5000 76 | 77 | /* Baseline number of random tweaks during a single 'havoc' stage: */ 78 | 79 | #define HAVOC_CYCLES 256 80 | #define HAVOC_CYCLES_INIT 1024 81 | 82 | /* Maximum multiplier for the above (should be a power of two, beware 83 | of 32-bit int overflows): */ 84 | 85 | #define HAVOC_MAX_MULT 16 86 | 87 | /* Absolute minimum number of havoc cycles (after all adjustments): */ 88 | 89 | #define HAVOC_MIN 16 90 | 91 | /* Maximum stacking for havoc-stage tweaks. The actual value is calculated 92 | like this: 93 | 94 | n = random between 1 and HAVOC_STACK_POW2 95 | stacking = 2^n 96 | 97 | In other words, the default (n = 7) produces 2, 4, 8, 16, 32, 64, or 98 | 128 stacked tweaks: */ 99 | 100 | #define HAVOC_STACK_POW2 7 101 | 102 | /* Caps on block sizes for cloning and deletion operations. Each of these 103 | ranges has a 33% probability of getting picked, except for the first 104 | two cycles where smaller blocks are favored: */ 105 | 106 | #define HAVOC_BLK_SMALL 32 107 | #define HAVOC_BLK_MEDIUM 128 108 | #define HAVOC_BLK_LARGE 1500 109 | 110 | /* Extra-large blocks, selected very rarely (<5% of the time): */ 111 | 112 | #define HAVOC_BLK_XL 32768 113 | 114 | /* Probabilities of skipping non-favored entries in the queue, expressed as 115 | percentages: */ 116 | 117 | #define SKIP_TO_NEW_PROB 99 /* ...when there are new, pending favorites */ 118 | #define SKIP_NFAV_OLD_PROB 95 /* ...no new favs, cur entry already fuzzed */ 119 | #define SKIP_NFAV_NEW_PROB 75 /* ...no new favs, cur entry not fuzzed yet */ 120 | 121 | /* Splicing cycle count: */ 122 | 123 | #define SPLICE_CYCLES 15 124 | 125 | /* Nominal per-splice havoc cycle length: */ 126 | 127 | #define SPLICE_HAVOC 32 128 | 129 | /* Maximum offset for integer addition / subtraction stages: */ 130 | 131 | #define ARITH_MAX 35 132 | 133 | /* Limits for the test case trimmer. The absolute minimum chunk size; and 134 | the starting and ending divisors for chopping up the input file: */ 135 | 136 | #define TRIM_MIN_BYTES 4 137 | #define TRIM_START_STEPS 16 138 | #define TRIM_END_STEPS 1024 139 | 140 | /* Maximum size of input file, in bytes (keep under 100MB): */ 141 | 142 | #define MAX_FILE (10 * 1024 * 1024) 143 | 144 | /* The same, for the test case minimizer: */ 145 | 146 | #define TMIN_MAX_FILE (10 * 1024 * 1024) 147 | 148 | /* Block normalization steps for afl-tmin: */ 149 | 150 | #define TMIN_SET_MIN_SIZE 4 151 | #define TMIN_SET_STEPS 128 152 | 153 | /* Maximum dictionary token size (-x), in bytes: */ 154 | 155 | #define MAX_DICT_FILE 128 156 | 157 | /* Length limits for auto-detected dictionary tokens: */ 158 | 159 | #define MIN_AUTO_EXTRA 3 160 | #define MAX_AUTO_EXTRA 32 161 | 162 | /* Maximum number of user-specified dictionary tokens to use in deterministic 163 | steps; past this point, the "extras/user" step will be still carried out, 164 | but with proportionally lower odds: */ 165 | 166 | #define MAX_DET_EXTRAS 200 167 | 168 | /* Maximum number of auto-extracted dictionary tokens to actually use in fuzzing 169 | (first value), and to keep in memory as candidates. The latter should be much 170 | higher than the former. */ 171 | 172 | #define USE_AUTO_EXTRAS 50 173 | #define MAX_AUTO_EXTRAS (USE_AUTO_EXTRAS * 10) 174 | 175 | /* Scaling factor for the effector map used to skip some of the more 176 | expensive deterministic steps. The actual divisor is set to 177 | 2^EFF_MAP_SCALE2 bytes: */ 178 | 179 | #define EFF_MAP_SCALE2 3 180 | 181 | /* Minimum input file length at which the effector logic kicks in: */ 182 | 183 | #define EFF_MIN_LEN 128 184 | 185 | /* Maximum effector density past which everything is just fuzzed 186 | unconditionally (%): */ 187 | 188 | #define EFF_MAX_PERC 90 189 | 190 | /* UI refresh frequency (Hz): */ 191 | 192 | #define UI_TARGET_HZ 5 193 | 194 | /* Fuzzer stats file and plot update intervals (sec): */ 195 | 196 | #define STATS_UPDATE_SEC 60 197 | #define PLOT_UPDATE_SEC 5 198 | 199 | /* Smoothing divisor for CPU load and exec speed stats (1 - no smoothing). */ 200 | 201 | #define AVG_SMOOTHING 16 202 | 203 | /* Sync interval (every n havoc cycles): */ 204 | 205 | #define SYNC_INTERVAL 5 206 | 207 | /* Output directory reuse grace period (minutes): */ 208 | 209 | #define OUTPUT_GRACE 25 210 | 211 | /* Uncomment to use simple file names (id_NNNNNN): */ 212 | 213 | // #define SIMPLE_FILES 214 | 215 | /* List of interesting values to use in fuzzing. */ 216 | 217 | #define INTERESTING_8 \ 218 | -128, /* Overflow signed 8-bit when decremented */ \ 219 | -1, /* */ \ 220 | 0, /* */ \ 221 | 1, /* */ \ 222 | 16, /* One-off with common buffer size */ \ 223 | 32, /* One-off with common buffer size */ \ 224 | 64, /* One-off with common buffer size */ \ 225 | 100, /* One-off with common buffer size */ \ 226 | 127 /* Overflow signed 8-bit when incremented */ 227 | 228 | #define INTERESTING_16 \ 229 | -32768, /* Overflow signed 16-bit when decremented */ \ 230 | -129, /* Overflow signed 8-bit */ \ 231 | 128, /* Overflow signed 8-bit */ \ 232 | 255, /* Overflow unsig 8-bit when incremented */ \ 233 | 256, /* Overflow unsig 8-bit */ \ 234 | 512, /* One-off with common buffer size */ \ 235 | 1000, /* One-off with common buffer size */ \ 236 | 1024, /* One-off with common buffer size */ \ 237 | 4096, /* One-off with common buffer size */ \ 238 | 32767 /* Overflow signed 16-bit when incremented */ 239 | 240 | #define INTERESTING_32 \ 241 | -2147483648LL, /* Overflow signed 32-bit when decremented */ \ 242 | -100663046, /* Large negative number (endian-agnostic) */ \ 243 | -32769, /* Overflow signed 16-bit */ \ 244 | 32768, /* Overflow signed 16-bit */ \ 245 | 65535, /* Overflow unsig 16-bit when incremented */ \ 246 | 65536, /* Overflow unsig 16 bit */ \ 247 | 100663045, /* Large positive number (endian-agnostic) */ \ 248 | 2147483647 /* Overflow signed 32-bit when incremented */ 249 | 250 | /*********************************************************** 251 | * * 252 | * Really exotic stuff you probably don't want to touch: * 253 | * * 254 | ***********************************************************/ 255 | 256 | /* Call count interval between reseeding the libc PRNG from /dev/urandom: */ 257 | 258 | #define RESEED_RNG 10000 259 | 260 | /* Maximum line length passed from GCC to 'as' and used for parsing 261 | configuration files: */ 262 | 263 | #define MAX_LINE 8192 264 | 265 | /* Environment variable used to pass SHM ID to the called program. */ 266 | 267 | #define SHM_ENV_VAR "__AFL_SHM_ID" 268 | 269 | /* Other less interesting, internal-only variables. */ 270 | 271 | #define CLANG_ENV_VAR "__AFL_CLANG_MODE" 272 | #define AS_LOOP_ENV_VAR "__AFL_AS_LOOPCHECK" 273 | #define PERSIST_ENV_VAR "__AFL_PERSISTENT" 274 | #define DEFER_ENV_VAR "__AFL_DEFER_FORKSRV" 275 | 276 | /* In-code signatures for deferred and persistent mode. */ 277 | 278 | #define PERSIST_SIG "##SIG_AFL_PERSISTENT##" 279 | #define DEFER_SIG "##SIG_AFL_DEFER_FORKSRV##" 280 | 281 | /* Distinctive bitmap signature used to indicate failed execution: */ 282 | 283 | #define EXEC_FAIL_SIG 0xfee1dead 284 | 285 | /* Distinctive exit code used to indicate MSAN trip condition: */ 286 | 287 | #define MSAN_ERROR 86 288 | 289 | /* Designated file descriptors for forkserver commands (the application will 290 | use FORKSRV_FD and FORKSRV_FD + 1): */ 291 | 292 | #define FORKSRV_FD 198 293 | 294 | /* Fork server init timeout multiplier: we'll wait the user-selected 295 | timeout plus this much for the fork server to spin up. */ 296 | 297 | #define FORK_WAIT_MULT 10 298 | 299 | /* Calibration timeout adjustments, to be a bit more generous when resuming 300 | fuzzing sessions or trying to calibrate already-added internal finds. 301 | The first value is a percentage, the other is in milliseconds: */ 302 | 303 | #define CAL_TMOUT_PERC 125 304 | #define CAL_TMOUT_ADD 50 305 | 306 | /* Number of chances to calibrate a case before giving up: */ 307 | 308 | #define CAL_CHANCES 3 309 | 310 | /* Map size for the traced binary (2^MAP_SIZE_POW2). Must be greater than 311 | 2; you probably want to keep it under 18 or so for performance reasons 312 | (adjusting AFL_INST_RATIO when compiling is probably a better way to solve 313 | problems with complex programs). You need to recompile the target binary 314 | after changing this - otherwise, SEGVs may ensue. */ 315 | 316 | #define MAP_SIZE_POW2 16 317 | #define MAP_SIZE (1 << MAP_SIZE_POW2) 318 | 319 | /* Maximum allocator request size (keep well under INT_MAX): */ 320 | 321 | #define MAX_ALLOC 0x40000000 322 | 323 | /* A made-up hashing seed: */ 324 | 325 | #define HASH_CONST 0xa5b35705 326 | 327 | /* Constants for afl-gotcpu to control busy loop timing: */ 328 | 329 | #define CTEST_TARGET_MS 5000 330 | #define CTEST_CORE_TRG_MS 1000 331 | #define CTEST_BUSY_CYCLES (10 * 1000 * 1000) 332 | 333 | /* Uncomment this to use inferior block-coverage-based instrumentation. Note 334 | that you need to recompile the target binary for this to have any effect: */ 335 | 336 | // #define COVERAGE_ONLY 337 | 338 | /* Uncomment this to ignore hit counts and output just one bit per tuple. 339 | As with the previous setting, you will need to recompile the target 340 | binary: */ 341 | 342 | // #define SKIP_COUNTS 343 | 344 | /* Uncomment this to use instrumentation data to record newly discovered paths, 345 | but do not use them as seeds for fuzzing. This is useful for conveniently 346 | measuring coverage that could be attained by a "dumb" fuzzing algorithm: */ 347 | 348 | // #define IGNORE_FINDS 349 | 350 | #endif /* ! _HAVE_CONFIG_H */ 351 | -------------------------------------------------------------------------------- /showmaps/debug.h: -------------------------------------------------------------------------------- 1 | /* 2 | american fuzzy lop - debug / error handling macros 3 | -------------------------------------------------- 4 | 5 | Written and maintained by Michal Zalewski 6 | 7 | Copyright 2013, 2014, 2015, 2016 Google Inc. All rights reserved. 8 | 9 | Licensed under the Apache License, Version 2.0 (the "License"); 10 | you may not use this file except in compliance with the License. 11 | You may obtain a copy of the License at: 12 | 13 | http://www.apache.org/licenses/LICENSE-2.0 14 | 15 | */ 16 | 17 | #ifndef _HAVE_DEBUG_H 18 | #define _HAVE_DEBUG_H 19 | 20 | #include 21 | 22 | #include "types.h" 23 | #include "config.h" 24 | 25 | /******************* 26 | * Terminal colors * 27 | *******************/ 28 | 29 | #ifdef USE_COLOR 30 | 31 | # define cBLK "\x1b[0;30m" 32 | # define cRED "\x1b[0;31m" 33 | # define cGRN "\x1b[0;32m" 34 | # define cBRN "\x1b[0;33m" 35 | # define cBLU "\x1b[0;34m" 36 | # define cMGN "\x1b[0;35m" 37 | # define cCYA "\x1b[0;36m" 38 | # define cLGR "\x1b[0;37m" 39 | # define cGRA "\x1b[1;90m" 40 | # define cLRD "\x1b[1;91m" 41 | # define cLGN "\x1b[1;92m" 42 | # define cYEL "\x1b[1;93m" 43 | # define cLBL "\x1b[1;94m" 44 | # define cPIN "\x1b[1;95m" 45 | # define cLCY "\x1b[1;96m" 46 | # define cBRI "\x1b[1;97m" 47 | # define cRST "\x1b[0m" 48 | 49 | # define bgBLK "\x1b[40m" 50 | # define bgRED "\x1b[41m" 51 | # define bgGRN "\x1b[42m" 52 | # define bgBRN "\x1b[43m" 53 | # define bgBLU "\x1b[44m" 54 | # define bgMGN "\x1b[45m" 55 | # define bgCYA "\x1b[46m" 56 | # define bgLGR "\x1b[47m" 57 | # define bgGRA "\x1b[100m" 58 | # define bgLRD "\x1b[101m" 59 | # define bgLGN "\x1b[102m" 60 | # define bgYEL "\x1b[103m" 61 | # define bgLBL "\x1b[104m" 62 | # define bgPIN "\x1b[105m" 63 | # define bgLCY "\x1b[106m" 64 | # define bgBRI "\x1b[107m" 65 | 66 | #else 67 | 68 | # define cBLK "" 69 | # define cRED "" 70 | # define cGRN "" 71 | # define cBRN "" 72 | # define cBLU "" 73 | # define cMGN "" 74 | # define cCYA "" 75 | # define cLGR "" 76 | # define cGRA "" 77 | # define cLRD "" 78 | # define cLGN "" 79 | # define cYEL "" 80 | # define cLBL "" 81 | # define cPIN "" 82 | # define cLCY "" 83 | # define cBRI "" 84 | # define cRST "" 85 | 86 | # define bgBLK "" 87 | # define bgRED "" 88 | # define bgGRN "" 89 | # define bgBRN "" 90 | # define bgBLU "" 91 | # define bgMGN "" 92 | # define bgCYA "" 93 | # define bgLGR "" 94 | # define bgGRA "" 95 | # define bgLRD "" 96 | # define bgLGN "" 97 | # define bgYEL "" 98 | # define bgLBL "" 99 | # define bgPIN "" 100 | # define bgLCY "" 101 | # define bgBRI "" 102 | 103 | #endif /* ^USE_COLOR */ 104 | 105 | /************************* 106 | * Box drawing sequences * 107 | *************************/ 108 | 109 | #ifdef FANCY_BOXES 110 | 111 | # define SET_G1 "\x1b)0" /* Set G1 for box drawing */ 112 | # define RESET_G1 "\x1b)B" /* Reset G1 to ASCII */ 113 | # define bSTART "\x0e" /* Enter G1 drawing mode */ 114 | # define bSTOP "\x0f" /* Leave G1 drawing mode */ 115 | # define bH "q" /* Horizontal line */ 116 | # define bV "x" /* Vertical line */ 117 | # define bLT "l" /* Left top corner */ 118 | # define bRT "k" /* Right top corner */ 119 | # define bLB "m" /* Left bottom corner */ 120 | # define bRB "j" /* Right bottom corner */ 121 | # define bX "n" /* Cross */ 122 | # define bVR "t" /* Vertical, branch right */ 123 | # define bVL "u" /* Vertical, branch left */ 124 | # define bHT "v" /* Horizontal, branch top */ 125 | # define bHB "w" /* Horizontal, branch bottom */ 126 | 127 | #else 128 | 129 | # define SET_G1 "" 130 | # define RESET_G1 "" 131 | # define bSTART "" 132 | # define bSTOP "" 133 | # define bH "-" 134 | # define bV "|" 135 | # define bLT "+" 136 | # define bRT "+" 137 | # define bLB "+" 138 | # define bRB "+" 139 | # define bX "+" 140 | # define bVR "+" 141 | # define bVL "+" 142 | # define bHT "+" 143 | # define bHB "+" 144 | 145 | #endif /* ^FANCY_BOXES */ 146 | 147 | /*********************** 148 | * Misc terminal codes * 149 | ***********************/ 150 | 151 | #define TERM_HOME "\x1b[H" 152 | #define TERM_CLEAR TERM_HOME "\x1b[2J" 153 | #define cEOL "\x1b[0K" 154 | #define CURSOR_HIDE "\x1b[?25l" 155 | #define CURSOR_SHOW "\x1b[?25h" 156 | 157 | /************************ 158 | * Debug & error macros * 159 | ************************/ 160 | 161 | /* Just print stuff to the appropriate stream. */ 162 | 163 | #ifdef MESSAGES_TO_STDOUT 164 | # define SAYF(x...) printf(x) 165 | #else 166 | # define SAYF(x...) fprintf(stderr, x) 167 | #endif /* ^MESSAGES_TO_STDOUT */ 168 | 169 | /* Show a prefixed warning. */ 170 | 171 | #define WARNF(x...) do { \ 172 | SAYF(cYEL "[!] " cBRI "WARNING: " cRST x); \ 173 | SAYF(cRST "\n"); \ 174 | } while (0) 175 | 176 | /* Show a prefixed "doing something" message. */ 177 | 178 | #define ACTF(x...) do { \ 179 | SAYF(cLBL "[*] " cRST x); \ 180 | SAYF(cRST "\n"); \ 181 | } while (0) 182 | 183 | /* Show a prefixed "success" message. */ 184 | 185 | #define OKF(x...) do { \ 186 | SAYF(cLGN "[+] " cRST x); \ 187 | SAYF(cRST "\n"); \ 188 | } while (0) 189 | 190 | /* Show a prefixed fatal error message (not used in afl). */ 191 | 192 | #define BADF(x...) do { \ 193 | SAYF(cLRD "\n[-] " cRST x); \ 194 | SAYF(cRST "\n"); \ 195 | } while (0) 196 | 197 | /* Die with a verbose non-OS fatal error message. */ 198 | 199 | #define FATAL(x...) do { \ 200 | SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD "\n[-] PROGRAM ABORT : " \ 201 | cBRI x); \ 202 | SAYF(cLRD "\n Location : " cRST "%s(), %s:%u\n\n", \ 203 | __FUNCTION__, __FILE__, __LINE__); \ 204 | exit(1); \ 205 | } while (0) 206 | 207 | /* Die by calling abort() to provide a core dump. */ 208 | 209 | #define ABORT(x...) do { \ 210 | SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD "\n[-] PROGRAM ABORT : " \ 211 | cBRI x); \ 212 | SAYF(cLRD "\n Stop location : " cRST "%s(), %s:%u\n\n", \ 213 | __FUNCTION__, __FILE__, __LINE__); \ 214 | abort(); \ 215 | } while (0) 216 | 217 | /* Die while also including the output of perror(). */ 218 | 219 | #define PFATAL(x...) do { \ 220 | fflush(stdout); \ 221 | SAYF(bSTOP RESET_G1 CURSOR_SHOW cRST cLRD "\n[-] SYSTEM ERROR : " \ 222 | cBRI x); \ 223 | SAYF(cLRD "\n Stop location : " cRST "%s(), %s:%u\n", \ 224 | __FUNCTION__, __FILE__, __LINE__); \ 225 | SAYF(cLRD " OS message : " cRST "%s\n", strerror(errno)); \ 226 | exit(1); \ 227 | } while (0) 228 | 229 | /* Die with FAULT() or PFAULT() depending on the value of res (used to 230 | interpret different failure modes for read(), write(), etc). */ 231 | 232 | #define RPFATAL(res, x...) do { \ 233 | if (res < 0) PFATAL(x); else FATAL(x); \ 234 | } while (0) 235 | 236 | /* Error-checking versions of read() and write() that call RPFATAL() as 237 | appropriate. */ 238 | 239 | #define ck_write(fd, buf, len, fn) do { \ 240 | u32 _len = (len); \ 241 | s32 _res = write(fd, buf, _len); \ 242 | if (_res != _len) RPFATAL(_res, "Short write to %s", fn); \ 243 | } while (0) 244 | 245 | #define ck_read(fd, buf, len, fn) do { \ 246 | u32 _len = (len); \ 247 | s32 _res = read(fd, buf, _len); \ 248 | if (_res != _len) RPFATAL(_res, "Short read from %s", fn); \ 249 | } while (0) 250 | 251 | #endif /* ! _HAVE_DEBUG_H */ 252 | -------------------------------------------------------------------------------- /showmaps/hash.h: -------------------------------------------------------------------------------- 1 | /* 2 | american fuzzy lop - hashing function 3 | ------------------------------------- 4 | 5 | The hash32() function is a variant of MurmurHash3, a good 6 | non-cryptosafe hashing function developed by Austin Appleby. 7 | 8 | For simplicity, this variant does *NOT* accept buffer lengths 9 | that are not divisible by 8 bytes. The 32-bit version is otherwise 10 | similar to the original; the 64-bit one is a custom hack with 11 | mostly-unproven properties. 12 | 13 | Austin's original code is public domain. 14 | 15 | Other code written and maintained by Michal Zalewski 16 | 17 | Copyright 2016 Google Inc. All rights reserved. 18 | 19 | Licensed under the Apache License, Version 2.0 (the "License"); 20 | you may not use this file except in compliance with the License. 21 | You may obtain a copy of the License at: 22 | 23 | http://www.apache.org/licenses/LICENSE-2.0 24 | 25 | */ 26 | 27 | #ifndef _HAVE_HASH_H 28 | #define _HAVE_HASH_H 29 | 30 | #include "types.h" 31 | 32 | #ifdef __x86_64__ 33 | 34 | #define ROL64(_x, _r) ((((u64)(_x)) << (_r)) | (((u64)(_x)) >> (64 - (_r)))) 35 | 36 | static inline u32 hash32(const void* key, u32 len, u32 seed) { 37 | 38 | const u64* data = (u64*)key; 39 | u64 h1 = seed ^ len; 40 | 41 | len >>= 3; 42 | 43 | while (len--) { 44 | 45 | u64 k1 = *data++; 46 | 47 | k1 *= 0x87c37b91114253d5ULL; 48 | k1 = ROL64(k1, 31); 49 | k1 *= 0x4cf5ad432745937fULL; 50 | 51 | h1 ^= k1; 52 | h1 = ROL64(h1, 27); 53 | h1 = h1 * 5 + 0x52dce729; 54 | 55 | } 56 | 57 | h1 ^= h1 >> 33; 58 | h1 *= 0xff51afd7ed558ccdULL; 59 | h1 ^= h1 >> 33; 60 | h1 *= 0xc4ceb9fe1a85ec53ULL; 61 | h1 ^= h1 >> 33; 62 | 63 | return h1; 64 | 65 | } 66 | 67 | #else 68 | 69 | #define ROL32(_x, _r) ((((u32)(_x)) << (_r)) | (((u32)(_x)) >> (32 - (_r)))) 70 | 71 | static inline u32 hash32(const void* key, u32 len, u32 seed) { 72 | 73 | const u32* data = (u32*)key; 74 | u32 h1 = seed ^ len; 75 | 76 | len >>= 2; 77 | 78 | while (len--) { 79 | 80 | u32 k1 = *data++; 81 | 82 | k1 *= 0xcc9e2d51; 83 | k1 = ROL32(k1, 15); 84 | k1 *= 0x1b873593; 85 | 86 | h1 ^= k1; 87 | h1 = ROL32(h1, 13); 88 | h1 = h1 * 5 + 0xe6546b64; 89 | 90 | } 91 | 92 | h1 ^= h1 >> 16; 93 | h1 *= 0x85ebca6b; 94 | h1 ^= h1 >> 13; 95 | h1 *= 0xc2b2ae35; 96 | h1 ^= h1 >> 16; 97 | 98 | return h1; 99 | 100 | } 101 | 102 | #endif /* ^__x86_64__ */ 103 | 104 | #endif /* !_HAVE_HASH_H */ 105 | -------------------------------------------------------------------------------- /showmaps/showmaps.c: -------------------------------------------------------------------------------- 1 | /* 2 | american fuzzy lop - map display utility 3 | ---------------------------------------- 4 | 5 | Written and maintained by Michal Zalewski 6 | 7 | Copyright 2013, 2014, 2015, 2016, 2017 Google Inc. All rights reserved. 8 | 9 | Licensed under the Apache License, Version 2.0 (the "License"); 10 | you may not use this file except in compliance with the License. 11 | You may obtain a copy of the License at: 12 | 13 | http://www.apache.org/licenses/LICENSE-2.0 14 | 15 | A very simple tool that runs the targeted binary and displays 16 | the contents of the trace bitmap in a human-readable form. Useful in 17 | scripts to eliminate redundant inputs and perform other checks. 18 | 19 | Exit code is 2 if the target program crashes; 1 if it times out or 20 | there is a problem executing it; or 0 if execution is successful. 21 | 22 | */ 23 | 24 | #define AFL_MAIN 25 | 26 | #include "alloc-inl.h" 27 | #include "config.h" 28 | #include "debug.h" 29 | #include "hash.h" 30 | #include "types.h" 31 | 32 | #include 33 | #include 34 | #include 35 | #include 36 | #include 37 | #include 38 | #include 39 | #include 40 | #include 41 | 42 | #include 43 | #include 44 | #include 45 | #include 46 | #include 47 | #include 48 | 49 | struct queue_entry 50 | { 51 | 52 | u8 *fname; /* File name for the test case */ 53 | u32 len; /* Input length */ 54 | 55 | u8 cal_failed, /* Calibration failed? */ 56 | trim_done, /* Trimmed? */ 57 | was_fuzzed, /* Had any fuzzing done yet? */ 58 | passed_det, /* Deterministic stages passed? */ 59 | has_new_cov, /* Triggers new coverage? */ 60 | var_behavior, /* Variable behavior? */ 61 | favored, /* Currently favored? */ 62 | fs_redundant; /* Marked as redundant in the fs? */ 63 | 64 | u32 bitmap_size, /* Number of bits set in bitmap */ 65 | exec_cksum; /* Checksum of the execution trace */ 66 | 67 | u64 mtime, /* Last modification time */ 68 | sec_slot, /* Slot of seed, in sec */ 69 | min_slot, /* Slot of seed, in min */ 70 | hour_slot; /* Slot of seed ,in hour */ 71 | 72 | u8 *trace_mini; /* Trace bytes, if kept */ 73 | u32 tc_ref; /* Trace bytes ref count */ 74 | 75 | struct queue_entry *next, /* Next element, if any */ 76 | *prev; /* Previous element, if any */ 77 | }; 78 | 79 | static struct queue_entry *queue, /* Fuzzing queue (linked list) */ 80 | *queue_cur, /* Current offset within the queue */ 81 | *queue_top; /* Top of the list */ 82 | 83 | // pair of time slot and value 84 | 85 | struct slot_val 86 | { 87 | u64 slot; 88 | u32 val; 89 | struct slot_val *next; 90 | }; 91 | 92 | static struct slot_val *slot_edge, /* N.O. of edges covered over time */ 93 | *slot_edge_top, /* Top of slot_edge */ 94 | *slot_entry, /* N.O. of seeds found over time */ 95 | *slot_entry_top, *cov_slot_entry, /* N.O. of new cov found over time */ 96 | *cov_slot_entry_top, 97 | *mtime_edge, 98 | *mtime_edge_top, 99 | *mtime_entry, 100 | *mtime_entry_top, 101 | *mtime_cov_entry, 102 | *mtime_cov_entry_top; 103 | 104 | static s32 child_pid; /* PID of the tested program */ 105 | 106 | static u8 *trace_bits; /* SHM with instrumentation bitmap */ 107 | 108 | static u8 *in_dir, /* Input directory with test cases */ 109 | *out_file, /* File to fuzz, if any */ 110 | *out_dir, /* Working & output directory */ 111 | *trace_file, /* File to store the current trace */ 112 | *target_path; /* Path to target binary */ 113 | 114 | static u32 queued_paths, /* Total number of queued testcases */ 115 | skip_no = 0, /* no of files to skip for time count*/ 116 | exec_tmout; /* Exec timeout (ms) */ 117 | 118 | static u64 min_mtime = 0, /* Min mtime of all initial seeds */ 119 | max_mtime, /* Max mtime of all initial seeds */ 120 | mem_limit = MEM_LIMIT; /* Memory limit (MB) */ 121 | 122 | static s32 out_fd, /* Persistent fd for out_file */ 123 | dev_urandom_fd = -1, /* Persistent fd for /dev/urandom */ 124 | dev_null_fd = -1, /* Persistent fd for /dev/null */ 125 | shm_id, /* ID of the SHM region */ 126 | out_dir_fd = -1; /* FD of the lock file */ 127 | 128 | static u8 quiet_mode, /* Hide non-essential messages? */ 129 | edges_only, /* Ignore hit counts? */ 130 | given_min_mtime = 0, /* User provides min_mtime */ 131 | use_stdin = 1, /* Target program read from stdin? */ 132 | entries_only, /* Only count for N.O. of items? */ 133 | binary_mode, /* Write output as a binary map */ 134 | skip_individual, /* Skip individual trace generation */ 135 | keep_cores; /* Allow coredumps? */ 136 | 137 | static volatile u8 stop_soon, /* Ctrl-C pressed? */ 138 | child_timed_out, /* Child timed out? */ 139 | child_crashed; /* Child crashed? */ 140 | 141 | u8 virgin_bits[MAP_SIZE]; /* Regions yet untouched by fuzzing */ 142 | 143 | /* Classify tuple counts. Instead of mapping to individual bits, as in 144 | afl-fuzz.c, we map to more user-friendly numbers between 1 and 8. */ 145 | 146 | static const u8 count_class_human[256] = { 147 | 148 | [0] = 0, [1] = 1, [2] = 2, [3] = 3, [4 ... 7] = 4, [8 ... 15] = 5, [16 ... 31] = 6, [32 ... 127] = 7, [128 ... 255] = 8 149 | 150 | }; 151 | 152 | static const u8 count_class_binary[256] = { 153 | 154 | [0] = 0, [1] = 1, [2] = 2, [3] = 4, [4 ... 7] = 8, [8 ... 15] = 16, [16 ... 31] = 32, [32 ... 127] = 64, [128 ... 255] = 128 155 | 156 | }; 157 | 158 | static u16 count_class_lookup16[65536]; 159 | 160 | void init_count_class16(void) 161 | { 162 | 163 | u32 b1, b2; 164 | 165 | for (b1 = 0; b1 < 256; b1++) 166 | for (b2 = 0; b2 < 256; b2++) 167 | count_class_lookup16[(b1 << 8) + b2] = 168 | (count_class_binary[b1] << 8) | count_class_binary[b2]; 169 | } 170 | 171 | static u8 *DI(u64 val) 172 | { 173 | 174 | static u8 tmp[12][16]; 175 | static u8 cur; 176 | 177 | cur = (cur + 1) % 12; 178 | 179 | #define CHK_FORMAT(_divisor, _limit_mult, _fmt, _cast) \ 180 | do \ 181 | { \ 182 | if (val < (_divisor) * (_limit_mult)) \ 183 | { \ 184 | sprintf(tmp[cur], _fmt, ((_cast)val) / (_divisor)); \ 185 | return tmp[cur]; \ 186 | } \ 187 | } while (0) 188 | 189 | /* 0-9999 */ 190 | CHK_FORMAT(1, 10000, "%llu", u64); 191 | 192 | /* 10.0k - 99.9k */ 193 | CHK_FORMAT(1000, 99.95, "%0.01fk", double); 194 | 195 | /* 100k - 999k */ 196 | CHK_FORMAT(1000, 1000, "%lluk", u64); 197 | 198 | /* 1.00M - 9.99M */ 199 | CHK_FORMAT(1000 * 1000, 9.995, "%0.02fM", double); 200 | 201 | /* 10.0M - 99.9M */ 202 | CHK_FORMAT(1000 * 1000, 99.95, "%0.01fM", double); 203 | 204 | /* 100M - 999M */ 205 | CHK_FORMAT(1000 * 1000, 1000, "%lluM", u64); 206 | 207 | /* 1.00G - 9.99G */ 208 | CHK_FORMAT(1000LL * 1000 * 1000, 9.995, "%0.02fG", double); 209 | 210 | /* 10.0G - 99.9G */ 211 | CHK_FORMAT(1000LL * 1000 * 1000, 99.95, "%0.01fG", double); 212 | 213 | /* 100G - 999G */ 214 | CHK_FORMAT(1000LL * 1000 * 1000, 1000, "%lluG", u64); 215 | 216 | /* 1.00T - 9.99G */ 217 | CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 9.995, "%0.02fT", double); 218 | 219 | /* 10.0T - 99.9T */ 220 | CHK_FORMAT(1000LL * 1000 * 1000 * 1000, 99.95, "%0.01fT", double); 221 | 222 | /* 100T+ */ 223 | strcpy(tmp[cur], "infty"); 224 | return tmp[cur]; 225 | } 226 | 227 | /* Describe float. Similar to the above, except with a single 228 | static buffer. */ 229 | 230 | static u8 *DF(double val) 231 | { 232 | 233 | static u8 tmp[16]; 234 | 235 | if (val < 99.995) 236 | { 237 | sprintf(tmp, "%0.02f", val); 238 | return tmp; 239 | } 240 | 241 | if (val < 999.95) 242 | { 243 | sprintf(tmp, "%0.01f", val); 244 | return tmp; 245 | } 246 | 247 | return DI((u64)val); 248 | } 249 | 250 | /* Describe integer as memory size. */ 251 | 252 | static u8 *DMS(u64 val) 253 | { 254 | 255 | static u8 tmp[12][16]; 256 | static u8 cur; 257 | 258 | cur = (cur + 1) % 12; 259 | 260 | /* 0-9999 */ 261 | CHK_FORMAT(1, 10000, "%llu B", u64); 262 | 263 | /* 10.0k - 99.9k */ 264 | CHK_FORMAT(1024, 99.95, "%0.01f kB", double); 265 | 266 | /* 100k - 999k */ 267 | CHK_FORMAT(1024, 1000, "%llu kB", u64); 268 | 269 | /* 1.00M - 9.99M */ 270 | CHK_FORMAT(1024 * 1024, 9.995, "%0.02f MB", double); 271 | 272 | /* 10.0M - 99.9M */ 273 | CHK_FORMAT(1024 * 1024, 99.95, "%0.01f MB", double); 274 | 275 | /* 100M - 999M */ 276 | CHK_FORMAT(1024 * 1024, 1000, "%llu MB", u64); 277 | 278 | /* 1.00G - 9.99G */ 279 | CHK_FORMAT(1024LL * 1024 * 1024, 9.995, "%0.02f GB", double); 280 | 281 | /* 10.0G - 99.9G */ 282 | CHK_FORMAT(1024LL * 1024 * 1024, 99.95, "%0.01f GB", double); 283 | 284 | /* 100G - 999G */ 285 | CHK_FORMAT(1024LL * 1024 * 1024, 1000, "%llu GB", u64); 286 | 287 | /* 1.00T - 9.99G */ 288 | CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 9.995, "%0.02f TB", double); 289 | 290 | /* 10.0T - 99.9T */ 291 | CHK_FORMAT(1024LL * 1024 * 1024 * 1024, 99.95, "%0.01f TB", double); 292 | 293 | #undef CHK_FORMAT 294 | 295 | /* 100T+ */ 296 | strcpy(tmp[cur], "infty"); 297 | return tmp[cur]; 298 | } 299 | 300 | static void classify_counts(u8 *mem, const u8 *map) 301 | { 302 | 303 | u32 i = MAP_SIZE; 304 | 305 | if (edges_only) 306 | { 307 | 308 | while (i--) 309 | { 310 | if (*mem) 311 | *mem = 1; 312 | mem++; 313 | } 314 | } 315 | else 316 | { 317 | 318 | while (i--) 319 | { 320 | *mem = map[*mem]; 321 | mem++; 322 | } 323 | } 324 | } 325 | 326 | // classify trace_bits counts 327 | 328 | #ifdef __x86_64__ 329 | 330 | static inline void classify_trace_counts(u64 *mem) 331 | { 332 | 333 | u32 i = MAP_SIZE >> 3; 334 | 335 | while (i--) 336 | { 337 | 338 | /* Optimize for sparse bitmaps. */ 339 | 340 | if (unlikely(*mem)) 341 | { 342 | 343 | u16 *mem16 = (u16 *)mem; 344 | 345 | mem16[0] = count_class_lookup16[mem16[0]]; 346 | mem16[1] = count_class_lookup16[mem16[1]]; 347 | mem16[2] = count_class_lookup16[mem16[2]]; 348 | mem16[3] = count_class_lookup16[mem16[3]]; 349 | } 350 | 351 | mem++; 352 | } 353 | } 354 | 355 | #else 356 | 357 | static inline void classify_trace_counts(u32 *mem) 358 | { 359 | 360 | u32 i = MAP_SIZE >> 2; 361 | 362 | while (i--) 363 | { 364 | 365 | /* Optimize for sparse bitmaps. */ 366 | 367 | if (unlikely(*mem)) 368 | { 369 | 370 | u16 *mem16 = (u16 *)mem; 371 | 372 | mem16[0] = count_class_lookup16[mem16[0]]; 373 | mem16[1] = count_class_lookup16[mem16[1]]; 374 | } 375 | 376 | mem++; 377 | } 378 | } 379 | 380 | #endif /* ^__x86_64__ */ 381 | 382 | // Linkedlist related 383 | 384 | void swap(struct queue_entry *a, struct queue_entry *b) 385 | { 386 | u8 *tmp_fname; 387 | u32 tmp_len; 388 | u64 tmp_mtime; 389 | 390 | tmp_fname = a->fname; 391 | tmp_len = a->len; 392 | tmp_mtime = a->mtime; 393 | 394 | a->fname = b->fname; 395 | a->len = b->len; 396 | a->mtime = b->mtime; 397 | 398 | b->fname = tmp_fname; 399 | b->len = tmp_len; 400 | b->mtime = tmp_mtime; 401 | } 402 | 403 | struct queue_entry *last_node(struct queue_entry *root) 404 | { 405 | while (root && root->next) 406 | root = root->next; 407 | return root; 408 | } 409 | 410 | struct queue_entry *partition(struct queue_entry *l, struct queue_entry *h) 411 | { 412 | // set the pivot point as h value 413 | u64 x = h->mtime; 414 | 415 | struct queue_entry *i = l->prev; 416 | 417 | struct queue_entry *j = l; 418 | 419 | for (; j != h; j = j->next) 420 | { 421 | if (j->mtime <= x) 422 | { 423 | i = (i == NULL) ? l : i->next; 424 | swap(i, j); 425 | } 426 | } 427 | i = (i == NULL) ? l : i->next; 428 | swap(i, j); 429 | return i; 430 | } 431 | 432 | void _quick_sort(struct queue_entry *l, struct queue_entry *h) 433 | { 434 | if (h != NULL && l != h && l != h->next) 435 | { 436 | struct queue_entry *p = partition(l, h); 437 | _quick_sort(l, p->prev); 438 | _quick_sort(p->next, h); 439 | } 440 | } 441 | 442 | void quick_sort(struct queue_entry *head) 443 | { 444 | struct queue_entry *h = last_node(head); 445 | _quick_sort(head, h); 446 | } 447 | 448 | #define FF(_b) (0xff << ((_b) << 3)) 449 | 450 | static u32 count_bytes(u8 *mem) 451 | { 452 | 453 | u32 *ptr = (u32 *)mem; 454 | u32 i = (MAP_SIZE >> 2); 455 | u32 ret = 0; 456 | 457 | while (i--) 458 | { 459 | 460 | u32 v = *(ptr++); 461 | 462 | if (!v) 463 | continue; 464 | if (v & FF(0)) 465 | ret++; 466 | if (v & FF(1)) 467 | ret++; 468 | if (v & FF(2)) 469 | ret++; 470 | if (v & FF(3)) 471 | ret++; 472 | } 473 | 474 | return ret; 475 | } 476 | 477 | /* Count the number of non-255 bytes set in the bitmap. Used strictly for the 478 | status screen, several calls per second or so. */ 479 | 480 | static u32 count_non_255_bytes(u8 *mem) 481 | { 482 | 483 | u32 *ptr = (u32 *)mem; 484 | u32 i = (MAP_SIZE >> 2); 485 | u32 ret = 0; 486 | 487 | while (i--) 488 | { 489 | 490 | u32 v = *(ptr++); 491 | 492 | /* This is called on the virgin bitmap, so optimize for the most likely 493 | case. */ 494 | 495 | if (v == 0xffffffff) 496 | continue; 497 | if ((v & FF(0)) != FF(0)) 498 | ret++; 499 | if ((v & FF(1)) != FF(1)) 500 | ret++; 501 | if ((v & FF(2)) != FF(2)) 502 | ret++; 503 | if ((v & FF(3)) != FF(3)) 504 | ret++; 505 | } 506 | 507 | return ret; 508 | } 509 | 510 | static inline u8 has_new_bits(u8 *virgin_map) 511 | { 512 | 513 | #ifdef __x86_64__ 514 | 515 | u64 *current = (u64 *)trace_bits; 516 | u64 *virgin = (u64 *)virgin_map; 517 | 518 | u32 i = (MAP_SIZE >> 3); 519 | 520 | #else 521 | 522 | u32 *current = (u32 *)trace_bits; 523 | u32 *virgin = (u32 *)virgin_map; 524 | 525 | u32 i = (MAP_SIZE >> 2); 526 | 527 | #endif /* ^__x86_64__ */ 528 | 529 | u8 ret = 0; 530 | 531 | while (i--) 532 | { 533 | 534 | /* Optimize for (*current & *virgin) == 0 - i.e., no bits in current bitmap 535 | that have not been already cleared from the virgin map - since this will 536 | almost always be the case. */ 537 | 538 | if (unlikely(*current) && unlikely(*current & *virgin)) 539 | { 540 | 541 | if (likely(ret < 2)) 542 | { 543 | 544 | u8 *cur = (u8 *)current; 545 | u8 *vir = (u8 *)virgin; 546 | 547 | /* Looks like we have not found any new bytes yet; see if any non-zero 548 | bytes in current[] are pristine in virgin[]. */ 549 | 550 | #ifdef __x86_64__ 551 | 552 | if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) || 553 | (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff) || 554 | (cur[4] && vir[4] == 0xff) || (cur[5] && vir[5] == 0xff) || 555 | (cur[6] && vir[6] == 0xff) || (cur[7] && vir[7] == 0xff)) 556 | ret = 2; 557 | else 558 | ret = 1; 559 | 560 | #else 561 | 562 | if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) || 563 | (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff)) 564 | ret = 2; 565 | else 566 | ret = 1; 567 | 568 | #endif /* ^__x86_64__ */ 569 | } 570 | 571 | *virgin &= ~*current; 572 | } 573 | 574 | current++; 575 | virgin++; 576 | } 577 | 578 | return ret; 579 | } 580 | 581 | /* Get rid of shared memory (atexit handler). */ 582 | 583 | static void remove_shm(void) { shmctl(shm_id, IPC_RMID, NULL); } 584 | 585 | /* Configure shared memory. */ 586 | 587 | static void setup_shm(void) 588 | { 589 | 590 | u8 *shm_str; 591 | 592 | shm_id = shmget(IPC_PRIVATE, MAP_SIZE, IPC_CREAT | IPC_EXCL | 0600); 593 | 594 | if (shm_id < 0) 595 | PFATAL("shmget() failed"); 596 | 597 | atexit(remove_shm); 598 | 599 | shm_str = alloc_printf("%d", shm_id); 600 | 601 | setenv(SHM_ENV_VAR, shm_str, 1); 602 | 603 | ck_free(shm_str); 604 | 605 | trace_bits = shmat(shm_id, NULL, 0); 606 | 607 | if (!trace_bits) 608 | PFATAL("shmat() failed"); 609 | 610 | memset(virgin_bits, 255, MAP_SIZE); 611 | } 612 | 613 | /* Write results. */ 614 | 615 | static u32 write_results(void) 616 | { 617 | 618 | s32 fd; 619 | u32 i, ret = 0; 620 | 621 | u8 cco = !!getenv("AFL_CMIN_CRASHES_ONLY"), 622 | caa = !!getenv("AFL_CMIN_ALLOW_ANY"); 623 | 624 | if (!strncmp(trace_file, "/dev/", 5)) 625 | { 626 | 627 | fd = open(trace_file, O_WRONLY, 0600); 628 | if (fd < 0) 629 | PFATAL("Unable to open '%s'", trace_file); 630 | } 631 | else if (!strcmp(trace_file, "-")) 632 | { 633 | 634 | fd = dup(1); 635 | if (fd < 0) 636 | PFATAL("Unable to open stdout"); 637 | } 638 | else 639 | { 640 | 641 | unlink(trace_file); /* Ignore errors */ 642 | fd = open(trace_file, O_WRONLY | O_CREAT | O_EXCL, 0600); 643 | if (fd < 0) 644 | PFATAL("Unable to create '%s'", trace_file); 645 | } 646 | 647 | if (binary_mode) 648 | { 649 | 650 | for (i = 0; i < MAP_SIZE; i++) 651 | if (trace_bits[i]) 652 | ret++; 653 | 654 | ck_write(fd, trace_bits, MAP_SIZE, trace_file); 655 | close(fd); 656 | } 657 | else 658 | { 659 | 660 | FILE *f = fdopen(fd, "w"); 661 | 662 | if (!f) 663 | PFATAL("fdopen() failed"); 664 | 665 | for (i = 0; i < MAP_SIZE; i++) 666 | { 667 | 668 | if (!trace_bits[i]) 669 | continue; 670 | ret++; 671 | 672 | fprintf(f, "%06u:%u\n", i, trace_bits[i]); 673 | } 674 | 675 | fclose(f); 676 | } 677 | 678 | return ret; 679 | } 680 | 681 | /* Write results. */ 682 | 683 | static u32 write_slot_val_file(u8 *filename, struct slot_val *list) 684 | { 685 | 686 | s32 fd; 687 | u32 i, ret = 0; 688 | 689 | if (!strncmp(filename, "/dev/", 5)) 690 | { 691 | 692 | fd = open(filename, O_WRONLY, 0600); 693 | if (fd < 0) 694 | PFATAL("Unable to open '%s'", filename); 695 | } 696 | else if (!strcmp(filename, "-")) 697 | { 698 | 699 | fd = dup(1); 700 | if (fd < 0) 701 | PFATAL("Unable to open stdout"); 702 | } 703 | else 704 | { 705 | 706 | unlink(filename); /* Ignore errors */ 707 | fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, 0600); 708 | if (fd < 0) 709 | PFATAL("Unable to create '%s'", filename); 710 | } 711 | 712 | FILE *f = fdopen(fd, "w"); 713 | 714 | if (!f) 715 | PFATAL("fdopen() failed"); 716 | 717 | while (list != NULL) 718 | { 719 | SAYF("slot is %lld, value is %d\n", list->slot, list->val); 720 | fprintf(f, "%10lld:%d\n", list->slot, list->val); 721 | list = list->next; 722 | } 723 | 724 | fclose(f); 725 | 726 | return ret; 727 | } 728 | 729 | // update the slots for the seeds in queue; use param here to avoid modifying 730 | // the real head 731 | 732 | void update_slots(struct queue_entry *head) 733 | { 734 | while (head) 735 | { 736 | head->sec_slot = head->mtime - min_mtime; 737 | head->min_slot = head->sec_slot / 60; 738 | head->hour_slot = head->sec_slot / 3600; 739 | head = head->next; 740 | } 741 | } 742 | 743 | /* Handle timeout signal. */ 744 | 745 | static void handle_timeout(int sig) 746 | { 747 | 748 | child_timed_out = 1; 749 | if (child_pid > 0) 750 | kill(child_pid, SIGKILL); 751 | } 752 | 753 | /* Execute target application. */ 754 | 755 | static void run_target(char **argv) 756 | { 757 | 758 | static struct itimerval it; 759 | int status = 0; 760 | 761 | if (!quiet_mode) 762 | SAYF("-- Program output begins --\n" cRST); 763 | 764 | memset(trace_bits, 0, MAP_SIZE); 765 | MEM_BARRIER(); 766 | 767 | child_pid = fork(); 768 | 769 | if (child_pid < 0) 770 | PFATAL("fork() failed"); 771 | 772 | if (!child_pid) 773 | { 774 | 775 | struct rlimit r; 776 | 777 | if (quiet_mode) 778 | { 779 | 780 | if (dev_null_fd < 0 || dup2(dev_null_fd, 1) < 0 || 781 | dup2(dev_null_fd, 2) < 0) 782 | { 783 | *(u32 *)trace_bits = EXEC_FAIL_SIG; 784 | PFATAL("Descriptor initialization failed"); 785 | } 786 | 787 | close(dev_null_fd); 788 | } 789 | 790 | if (mem_limit) 791 | { 792 | 793 | r.rlim_max = r.rlim_cur = ((rlim_t)mem_limit) << 20; 794 | 795 | #ifdef RLIMIT_AS 796 | 797 | setrlimit(RLIMIT_AS, &r); /* Ignore errors */ 798 | 799 | #else 800 | 801 | setrlimit(RLIMIT_DATA, &r); /* Ignore errors */ 802 | 803 | #endif /* ^RLIMIT_AS */ 804 | } 805 | 806 | if (!keep_cores) 807 | r.rlim_max = r.rlim_cur = 0; 808 | else 809 | r.rlim_max = r.rlim_cur = RLIM_INFINITY; 810 | 811 | setrlimit(RLIMIT_CORE, &r); /* Ignore errors */ 812 | 813 | if (!getenv("LD_BIND_LAZY")) 814 | setenv("LD_BIND_NOW", "1", 0); 815 | 816 | setsid(); 817 | 818 | if (use_stdin) 819 | { 820 | FILE *temp; 821 | s32 out_fd; 822 | temp = fopen(out_file, "r"); 823 | out_fd = fileno(temp); 824 | s32 ret = dup2(out_fd, 0); 825 | if (ret == -1) 826 | { 827 | FATAL("Error dup2 for stdin: message is %s", strerror(errno)); 828 | } 829 | close(out_fd); 830 | } 831 | 832 | execv(target_path, argv); 833 | 834 | *(u32 *)trace_bits = EXEC_FAIL_SIG; 835 | exit(0); 836 | } 837 | 838 | /* Configure timeout, wait for child, cancel timeout. */ 839 | 840 | if (exec_tmout) 841 | { 842 | 843 | child_timed_out = 0; 844 | it.it_value.tv_sec = (exec_tmout / 1000); 845 | it.it_value.tv_usec = (exec_tmout % 1000) * 1000; 846 | } 847 | 848 | setitimer(ITIMER_REAL, &it, NULL); 849 | 850 | if (waitpid(child_pid, &status, 0) <= 0) 851 | FATAL("waitpid() failed"); 852 | 853 | child_pid = 0; 854 | it.it_value.tv_sec = 0; 855 | it.it_value.tv_usec = 0; 856 | setitimer(ITIMER_REAL, &it, NULL); 857 | 858 | MEM_BARRIER(); 859 | 860 | /* Clean up bitmap, analyze exit condition, etc. */ 861 | 862 | if (*(u32 *)trace_bits == EXEC_FAIL_SIG) 863 | FATAL("Unable to execute '%s'", argv[0]); 864 | 865 | classify_counts(trace_bits, 866 | binary_mode ? count_class_binary : count_class_human); 867 | 868 | if (!quiet_mode) 869 | SAYF(cRST "-- Program output ends --\n"); 870 | 871 | if (!child_timed_out && !stop_soon && WIFSIGNALED(status)) 872 | child_crashed = 1; 873 | 874 | if (!quiet_mode) 875 | { 876 | 877 | if (child_timed_out) 878 | SAYF(cLRD "\n+++ Program timed off +++\n" cRST); 879 | else if (stop_soon) 880 | SAYF(cLRD "\n+++ Program aborted by user +++\n" cRST); 881 | else if (child_crashed) 882 | SAYF(cLRD "\n+++ Program killed by signal %u +++\n" cRST, 883 | WTERMSIG(status)); 884 | } 885 | } 886 | 887 | /* Handle Ctrl-C and the like. */ 888 | 889 | static void handle_stop_sig(int sig) 890 | { 891 | 892 | stop_soon = 1; 893 | 894 | if (child_pid > 0) 895 | kill(child_pid, SIGKILL); 896 | } 897 | 898 | /* Do basic preparations - persistent fds, filenames, etc. */ 899 | 900 | static void set_up_environment(void) 901 | { 902 | 903 | setenv("ASAN_OPTIONS", "abort_on_error=1:" 904 | "detect_leaks=0:" 905 | "symbolize=0:" 906 | "allocator_may_return_null=1", 907 | 0); 908 | 909 | setenv("MSAN_OPTIONS", 910 | "exit_code=" STRINGIFY(MSAN_ERROR) ":" 911 | "symbolize=0:" 912 | "abort_on_error=1:" 913 | "allocator_may_return_null=1:" 914 | "msan_track_origins=0", 915 | 0); 916 | 917 | if (getenv("AFL_PRELOAD")) 918 | { 919 | setenv("LD_PRELOAD", getenv("AFL_PRELOAD"), 1); 920 | setenv("DYLD_INSERT_LIBRARIES", getenv("AFL_PRELOAD"), 1); 921 | } 922 | } 923 | 924 | /* Setup signal handlers, duh. */ 925 | 926 | static void setup_signal_handlers(void) 927 | { 928 | 929 | struct sigaction sa; 930 | 931 | sa.sa_handler = NULL; 932 | sa.sa_flags = SA_RESTART; 933 | sa.sa_sigaction = NULL; 934 | 935 | sigemptyset(&sa.sa_mask); 936 | 937 | /* Various ways of saying "stop". */ 938 | 939 | sa.sa_handler = handle_stop_sig; 940 | sigaction(SIGHUP, &sa, NULL); 941 | sigaction(SIGINT, &sa, NULL); 942 | sigaction(SIGTERM, &sa, NULL); 943 | 944 | /* Exec timeout notifications. */ 945 | 946 | sa.sa_handler = handle_timeout; 947 | sigaction(SIGALRM, &sa, NULL); 948 | } 949 | 950 | /* Detect @@ in args. */ 951 | 952 | void detect_file_args(char **argv) 953 | { 954 | 955 | u32 i = 0; 956 | u8 *cwd = getcwd(NULL, 0); 957 | 958 | if (!cwd) 959 | PFATAL("getcwd() failed"); 960 | 961 | /* If we don't have a file name chosen yet, use a safe default. */ 962 | 963 | if (!out_file) 964 | out_file = alloc_printf("%s/.cur_input", out_dir); 965 | 966 | while (argv[i]) 967 | { 968 | 969 | u8 *aa_loc = strstr(argv[i], "@@"); 970 | 971 | if (aa_loc) 972 | { 973 | 974 | use_stdin = 0; 975 | 976 | u8 *aa_subst, *n_arg; 977 | 978 | /* Be sure that we're always using fully-qualified paths. */ 979 | 980 | if (out_file[0] == '/') 981 | aa_subst = out_file; 982 | else 983 | aa_subst = alloc_printf("%s/%s", cwd, out_file); 984 | 985 | /* Construct a replacement argv value. */ 986 | 987 | *aa_loc = 0; 988 | n_arg = alloc_printf("%s%s%s", argv[i], aa_subst, aa_loc + 2); 989 | argv[i] = n_arg; 990 | *aa_loc = '@'; 991 | 992 | if (out_file[0] != '/') 993 | ck_free(aa_subst); 994 | } 995 | 996 | i++; 997 | } 998 | 999 | free(cwd); /* not tracked */ 1000 | } 1001 | 1002 | /* Show banner. */ 1003 | 1004 | static void show_banner(void) 1005 | { 1006 | SAYF(cCYA "showmaps utility " cBRI VERSION cRST " by ThePatrickStar\n"); 1007 | } 1008 | 1009 | /* Display usage hints. */ 1010 | 1011 | static void usage(u8 *argv0) 1012 | { 1013 | 1014 | show_banner(); 1015 | 1016 | SAYF("\n%s [ options ] -- /path/to/target_app [ ... ]\n\n" 1017 | 1018 | "Required parameters:\n\n" 1019 | 1020 | " -i dir - input directory with test cases\n" 1021 | " -o dir - output directory\n\n" 1022 | 1023 | "Execution control settings:\n\n" 1024 | 1025 | " -f file - location read by the fuzzed program (stdin)\n" 1026 | " -t msec - timeout for each run (none)\n" 1027 | " -m megs - memory limit for child process (%u MB)\n" 1028 | " -s - skip individual trace file generation (speed up) \n\n" 1029 | 1030 | "Other settings:\n\n" 1031 | 1032 | " -T sec - the timestamp to be used as min_mtime (optional)\n" 1033 | " -q - sink program's output and don't show messages\n" 1034 | " -e - show edge coverage only, ignore hit counts\n" 1035 | " -E - count for N.O. of entries only, ignore coverage\n" 1036 | " -S number - skip the number of files for start time counting\n" 1037 | " -c - allow core dumps\n\n" 1038 | 1039 | "This tool displays raw tuple data captured by AFL " 1040 | "instrumentation.\n\n" cRST, 1041 | 1042 | argv0, MEM_LIMIT); 1043 | 1044 | exit(1); 1045 | } 1046 | 1047 | /* Find binary. */ 1048 | 1049 | static void find_binary(u8 *fname) 1050 | { 1051 | 1052 | u8 *env_path = 0; 1053 | struct stat st; 1054 | 1055 | if (strchr(fname, '/') || !(env_path = getenv("PATH"))) 1056 | { 1057 | 1058 | target_path = ck_strdup(fname); 1059 | 1060 | if (stat(target_path, &st) || !S_ISREG(st.st_mode) || 1061 | !(st.st_mode & 0111) || st.st_size < 4) 1062 | FATAL("Program '%s' not found or not executable", fname); 1063 | } 1064 | else 1065 | { 1066 | 1067 | while (env_path) 1068 | { 1069 | 1070 | u8 *cur_elem, *delim = strchr(env_path, ':'); 1071 | 1072 | if (delim) 1073 | { 1074 | 1075 | cur_elem = ck_alloc(delim - env_path + 1); 1076 | memcpy(cur_elem, env_path, delim - env_path); 1077 | delim++; 1078 | } 1079 | else 1080 | cur_elem = ck_strdup(env_path); 1081 | 1082 | env_path = delim; 1083 | 1084 | if (cur_elem[0]) 1085 | target_path = alloc_printf("%s/%s", cur_elem, fname); 1086 | else 1087 | target_path = ck_strdup(fname); 1088 | 1089 | ck_free(cur_elem); 1090 | 1091 | if (!stat(target_path, &st) && S_ISREG(st.st_mode) && 1092 | (st.st_mode & 0111) && st.st_size >= 4) 1093 | break; 1094 | 1095 | ck_free(target_path); 1096 | target_path = 0; 1097 | } 1098 | 1099 | if (!target_path) 1100 | FATAL("Program '%s' not found or not executable", fname); 1101 | } 1102 | } 1103 | 1104 | /* Prepare output directories and fds. */ 1105 | 1106 | void setup_dirs_fds(void) 1107 | { 1108 | 1109 | u8 *tmp; 1110 | 1111 | ACTF("Setting up output directories..."); 1112 | 1113 | if (mkdir(out_dir, 0700)) 1114 | { 1115 | 1116 | if (errno != EEXIST) 1117 | PFATAL("Unable to create '%s'", out_dir); 1118 | 1119 | PFATAL("Directory '%s' exists!", out_dir); 1120 | } 1121 | else 1122 | { 1123 | 1124 | out_dir_fd = open(out_dir, O_RDONLY); 1125 | 1126 | #ifndef __sun 1127 | 1128 | if (out_dir_fd < 0 || flock(out_dir_fd, LOCK_EX | LOCK_NB)) 1129 | PFATAL("Unable to flock() output directory."); 1130 | 1131 | #endif /* !__sun */ 1132 | } 1133 | 1134 | /* The directory to store all the traces (same name as input) */ 1135 | if (!skip_individual && !entries_only) 1136 | { 1137 | tmp = alloc_printf("%s/traces", out_dir); 1138 | if (mkdir(tmp, 0700)) 1139 | PFATAL("Unable to create '%s'", tmp); 1140 | ck_free(tmp); 1141 | } 1142 | 1143 | /* Generally useful file descriptors. */ 1144 | 1145 | dev_null_fd = open("/dev/null", O_RDWR); 1146 | if (dev_null_fd < 0) 1147 | PFATAL("Unable to open /dev/null"); 1148 | 1149 | dev_urandom_fd = open("/dev/urandom", O_RDONLY); 1150 | if (dev_urandom_fd < 0) 1151 | PFATAL("Unable to open /dev/urandom"); 1152 | } 1153 | 1154 | /* Append new test case to the queue. */ 1155 | 1156 | static void add_to_queue(u8 *fname, u32 len, u64 mtime) 1157 | { 1158 | 1159 | struct queue_entry *q = ck_alloc(sizeof(struct queue_entry)); 1160 | 1161 | q->fname = fname; 1162 | q->len = len; 1163 | q->mtime = mtime; 1164 | q->prev = NULL; 1165 | 1166 | if (queued_paths >= skip_no) 1167 | { 1168 | 1169 | if (queued_paths == skip_no) 1170 | { 1171 | max_mtime = mtime; 1172 | if (!given_min_mtime) 1173 | min_mtime = mtime; 1174 | } 1175 | 1176 | if (mtime >= max_mtime) 1177 | max_mtime = mtime; 1178 | if (mtime <= min_mtime && !given_min_mtime) 1179 | min_mtime = mtime; 1180 | } 1181 | 1182 | if (queue_top) 1183 | { 1184 | 1185 | queue_top->next = q; 1186 | q->prev = queue_top; 1187 | queue_top = q; 1188 | } 1189 | else 1190 | queue = queue_top = q; 1191 | 1192 | queued_paths++; 1193 | } 1194 | 1195 | // Append to slot_val list 1196 | 1197 | static void add_slot_val(struct slot_val **list, struct slot_val **list_top, 1198 | u64 slot, u32 val) 1199 | { 1200 | 1201 | struct slot_val *tmp = *list; 1202 | 1203 | while (tmp != NULL) 1204 | { 1205 | if (tmp->slot == slot) 1206 | { 1207 | tmp->val = val; 1208 | return; 1209 | } 1210 | tmp = tmp->next; 1211 | } 1212 | 1213 | struct slot_val *s = ck_alloc(sizeof(struct slot_val)); 1214 | s->slot = slot; 1215 | s->val = val; 1216 | s->next = NULL; 1217 | 1218 | if (*list_top) 1219 | { 1220 | (*list_top)->next = s; 1221 | (*list_top) = s; 1222 | } 1223 | else 1224 | (*list) = (*list_top) = s; 1225 | } 1226 | 1227 | static void read_testcases(void) 1228 | { 1229 | 1230 | struct dirent **nl; 1231 | s32 nl_cnt; 1232 | u32 i; 1233 | u8 *fn; 1234 | 1235 | /* Auto-detect non-in-place resumption attempts. */ 1236 | 1237 | fn = alloc_printf("%s/queue", in_dir); 1238 | if (!access(fn, F_OK)) 1239 | in_dir = fn; 1240 | else 1241 | ck_free(fn); 1242 | 1243 | ACTF("Scanning '%s'...", in_dir); 1244 | 1245 | /* We use scandir() + alphasort() rather than readdir() because otherwise, 1246 | the ordering of test cases would vary somewhat randomly and would be 1247 | difficult to control. */ 1248 | 1249 | nl_cnt = scandir(in_dir, &nl, NULL, alphasort); 1250 | 1251 | if (nl_cnt < 0) 1252 | { 1253 | 1254 | if (errno == ENOENT || errno == ENOTDIR) 1255 | 1256 | SAYF("\n" cLRD "[-] " cRST "The input directory does not seem to be " 1257 | "valid - try again. The fuzzer needs\n" 1258 | " one or more test case to start with - ideally, a small file " 1259 | "under 1 kB\n" 1260 | " or so. The cases must be stored as regular files directly in " 1261 | "the input\n" 1262 | " directory.\n"); 1263 | 1264 | PFATAL("Unable to open '%s'", in_dir); 1265 | } 1266 | 1267 | for (i = 0; i < nl_cnt; i++) 1268 | { 1269 | 1270 | struct stat st; 1271 | 1272 | u8 *fn = alloc_printf("%s/%s", in_dir, nl[i]->d_name); 1273 | 1274 | u8 passed_det = 0; 1275 | 1276 | free(nl[i]); /* not tracked */ 1277 | 1278 | if (lstat(fn, &st) || access(fn, R_OK)) 1279 | PFATAL("Unable to access '%s'", fn); 1280 | 1281 | /* This also takes care of . and .. */ 1282 | 1283 | if (!S_ISREG(st.st_mode) || !st.st_size || strstr(fn, "/README.txt")) 1284 | { 1285 | 1286 | ck_free(fn); 1287 | continue; 1288 | } 1289 | 1290 | if (st.st_size > MAX_FILE) 1291 | FATAL("Test case '%s' is too big (%s, limit is %s)", fn, DMS(st.st_size), 1292 | DMS(MAX_FILE)); 1293 | 1294 | u64 mtime = (u64)st.st_mtim.tv_sec; 1295 | 1296 | add_to_queue(fn, st.st_size, mtime); 1297 | } 1298 | 1299 | free(nl); /* not tracked */ 1300 | 1301 | if (!queued_paths) 1302 | { 1303 | 1304 | SAYF("\n" cLRD "[-] " cRST "Looks like there are no valid test cases in " 1305 | "the input directory! The fuzzer\n" 1306 | " needs one or more test case to start with - ideally, a small " 1307 | "file under\n" 1308 | " 1 kB or so. The cases must be stored as regular files directly " 1309 | "in the\n" 1310 | " input directory.\n"); 1311 | 1312 | FATAL("No usable test cases in '%s'", in_dir); 1313 | } 1314 | } 1315 | 1316 | /* Helper function: link() if possible, copy otherwise. */ 1317 | 1318 | static void link_or_copy(u8 *old_path, u8 *new_path) 1319 | { 1320 | 1321 | s32 i = link(old_path, new_path); 1322 | s32 sfd, dfd; 1323 | u8 *tmp; 1324 | 1325 | if (!i) 1326 | return; 1327 | 1328 | sfd = open(old_path, O_RDONLY); 1329 | if (sfd < 0) 1330 | PFATAL("Unable to open '%s'", old_path); 1331 | 1332 | dfd = open(new_path, O_WRONLY | O_CREAT | O_EXCL, 0600); 1333 | if (dfd < 0) 1334 | PFATAL("Unable to create '%s'", new_path); 1335 | 1336 | tmp = ck_alloc(64 * 1024); 1337 | 1338 | while ((i = read(sfd, tmp, 64 * 1024)) > 0) 1339 | ck_write(dfd, tmp, i, new_path); 1340 | 1341 | if (i < 0) 1342 | PFATAL("read() failed"); 1343 | 1344 | ck_free(tmp); 1345 | close(sfd); 1346 | close(dfd); 1347 | } 1348 | 1349 | /* Main entry point */ 1350 | 1351 | int main(int argc, char **argv) 1352 | { 1353 | 1354 | s32 opt; 1355 | u8 mem_limit_given = 0, timeout_given = 0, skip_no_given = 0; 1356 | u32 tcnt; 1357 | char **use_argv; 1358 | 1359 | while ((opt = getopt(argc, argv, "+i:o:f:m:t:S:T:Eeqbcs")) > 0) 1360 | 1361 | switch (opt) 1362 | { 1363 | 1364 | case 'i': /* input dir */ 1365 | 1366 | if (in_dir) 1367 | FATAL("Multiple -i options not supported"); 1368 | in_dir = optarg; 1369 | break; 1370 | 1371 | case 'o': 1372 | 1373 | if (out_dir) 1374 | FATAL("Multiple -o options not supported"); 1375 | out_dir = optarg; 1376 | break; 1377 | 1378 | case 'f': /* target file */ 1379 | 1380 | if (out_file) 1381 | FATAL("Multiple -f options not supported"); 1382 | out_file = optarg; 1383 | break; 1384 | 1385 | case 'm': 1386 | { 1387 | 1388 | u8 suffix = 'M'; 1389 | 1390 | if (mem_limit_given) 1391 | FATAL("Multiple -m options not supported"); 1392 | mem_limit_given = 1; 1393 | 1394 | if (!strcmp(optarg, "none")) 1395 | { 1396 | mem_limit = 0; 1397 | break; 1398 | } 1399 | 1400 | if (sscanf(optarg, "%llu%c", &mem_limit, &suffix) < 1 || optarg[0] == '-') 1401 | FATAL("Bad syntax used for -m"); 1402 | 1403 | switch (suffix) 1404 | { 1405 | case 'T': 1406 | mem_limit *= 1024 * 1024; 1407 | break; 1408 | case 'G': 1409 | mem_limit *= 1024; 1410 | break; 1411 | case 'k': 1412 | mem_limit /= 1024; 1413 | break; 1414 | case 'M': 1415 | break; 1416 | 1417 | default: 1418 | FATAL("Unsupported suffix or bad syntax for -m"); 1419 | } 1420 | 1421 | if (mem_limit < 5) 1422 | FATAL("Dangerously low value of -m"); 1423 | 1424 | if (sizeof(rlim_t) == 4 && mem_limit > 2000) 1425 | FATAL("Value of -m out of range on 32-bit systems"); 1426 | } 1427 | 1428 | break; 1429 | 1430 | case 't': 1431 | 1432 | if (timeout_given) 1433 | FATAL("Multiple -t options not supported"); 1434 | timeout_given = 1; 1435 | 1436 | if (strcmp(optarg, "none")) 1437 | { 1438 | exec_tmout = atoi(optarg); 1439 | 1440 | if (exec_tmout < 20 || optarg[0] == '-') 1441 | FATAL("Dangerously low value of -t"); 1442 | } 1443 | 1444 | break; 1445 | 1446 | case 'S': 1447 | 1448 | if (skip_no_given) 1449 | FATAL("Multiple -S options not supported"); 1450 | skip_no_given = 1; 1451 | 1452 | skip_no = atoi(optarg); 1453 | 1454 | break; 1455 | 1456 | case 'e': 1457 | 1458 | if (edges_only) 1459 | FATAL("Multiple -e options not supported"); 1460 | edges_only = 1; 1461 | break; 1462 | 1463 | case 'q': 1464 | 1465 | if (quiet_mode) 1466 | FATAL("Multiple -q options not supported"); 1467 | quiet_mode = 1; 1468 | break; 1469 | 1470 | case 'b': 1471 | 1472 | /* Secret undocumented mode. Writes output in raw binary format 1473 | similar to that dumped by afl-fuzz in has_new_cov = 0; 1562 | // SAYF("current fname is %s, queue_cur mtime is: %lld, sec_slot is: %lld, min_slot is: %lld, hour_slot is: %lld\n",\ 1563 | // queue_cur->fname, queue_cur->mtime, queue_cur->sec_slot, queue_cur->min_slot, queue_cur->hour_slot); 1564 | u64 slot = queue_cur->sec_slot; 1565 | if (current_no >= skip_no && (int)slot >= 0) 1566 | { 1567 | SAYF("current fname is %s, queue_cur mtime is: %lld, sec_slot is: %lld\n", 1568 | queue_cur->fname, queue_cur->mtime, queue_cur->sec_slot); 1569 | } 1570 | else 1571 | { 1572 | SAYF("skipping but still executing %s, queue_cur mtime is: %lld, " 1573 | "sec_slot is: %lld\n", 1574 | queue_cur->fname, queue_cur->mtime, queue_cur->sec_slot); 1575 | } 1576 | 1577 | if (!entries_only) 1578 | { 1579 | // create hard link of current item to the out_file 1580 | link_or_copy(queue_cur->fname, out_file); 1581 | 1582 | // run the program against the current item 1583 | run_target(use_argv); 1584 | 1585 | // delete the out_file 1586 | unlink(out_file); 1587 | 1588 | if (!skip_individual && current_no >= skip_no) 1589 | { 1590 | 1591 | // setup the path for the new trace file 1592 | pure_fname = strrchr(queue_cur->fname, '/'); 1593 | trace_file = alloc_printf("%s/traces/%s.txt", out_dir, pure_fname); 1594 | 1595 | // write the trace 1596 | write_results(); 1597 | 1598 | ck_free(trace_file); 1599 | } 1600 | 1601 | // classify the trace as log2 based 1602 | #ifdef __x86_64__ 1603 | classify_trace_counts((u64 *)trace_bits); 1604 | #else 1605 | classify_trace_counts((u32 *)trace_bits); 1606 | #endif /* ^__x86_64__ */ 1607 | 1608 | // update virgin bits 1609 | ret_new_bits = has_new_bits(virgin_bits); 1610 | 1611 | if (ret_new_bits) 1612 | { 1613 | queue_cur->has_new_cov = 1; 1614 | cov_entries_no += 1; 1615 | } 1616 | 1617 | u32 bitmap_size = count_non_255_bytes(virgin_bits); 1618 | // SAYF("bitmap_size is %d\n", bitmap_size); 1619 | if (current_no >= skip_no && (int)slot >= 0) { 1620 | add_slot_val(&slot_edge, &slot_edge_top, slot, bitmap_size); 1621 | add_slot_val(&mtime_edge, &mtime_edge_top, queue_cur->mtime, bitmap_size); 1622 | } 1623 | 1624 | } 1625 | 1626 | entries_no++; 1627 | if (current_no >= skip_no && (int)slot >= 0) 1628 | { 1629 | add_slot_val(&slot_entry, &slot_entry_top, slot, entries_no); 1630 | add_slot_val(&mtime_entry, &mtime_entry_top, queue_cur->mtime, entries_no); 1631 | if (queue_cur->has_new_cov) { 1632 | add_slot_val(&cov_slot_entry, &cov_slot_entry_top, slot, 1633 | cov_entries_no); 1634 | add_slot_val(&mtime_cov_entry, &mtime_cov_entry_top, queue_cur->mtime, cov_entries_no); 1635 | } 1636 | } 1637 | 1638 | // move to the next item in queue 1639 | queue_cur = queue_cur->next; 1640 | current_no++; 1641 | } 1642 | 1643 | if (!entries_only) 1644 | { 1645 | 1646 | u8 *slot_edge_file = alloc_printf("%s/slot_edge.txt", out_dir); 1647 | 1648 | write_slot_val_file(slot_edge_file, slot_edge); 1649 | 1650 | ck_free(slot_edge_file); 1651 | 1652 | u8 *mtime_edge_file = alloc_printf("%s/mtime_edge.txt", out_dir); 1653 | 1654 | write_slot_val_file(mtime_edge_file, mtime_edge); 1655 | 1656 | ck_free(mtime_edge_file); 1657 | 1658 | u8 *cov_slot_entry_file = alloc_printf("%s/cov_slot_entry.txt", out_dir); 1659 | 1660 | write_slot_val_file(cov_slot_entry_file, cov_slot_entry); 1661 | 1662 | ck_free(cov_slot_entry_file); 1663 | 1664 | u8 *mtime_cov_entry_file = alloc_printf("%s/mtime_cov_entry.txt", out_dir); 1665 | 1666 | write_slot_val_file(mtime_cov_entry_file, mtime_cov_entry); 1667 | 1668 | ck_free(mtime_cov_entry_file); 1669 | } 1670 | 1671 | u8 *slot_entry_file = alloc_printf("%s/slot_entry.txt", out_dir); 1672 | 1673 | write_slot_val_file(slot_entry_file, slot_entry); 1674 | 1675 | ck_free(slot_entry_file); 1676 | 1677 | u8 *mtime_entry_file = alloc_printf("%s/mtime_entry.txt", out_dir); 1678 | 1679 | write_slot_val_file(mtime_entry_file, mtime_entry); 1680 | 1681 | ck_free(mtime_entry_file); 1682 | } 1683 | -------------------------------------------------------------------------------- /showmaps/test.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | make 4 | 5 | rm -rf test/out/ 6 | rm -rf test/out-simple/ 7 | rm -rf test/out-entry/ 8 | 9 | ./showmaps -i test/queue -o test/out -q -- ./test/mjs-afl @@ 10 | 11 | ./showmaps -i test/queue -o test/out-simple -q -s -- ./test/mjs-afl @@ 12 | 13 | ./showmaps -i test/queue -o test/out-entry -E -------------------------------------------------------------------------------- /showmaps/test/exiv2-afl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ThePatrickStar/fuzzer-data-collector/7ba2d9a79d35243cc3504aa8e4a27e8a205e26ec/showmaps/test/exiv2-afl -------------------------------------------------------------------------------- /showmaps/test/hang-exiv2/hang20may: -------------------------------------------------------------------------------- 1 | MM* -------------------------------------------------------------------------------- /showmaps/test/mjs-afl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ThePatrickStar/fuzzer-data-collector/7ba2d9a79d35243cc3504aa8e4a27e8a205e26ec/showmaps/test/mjs-afl -------------------------------------------------------------------------------- /showmaps/test/queue/id:000000,orig:err1.js: -------------------------------------------------------------------------------- 1 | 2 | function err1f2() { 3 | return bar; 4 | } 5 | 6 | function err1f1() { 7 | return err1f2(); 8 | } 9 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000001,orig:err2.js: -------------------------------------------------------------------------------- 1 | 2 | function err2f1() { 3 | return err2f2(); 4 | } 5 | 6 | function err2f2() { 7 | return bar; 8 | } 9 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000002,orig:module1.js: -------------------------------------------------------------------------------- 1 | let foo = 1; 2 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000003,orig:module2.js: -------------------------------------------------------------------------------- 1 | let o = { 2 | a: 1, 3 | foo: ffi('int foo(int)'), 4 | }; 5 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000004,orig:test_1.js: -------------------------------------------------------------------------------- 1 | let o = {a: 1, 'b': 2, c: {d: 3}, d: [1, 2, 3, 'xx']}; 2 | let a = 'foo', b = 'bar'; 3 | let s1 = 'a' + "b"; 4 | let s2 = 'abcdef' + "123456"; 5 | 1 - 2 + 3 + o['a'] + o.c.d + o.b === 8 && a === "foo" && a !== b && 6 | s1 === 'ab' && s2 === 'abcdef123456' && o.d[0] === 1 && o.d[3] === 'xx' && 7 | o.d[4] === undefined; 8 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000005,orig:test_10.js: -------------------------------------------------------------------------------- 1 | (1 ? 2 : 3) === 2 && (0 ? 2 : 3) === 3 && (0 ? 1 : 2 ? 3 : 4) === 3 && 2 | (0 ? 1 : false ? 3 : 4) === 4 && (0 ? 1 ? 2 : 3 : 4) === 4 && 3 | (1 ? 0 ? 2 : 3 : 4) === 3 && (1 ? 1 ? 2 : 3 : 4) === 2; 4 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000006,orig:test_11.js: -------------------------------------------------------------------------------- 1 | let s = '{"a": 1, "b": "foo", "c": true, "d": [null], "e": "1\\n2"}'; 2 | let o = JSON.parse(s); 3 | let z = JSON.parse('""'); // Zlength string 4 | let s2 = JSON.stringify(o); 5 | s2 === '{"e":"1\\n2","d":[null],"c":true,"b":"foo","a":1}' && o.c && o.a === 1 && o.e === '1\n2' && z === ''; 6 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000007,orig:test_12.js: -------------------------------------------------------------------------------- 1 | typeof 1 === 'number' && typeof('foo') === 'string' && typeof '' === 'string' && 2 | typeof(1 === 2) === 'boolean' && typeof(true) === 'boolean' && 3 | typeof false === 'boolean' && typeof[] === 'array' && 4 | typeof({}) === 'object' && typeof print === 'foreign_ptr' && 5 | typeof(function() {}) === 'function' && typeof null === 'null' && 6 | typeof undefined === 'undefined'; 7 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000008,orig:test_13.js: -------------------------------------------------------------------------------- 1 | let s = '', sum = 0, o = {a: 1, b: 2, c: 3}; 2 | for (let k in o) { 3 | s = s + k; 4 | sum += o[k]; 5 | } 6 | 7 | // esent in object, false otherwise 8 | let f = function(obj, key) { 9 | for (let k in obj) if (k === key) return true; 10 | return false; 11 | }; 12 | 13 | s === 'cba' && sum === 6 && f(o, 'x') === false && f(o, 'b') === true; 14 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000009,orig:test_2.js: -------------------------------------------------------------------------------- 1 | let x = 1, y = 2, z = 3; 2 | 3 | let f = function(x) { 4 | let f2 = function(y) { return x - z + y; 5 | }; 6 | return f2(7); 7 | }; 8 | 9 | let o = { 10 | x: function(y) { 11 | return y * y; 12 | }, 13 | y: function() { 14 | return this.z; 15 | }, 16 | z: 123 17 | }; 18 | 19 | f(5) === 9 && o.x(12) === 144; 20 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000010,orig:test_3.js: -------------------------------------------------------------------------------- 1 | let a = function() { 2 | return function() { 3 | return true; 4 | }; 5 | }; 6 | 7 | let b = function() { 8 | for (let i = 3; i < 100; i++) return i; 9 | }; 10 | 11 | let c = function() { 12 | let i, res = 0; 13 | for (i = 0; i < 10; i++) { 14 | if (i < 2) continue; res += i; 15 | break; 16 | } 17 | return res; 18 | }; 19 | 20 | let d = function() { 21 | let i = -5; 22 | for (let i = 3; i < 100; i++) 1; 23 | return i; 24 | }; 25 | 26 | 27 | a()() && b() === 3 && d() === -5 && c() === 2; 28 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000011,orig:test_4.js: -------------------------------------------------------------------------------- 1 | let a = function() { 2 | let y = 17; 3 | let boo = function() { 4 | return y; 5 | }; 6 | return boo(); 7 | }; 8 | 9 | a() === 17; 10 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000012,orig:test_5.js: -------------------------------------------------------------------------------- 1 | // Aruthmetics 2 | 0x64 === 100 && (0 - 14) >>> 2 === 1073741820 && 100 << 3 === 800; 3 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000013,orig:test_6.js: -------------------------------------------------------------------------------- 1 | let x = 1; 2 | 3 | let a = function() { 4 | let x = 2; 5 | { 6 | let y = 3; return y; 7 | } 8 | }; 9 | 10 | let b = function() { 11 | return x; 12 | }; 13 | 14 | a() === 3 && b() === 1 && x === 1; -------------------------------------------------------------------------------- /showmaps/test/queue/id:000014,orig:test_7.js: -------------------------------------------------------------------------------- 1 | let x = 1; 2 | let y = x++; 3 | if (x > 0) x++; 4 | x === 3 && y === 1 && !'' === true && !!'' === false; 5 | -------------------------------------------------------------------------------- /showmaps/test/queue/id:000015,orig:test_8.js: -------------------------------------------------------------------------------- 1 | let i, a = 0, b = 0, c = 0, d = 0, e = 0; 2 | 3 | for (i = 0; i < 10; i++) { 4 | a += i; 5 | } 6 | 7 | while (b++ < 5) c += b; 8 | 9 | while (d++ < 10) { 10 | if (d < 7) continue; 11 | e += d; 12 | break; 13 | } 14 | 15 | a === 45 && c === 15 && e === 7; -------------------------------------------------------------------------------- /showmaps/test/queue/id:000016,orig:test_9.js: -------------------------------------------------------------------------------- 1 | let o = {}; 2 | load('tests/module1.js'); 3 | let a = o.foo === undefined; 4 | load('tests/module1.js', o); 5 | let b = o.foo === 1; 6 | a && b && foo + 2 + o.foo === 4; 7 | -------------------------------------------------------------------------------- /showmaps/types.h: -------------------------------------------------------------------------------- 1 | /* 2 | american fuzzy lop - type definitions and minor macros 3 | ------------------------------------------------------ 4 | 5 | Written and maintained by Michal Zalewski 6 | 7 | Copyright 2013, 2014, 2015 Google Inc. All rights reserved. 8 | 9 | Licensed under the Apache License, Version 2.0 (the "License"); 10 | you may not use this file except in compliance with the License. 11 | You may obtain a copy of the License at: 12 | 13 | http://www.apache.org/licenses/LICENSE-2.0 14 | 15 | */ 16 | 17 | #ifndef _HAVE_TYPES_H 18 | #define _HAVE_TYPES_H 19 | 20 | #include 21 | #include 22 | 23 | typedef uint8_t u8; 24 | typedef uint16_t u16; 25 | typedef uint32_t u32; 26 | 27 | /* 28 | 29 | Ugh. There is an unintended compiler / glibc #include glitch caused by 30 | combining the u64 type an %llu in format strings, necessitating a workaround. 31 | 32 | In essence, the compiler is always looking for 'unsigned long long' for %llu. 33 | On 32-bit systems, the u64 type (aliased to uint64_t) is expanded to 34 | 'unsigned long long' in , so everything checks out. 35 | 36 | But on 64-bit systems, it is #ifdef'ed in the same file as 'unsigned long'. 37 | Now, it only happens in circumstances where the type happens to have the 38 | expected bit width, *but* the compiler does not know that... and complains 39 | about 'unsigned long' being unsafe to pass to %llu. 40 | 41 | */ 42 | 43 | #ifdef __x86_64__ 44 | typedef unsigned long long u64; 45 | #else 46 | typedef uint64_t u64; 47 | #endif /* ^__x86_64__ */ 48 | 49 | typedef int8_t s8; 50 | typedef int16_t s16; 51 | typedef int32_t s32; 52 | typedef int64_t s64; 53 | 54 | #ifndef MIN 55 | # define MIN(_a,_b) ((_a) > (_b) ? (_b) : (_a)) 56 | # define MAX(_a,_b) ((_a) > (_b) ? (_a) : (_b)) 57 | #endif /* !MIN */ 58 | 59 | #define SWAP16(_x) ({ \ 60 | u16 _ret = (_x); \ 61 | (u16)((_ret << 8) | (_ret >> 8)); \ 62 | }) 63 | 64 | #define SWAP32(_x) ({ \ 65 | u32 _ret = (_x); \ 66 | (u32)((_ret << 24) | (_ret >> 24) | \ 67 | ((_ret << 8) & 0x00FF0000) | \ 68 | ((_ret >> 8) & 0x0000FF00)); \ 69 | }) 70 | 71 | #ifdef AFL_LLVM_PASS 72 | # define AFL_R(x) (random() % (x)) 73 | #else 74 | # define R(x) (random() % (x)) 75 | #endif /* ^AFL_LLVM_PASS */ 76 | 77 | #define STRINGIFY_INTERNAL(x) #x 78 | #define STRINGIFY(x) STRINGIFY_INTERNAL(x) 79 | 80 | #define MEM_BARRIER() \ 81 | asm volatile("" ::: "memory") 82 | 83 | #define likely(_x) __builtin_expect(!!(_x), 1) 84 | #define unlikely(_x) __builtin_expect(!!(_x), 0) 85 | 86 | #endif /* ! _HAVE_TYPES_H */ 87 | -------------------------------------------------------------------------------- /stat_plot/.gitignore: -------------------------------------------------------------------------------- 1 | test/out/ 2 | test/data/ 3 | test/out_boxplot/ 4 | test/out_scatter/ 5 | test/out_histogram/ 6 | exp/ -------------------------------------------------------------------------------- /stat_plot/conf.py: -------------------------------------------------------------------------------- 1 | import toml 2 | 3 | 4 | def check_bucket(bucket): 5 | valid_buckets = ["sec", "s", "min", "m", "hour", "h"] 6 | bucket = bucket.lower() 7 | 8 | if bucket not in valid_buckets: 9 | print("[!] invalid bucket value: {}".format(bucket)) 10 | return False, bucket 11 | else: 12 | bucket = bucket[0] 13 | return True, bucket 14 | 15 | 16 | def parse_config(config_path): 17 | config_valid = True 18 | 19 | with open(config_path) as config_file: 20 | conf_dict = toml.load(config_file) 21 | 22 | fuzzers_dict = conf_dict['fuzzers'] 23 | 24 | misc_dict = conf_dict['misc'] 25 | 26 | # sanitize the config 27 | for fuzzer_name in fuzzers_dict: 28 | fuzzer = fuzzers_dict[fuzzer_name] 29 | fuzzer['name'] = fuzzer_name 30 | if 'line_style' not in fuzzer: 31 | fuzzer['line_style'] = 'solid' 32 | # only for boxplot stat_type 33 | if 'box_color' not in fuzzer: 34 | fuzzer['box_color'] = 'white' 35 | if len(fuzzer["data_files"]) == 0: 36 | print("[!] {} has no data file!".format(fuzzer_name)) 37 | config_valid = False 38 | 39 | if 'stat_type' not in misc_dict: 40 | print("[!] [misc] table misses 'stat_type'!") 41 | config_valid = False 42 | 43 | valid_stat_types = ['overall', 'stest', 'boxplot', 'scatterplot', 'histogram'] 44 | if misc_dict['stat_type'] not in valid_stat_types: 45 | print("[!] invalid stat_type: {}".format(misc_dict['stat_type'])) 46 | config_valid = False 47 | 48 | if misc_dict['stat_type'] == 'overall': 49 | 50 | if "bucket" not in misc_dict: 51 | misc_dict["bucket"] = ["s"] 52 | else: 53 | bucket_valid, bucket = check_bucket(misc_dict["bucket"]) 54 | if not bucket_valid: 55 | config_valid = False 56 | misc_dict["bucket"] = bucket 57 | 58 | if "confidence_lvl" not in misc_dict: 59 | misc_dict["confidence_lvl"] = 0.95 60 | 61 | required_keys = ["out_dir", "ylabel", "file_postfix", "project", "max_time"] 62 | 63 | for r_key in required_keys: 64 | if r_key not in misc_dict: 65 | print("[!] {} (required) is missing is [misc]!".format(r_key)) 66 | config_valid = False 67 | 68 | if 'x_log_scale' not in misc_dict: 69 | misc_dict['x_log_scale'] = False 70 | if 'y_log_scale' not in misc_dict: 71 | misc_dict['y_log_scale'] = False 72 | 73 | elif misc_dict['stat_type'] == 'stest': 74 | 75 | required_keys = ["out_dir", "project", "file_postfix"] 76 | 77 | for r_key in required_keys: 78 | if r_key not in misc_dict: 79 | print("[!] {} (required) is missing is [misc]!".format(r_key)) 80 | config_valid = False 81 | 82 | elif misc_dict['stat_type'] == 'boxplot': 83 | 84 | required_keys = ["out_dir", "project", "file_postfix", "notch", 'plot_title'] 85 | 86 | for r_key in required_keys: 87 | if r_key not in misc_dict: 88 | print("[!] {} (required) is missing is [misc]!".format(r_key)) 89 | config_valid = False 90 | 91 | if 'ylim' in misc_dict: 92 | # TODO: add type check 93 | if len(misc_dict['ylim']) != 2: 94 | print('[!] invalid ylim: {} in [misc]!'.format(misc_dict['ylim'])) 95 | 96 | elif misc_dict['stat_type'] == 'scatterplot': 97 | 98 | required_keys = ["out_dir", "project", "file_postfix", 'plot_title', 'xlabel', 'ylabel', 'large_font'] 99 | 100 | for r_key in required_keys: 101 | if r_key not in misc_dict: 102 | print("[!] {} (required) is missing is [misc]!".format(r_key)) 103 | config_valid = False 104 | 105 | elif misc_dict['stat_type'] == 'histogram': 106 | 107 | required_keys = ["out_dir", "project", "file_postfix", 'plot_title', 'xlabel', 'ylabel', 108 | 'large_font', 'n_bins'] 109 | 110 | for r_key in required_keys: 111 | if r_key not in misc_dict: 112 | print("[!] {} (required) is missing is [misc]!".format(r_key)) 113 | config_valid = False 114 | 115 | return config_valid, fuzzers_dict, misc_dict 116 | -------------------------------------------------------------------------------- /stat_plot/confgen.py: -------------------------------------------------------------------------------- 1 | import toml 2 | import argparse 3 | import os 4 | import re 5 | from pathlib import Path 6 | import fnmatch 7 | 8 | 9 | def main(): 10 | parser = argparse.ArgumentParser() 11 | parser.add_argument("--config", "-c", required=True, type=str) 12 | parser.add_argument("--verbose", "-v", required=False, action="store_true") 13 | parser.add_argument("--output", "-o", required=True, type=str) 14 | parser.add_argument("--inputs", "-i", action='append', required=True) 15 | args = parser.parse_args() 16 | 17 | config_path = os.path.abspath(args.config) 18 | verbose = args.verbose 19 | 20 | #print('inputs is %s' % (args.inputs)) 21 | #print('output is %s' % (args.output)) 22 | #exit(1) 23 | print("[*] config file is {}".format(config_path)) 24 | 25 | conf_dict = {} 26 | with open(config_path) as config_file: 27 | conf_dict = toml.load(config_file) 28 | # TODO check config validity 29 | 30 | if not os.path.exists(args.output): 31 | os.makedirs(args.output) 32 | 33 | # find all the data files 34 | all_data_files = [] 35 | for fname in conf_dict['objective_filenames']: 36 | for base_dir in args.inputs: 37 | for fpath in Path(base_dir).rglob(fname): 38 | if verbose: 39 | print(os.path.abspath(str(fpath))) 40 | all_data_files.append(fpath) 41 | 42 | # create one config for every target * obj 43 | for t, target_name in enumerate(conf_dict['target_names']): 44 | for o, objective in enumerate(conf_dict['objectives']): 45 | 46 | misc_dict = { 47 | "bucket": conf_dict["bucket"], 48 | "confidence_lvl": conf_dict["confidence_lvl"], 49 | "out_dir": args.output + "/" + "plot-"+target_name+"-"+objective+"-out/", 50 | "ylabel": conf_dict["objective_y_labels"][o], 51 | "file_postfix": conf_dict["file_postfixes"][o], 52 | "project": conf_dict["target_names"][t], 53 | "max_time": conf_dict["max_time"], 54 | "stat_type": conf_dict["stat_type"], 55 | "large_font": conf_dict["large_font"], 56 | "no_legend": conf_dict["no_legend"], 57 | "y_start_0": conf_dict["y_start_0"], 58 | "x_log_scale": conf_dict["x_log_scale"], 59 | "y_log_scale": conf_dict["y_log_scale"] 60 | } 61 | 62 | fuzzer_dict = {} 63 | for f, fuzzer_name in enumerate(conf_dict["fuzzer_names"]): 64 | data_files = [os.path.abspath(str(data_file)) for data_file in all_data_files 65 | if re.search(conf_dict['fuzzer_sigs'][f], str(data_file)) and 66 | re.search(conf_dict['target_sigs'][t], str(data_file)) and 67 | fnmatch.fnmatch(data_file.name, conf_dict['objective_filenames'][o])] 68 | if len(data_files) > 0: 69 | fuzzer_dict[fuzzer_name] = { 70 | "data_files": sorted(data_files), 71 | "line_style": conf_dict['fuzzer_line_styles'][f], 72 | "line_color": conf_dict['fuzzer_line_colors'][f] 73 | } 74 | 75 | out_dict = { 76 | "fuzzers": fuzzer_dict, 77 | "misc": misc_dict 78 | } 79 | 80 | plot_config_name = "plot-"+target_name+"-"+objective+".toml" 81 | plot_config_path = args.output + "/" + plot_config_name 82 | 83 | with open(plot_config_path, 'w') as handle: 84 | toml.dump(out_dict, handle) 85 | 86 | 87 | if __name__ == "__main__": 88 | main() 89 | -------------------------------------------------------------------------------- /stat_plot/draw_boxplot.py: -------------------------------------------------------------------------------- 1 | ################### 2 | # draw boxplots based on plots generated by main.py 3 | ################### 4 | 5 | import toml 6 | import argparse 7 | import os 8 | import re 9 | from pathlib import Path 10 | import fnmatch 11 | import pathlib 12 | import seaborn as sns 13 | import matplotlib.pyplot as plt 14 | import pandas as pd 15 | import numpy as np 16 | from matplotlib.figure import figaspect 17 | 18 | 19 | def main(): 20 | parser = argparse.ArgumentParser() 21 | parser.add_argument("--config", "-c", required=True, type=str) 22 | parser.add_argument("--verbose", "-v", required=False, action="store_true") 23 | parser.add_argument("--inputs", "-i", action='append', required=True) 24 | args = parser.parse_args() 25 | 26 | config_path = os.path.abspath(args.config) 27 | verbose = args.verbose 28 | 29 | print("[*] config file is {}".format(config_path)) 30 | 31 | conf_dict = {} 32 | with open(config_path) as config_file: 33 | conf_dict = toml.load(config_file) 34 | # TODO check config validity 35 | 36 | # draw a set of box plots for every folder 37 | for plot_dir in args.inputs: 38 | if not os.path.isdir(plot_dir): 39 | print(f"{plot_dir} is not a dir, skip") 40 | continue 41 | 42 | filenames = os.listdir(plot_dir) 43 | config_files = [] 44 | 45 | for filename in filenames: 46 | for config_sig in conf_dict['config_sigs']: 47 | if re.search(config_sig, filename): 48 | config_files.append(os.path.abspath(plot_dir + '/' + filename)) 49 | 50 | # draw a set of boxplots for every target 51 | for config_file in config_files: 52 | if args.verbose: 53 | print(f"checking config file: {config_file}") 54 | plot_conf_dict = toml.load(open(config_file)) 55 | # assume the out dir and the toml file are both in the root of args.in 56 | plot_out_path = os.path.abspath(plot_dir + '/' + pathlib.PurePath(plot_conf_dict['misc']['out_dir']).name) 57 | plot_aligned_dir = plot_out_path + '/aligned' 58 | plot_target = plot_conf_dict['misc']['project'] 59 | plot_postfix = plot_conf_dict['misc']['file_postfix'] 60 | 61 | fuzzers = os.listdir(plot_aligned_dir) 62 | 63 | # draw an individual boxplot for every data point 64 | for data_point in conf_dict['data_points']: 65 | out_dir_name = f'section-{data_point}-{plot_target}-{plot_postfix}' 66 | out_dir_path = os.path.abspath(plot_dir + '/' + out_dir_name) 67 | if not os.path.exists(out_dir_path): 68 | os.makedirs(out_dir_path) 69 | 70 | # key: fuzzer val: [val] 71 | fuzzer_data = {} 72 | min_item_no = -1 73 | for fuzzer in fuzzers: 74 | fuzzer_data[fuzzer] = [] 75 | fuzzer_data_dir = plot_aligned_dir + '/' + fuzzer 76 | fuzzer_data_files = os.listdir(fuzzer_data_dir) 77 | if min_item_no == -1 or len(fuzzer_data_files) < min_item_no: 78 | min_item_no = len(fuzzer_data_files) 79 | for fuzzer_data_file in fuzzer_data_files: 80 | with open(fuzzer_data_dir + '/' + fuzzer_data_file) as data_file: 81 | lines = data_file.readlines() 82 | data_point = min(data_point, len(lines)) 83 | fuzzer_data[fuzzer].append(int(lines[data_point-1])) 84 | 85 | # trim the fuzzer_data so that all of them aligns for pandas DataFrame 86 | # TODO this may not be a desired default behavior, make this configurable 87 | for fuzzer in fuzzer_data: 88 | fuzzer_data[fuzzer] = fuzzer_data[fuzzer][0:min_item_no] 89 | 90 | # data = np.array([fuzzer_data[fuzzer] for fuzzer in fuzzer_data]).T.tolist() 91 | try: 92 | data = pd.DataFrame(data=fuzzer_data) 93 | # TODO move duplicate code into functions; make more things configurable 94 | w, h = figaspect(0.618) # golden ratio 95 | fig, ax = plt.subplots(figsize=(w, h)) 96 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label]): 97 | item.set_fontsize(16) 98 | for item in (ax.get_xticklabels()): 99 | item.set_fontsize(16) 100 | # item.set_rotation(45) 101 | for item in (ax.get_yticklabels()): 102 | item.set_fontsize(16) 103 | # for tick in ax.get_xticklabels(): 104 | # tick.set_rotation(45) 105 | # palette: "Greys", "ch:.25", 106 | if conf_dict['y_start_0']: 107 | ax.set_ylim(ymin=0) 108 | box = sns.boxplot(ax=ax, data=data, orient="v", width=conf_dict['width'], palette=conf_dict['color_palette'], fliersize=0, 109 | dodge=False) 110 | swarm = sns.swarmplot(ax=ax, orient="v", data=data, color=".25", size=8) 111 | 112 | box.set_ylabel('# edges') 113 | 114 | out_file_name_base = f'boxplot-{data_point}-{plot_target}-{plot_postfix}' 115 | 116 | plt.savefig(out_dir_path+'/'+out_file_name_base+'.png') 117 | plt.savefig(out_dir_path+'/'+out_file_name_base+'.pdf') 118 | plt.clf() 119 | plt.close(fig) 120 | 121 | w, h = figaspect(0.618) # golden ratio 122 | fig, ax = plt.subplots(figsize=(w, h)) 123 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label]): 124 | item.set_fontsize(16) 125 | for item in (ax.get_yticklabels()): 126 | item.set_fontsize(16) 127 | # for tick in ax.get_xticklabels(): 128 | # tick.set_rotation(45) 129 | if conf_dict['y_start_0']: 130 | ax.set_ylim(ymin=0) 131 | violin = sns.violinplot(ax=ax, data=data, orient="v", width=conf_dict['width'], palette=conf_dict['color_palette'], dodge=False, 132 | scale='width') 133 | swarm = sns.swarmplot(ax=ax, orient="v", data=data, color=".25", size=8) 134 | 135 | violin.set_ylabel('# edges') 136 | 137 | out_file_name_base = f'violinplot-{data_point}-{plot_target}-{plot_postfix}' 138 | 139 | plt.savefig(out_dir_path+'/'+out_file_name_base+'.png') 140 | plt.savefig(out_dir_path+'/'+out_file_name_base+'.pdf') 141 | plt.clf() 142 | 143 | plt.close(fig) 144 | except Exception as e: 145 | print(e) 146 | print(f'skipping the plot for {out_dir_name}') 147 | 148 | 149 | if __name__ == "__main__": 150 | main() 151 | -------------------------------------------------------------------------------- /stat_plot/main.py: -------------------------------------------------------------------------------- 1 | import argparse 2 | import os 3 | 4 | from conf import * 5 | from stat_plot import * 6 | 7 | 8 | def main(): 9 | parser = argparse.ArgumentParser() 10 | parser.add_argument("--config", "-c", required=True, type=str) 11 | args = parser.parse_args() 12 | 13 | config_path = os.path.abspath(args.config) 14 | 15 | print("[*] config file is {}".format(config_path)) 16 | config_valid, fuzzers_dict, misc_dict = parse_config(config_path) 17 | 18 | if not config_valid: 19 | print("[!] config: {} is not valid!".format(config_path)) 20 | exit(1) 21 | 22 | if misc_dict['stat_type'] == 'overall': 23 | generate_plots(fuzzers_dict, misc_dict) 24 | elif misc_dict['stat_type'] == 'stest': 25 | generate_stat_data(fuzzers_dict, misc_dict) 26 | elif misc_dict['stat_type'] == 'boxplot': 27 | generate_box_plots(fuzzers_dict, misc_dict) 28 | elif misc_dict['stat_type'] == 'scatterplot': 29 | generate_scatter_plots(fuzzers_dict, misc_dict) 30 | elif misc_dict['stat_type'] == 'histogram': 31 | generate_histograms(fuzzers_dict, misc_dict) 32 | 33 | 34 | if __name__ == "__main__": 35 | main() 36 | -------------------------------------------------------------------------------- /stat_plot/stat_plot.py: -------------------------------------------------------------------------------- 1 | import matplotlib.pyplot as plt 2 | import numpy as np 3 | import scipy.stats 4 | import os 5 | 6 | from matplotlib.patches import Polygon 7 | 8 | 9 | def convert_linestyle(linestyle): 10 | if linestyle == 'loosely dotted': 11 | return (0, (1, 5)) 12 | elif linestyle == 'densely dotted': 13 | return (0, (1, 1)) 14 | elif linestyle == 'loosely dashed': 15 | return (0, (5, 8)) 16 | elif linestyle == 'densely dashed': 17 | return (0, (5, 1)) 18 | elif linestyle == 'loosely dashdot': 19 | return (0, (3, 8, 1, 8)) 20 | elif linestyle == 'densely dashdot': 21 | return (0, (3, 1, 1, 1)) 22 | elif linestyle == 'dashdotdot': 23 | return (0, (3, 5, 1, 5, 1, 5)) 24 | elif linestyle == 'loosely dashdotdot': 25 | return (0, (3, 8, 1, 8, 1, 8)) 26 | elif linestyle == 'densely dashdotdot': 27 | return (0, (3, 1, 1, 1, 1, 1)) 28 | elif linestyle in ['solid', 'dotted', 'dashed', 'dashdot']: 29 | return linestyle 30 | # invalid linestyle 31 | else: 32 | return 'invalid' 33 | 34 | def mean_confidence_interval(data, confidence): 35 | a = 1.0 * np.array(data) 36 | n = len(a) 37 | m, se = np.mean(a), scipy.stats.sem(a) 38 | h = se * scipy.stats.t.ppf((1+confidence)/2., n-1) 39 | return m, m-h, m+h 40 | 41 | 42 | def row_to_col(rows): 43 | return [*zip(*rows)] 44 | 45 | 46 | def mkdirs(path): 47 | if not os.path.exists(path): 48 | os.makedirs(path) 49 | 50 | 51 | def display_bucket(bucket): 52 | if bucket[0] == 's': 53 | return 'sec' 54 | elif bucket[0] == 'm': 55 | return 'min' 56 | elif bucket[0] == 'h': 57 | return 'hour' 58 | else: 59 | # wrong bucket encoding 60 | return 'invalid_value' 61 | 62 | 63 | def get_step(misc_dict): 64 | step = 1 65 | if misc_dict['bucket'] == 'm': 66 | step = 60 67 | elif misc_dict['bucket'] == 'h': 68 | step = 3600 69 | 70 | return step 71 | 72 | 73 | # align data files 74 | def align_data(fuzzer_dict, misc_dict): 75 | 76 | fuzzer_name = fuzzer_dict['name'] 77 | data_files = fuzzer_dict['data_files'] 78 | out_dir = misc_dict['out_dir'] 79 | aligned_dir = out_dir + "/aligned/" + fuzzer_name + '/' 80 | max_slot = int(misc_dict['max_time'] * 3600) 81 | 82 | mkdirs(aligned_dir) 83 | 84 | new_data_files = [] 85 | last_vals = [] 86 | 87 | print("[*] aligning data for {}".format(fuzzer_name)) 88 | 89 | for (j, data_file) in enumerate(data_files): 90 | slots = [] 91 | vals = [] 92 | first = True 93 | 94 | if os.path.exists(data_file): 95 | with open(data_file) as df: 96 | lines = df.readlines() 97 | 98 | for line in lines: 99 | tokens = line.split(":") 100 | # skip illegal line 101 | if len(tokens) != 2: 102 | continue 103 | slot = int(tokens[0]) 104 | val = int(tokens[1]) 105 | 106 | if first: 107 | if slot != 0: 108 | slots.append(0) 109 | vals.append(0) 110 | first = False 111 | 112 | if slot > max_slot: 113 | break 114 | slots.append(slot) 115 | vals.append(val) 116 | 117 | # handle the case when the txt file is empty 118 | if len(slots) == 0: 119 | slots.append(0) 120 | vals.append(0) 121 | slots.append(1) 122 | vals.append(0) 123 | elif len(slots) == 1: 124 | slots.append(1) 125 | vals.append(vals[0]) 126 | 127 | slot_idx = 1 128 | new_vals = [] 129 | val_idx = 0 130 | 131 | for i in range(0, max_slot): 132 | if i > slots[slot_idx]: 133 | val_idx = min(len(vals)-1, val_idx + 1) 134 | slot_idx = min(len(slots)-1, slot_idx + 1) 135 | new_vals.append(vals[val_idx]) 136 | 137 | new_data_file = aligned_dir + str(j) + ".txt" 138 | last_vals.append(new_vals[-1]) 139 | with open(new_data_file, "w") as out_file: 140 | for val in new_vals: 141 | out_file.write(str(val)+'\n') 142 | 143 | new_data_files.append(new_data_file) 144 | 145 | fuzzer_dict['old_data_files'] = data_files 146 | fuzzer_dict['data_files'] = new_data_files 147 | fuzzer_dict['last_vals'] = last_vals 148 | 149 | 150 | # plot for every data file of the fuzzer; n is the id for the figure 151 | def detailed_plot(fuzzer_dict, misc_dict, n): 152 | fig = plt.figure(n) 153 | ax = fig.add_subplot(111) 154 | 155 | data_files = fuzzer_dict['data_files'] 156 | fuzzer_name = fuzzer_dict['name'] 157 | print('[*] generating detailed plots for {}'.format(fuzzer_name)) 158 | 159 | step = get_step(misc_dict) 160 | 161 | for (i, data_file) in enumerate(data_files): 162 | with open(data_file) as df: 163 | lines = df.readlines() 164 | ys = [int(x) for x in lines] 165 | ys = ys[0::step] 166 | bins = range(0, len(ys)) 167 | ax.plot(bins, ys, label=fuzzer_name + str(i)) 168 | 169 | out_dir = misc_dict['out_dir'] + '/detailed/' + fuzzer_name + '/' 170 | mkdirs(out_dir) 171 | base_filename = out_dir + \ 172 | misc_dict["project"] + "_detailed" + misc_dict["file_postfix"] 173 | filename_pdf = base_filename + '.pdf' 174 | filename_png = base_filename + '.png' 175 | 176 | ax.set(xlabel='time ({})'.format(display_bucket( 177 | misc_dict['bucket'])), ylabel=misc_dict['ylabel']) 178 | ax.legend() 179 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100) 180 | fig.savefig(filename_png, bbox_inches='tight', dpi=100) 181 | 182 | 183 | # add plots to ax; write the computed data out 184 | def plot_files(fuzzer_dict, misc_dict, ax, ax_s): 185 | entire_data_rows = [] 186 | 187 | data_files = fuzzer_dict['data_files'] 188 | fuzzer_name = fuzzer_dict['name'] 189 | 190 | print('[*] generating overall plots for {}'.format(fuzzer_name)) 191 | 192 | for data_file in data_files: 193 | data_row = [] 194 | with open(data_file) as df: 195 | lines = df.readlines() 196 | for line in lines: 197 | data_row.append(int(line)) 198 | entire_data_rows.append(data_row) 199 | 200 | entire_data_col = row_to_col(entire_data_rows) 201 | 202 | fuzzer_dict['final_vals'] = entire_data_col[-1] 203 | 204 | means = [] 205 | mins = [] 206 | maxs = [] 207 | bins = [] 208 | 209 | for col in entire_data_col: 210 | mean, min_, max_ = mean_confidence_interval( 211 | col, misc_dict['confidence_lvl']) 212 | means.append(mean) 213 | mins.append(max(min_, 0)) 214 | maxs.append(max_) 215 | 216 | data_dir = misc_dict['out_dir'] + '/' + 'stat_data/' 217 | mkdirs(data_dir) 218 | 219 | with open(data_dir + fuzzer_name + "-mean-confi.txt", "w") as df: 220 | for (idx, mean) in enumerate(means): 221 | df.write("{},{},{}\n".format(mean, mins[idx], maxs[idx])) 222 | bins.append(idx) 223 | 224 | set_line_color = 'line_color' in fuzzer_dict 225 | set_line_style = 'line_style' in fuzzer_dict 226 | set_marker = 'marker' in fuzzer_dict 227 | 228 | step = get_step(misc_dict) 229 | 230 | bins = [int(x/step) for x in bins[0::step]] 231 | 232 | if set_line_color and set_line_style and set_marker: 233 | ax.plot(bins[0:], means[0::step], label=fuzzer_name, linestyle=convert_linestyle(fuzzer_dict['line_style']) 234 | , color=fuzzer_dict['line_color'], marker=fuzzer_dict['marker'], ms=6) 235 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name, linestyle=convert_linestyle(fuzzer_dict['line_style']) 236 | , color=fuzzer_dict['line_color'], marker=fuzzer_dict['marker'], ms=6) 237 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step], facecolor=fuzzer_dict['line_color'], alpha=0.2) 238 | elif set_line_color and set_line_style: 239 | ax.plot(bins[0:], means[0::step], label=fuzzer_name, 240 | linestyle=convert_linestyle(fuzzer_dict['line_style']), color=fuzzer_dict['line_color']) 241 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name, 242 | linestyle=convert_linestyle(fuzzer_dict['line_style']), color=fuzzer_dict['line_color']) 243 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step], 244 | facecolor=fuzzer_dict['line_color'], alpha=0.2) 245 | elif set_line_color: 246 | ax.plot(bins[0:], means[0::step], label=fuzzer_name, 247 | color=fuzzer_dict['line_color']) 248 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name, 249 | color=fuzzer_dict['line_color']) 250 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step], 251 | facecolor=fuzzer_dict['line_color'], alpha=0.2) 252 | elif set_line_style: 253 | ax.plot(bins[0:], means[0::step], label=fuzzer_name, 254 | linestyle=convert_linestyle(fuzzer_dict['line_style'])) 255 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name, 256 | linestyle=convert_linestyle(fuzzer_dict['line_style'])) 257 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step], alpha=0.2) 258 | else: 259 | ax.plot(bins[0:], means[0::step], label=fuzzer_name) 260 | ax_s.plot(bins[0:], means[0::step], label=fuzzer_name) 261 | ax.fill_between(bins[0:], mins[0::step], maxs[0::step], alpha=0.2) 262 | 263 | 264 | def student_t_test(filename, open_mode, fuzzers_dict): 265 | with open(filename, open_mode) as gsf: 266 | checked = [] 267 | gsf.write("### Student's t test ###\n") 268 | for fuzzer_name1 in fuzzers_dict: 269 | for fuzzer_name2 in fuzzers_dict: 270 | if not fuzzer_name1 == fuzzer_name2 and not (fuzzer_name1, fuzzer_name2) in checked: 271 | f1 = fuzzers_dict[fuzzer_name1] 272 | f2 = fuzzers_dict[fuzzer_name2] 273 | checked.append((fuzzer_name1, fuzzer_name2)) 274 | checked.append((fuzzer_name2, fuzzer_name1)) 275 | 276 | p_value = scipy.stats.ttest_ind( 277 | f1['final_vals'], f2['final_vals'])[1] 278 | 279 | gsf.write( 280 | "pvalue: {} --- {} : {}\n".format(fuzzer_name1, fuzzer_name2, p_value)) 281 | gsf.write("------------------\n") 282 | gsf.write("\n") 283 | 284 | 285 | def mw_u_test(filename, open_mode, fuzzers_dict): 286 | with open(filename, open_mode) as gsf: 287 | checked = [] 288 | gsf.write("### Mann Whitney u test ###\n") 289 | for fuzzer_name1 in fuzzers_dict: 290 | for fuzzer_name2 in fuzzers_dict: 291 | if not fuzzer_name1 == fuzzer_name2 and not (fuzzer_name1, fuzzer_name2) in checked: 292 | f1 = fuzzers_dict[fuzzer_name1] 293 | f2 = fuzzers_dict[fuzzer_name2] 294 | checked.append((fuzzer_name1, fuzzer_name2)) 295 | checked.append((fuzzer_name2, fuzzer_name1)) 296 | try: 297 | p_value = scipy.stats.mannwhitneyu( 298 | f1['final_vals'], f2['final_vals'])[1] 299 | gsf.write( 300 | "pvalue: {} --- {} : {}\n".format(fuzzer_name1, fuzzer_name2, p_value)) 301 | except ValueError as e: 302 | gsf.write( 303 | "ERROR: {} --- {} : {}\n".format(fuzzer_name1, fuzzer_name2, e)) 304 | gsf.write("------------------\n") 305 | gsf.write("\n") 306 | 307 | 308 | # calculate the chance of f1s < f2s 309 | def calculate_a12(max_pop, f1s, f2s): 310 | numerator = 0 311 | denominator = float(max_pop * max_pop) 312 | for first_val in f1s: 313 | for second_val in f2s: 314 | if first_val < second_val: 315 | numerator += 1 316 | elif first_val == second_val: 317 | numerator += 0.5 318 | a12 = numerator / denominator 319 | return a12 320 | 321 | 322 | def calculate_a12s(filename, open_mode, fuzzers_dict): 323 | with open(filename, open_mode) as gsf: 324 | checked = [] 325 | gsf.write("### A12 values ###\n") 326 | for fuzzer_name1 in fuzzers_dict: 327 | for fuzzer_name2 in fuzzers_dict: 328 | if not fuzzer_name1 == fuzzer_name2 and not (fuzzer_name1, fuzzer_name2) in checked: 329 | f1 = fuzzers_dict[fuzzer_name1] 330 | f2 = fuzzers_dict[fuzzer_name2] 331 | checked.append((fuzzer_name1, fuzzer_name2)) 332 | checked.append((fuzzer_name2, fuzzer_name1)) 333 | 334 | # assume f1 and f2 have the same len 335 | a12 = calculate_a12( 336 | len(f1['final_vals']), f1['final_vals'], f2['final_vals']) 337 | 338 | gsf.write("A12: {} <= {} : {}\n".format( 339 | fuzzer_name1, fuzzer_name2, a12)) 340 | gsf.write("A12: {} >= {} : {}\n".format( 341 | fuzzer_name1, fuzzer_name2, (1.0-a12))) 342 | gsf.write("------------------\n") 343 | gsf.write("\n") 344 | 345 | 346 | def generate_plots(fuzzers_dict, misc_dict): 347 | fig = plt.figure(len(fuzzers_dict)) 348 | ax = fig.add_subplot(111) 349 | 350 | # fig_s does not plot the confidence interval 351 | fig_s = plt.figure(len(fuzzers_dict) + 1) 352 | ax_s = fig_s.add_subplot(111) 353 | 354 | if misc_dict['x_log_scale']: 355 | ax.set_xscale('log') 356 | ax_s.set_xscale('log') 357 | 358 | if misc_dict['y_log_scale']: 359 | ax.set_yscale('log') 360 | ax_s.set_yscale('log') 361 | 362 | for (n, fuzzer_name) in enumerate(fuzzers_dict): 363 | fuzzer_dict = fuzzers_dict[fuzzer_name] 364 | align_data(fuzzer_dict, misc_dict) 365 | detailed_plot(fuzzer_dict, misc_dict, n) 366 | plot_files(fuzzer_dict, misc_dict, ax, ax_s) 367 | 368 | out_dir = misc_dict['out_dir'] + '/' 369 | base_filename = out_dir + \ 370 | misc_dict["project"] + "_overall" + misc_dict["file_postfix"] 371 | filename_pdf = base_filename + '.pdf' 372 | filename_png = base_filename + '.png' 373 | filename_pdf_s = base_filename + '_simple.pdf' 374 | filename_png_s = base_filename + '_simple.png' 375 | general_stats_file = out_dir + \ 376 | misc_dict["project"] + "_overall_stats" + \ 377 | misc_dict["file_postfix"] + ".txt" 378 | 379 | student_t_test(general_stats_file, 'w', fuzzers_dict) 380 | 381 | mw_u_test(general_stats_file, 'a', fuzzers_dict) 382 | 383 | calculate_a12s(general_stats_file, 'a', fuzzers_dict) 384 | 385 | with open(general_stats_file, 'a') as file_handle: 386 | for fuzzer_name in fuzzers_dict: 387 | fuzzer_dict = fuzzers_dict[fuzzer_name] 388 | old_data_files = fuzzer_dict['old_data_files'] 389 | data_files = fuzzer_dict['data_files'] 390 | last_vals = fuzzer_dict['last_vals'] 391 | 392 | for (i, old_data_file) in enumerate(old_data_files): 393 | file_handle.write('fuzzer:{} orig_file:{} aligned_file:{} last_val:{} \n' 394 | .format(fuzzer_name, data_files[i], old_data_file, last_vals[i])) 395 | 396 | file_handle.write('\n') 397 | 398 | if 'y_start_0' in misc_dict and misc_dict['y_start_0']: 399 | ax.set_ylim(ymin=0) 400 | ax_s.set_ylim(ymin=0) 401 | 402 | ax.set(xlabel='time ({})'.format(display_bucket( 403 | misc_dict['bucket'])), ylabel=misc_dict['ylabel']) 404 | if 'plot_title' in misc_dict: 405 | ax.set(title=misc_dict['plot_title']) 406 | ax.set_title(misc_dict['plot_title'], fontsize=18, color='black') 407 | if 'no_legend' in misc_dict and misc_dict['no_legend']: 408 | pass 409 | else: 410 | if 'large_font' in misc_dict and misc_dict['large_font']: 411 | ax.legend(fontsize=20) 412 | else: 413 | ax.legend() 414 | if 'large_font' in misc_dict and misc_dict['large_font']: 415 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label] + 416 | ax.get_xticklabels()): 417 | item.set_fontsize(20) 418 | 419 | for item in (ax.get_yticklabels()): 420 | item.set_fontsize(20) 421 | 422 | for tick in ax.get_xticklabels(): 423 | tick.set_rotation(45) 424 | 425 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100) 426 | fig.savefig(filename_png, bbox_inches='tight', dpi=100) 427 | 428 | ax_s.set(xlabel='time ({})'.format(display_bucket( 429 | misc_dict['bucket'])), ylabel=misc_dict['ylabel']) 430 | if 'no_legend' in misc_dict and misc_dict['no_legend']: 431 | pass 432 | else: 433 | if 'large_font' in misc_dict and misc_dict['large_font']: 434 | ax_s.legend(fontsize=20) 435 | else: 436 | ax_s.legend() 437 | if 'large_font' in misc_dict and misc_dict['large_font']: 438 | for item in ([ax_s.title, ax_s.xaxis.label, ax_s.yaxis.label] + 439 | ax_s.get_xticklabels()): 440 | item.set_fontsize(20) 441 | 442 | for tick in ax_s.get_xticklabels(): 443 | tick.set_rotation(45) 444 | 445 | for item in (ax_s.get_yticklabels()): 446 | item.set_fontsize(20) 447 | 448 | fig_s.savefig(filename_pdf_s, bbox_inches='tight', dpi=100) 449 | fig_s.savefig(filename_png_s, bbox_inches='tight', dpi=100) 450 | 451 | 452 | def generate_stat_data(fuzzers_dict, misc_dict): 453 | 454 | # fill in the raw data 455 | for fuzzer_name in fuzzers_dict: 456 | fuzzer = fuzzers_dict[fuzzer_name] 457 | # use only the first data file 458 | data_file = fuzzer['data_files'][0] 459 | with open(data_file) as df: 460 | lines = df.readlines() 461 | fuzzer['final_vals'] = [float(x.strip()) for x in lines] 462 | 463 | out_dir = misc_dict['out_dir'] + '/' 464 | mkdirs(out_dir) 465 | general_stats_file = out_dir + \ 466 | misc_dict["project"] + "_overall_stats" + \ 467 | misc_dict["file_postfix"] + ".txt" 468 | 469 | student_t_test(general_stats_file, 'w', fuzzers_dict) 470 | 471 | mw_u_test(general_stats_file, 'a', fuzzers_dict) 472 | 473 | calculate_a12s(general_stats_file, 'a', fuzzers_dict) 474 | 475 | with open(general_stats_file, 'a') as file_handle: 476 | for fuzzer_name in fuzzers_dict: 477 | fuzzer_dict = fuzzers_dict[fuzzer_name] 478 | old_data_files = fuzzer_dict['old_data_files'] 479 | data_files = fuzzer_dict['data_files'] 480 | last_vals = fuzzer_dict['last_vals'] 481 | 482 | for (i, old_data_file) in enumerate(old_data_files): 483 | file_handle.write('fuzzer:{} orig_file:{} aligned_file:{} last_val:{} \n' 484 | .format(fuzzer_name, data_files[i], old_data_file, last_vals[i])) 485 | 486 | file_handle.write('\n') 487 | 488 | 489 | 490 | def generate_box_plots(fuzzers_dict, misc_dict): 491 | fig = plt.figure(len(fuzzers_dict)) 492 | ax = fig.add_subplot(111) 493 | 494 | # fill in the raw data 495 | # the data for the box plot 496 | box_data = [] 497 | box_colors = [] 498 | line_styles = [] 499 | # marker = [] 500 | fuzzer_names = list(fuzzers_dict.keys()) 501 | fuzzer_names.sort() 502 | for fuzzer_name in fuzzer_names: 503 | fuzzer = fuzzers_dict[fuzzer_name] 504 | # use only the first data file 505 | data_file = fuzzer['data_files'][0] 506 | 507 | box_colors.append(fuzzer['box_color']) 508 | 509 | line_styles.append(fuzzer['line_style']) 510 | 511 | # marker.append(fuzzer['marker']) 512 | 513 | if not os.path.exists(data_file): 514 | fuzzer['final_vals'] = [] 515 | box_data.append(fuzzer['final_vals']) 516 | continue 517 | 518 | with open(data_file) as df: 519 | lines = df.readlines() 520 | fuzzer['final_vals'] = [float(x) for x in lines] 521 | box_data.append(fuzzer['final_vals']) 522 | 523 | out_dir = misc_dict['out_dir'] + '/' 524 | mkdirs(out_dir) 525 | base_filename = out_dir + misc_dict["project"] + misc_dict["file_postfix"] 526 | filename_pdf = base_filename + '.pdf' 527 | filename_png = base_filename + '.png' 528 | 529 | # notch may look weird 530 | # https://stackoverflow.com/questions/26291082/weird-behavior-of-matplotlibs-boxplot-when-using-the-notch-shape 531 | bp = ax.boxplot(box_data, labels=fuzzer_names, sym='k+', 532 | notch=misc_dict['notch'], patch_artist=False, widths=0.5, showfliers=False) 533 | 534 | # this might be buggy as the order of bp['boxes'] may not follow the specified order 535 | # this is to set the color for the boxes 536 | # for box, color, line_style in zip(bp['boxes'], box_colors, line_styles): 537 | # box.set(facecolor=color) 538 | # box.set(linestyle=line_style) 539 | 540 | # this is buggy 541 | # ['whiskers', 'fliers', 'means', 'medians', 'caps'] 542 | # for whisker, median, cap, line_style in zip(bp['whiskers'], bp['medians'], bp['caps'], line_styles): 543 | # whisker.set(linestyle=line_style) 544 | # median.set(linestyle=line_style) 545 | # cap.set(linestyle=line_style) 546 | # print("haha") 547 | # print(cap.get_linestyle()) 548 | 549 | # this works, but it's for all boxes 550 | # for element in ['whiskers', 'means', 'medians', 'caps']: 551 | # plt.setp(bp[element], color='red', linestyle="dashed") 552 | 553 | for median in bp['medians']: 554 | median.set(color='k', linewidth=1.5) 555 | x, y = median.get_data() 556 | xn = (x-(x.sum()/2.))*0.5 + (x.sum()/2.) 557 | ax.plot(xn, y, color="k", linewidth=5, solid_capstyle="butt", zorder=4) 558 | 559 | # plot the dots (scatter) 560 | for (i, fuzzer_name) in enumerate(fuzzer_names): 561 | fuzzer = fuzzers_dict[fuzzer_name] 562 | y = fuzzer['final_vals'] 563 | x = np.random.normal(1+i, 0.1, size=len(y)) 564 | ax.scatter(x, y, c=fuzzer['box_color'], alpha=0.8, s=100) 565 | 566 | if 'ylim' in misc_dict: 567 | ax.set_ylim(misc_dict['ylim']) 568 | 569 | # ax.grid(which='major', axis='both', linestyle='--') 570 | ax.grid(False) 571 | if 'plot_title' in misc_dict: 572 | ax.set(title=misc_dict['plot_title']) 573 | 574 | for item in ([ax.title, ax.xaxis.label] + 575 | ax.get_xticklabels()): 576 | item.set_fontsize(30) 577 | 578 | for item in (ax.get_yticklabels()): 579 | item.set_fontsize(20) 580 | 581 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100) 582 | fig.savefig(filename_png, bbox_inches='tight', dpi=100) 583 | 584 | 585 | def generate_scatter_plots(fuzzers_dict, misc_dict): 586 | fig = plt.figure(len(fuzzers_dict)) 587 | ax = fig.add_subplot(111) 588 | 589 | fuzzer_names = list(fuzzers_dict.keys()) 590 | fuzzer_names.sort() 591 | for fuzzer_name in fuzzer_names: 592 | fuzzer = fuzzers_dict[fuzzer_name] 593 | 594 | # use only the first data file 595 | data_file = fuzzer['data_files'][0] 596 | with open(data_file) as df: 597 | lines = df.readlines() 598 | xs = [] 599 | ys = [] 600 | for line in lines: 601 | tokens = line.split(':') 602 | # skip invalid line 603 | if len(tokens) != 2: 604 | continue 605 | xs.append(int(tokens[0])) 606 | ys.append(int(tokens[1])) 607 | 608 | fuzzer['final_xs'] = xs 609 | fuzzer['final_ys'] = ys 610 | 611 | set_line_color = 'line_color' in fuzzer 612 | 613 | if set_line_color: 614 | ax.scatter(xs, ys, c=fuzzer['line_color'], 615 | alpha=1, s=20, label=fuzzer_name) 616 | else: 617 | ax.scatter(xs, ys, alpha=1, s=20, label=fuzzer_name) 618 | 619 | # ax.set_xscale('log') 620 | ax.set_yscale('log') 621 | if 'plot_title' in misc_dict: 622 | ax.set(title=misc_dict['plot_title']) 623 | ax.set(xlabel=misc_dict['xlabel'], ylabel=misc_dict['ylabel']) 624 | 625 | large_font = misc_dict['large_font'] 626 | 627 | if large_font: 628 | ax.legend(fontsize=15) 629 | else: 630 | ax.legend() 631 | 632 | if large_font: 633 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label] + ax.get_xticklabels()): 634 | item.set_fontsize(15) 635 | 636 | for tick in ax.get_xticklabels(): 637 | tick.set_rotation(45) 638 | 639 | for item in (ax.get_yticklabels()): 640 | item.set_fontsize(15) 641 | 642 | out_dir = misc_dict['out_dir'] + '/' 643 | mkdirs(out_dir) 644 | base_filename = out_dir + misc_dict["project"] + misc_dict["file_postfix"] 645 | filename_pdf = base_filename + '.pdf' 646 | filename_png = base_filename + '.png' 647 | 648 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100) 649 | fig.savefig(filename_png, bbox_inches='tight', dpi=100) 650 | 651 | 652 | def draw_histograms(histtype, figure_no, xss, colors, fuzzer_names, misc_dict): 653 | fig = plt.figure(figure_no) 654 | ax = fig.add_subplot(111) 655 | n_bins = misc_dict['n_bins'] 656 | ax.hist(x=xss, bins=n_bins, histtype=histtype, 657 | color=colors, label=fuzzer_names) 658 | 659 | # ax.set_xscale('log') 660 | ax.set_yscale('log') 661 | if 'plot_title' in misc_dict: 662 | ax.set(title=misc_dict['plot_title']) 663 | ax.set(xlabel=misc_dict['xlabel'], ylabel=misc_dict['ylabel']) 664 | # scientific notation for x axis labels 665 | # ax.ticklabel_format(style='sci', axis='x', scilimits=(1, 4)) 666 | 667 | large_font = misc_dict['large_font'] 668 | 669 | if large_font: 670 | ax.legend(fontsize=15) 671 | else: 672 | ax.legend() 673 | 674 | if large_font: 675 | for item in ([ax.title, ax.xaxis.label, ax.yaxis.label] + ax.get_xticklabels()): 676 | item.set_fontsize(15) 677 | 678 | for tick in ax.get_xticklabels(): 679 | tick.set_rotation(45) 680 | 681 | for item in (ax.get_yticklabels()): 682 | item.set_fontsize(15) 683 | 684 | out_dir = misc_dict['out_dir'] + '/' 685 | mkdirs(out_dir) 686 | base_filename = out_dir + \ 687 | misc_dict["project"] + misc_dict["file_postfix"] + '-' + histtype 688 | filename_pdf = base_filename + '.pdf' 689 | filename_png = base_filename + '.png' 690 | 691 | fig.savefig(filename_pdf, bbox_inches='tight', dpi=100) 692 | fig.savefig(filename_png, bbox_inches='tight', dpi=100) 693 | 694 | 695 | def generate_histograms(fuzzers_dict, misc_dict): 696 | 697 | fuzzer_names = list(fuzzers_dict.keys()) 698 | fuzzer_names.sort() 699 | xss = [] 700 | colors = [] 701 | for fuzzer_name in fuzzer_names: 702 | fuzzer = fuzzers_dict[fuzzer_name] 703 | 704 | # use only the first data file 705 | data_file = fuzzer['data_files'][0] 706 | with open(data_file) as df: 707 | lines = df.readlines() 708 | xs = [] 709 | for line in lines: 710 | if len(line.strip()) > 0: 711 | xs.append(int(line)) 712 | 713 | fuzzer['final_xs'] = xs 714 | xss.append(xs) 715 | 716 | set_line_color = 'line_color' in fuzzer 717 | 718 | if set_line_color: 719 | colors.append(fuzzer['line_color']) 720 | else: 721 | colors.append('xkcd:slate grey') 722 | 723 | draw_histograms('bar', 1, xss, colors, fuzzer_names, misc_dict) 724 | draw_histograms('barstacked', 2, xss, colors, fuzzer_names, misc_dict) 725 | draw_histograms('step', 3, xss, colors, fuzzer_names, misc_dict) 726 | draw_histograms('stepfilled', 4, xss, colors, fuzzer_names, misc_dict) 727 | -------------------------------------------------------------------------------- /stat_plot/statistic_tester.py: -------------------------------------------------------------------------------- 1 | # generate statistic test results based on .csv files 2 | # the test/statistics.csv is generated by: https://onlinemathtools.com/generate-random-matrix 3 | 4 | import argparse 5 | import scipy.stats 6 | import numpy as np 7 | import json 8 | 9 | 10 | # currently support student t test, mann whitney u test and a12 results 11 | def statistic_tests(data_array): 12 | # TODO: later make these options 13 | p_value_sig_bar = 0.05 14 | a12_sig_bar = 0.71 15 | 16 | checked = [] 17 | data_names = data_array.dtype.names 18 | student_t_results = {} 19 | student_t_sig_results = {} 20 | mw_u_results = {} 21 | mw_u_sig_results = {} 22 | a12_results = {} 23 | a12_sig_results = {} 24 | average_values = {} 25 | for dname1 in data_names: 26 | for dname2 in data_names: 27 | if not dname1 == dname2 and not (dname1, dname2) in checked: 28 | checked.append((dname1, dname2)) 29 | checked.append((dname2, dname1)) 30 | 31 | s_test_key = '{}-{}'.format(dname1, dname2) 32 | 33 | student_t_p_value = scipy.stats.ttest_ind(data_array[dname1], data_array[dname2])[1] 34 | mw_u_p_value = scipy.stats.mannwhitneyu(data_array[dname1], data_array[dname2])[1] 35 | 36 | student_t_results[s_test_key] = student_t_p_value 37 | mw_u_results[s_test_key] = mw_u_p_value 38 | if mw_u_p_value < p_value_sig_bar: 39 | mw_u_sig_results[s_test_key] = mw_u_p_value 40 | if student_t_p_value < p_value_sig_bar: 41 | student_t_sig_results[s_test_key] = student_t_p_value 42 | 43 | a12_key1 = '{}<{}'.format(dname1, dname2) 44 | a12_val1 = calculate_a12(data_array[dname1], data_array[dname2]) 45 | a12_key2 = '{}<{}'.format(dname2, dname1) 46 | a12_val2 = calculate_a12(data_array[dname2], data_array[dname1]) 47 | a12_results[a12_key1] = a12_val1 48 | a12_results[a12_key2] = a12_val2 49 | 50 | if a12_val1 > a12_sig_bar: 51 | a12_sig_results[a12_key1] = a12_val1 52 | if a12_val2 > a12_sig_bar: 53 | a12_sig_results[a12_key2] = a12_val2 54 | 55 | # do things that do not need comparison with another set of data 56 | average_values[dname1] = np.average(data_array[dname1]) 57 | 58 | statistic_test_results = { 59 | "student_t_test": student_t_results, 60 | "mann_whitney_u_test": mw_u_results, 61 | "a12": a12_results, 62 | "average": average_values 63 | } 64 | statistic_test_sig_results = { 65 | "student_t_test": student_t_sig_results, 66 | "mann_whitney_u_test": mw_u_sig_results, 67 | "a12": a12_sig_results 68 | } 69 | results = { 70 | "all": statistic_test_results, 71 | "significant": statistic_test_sig_results 72 | } 73 | return results 74 | 75 | 76 | # calculate the chance of f1s < f2s 77 | def calculate_a12(f1s, f2s): 78 | numerator = 0 79 | denominator = float(len(f1s) * len(f2s)) 80 | for first_val in f1s: 81 | for second_val in f2s: 82 | if first_val < second_val: 83 | numerator += 1 84 | elif first_val == second_val: 85 | numerator += 0.5 86 | a12 = numerator / denominator 87 | return a12 88 | 89 | 90 | def main(): 91 | parser = argparse.ArgumentParser() 92 | parser.add_argument("--input", "-i", required=True, type=str, help="path to the input csv file") 93 | parser.add_argument("--output", "-o", required=True, type=str, help="path to the output file, in json format") 94 | 95 | args = parser.parse_args() 96 | 97 | data_array = np.genfromtxt(args.input, delimiter=',', names=True) 98 | 99 | results = statistic_tests(data_array) 100 | 101 | with open(args.output, 'w') as output_file: 102 | json.dump(results, indent=2, sort_keys=True, fp=output_file) 103 | 104 | 105 | if __name__ == "__main__": 106 | main() 107 | -------------------------------------------------------------------------------- /stat_plot/test/data_boxplot/out_afl.txt: -------------------------------------------------------------------------------- 1 | 5.5 2 | 6.5 3 | 3.5 4 | 4.5 5 | 7.5 -------------------------------------------------------------------------------- /stat_plot/test/data_boxplot/out_aflfast.txt: -------------------------------------------------------------------------------- 1 | 6.6 2 | 7.8 3 | 9.4 4 | 8.4 5 | 7.6 -------------------------------------------------------------------------------- /stat_plot/test/data_boxplot/out_cerebro.txt: -------------------------------------------------------------------------------- 1 | 1.2 2 | 2.3 3 | 4.3 4 | 2.6 5 | 2.5 -------------------------------------------------------------------------------- /stat_plot/test/data_histo/test_aflfast.txt: -------------------------------------------------------------------------------- 1 | 10 2 | 10 3 | 10 4 | 10 5 | 10 6 | 10 7 | 10 8 | 10 9 | 10 10 | 10 11 | 10 12 | 12 13 | 10 14 | 10 15 | 10 16 | 10 17 | 10 18 | 10 19 | 10 20 | 10 21 | 10 22 | 10 23 | 10 24 | 10 25 | 10 26 | 10 27 | 12 28 | 10 29 | 10 30 | 12 31 | 10 32 | 10 33 | 10 34 | 10 35 | 12 36 | 10 37 | 10 38 | 10 39 | 10 40 | 10 41 | 10 42 | 10 43 | 10 44 | 10 45 | 10 46 | 10 47 | 10 48 | 10 49 | 10 50 | 18 51 | 10 52 | 10 53 | 10 54 | 10 55 | 10 56 | 10 57 | 10 58 | 10 59 | 10 60 | 10 61 | 10 62 | 10 63 | 10 64 | 10 65 | 10 66 | 10 67 | 10 68 | 11 69 | 10 70 | 10 71 | 12 72 | 10 73 | 10 74 | 12 75 | 10 76 | 10 77 | 10 78 | 10 79 | 10 80 | 10 81 | 10 82 | 10 83 | 10 84 | 12 85 | 10 86 | 10 87 | 10 88 | 12 89 | 10 90 | 10 91 | 10 92 | 10 93 | 10 94 | 10 95 | 10 96 | 10 97 | 10 98 | 10 99 | 10 100 | 10 101 | 12 102 | 10 103 | 10 104 | 11 105 | 12 106 | 10 107 | 10 108 | 12 109 | 10 110 | 10 111 | 10 112 | 10 113 | 10 114 | 12 115 | 13 116 | 12 117 | 10 118 | 10 119 | 10 120 | 12 121 | 10 122 | 10 123 | 10 124 | 10 125 | 10 126 | 10 127 | 12 128 | 10 129 | 10 130 | 10 131 | 11 132 | 10 133 | 10 134 | 10 135 | 10 136 | 10 137 | 10 138 | 12 139 | 10 140 | 10 141 | 10 142 | 10 143 | 10 144 | 10 145 | 12 146 | 10 147 | 10 148 | 10 149 | 10 150 | 12 151 | 10 152 | 10 153 | 10 154 | 10 155 | 10 156 | 12 157 | 10 158 | 10 159 | 10 160 | 12 161 | 10 162 | 10 163 | 10 164 | 10 165 | 10 166 | 10 167 | 10 168 | 12 169 | 10 170 | 10 171 | 10 172 | 10 173 | 10 174 | 10 175 | 10 176 | 10 177 | 12 178 | 10 179 | 10 180 | 10 181 | 10 182 | 18 183 | 10 184 | 10 185 | 12 186 | 10 187 | 10 188 | 12 189 | 10 190 | 10 191 | 10 192 | 10 193 | 10 194 | 13 195 | 10 196 | 10 197 | 10 198 | 13 199 | 10 200 | 10 201 | 10 202 | 10 203 | 10 204 | 10 205 | 10 206 | 12 207 | 10 208 | 10 209 | 10 210 | 10 211 | 12 212 | 10 213 | 10 214 | 10 215 | 10 216 | 10 217 | 12 218 | 10 219 | 11 220 | 10 221 | 10 222 | 10 223 | 10 224 | 11 225 | 12 226 | 10 227 | 12 228 | 10 229 | 12 230 | 10 231 | 10 232 | 10 233 | 10 234 | 10 235 | 10 236 | 12 237 | 10 238 | 12 239 | 12 240 | 10 241 | 10 242 | 10 243 | 12 244 | 12 245 | 10 246 | 12 247 | 10 248 | 10 249 | 12 250 | 12 251 | 10 252 | 10 253 | 10 254 | 10 255 | 11 256 | 10 257 | 10 258 | 10 259 | 10 260 | 10 261 | 10 262 | 10 263 | 10 264 | 10 265 | 10 266 | 12 267 | 10 268 | 12 269 | 10 270 | 10 271 | 12 272 | 10 273 | 10 274 | 12 275 | 10 276 | 10 277 | 10 278 | 10 279 | 10 280 | 12 281 | 12 282 | 10 283 | 10 284 | 10 285 | 10 286 | 10 287 | 10 288 | 12 289 | 12 290 | 10 291 | 10 292 | 13 293 | 10 294 | 10 295 | 10 296 | 10 297 | 10 298 | 10 299 | 10 300 | 10 301 | 10 302 | 10 303 | 10 304 | 10 305 | 10 306 | 11 307 | 10 308 | 13 309 | 10 310 | 12 311 | 10 312 | 12 313 | 10 314 | 10 315 | 10 316 | 10 317 | 10 318 | 12 319 | 12 320 | 10 321 | 10 322 | 10 323 | 10 324 | 10 325 | 10 326 | 10 327 | 10 328 | 10 329 | 12 330 | 10 331 | 10 332 | 12 333 | 10 334 | 10 335 | 10 336 | 10 337 | 10 338 | 10 339 | 10 340 | 10 341 | 12 342 | 10 343 | 10 344 | 10 345 | 10 346 | 10 347 | 10 348 | 10 349 | 12 350 | 12 351 | 12 352 | 10 353 | 12 354 | 12 355 | 10 356 | 12 357 | 10 358 | 10 359 | 10 360 | 10 361 | 12 362 | 12 363 | 10 364 | 10 365 | 12 366 | 10 367 | 12 368 | 10 369 | 10 370 | 10 371 | 10 372 | 10 373 | 10 374 | 10 375 | 10 376 | 10 377 | 12 378 | 10 379 | 10 380 | 10 381 | 10 382 | 12 383 | 10 384 | 12 385 | 10 386 | 10 387 | 10 388 | 10 389 | 10 390 | 12 391 | 10 392 | 10 393 | 10 394 | 10 395 | 10 396 | 10 397 | 10 398 | 10 399 | 10 400 | 12 401 | 10 402 | 10 403 | 10 404 | 11 405 | 10 406 | 10 407 | 12 408 | 10 409 | 10 410 | 10 411 | 10 412 | 10 413 | 10 414 | 10 415 | 10 416 | 10 417 | 10 418 | 10 419 | 12 420 | 10 421 | 10 422 | 10 423 | 11 424 | 10 425 | 10 426 | 10 427 | 10 428 | 10 429 | 10 430 | 10 431 | 10 432 | 12 433 | 10 434 | 10 435 | 10 436 | 10 437 | 10 438 | 10 439 | 11 440 | 10 441 | 12 442 | 12 443 | 12 444 | 10 445 | 13 446 | 12 447 | 12 448 | 12 449 | 10 450 | 12 451 | 12 452 | 10 453 | 12 454 | 12 455 | 12 456 | 12 457 | 10 458 | 12 459 | 12 460 | 12 461 | 10 462 | 12 463 | 12 464 | 10 465 | 12 466 | 12 467 | 12 468 | 10 469 | 12 470 | 10 471 | 10 472 | 12 473 | 10 474 | 12 475 | 10 476 | 13 477 | 10 478 | 12 479 | 10 480 | 10 481 | 10 482 | 12 483 | 12 484 | 10 485 | 10 486 | 10 487 | 10 488 | 12 489 | 12 490 | 10 491 | 12 492 | 10 493 | 12 494 | 10 495 | 12 496 | 13 497 | 10 498 | 10 499 | 11 500 | 13 501 | 12 502 | 13 503 | 19 504 | 10 505 | 10 506 | 10 507 | 12 508 | 12 509 | 12 510 | 12 511 | 10 512 | 12 513 | 12 514 | 12 515 | 12 516 | 12 517 | 10 518 | 12 519 | 12 520 | 10 521 | 12 522 | 12 523 | 12 524 | 12 525 | 12 526 | 12 527 | 10 528 | 10 529 | 10 530 | 10 531 | 10 532 | 10 533 | 10 534 | 10 535 | 10 536 | 10 537 | 10 538 | 10 539 | 10 540 | 10 541 | 10 542 | 12 543 | 10 544 | 10 545 | 10 546 | 12 547 | 10 548 | 10 549 | 12 550 | 10 551 | 10 552 | 10 553 | 10 554 | 10 555 | 10 556 | 10 557 | 10 558 | 10 559 | 10 560 | 12 561 | 12 562 | 12 563 | 10 564 | 10 565 | 12 566 | 12 567 | 12 568 | 10 569 | 12 570 | 10 571 | 10 572 | 10 573 | 12 574 | 10 575 | 10 576 | 10 577 | 10 578 | 10 579 | 10 580 | 10 581 | 11 582 | 10 583 | 12 584 | 10 585 | 10 586 | 10 587 | 13 588 | 10 589 | 10 590 | 10 591 | 10 592 | 10 593 | 12 594 | 12 595 | 10 596 | 12 597 | 12 598 | 10 599 | 12 600 | 11 601 | 12 602 | 12 603 | 13 604 | 14 605 | 10 606 | 18 607 | 12 608 | 12 609 | 12 610 | 10 611 | 12 612 | 10 613 | 10 614 | 12 615 | 12 616 | 12 617 | 12 618 | 11 619 | 12 620 | 12 621 | 12 622 | 12 623 | 10 624 | 10 625 | 10 626 | 10 627 | 10 628 | 13 629 | 10 630 | 10 631 | 12 632 | 10 633 | 12 634 | 10 635 | 10 636 | 10 637 | 13 638 | 10 639 | 10 640 | 10 641 | 10 642 | 10 643 | 10 644 | 13 645 | 12 646 | 13 647 | 10 648 | 10 649 | 10 650 | 10 651 | 10 652 | 10 653 | 10 654 | 10 655 | 10 656 | 10 657 | 10 658 | 13 659 | 14 660 | 10 661 | 10 662 | 10 663 | 10 664 | 12 665 | 10 666 | 12 667 | 12 668 | 10 669 | 10 670 | 10 671 | 10 672 | 12 673 | 12 674 | 12 675 | 10 676 | 12 677 | 10 678 | 10 679 | 10 680 | 12 681 | 12 682 | 10 683 | 10 684 | 10 685 | 10 686 | 10 687 | 10 688 | 10 689 | 10 690 | 10 691 | 10 692 | 10 693 | 10 694 | 11 695 | 11 696 | 11 697 | 12 698 | 12 699 | 11 700 | 11 701 | 12 702 | 11 703 | 10 704 | 10 705 | 11 706 | 12 707 | 11 708 | 10 709 | 11 710 | 12 711 | 11 712 | 10 713 | 11 714 | 11 715 | 10 716 | 10 717 | 10 718 | 12 719 | 12 720 | 12 721 | 12 722 | 10 723 | 12 724 | 12 725 | 10 726 | 12 727 | 12 728 | 10 729 | 12 730 | 12 731 | 10 732 | 10 733 | 10 734 | 10 735 | 10 736 | 10 737 | 10 738 | 10 739 | 10 740 | 10 741 | 10 742 | 12 743 | 10 744 | 10 745 | 12 746 | 10 747 | 12 748 | 10 749 | 13 750 | 13 751 | 13 752 | 13 753 | 10 754 | 10 755 | 10 756 | 10 757 | 12 758 | 12 759 | 12 760 | 10 761 | 10 762 | 12 763 | 10 764 | 12 765 | 10 766 | 12 767 | 12 768 | 12 769 | 10 770 | 10 771 | 12 772 | 12 773 | 18 774 | 12 775 | 12 776 | 14 777 | 13 778 | 13 779 | 12 780 | 12 781 | 12 782 | 12 783 | 10 784 | 10 785 | 10 786 | 10 787 | 10 788 | 10 789 | 12 790 | 14 791 | 13 792 | 14 793 | 13 794 | 13 795 | 12 796 | 12 797 | 12 798 | 14 799 | 13 800 | 13 801 | 18 802 | 12 803 | 12 804 | 12 805 | 12 806 | 12 807 | 12 808 | 12 809 | 12 810 | 12 811 | 12 812 | 12 813 | 12 814 | 12 815 | 12 816 | 12 817 | 11 818 | 12 819 | 12 820 | 10 821 | 10 822 | 18 823 | 10 824 | 10 825 | 10 826 | 18 827 | 10 828 | 15 829 | 10 830 | 10 831 | 10 832 | 10 833 | 10 834 | 10 835 | 10 836 | 10 837 | 10 838 | 18 839 | 10 840 | 14 841 | 16 842 | 14 843 | 16 844 | 13 845 | 14 846 | 15 847 | 14 848 | 13 849 | 13 850 | 16 851 | 14 852 | 16 853 | 15 854 | 14 855 | 14 856 | 13 857 | 14 858 | 16 859 | 14 860 | 14 861 | 13 862 | 14 863 | 14 864 | 14 865 | 14 866 | 13 867 | 13 868 | 12 869 | 13 870 | 15 871 | 14 872 | 14 873 | 14 874 | 14 875 | 16 876 | 15 877 | 14 878 | 15 879 | 14 880 | 14 881 | 14 882 | 12 883 | 14 884 | 10 885 | 12 886 | 12 887 | 12 888 | 12 889 | 12 890 | 10 891 | 19 892 | 16 893 | 25 894 | 15 895 | 17 896 | 16 897 | 15 898 | 18 899 | 19 900 | 15 901 | 16 902 | 10 903 | 10 904 | 16 905 | 18 906 | 19 907 | 15 908 | 20 909 | 18 910 | 16 911 | 19 912 | 16 913 | 18 914 | 25 915 | 19 916 | 18 917 | 22 918 | 25 919 | 11 920 | 19 921 | 14 922 | 12 923 | 12 924 | 12 925 | 12 926 | 12 927 | 10 928 | 12 929 | 12 930 | 12 931 | 12 932 | 12 933 | 12 934 | 11 935 | 11 936 | 10 937 | 11 938 | 10 939 | 11 940 | 10 941 | 11 942 | 12 943 | 12 944 | 10 945 | 11 946 | 10 947 | 10 948 | 12 949 | 10 950 | 10 951 | 11 952 | 10 953 | 12 954 | 10 955 | 10 956 | 10 957 | 10 958 | 10 959 | 10 960 | 10 961 | 10 962 | 10 963 | 10 964 | 10 965 | 10 966 | 10 967 | 10 968 | 10 969 | 10 970 | 10 971 | 12 972 | 10 973 | 10 974 | 12 975 | 10 976 | 10 977 | 12 978 | 12 979 | 10 980 | 10 981 | 10 982 | 10 983 | 10 984 | 10 985 | 10 986 | 10 987 | 10 988 | 10 989 | 10 990 | 10 991 | 10 992 | 10 993 | 10 994 | 12 995 | 10 996 | 10 997 | 10 998 | 12 999 | 12 1000 | 10 1001 | 10 1002 | 10 1003 | 12 1004 | 12 1005 | 12 1006 | 12 1007 | 12 1008 | 10 1009 | 12 1010 | 11 1011 | 11 1012 | 14 1013 | 13 1014 | 12 1015 | 12 1016 | 12 1017 | 12 1018 | 12 1019 | 12 1020 | 10 1021 | 12 1022 | 12 1023 | 12 1024 | 18 1025 | 18 1026 | 12 1027 | 11 1028 | 11 1029 | 11 1030 | 15 1031 | 12 1032 | 14 1033 | 18 1034 | 15 1035 | 14 1036 | 10 1037 | 10 1038 | 16 1039 | 10 1040 | 15 1041 | 14 1042 | 10 1043 | 19 1044 | 11 1045 | 14 1046 | 10 1047 | 18 1048 | 15 1049 | 14 1050 | 10 1051 | 18 1052 | 19 1053 | 16 1054 | 18 1055 | 18 1056 | 18 1057 | 18 1058 | 18 1059 | 18 1060 | 11 1061 | 10 1062 | 10 1063 | 10 1064 | 10 1065 | 10 1066 | 10 1067 | 10 1068 | 10 1069 | 10 1070 | 10 1071 | 18 1072 | 33 1073 | 12 1074 | 16 1075 | 15 1076 | 14 1077 | 20 1078 | 17 1079 | 15 1080 | 13 1081 | 16 1082 | 15 1083 | 15 1084 | 15 1085 | 20 1086 | 16 1087 | 18 1088 | 17 1089 | 14 1090 | 16 1091 | 12 1092 | 12 1093 | 12 1094 | 12 1095 | 12 1096 | 12 1097 | 12 1098 | 12 1099 | 12 1100 | 12 1101 | 12 1102 | 12 1103 | 12 1104 | 12 1105 | 12 1106 | 12 1107 | 12 1108 | 12 1109 | 12 1110 | 12 1111 | 12 1112 | 12 1113 | 12 1114 | 10 1115 | 12 1116 | 10 1117 | 10 1118 | 10 1119 | 10 1120 | 12 1121 | 12 1122 | 12 1123 | 10 1124 | 12 1125 | 10 1126 | 12 1127 | 10 1128 | 10 1129 | 10 1130 | 10 1131 | 10 1132 | 10 1133 | 10 1134 | 10 1135 | 12 1136 | 10 1137 | 12 1138 | 10 1139 | 16 1140 | 14 1141 | 15 1142 | 14 1143 | 14 1144 | 17 1145 | 18 1146 | 10 1147 | 10 1148 | 10 1149 | 10 1150 | 12 1151 | 10 1152 | 13 1153 | 12 1154 | 10 1155 | 17 1156 | 21 1157 | 16 1158 | 20 1159 | 18 1160 | 20 1161 | 20 1162 | 18 1163 | 18 1164 | 16 1165 | 13 1166 | 16 1167 | 16 1168 | 18 1169 | 17 1170 | 23 1171 | 18 1172 | 16 1173 | 18 1174 | 18 1175 | 17 1176 | 18 1177 | 19 1178 | 10 1179 | 10 1180 | 10 1181 | 10 1182 | 10 1183 | 10 1184 | 10 1185 | 10 1186 | 10 1187 | 10 1188 | 10 1189 | 10 1190 | 12 1191 | 10 1192 | 10 1193 | 10 1194 | 10 1195 | 10 1196 | 10 1197 | 10 1198 | 12 1199 | 19 1200 | 12 1201 | 12 1202 | 12 1203 | 12 1204 | 12 1205 | 12 1206 | 12 1207 | 12 1208 | 12 1209 | 12 1210 | 12 1211 | 12 1212 | 12 1213 | 10 1214 | 12 1215 | 19 1216 | 21 1217 | 19 1218 | 19 1219 | 20 1220 | 12 1221 | 18 1222 | 21 1223 | 10 1224 | 15 1225 | 19 1226 | 18 1227 | 18 1228 | 12 1229 | 12 1230 | 17 1231 | 10 1232 | 12 1233 | 18 1234 | 10 1235 | 10 1236 | 12 1237 | 12 1238 | 10 1239 | 12 1240 | 14 1241 | 12 1242 | 14 1243 | 10 1244 | 10 1245 | 10 1246 | 10 1247 | 10 1248 | 12 1249 | 10 1250 | 12 1251 | 10 1252 | 12 1253 | 11 1254 | 10 1255 | 10 1256 | 10 1257 | 10 1258 | 10 1259 | 10 1260 | 14 1261 | 10 1262 | 10 1263 | 10 1264 | 10 1265 | 10 1266 | 14 1267 | 13 1268 | 13 1269 | 14 1270 | 12 1271 | 13 1272 | 12 1273 | 10 1274 | 14 1275 | 12 1276 | 12 1277 | 12 1278 | 14 1279 | 13 1280 | 12 1281 | 12 1282 | 12 1283 | 10 1284 | 10 1285 | 12 1286 | 12 1287 | 12 1288 | 12 1289 | 12 1290 | 12 1291 | 12 1292 | 10 1293 | 25 1294 | 10 1295 | 12 1296 | 12 1297 | 12 1298 | 12 1299 | 12 1300 | 12 1301 | 18 1302 | 16 1303 | 21 1304 | 21 1305 | 26 1306 | 18 1307 | 23 1308 | 18 1309 | 22 1310 | 22 1311 | 20 1312 | 23 1313 | 23 1314 | 23 1315 | 23 1316 | 23 1317 | 26 1318 | 23 1319 | 18 1320 | 25 1321 | 22 1322 | 21 1323 | 22 1324 | 12 1325 | 12 1326 | 12 1327 | 12 1328 | 12 1329 | 12 1330 | 12 1331 | 12 1332 | 12 1333 | 12 1334 | 12 1335 | 12 1336 | 12 1337 | 10 1338 | 10 1339 | 20 1340 | 12 1341 | 10 1342 | 10 1343 | 10 1344 | 12 1345 | 10 1346 | 12 1347 | 12 1348 | 10 1349 | 12 1350 | 11 1351 | 10 1352 | 10 1353 | 10 1354 | 10 1355 | 10 1356 | 13 1357 | 13 1358 | 12 1359 | 12 1360 | 14 1361 | 10 1362 | 10 1363 | 10 1364 | 13 1365 | 13 1366 | 13 1367 | 13 1368 | 13 1369 | 12 1370 | 13 1371 | 10 1372 | 12 1373 | 12 1374 | 10 1375 | 16 1376 | 18 1377 | 18 1378 | 18 1379 | 18 1380 | 16 1381 | 16 1382 | 15 1383 | 10 1384 | 15 1385 | 16 1386 | 12 1387 | 10 1388 | 10 1389 | 12 1390 | 10 1391 | 10 1392 | 10 1393 | 11 1394 | 10 1395 | 10 1396 | 12 1397 | 12 1398 | 12 1399 | 12 1400 | 12 1401 | 12 1402 | 12 1403 | 12 1404 | 12 1405 | 12 1406 | 12 1407 | 12 1408 | 12 1409 | 12 1410 | 12 1411 | 10 1412 | 12 1413 | 12 1414 | 12 1415 | 12 1416 | 10 1417 | 12 1418 | 15 1419 | 15 1420 | 10 1421 | 15 1422 | 15 1423 | 15 1424 | 15 1425 | 15 1426 | 15 1427 | 10 1428 | 15 1429 | 12 1430 | 12 1431 | 10 1432 | 12 1433 | 20 1434 | 18 1435 | 22 1436 | 21 1437 | 20 1438 | 19 1439 | 25 1440 | 15 1441 | 20 1442 | 21 1443 | 20 1444 | 20 1445 | 20 1446 | 20 1447 | 21 1448 | 20 1449 | 21 1450 | 23 1451 | 18 1452 | 14 1453 | 20 1454 | 21 1455 | 16 1456 | 16 1457 | 20 1458 | 21 1459 | 20 1460 | 19 1461 | 20 1462 | 21 1463 | 22 1464 | 18 1465 | 22 1466 | 20 1467 | 21 1468 | 12 1469 | 18 1470 | 19 1471 | 12 1472 | 16 1473 | 15 1474 | 16 1475 | 16 1476 | 16 1477 | 19 1478 | 16 1479 | 19 1480 | 25 1481 | 26 1482 | 25 1483 | 26 1484 | 25 1485 | 36 1486 | 25 1487 | 25 1488 | 25 1489 | 22 1490 | 25 1491 | 25 1492 | 22 1493 | 25 1494 | 22 1495 | 25 1496 | 25 1497 | 22 1498 | 25 1499 | 25 1500 | 25 1501 | 11 1502 | 22 1503 | 26 1504 | 25 1505 | 25 1506 | 25 1507 | 25 1508 | 25 1509 | 25 1510 | 25 1511 | 25 1512 | 25 1513 | 22 1514 | 22 1515 | 25 1516 | 25 1517 | 25 1518 | 11 1519 | 11 1520 | 11 1521 | 11 1522 | 11 1523 | 11 1524 | 12 1525 | 11 1526 | 14 1527 | 29 1528 | 25 1529 | 25 1530 | 26 1531 | 25 1532 | 27 1533 | 25 1534 | 25 1535 | 22 1536 | 21 1537 | 14 1538 | 15 1539 | 25 1540 | 20 1541 | 24 1542 | 28 1543 | 17 1544 | 21 1545 | 20 1546 | 48 1547 | 19 1548 | 22 1549 | 29 1550 | 25 1551 | 25 1552 | 23 1553 | 25 1554 | 28 1555 | 17 1556 | 33 1557 | 20 1558 | 16 1559 | 19 1560 | 39 1561 | 39 1562 | 37 1563 | 18 1564 | 19 1565 | 25 1566 | 12 1567 | 20 1568 | 18 1569 | 12 1570 | 10 1571 | 10 1572 | 13 1573 | 12 1574 | 12 1575 | 12 1576 | 20 1577 | 20 1578 | 27 1579 | 22 1580 | 23 1581 | 23 1582 | 20 1583 | 23 1584 | 17 1585 | 22 1586 | 27 1587 | 28 1588 | 22 1589 | 24 1590 | 24 1591 | 25 1592 | 23 1593 | 12 1594 | 24 1595 | 22 1596 | 22 1597 | 23 1598 | 23 1599 | 22 1600 | 24 1601 | 23 1602 | 27 1603 | 24 1604 | 15 1605 | 21 1606 | 12 1607 | 12 1608 | 12 1609 | 10 1610 | 10 1611 | 12 1612 | 12 1613 | 12 1614 | 12 1615 | 12 1616 | 12 1617 | 12 1618 | 10 1619 | 10 1620 | 12 1621 | 10 1622 | 12 1623 | 12 1624 | 12 1625 | 12 1626 | 10 1627 | 12 1628 | 12 1629 | 10 1630 | 12 1631 | 12 1632 | 10 1633 | 12 1634 | 12 1635 | 12 1636 | 10 1637 | 12 1638 | 12 1639 | 12 1640 | 10 1641 | 12 1642 | 12 1643 | 12 1644 | 12 1645 | 12 1646 | 12 1647 | 11 1648 | 11 1649 | 12 1650 | 12 1651 | 12 1652 | 12 1653 | 12 1654 | 12 1655 | 12 1656 | 12 1657 | 12 1658 | 10 1659 | 10 1660 | 12 1661 | 25 1662 | 31 1663 | 24 1664 | 26 1665 | 25 1666 | 10 1667 | 14 1668 | 19 1669 | 15 1670 | 18 1671 | 18 1672 | 18 1673 | 18 1674 | 18 1675 | 12 1676 | 12 1677 | 12 1678 | 12 1679 | 18 1680 | 11 1681 | 18 1682 | 18 1683 | 18 1684 | 10 1685 | 10 1686 | 15 1687 | 14 1688 | 19 1689 | 12 1690 | 37 1691 | 10 1692 | 10 1693 | 10 1694 | 18 1695 | 20 1696 | 15 1697 | 15 1698 | 17 1699 | 16 1700 | 22 1701 | 23 1702 | 21 1703 | 17 1704 | 21 1705 | 10 1706 | 15 1707 | 14 1708 | 10 1709 | 17 1710 | 44 1711 | 22 1712 | 25 1713 | 27 1714 | 15 1715 | 14 1716 | 17 1717 | 17 1718 | 17 1719 | 17 1720 | 15 1721 | 16 1722 | 15 1723 | 15 1724 | 10 1725 | 14 1726 | 16 1727 | 14 1728 | 30 1729 | 18 1730 | 18 1731 | 12 1732 | 14 1733 | 17 1734 | 10 1735 | 15 1736 | 18 1737 | 14 1738 | 13 1739 | 13 1740 | 21 1741 | 13 1742 | 10 1743 | 15 1744 | 15 1745 | 14 1746 | 10 1747 | 20 1748 | 29 1749 | 29 1750 | 28 1751 | 29 1752 | 27 1753 | 26 1754 | 24 1755 | 21 1756 | 26 1757 | 22 1758 | 30 1759 | 10 1760 | 10 1761 | 10 1762 | 16 1763 | 18 1764 | 18 1765 | 18 1766 | 18 1767 | 24 1768 | 18 1769 | 18 1770 | 18 1771 | 18 1772 | 18 1773 | 18 1774 | 18 1775 | 18 1776 | 18 1777 | 18 1778 | 14 1779 | 15 1780 | 15 1781 | 18 1782 | 15 1783 | 18 1784 | 12 1785 | 15 1786 | 18 1787 | 14 1788 | 14 1789 | 18 1790 | 14 1791 | 21 1792 | 17 1793 | 13 1794 | 15 1795 | 13 1796 | 13 1797 | 12 1798 | 12 1799 | 12 1800 | 12 1801 | 12 1802 | 12 1803 | 12 1804 | 12 1805 | 12 1806 | 12 1807 | 12 1808 | 16 1809 | 10 1810 | 12 1811 | 12 1812 | 26 1813 | 10 1814 | 12 1815 | 11 1816 | 12 1817 | 12 1818 | 10 1819 | 10 1820 | 10 1821 | 10 1822 | 10 1823 | 12 1824 | 10 1825 | 10 1826 | 10 1827 | 12 1828 | 10 1829 | 14 1830 | 12 1831 | 10 1832 | 10 1833 | 12 1834 | 10 1835 | 14 1836 | 14 1837 | 15 1838 | 15 1839 | 15 1840 | 18 1841 | 10 1842 | 10 1843 | 10 1844 | 10 1845 | 21 1846 | 21 1847 | 13 1848 | 13 1849 | 12 1850 | 13 1851 | 13 1852 | 14 1853 | 12 1854 | 14 1855 | 13 1856 | 13 1857 | 13 1858 | 12 1859 | 17 1860 | 15 1861 | 12 1862 | 12 1863 | 12 1864 | 12 1865 | 10 1866 | 12 1867 | 12 1868 | 12 1869 | 18 1870 | 10 1871 | 19 1872 | 16 1873 | 16 1874 | 15 1875 | 15 1876 | 16 1877 | 19 1878 | 16 1879 | 19 1880 | 10 1881 | 19 1882 | 12 1883 | 12 1884 | 12 1885 | 12 1886 | 12 1887 | 12 1888 | 12 1889 | 12 1890 | 12 1891 | 23 1892 | 10 1893 | 11 1894 | 10 1895 | 10 1896 | 10 1897 | 10 1898 | 12 1899 | 10 1900 | 10 1901 | 10 1902 | 12 1903 | 12 1904 | 10 1905 | 12 1906 | 10 1907 | 10 1908 | 10 1909 | 13 1910 | 12 1911 | 16 1912 | 18 1913 | 16 1914 | 16 1915 | 16 1916 | 16 1917 | 15 1918 | 16 1919 | 16 1920 | 36 1921 | 20 1922 | 16 1923 | 12 1924 | 18 1925 | 15 1926 | 18 1927 | 10 1928 | 15 1929 | 18 1930 | 15 1931 | 15 1932 | 18 1933 | 16 1934 | 18 1935 | 18 1936 | 16 1937 | 18 1938 | 16 1939 | 18 1940 | 18 1941 | 16 1942 | 16 1943 | 18 1944 | 16 1945 | 18 1946 | 18 1947 | 27 1948 | 16 1949 | 16 1950 | 12 1951 | 12 1952 | 12 1953 | 13 1954 | 12 1955 | 12 1956 | 12 1957 | 12 1958 | 12 1959 | 12 1960 | 12 1961 | 12 1962 | 10 1963 | 12 1964 | 12 1965 | 12 1966 | 12 1967 | 12 1968 | 12 1969 | 12 1970 | 12 1971 | 12 1972 | 12 1973 | 12 1974 | 18 1975 | 12 1976 | 12 1977 | 12 1978 | 12 1979 | 12 1980 | 12 1981 | 12 1982 | 12 1983 | 12 1984 | 12 1985 | 12 1986 | 12 1987 | 12 1988 | 12 1989 | 12 1990 | 12 1991 | 12 1992 | 12 1993 | 19 1994 | 15 1995 | 18 1996 | 19 1997 | 19 1998 | 19 1999 | 15 2000 | 15 2001 | 15 2002 | 15 2003 | 18 2004 | 14 2005 | 14 2006 | 14 2007 | 16 2008 | 15 2009 | 14 2010 | 14 2011 | 14 2012 | 14 2013 | 14 2014 | 14 2015 | 14 2016 | 18 2017 | 15 2018 | 18 2019 | 18 2020 | 19 2021 | 19 2022 | 19 2023 | 31 2024 | 16 2025 | 16 2026 | 35 2027 | 19 2028 | 16 2029 | 18 2030 | 21 2031 | 18 2032 | 16 2033 | 19 2034 | 25 2035 | 18 2036 | 18 2037 | 24 2038 | 18 2039 | 19 2040 | 16 2041 | 17 2042 | 19 2043 | 16 2044 | 16 2045 | 25 2046 | 18 2047 | 25 2048 | 25 2049 | 25 2050 | 25 2051 | 22 2052 | 21 2053 | 25 2054 | 25 2055 | 25 2056 | 26 2057 | 25 2058 | 25 2059 | 27 2060 | 25 2061 | 25 2062 | 25 2063 | 25 2064 | 22 2065 | 10 2066 | 12 2067 | 13 2068 | 25 2069 | 25 2070 | 25 2071 | 25 2072 | 25 2073 | 25 2074 | 25 2075 | 25 2076 | 25 2077 | 25 2078 | 25 2079 | 25 2080 | 25 2081 | 25 2082 | 25 2083 | 25 2084 | 25 2085 | 25 2086 | 25 2087 | 11 2088 | 12 2089 | 11 2090 | 11 2091 | 18 2092 | 14 2093 | 21 2094 | 23 2095 | 23 2096 | 23 2097 | 23 2098 | 23 2099 | 20 2100 | 12 2101 | 12 2102 | 10 2103 | 12 2104 | 12 2105 | 14 2106 | 14 2107 | 12 2108 | 12 2109 | 12 2110 | 12 2111 | 12 2112 | 14 2113 | 14 2114 | 14 2115 | 12 2116 | 12 2117 | 12 2118 | 12 2119 | 15 2120 | 22 2121 | 12 2122 | 12 2123 | 10 2124 | 12 2125 | 10 2126 | 10 2127 | 12 2128 | 12 2129 | 12 2130 | 12 2131 | 12 2132 | 10 2133 | 12 2134 | 12 2135 | 12 2136 | 12 2137 | 10 2138 | 11 2139 | 12 2140 | 11 2141 | 10 2142 | 12 2143 | 24 2144 | 23 2145 | 12 2146 | 18 2147 | 10 2148 | 10 2149 | 10 2150 | 10 2151 | 10 2152 | 10 2153 | 10 2154 | 54 2155 | 15 2156 | 18 2157 | 18 2158 | 15 2159 | 18 2160 | 14 2161 | 23 2162 | 15 2163 | 14 2164 | 15 2165 | 18 2166 | 192 2167 | 14 2168 | 28 2169 | 14 2170 | 15 2171 | 15 2172 | 27 2173 | 27 2174 | 27 2175 | 27 2176 | 25 2177 | 24 2178 | 28 2179 | 28 2180 | 26 2181 | 26 2182 | 26 2183 | 27 2184 | 29 2185 | 27 2186 | 26 2187 | 23 2188 | 15 2189 | 18 2190 | 12 2191 | 19 2192 | 10 2193 | 10 2194 | 24 2195 | 25 2196 | 25 2197 | 26 2198 | 25 2199 | 23 2200 | 25 2201 | 27 2202 | 22 2203 | 18 2204 | 12 2205 | 13 2206 | 13 2207 | 13 2208 | 10 2209 | 30 2210 | 18 2211 | 10 2212 | 10 2213 | 12 2214 | 10 2215 | 10 2216 | 10 2217 | 10 2218 | 10 2219 | 14 2220 | 10 2221 | 10 2222 | 10 2223 | 10 2224 | 21 2225 | 12 2226 | 14 2227 | 20 2228 | 10 2229 | 21 2230 | 12 2231 | 15 2232 | 18 2233 | 14 2234 | 10 2235 | 14 2236 | 14 2237 | 10 2238 | 14 2239 | 10 2240 | 10 2241 | 10 2242 | 14 2243 | 18 2244 | 10 2245 | 18 2246 | 17 2247 | 26 2248 | 24 2249 | 54 2250 | 37 2251 | 22 2252 | 16 2253 | 16 2254 | 18 2255 | 16 2256 | 18 2257 | 18 2258 | 14 2259 | 14 2260 | 18 2261 | 18 2262 | 14 2263 | 18 2264 | 18 2265 | 18 2266 | 14 2267 | 18 2268 | 18 2269 | 18 2270 | 18 2271 | 18 2272 | 15 2273 | 10 2274 | 12 2275 | 18 2276 | 15 2277 | 18 2278 | 14 2279 | 14 2280 | 14 2281 | 19 2282 | 16 2283 | 18 2284 | 14 2285 | 14 2286 | 14 2287 | 13 2288 | 13 2289 | 14 2290 | 14 2291 | 17 2292 | 17 2293 | 17 2294 | 12 2295 | 12 2296 | 12 2297 | 12 2298 | 12 2299 | 12 2300 | 12 2301 | 12 2302 | 10 2303 | 10 2304 | 10 2305 | 12 2306 | 12 2307 | 17 2308 | 10 2309 | 12 2310 | 12 2311 | 13 2312 | 16 2313 | 16 2314 | 16 2315 | 13 2316 | 16 2317 | 14 2318 | 16 2319 | 16 2320 | 17 2321 | 15 2322 | 14 2323 | 42 2324 | 14 2325 | 15 2326 | 14 2327 | 18 2328 | 18 2329 | 18 2330 | 10 2331 | 10 2332 | 10 2333 | 10 2334 | 25 2335 | 13 2336 | 10 2337 | 13 2338 | 13 2339 | 10 2340 | 13 2341 | 10 2342 | 10 2343 | 10 2344 | 10 2345 | 12 2346 | 12 2347 | 12 2348 | 12 2349 | 12 2350 | 16 2351 | 12 2352 | 12 2353 | 12 2354 | 12 2355 | 12 2356 | 15 2357 | 11 2358 | 12 2359 | 16 2360 | 19 2361 | 15 2362 | 16 2363 | 16 2364 | 16 2365 | 16 2366 | 16 2367 | 15 2368 | 16 2369 | 16 2370 | 16 2371 | 19 2372 | 16 2373 | 16 2374 | 19 2375 | 19 2376 | 11 2377 | 19 2378 | 16 2379 | 15 2380 | 19 2381 | 12 2382 | 14 2383 | 12 2384 | 12 2385 | 12 2386 | 18 2387 | 16 2388 | 28 2389 | 16 2390 | 12 2391 | 16 2392 | 16 2393 | 18 2394 | 15 2395 | 25 2396 | 18 2397 | 16 2398 | 16 2399 | 18 2400 | 29 2401 | 18 2402 | 15 2403 | 18 2404 | 18 2405 | 18 2406 | 15 2407 | 15 2408 | 10 2409 | 18 2410 | 18 2411 | 45 2412 | 18 2413 | 12 2414 | 12 2415 | 12 2416 | 18 2417 | 12 2418 | 10 2419 | 10 2420 | 12 2421 | 12 2422 | 12 2423 | 12 2424 | 12 2425 | 12 2426 | 12 2427 | 12 2428 | 12 2429 | 12 2430 | 12 2431 | 12 2432 | 10 2433 | 12 2434 | 12 2435 | 12 2436 | 17 2437 | 12 2438 | 18 2439 | 12 2440 | 12 2441 | 12 2442 | 10 2443 | 12 2444 | 12 2445 | 12 2446 | 12 2447 | 19 2448 | 19 2449 | 10 2450 | 16 2451 | 19 2452 | 15 2453 | 14 2454 | 14 2455 | 18 2456 | 14 2457 | 15 2458 | 14 2459 | 14 2460 | 14 2461 | 18 2462 | 14 2463 | 12 2464 | 14 2465 | 10 2466 | 14 2467 | 14 2468 | 15 2469 | 13 2470 | 16 2471 | 15 2472 | 18 2473 | 16 2474 | 16 2475 | 16 2476 | 16 2477 | 19 2478 | 19 2479 | 19 2480 | 19 2481 | 10 2482 | 18 2483 | 16 2484 | 16 2485 | 19 2486 | 19 2487 | 19 2488 | 19 2489 | 19 2490 | 19 2491 | 19 2492 | 19 2493 | 19 2494 | 16 2495 | 16 2496 | 16 2497 | 19 2498 | 19 2499 | 19 2500 | 19 2501 | 19 2502 | 18 2503 | 19 2504 | 19 2505 | 19 2506 | 19 2507 | 16 2508 | 18 2509 | 16 2510 | 16 2511 | 16 2512 | 16 2513 | 16 2514 | 26 2515 | 26 2516 | 26 2517 | 26 2518 | 25 2519 | 25 2520 | 12 2521 | 14 2522 | 22 2523 | 22 2524 | 10 2525 | 10 2526 | 12 2527 | 10 2528 | 12 2529 | 10 2530 | 27 2531 | 26 2532 | 20 2533 | 26 2534 | 13 2535 | 13 2536 | 13 2537 | 13 2538 | 25 2539 | 13 2540 | 25 2541 | 25 2542 | 25 2543 | 25 2544 | 51 2545 | 17 2546 | 15 2547 | 10 2548 | 10 2549 | 10 2550 | 10 2551 | 10 2552 | 15 2553 | 23 2554 | 23 2555 | 12 2556 | 27 2557 | 12 2558 | 12 2559 | 10 2560 | 12 2561 | 12 2562 | 12 2563 | 10 2564 | 12 2565 | 12 2566 | 10 2567 | 12 2568 | 10 2569 | 10 2570 | 15 2571 | 14 2572 | 18 2573 | 18 2574 | 18 2575 | 14 2576 | 15 2577 | 14 2578 | 14 2579 | 14 2580 | 14 2581 | 14 2582 | 14 2583 | 14 2584 | 14 2585 | 14 2586 | 15 2587 | 15 2588 | 15 2589 | 18 2590 | 15 2591 | 18 2592 | 14 2593 | 18 2594 | 18 2595 | 10 2596 | 12 2597 | 10 2598 | 10 2599 | 19 2600 | 10 2601 | 15 2602 | 15 2603 | 18 2604 | 18 2605 | 14 2606 | 14 2607 | 14 2608 | 10 2609 | 15 2610 | 12 2611 | 14 2612 | 14 2613 | 18 2614 | 18 2615 | 18 2616 | 18 2617 | 15 2618 | 27 2619 | 18 2620 | 13 2621 | 13 2622 | 14 2623 | 13 2624 | 13 2625 | 13 2626 | 12 2627 | 14 2628 | 10 2629 | 12 2630 | 12 2631 | 12 2632 | 10 2633 | 10 2634 | 14 2635 | 10 2636 | 12 2637 | 12 2638 | 14 2639 | 12 2640 | 13 2641 | 10 2642 | 13 2643 | 10 2644 | 10 2645 | 10 2646 | 13 2647 | 13 2648 | 13 2649 | 14 2650 | 10 2651 | 13 2652 | 10 2653 | 13 2654 | 10 2655 | 18 2656 | 10 2657 | 10 2658 | 10 2659 | 10 2660 | 13 2661 | 13 2662 | 10 2663 | 10 2664 | 13 2665 | 10 2666 | 10 2667 | 14 2668 | 10 2669 | 10 2670 | 14 2671 | 10 2672 | 14 2673 | 14 2674 | 16 2675 | 15 2676 | 14 2677 | 10 2678 | 10 2679 | 14 2680 | 14 2681 | 18 2682 | 13 2683 | 14 2684 | 14 2685 | 27 2686 | 17 2687 | 15 2688 | 14 2689 | 15 2690 | 15 2691 | 10 2692 | 18 2693 | 14 2694 | 14 2695 | 23 2696 | 21 2697 | 21 2698 | 19 2699 | 23 2700 | 15 2701 | 18 2702 | 14 2703 | 14 2704 | 15 2705 | 14 2706 | 19 2707 | 18 2708 | 15 2709 | 15 2710 | 15 2711 | 15 2712 | 15 2713 | 19 2714 | 12 2715 | 12 2716 | 12 2717 | 12 2718 | 12 2719 | 12 2720 | 12 2721 | 14 2722 | 14 2723 | 13 2724 | 12 2725 | 10 2726 | 14 2727 | 14 2728 | 12 2729 | 12 2730 | 18 2731 | 16 2732 | 16 2733 | 16 2734 | 16 2735 | 16 2736 | 16 2737 | 16 2738 | 10 2739 | 16 2740 | 15 2741 | 19 2742 | 14 2743 | 12 2744 | 12 2745 | 12 2746 | 10 2747 | 10 2748 | 10 2749 | 16 2750 | 16 2751 | 18 2752 | 18 2753 | 18 2754 | 18 2755 | 18 2756 | 18 2757 | 12 2758 | 12 2759 | 12 2760 | 12 2761 | 12 2762 | 12 2763 | 12 2764 | 12 2765 | 12 2766 | 12 2767 | 12 2768 | 10 2769 | 12 2770 | 12 2771 | 10 2772 | 27 2773 | 12 2774 | 12 2775 | 23 2776 | 12 2777 | 12 2778 | 12 2779 | 15 2780 | 19 2781 | 14 2782 | 14 2783 | 14 2784 | 15 2785 | 10 2786 | 18 2787 | 10 2788 | 14 2789 | 14 2790 | 13 2791 | 18 2792 | 16 2793 | 18 2794 | 18 2795 | 18 2796 | 16 2797 | 19 2798 | 15 2799 | 15 2800 | 18 2801 | 10 2802 | 15 2803 | 15 2804 | 15 2805 | 18 2806 | 16 2807 | 16 2808 | 26 2809 | 12 2810 | 25 2811 | 25 2812 | 25 2813 | 25 2814 | 25 2815 | 22 2816 | 13 2817 | 18 2818 | 13 2819 | 25 2820 | 25 2821 | 25 2822 | 25 2823 | 10 2824 | 11 2825 | 12 2826 | 12 2827 | 20 2828 | 18 2829 | 19 2830 | 12 2831 | 12 2832 | 10 2833 | 18 2834 | 12 2835 | 15 2836 | 15 2837 | 14 2838 | 15 2839 | 15 2840 | 15 2841 | 18 2842 | 14 2843 | 15 2844 | 10 2845 | 13 2846 | 10 2847 | 13 2848 | 10 2849 | 13 2850 | 12 2851 | 13 2852 | 13 2853 | 13 2854 | 18 2855 | 19 2856 | 19 2857 | 17 2858 | 10 2859 | 19 2860 | 10 2861 | 14 2862 | 15 2863 | 14 2864 | 25 2865 | 14 2866 | 14 2867 | 14 2868 | 15 2869 | 14 2870 | 14 2871 | 10 2872 | 14 2873 | 10 2874 | 10 2875 | 10 2876 | 10 2877 | 25 2878 | 10 2879 | 10 2880 | 18 2881 | 18 2882 | 10 2883 | 10 2884 | 18 2885 | 18 2886 | 10 2887 | 18 2888 | 18 2889 | 18 2890 | 13 2891 | 13 2892 | 13 2893 | 10 2894 | 14 2895 | 14 2896 | 10 2897 | 13 2898 | 14 2899 | 10 2900 | 12 2901 | 15 2902 | 10 2903 | 14 2904 | 10 2905 | 10 2906 | 13 2907 | 10 2908 | 10 2909 | 10 2910 | 14 2911 | 10 2912 | 10 2913 | 14 2914 | 18 2915 | 19 2916 | 10 2917 | 12 2918 | 12 2919 | 18 2920 | 18 2921 | 18 2922 | 18 2923 | 10 2924 | 14 2925 | 14 2926 | 39 2927 | 19 2928 | 28 2929 | 32 2930 | 62 2931 | 31 2932 | 43 2933 | 14 2934 | 22 2935 | 20 2936 | 22 2937 | 55 2938 | 22 2939 | 22 2940 | 18 2941 | 25 2942 | 15 2943 | 15 2944 | 14 2945 | 18 2946 | 12 2947 | 14 2948 | 12 2949 | 12 2950 | 12 2951 | 12 2952 | 18 2953 | 15 2954 | 15 2955 | 15 2956 | 15 2957 | 15 2958 | 15 2959 | 15 2960 | 16 2961 | 18 2962 | 18 2963 | 16 2964 | 18 2965 | 18 2966 | 18 2967 | 16 2968 | 16 2969 | 18 2970 | 12 2971 | 12 2972 | 12 2973 | 12 2974 | 12 2975 | 10 2976 | 12 2977 | 12 2978 | 10 2979 | 12 2980 | 10 2981 | 10 2982 | 10 2983 | 10 2984 | 10 2985 | 10 2986 | 10 2987 | 10 2988 | 36 2989 | 14 2990 | 14 2991 | 14 2992 | 18 2993 | 17 2994 | 14 2995 | 15 2996 | 15 2997 | 22 2998 | 16 2999 | 19 3000 | 15 3001 | 15 3002 | 12 3003 | 12 3004 | 25 3005 | 13 3006 | 10 3007 | 25 3008 | 25 3009 | 25 3010 | 14 3011 | 14 3012 | 15 3013 | 15 3014 | 14 3015 | 14 3016 | 14 3017 | 10 3018 | 10 3019 | 10 3020 | 19 3021 | 10 3022 | 19 3023 | 15 3024 | 10 3025 | 10 3026 | 10 3027 | 24 3028 | 10 3029 | 12 3030 | 19 3031 | 20 3032 | 19 3033 | 18 3034 | 10 3035 | 13 3036 | 10 3037 | 14 3038 | 14 3039 | 15 3040 | 17 3041 | 14 3042 | 18 3043 | 18 3044 | 13 3045 | 10 3046 | 62 3047 | 18 3048 | 10 3049 | 10 3050 | 13 3051 | 10 3052 | 18 3053 | 10 3054 | 10 3055 | 14 3056 | 14 3057 | 13 3058 | 14 3059 | 10 3060 | 14 3061 | 17 3062 | 10 3063 | 13 3064 | 10 3065 | 13 3066 | 13 3067 | 14 3068 | 10 3069 | 12 3070 | 14 3071 | 14 3072 | 12 3073 | 10 3074 | 14 3075 | 12 3076 | 14 3077 | 12 3078 | 13 3079 | 10 3080 | 10 3081 | 10 3082 | 16 3083 | 16 3084 | 16 3085 | 19 3086 | 16 3087 | 19 3088 | 19 3089 | 16 3090 | 10 3091 | 23 3092 | 23 3093 | 10 3094 | 10 3095 | 10 3096 | 10 3097 | 10 3098 | 18 3099 | 10 3100 | 14 3101 | 18 3102 | 18 3103 | 18 3104 | 18 3105 | 18 3106 | 18 3107 | 10 3108 | 15 3109 | 18 3110 | 12 3111 | 30 3112 | 22 3113 | 14 3114 | 14 3115 | 15 3116 | 14 3117 | 14 3118 | 14 3119 | 25 3120 | 22 3121 | 16 3122 | 13 3123 | 17 3124 | 16 3125 | 13 3126 | 26 3127 | 16 3128 | 12 3129 | 13 3130 | 18 3131 | 18 3132 | 18 3133 | 18 3134 | 18 3135 | 12 3136 | 12 3137 | 12 3138 | 12 3139 | 10 3140 | 10 3141 | 31 3142 | 27 3143 | 14 3144 | 14 3145 | 10 3146 | 109 3147 | 14 3148 | 13 3149 | 25 3150 | 25 3151 | 25 3152 | 25 3153 | 14 3154 | 14 3155 | 14 3156 | 24 3157 | 14 3158 | 10 3159 | 19 3160 | 10 3161 | 10 3162 | 10 3163 | 13 3164 | 15 3165 | 13 3166 | 14 3167 | 18 3168 | 16 3169 | 30 3170 | 10 3171 | 13 3172 | 10 3173 | 10 3174 | 13 3175 | 10 3176 | 18 3177 | 15 3178 | 18 3179 | 15 3180 | 14 3181 | 13 3182 | 12 3183 | 12 3184 | 12 3185 | 10 3186 | 10 3187 | 14 3188 | 12 3189 | 10 3190 | 10 3191 | 10 3192 | 10 3193 | 10 3194 | 10 3195 | 12 3196 | 10 3197 | 14 3198 | 14 3199 | 14 3200 | 14 3201 | 14 3202 | 14 3203 | 10 3204 | 10 3205 | 19 3206 | 10 3207 | 16 3208 | 16 3209 | 15 3210 | 16 3211 | 16 3212 | 19 3213 | 16 3214 | 16 3215 | 16 3216 | 16 3217 | 16 3218 | 16 3219 | 16 3220 | 18 3221 | 18 3222 | 18 3223 | 10 3224 | 16 3225 | 16 3226 | 16 3227 | 18 3228 | 16 3229 | 19 3230 | 10 3231 | 19 3232 | 19 3233 | 19 3234 | 19 3235 | 19 3236 | 12 3237 | 10 3238 | 18 3239 | 14 3240 | 14 3241 | 16 3242 | 10 3243 | 18 3244 | 18 3245 | 18 3246 | 18 3247 | 18 3248 | 19 3249 | 18 3250 | 15 3251 | 18 3252 | 18 3253 | 10 3254 | 10 3255 | 15 3256 | 15 3257 | 19 3258 | 20 3259 | 18 3260 | 19 3261 | 14 3262 | 10 3263 | 15 3264 | 18 3265 | 15 3266 | 14 3267 | 14 3268 | 18 3269 | 15 3270 | 14 3271 | 13 3272 | 13 3273 | 14 3274 | 18 3275 | 12 3276 | 18 3277 | 10 3278 | 12 3279 | 12 3280 | 14 3281 | 14 3282 | 15 3283 | 15 3284 | 15 3285 | 15 3286 | 18 3287 | 25 3288 | 19 3289 | 14 3290 | 15 3291 | 14 3292 | 15 3293 | 18 3294 | 10 3295 | 23 3296 | 22 3297 | 10 3298 | 10 3299 | 13 3300 | 13 3301 | 11 3302 | 10 3303 | 10 3304 | 12 3305 | 12 3306 | 12 3307 | 18 3308 | 14 3309 | 18 3310 | 14 3311 | 14 3312 | 13 3313 | 10 3314 | 10 3315 | 14 3316 | 23 3317 | 10 3318 | 10 3319 | 10 3320 | 10 3321 | 16 3322 | 15 3323 | 16 3324 | 16 3325 | 16 3326 | 16 3327 | 16 3328 | 16 3329 | 16 3330 | 19 3331 | 19 3332 | 19 3333 | 18 3334 | 18 3335 | 22 3336 | 19 3337 | 17 3338 | 19 3339 | 15 3340 | 14 3341 | 18 3342 | 18 3343 | 17 3344 | 17 3345 | 16 3346 | 41 3347 | 16 3348 | 13 3349 | 14 3350 | 16 3351 | 13 3352 | 14 3353 | 12 3354 | 12 3355 | 15 3356 | 15 3357 | 19 3358 | 15 3359 | 15 3360 | 15 3361 | 18 3362 | 18 3363 | 18 3364 | 18 3365 | 18 3366 | 25 3367 | 14 3368 | 14 3369 | 15 3370 | 14 3371 | 14 3372 | 14 3373 | 14 3374 | 18 3375 | 12 3376 | 12 3377 | 18 3378 | 12 3379 | 22 3380 | 22 3381 | 22 3382 | 21 3383 | 22 3384 | 13 3385 | 11 3386 | 11 3387 | 10 3388 | 10 3389 | 10 3390 | 11 3391 | 12 3392 | 10 3393 | 10 3394 | 15 3395 | 15 3396 | 19 3397 | 19 3398 | 14 3399 | 14 3400 | 15 3401 | 14 3402 | 18 3403 | 15 3404 | 17 3405 | 29 3406 | 15 3407 | 18 3408 | 18 3409 | 18 3410 | 18 3411 | 18 3412 | 18 3413 | 16 3414 | 14 3415 | 15 3416 | 17 3417 | 21 3418 | 12 3419 | 15 3420 | 18 3421 | 19 3422 | 15 3423 | 15 3424 | 19 3425 | 15 3426 | 15 3427 | 18 3428 | 10 3429 | 10 3430 | 10 3431 | 10 3432 | 10 3433 | 15 3434 | 19 3435 | 15 3436 | 18 3437 | 15 3438 | 15 3439 | 14 3440 | 15 3441 | 18 3442 | 18 3443 | 14 3444 | 14 3445 | 18 3446 | 10 3447 | 10 3448 | 15 3449 | 18 3450 | 15 3451 | 18 3452 | 15 3453 | 19 3454 | 15 3455 | 18 3456 | 18 3457 | 21 3458 | 17 3459 | 18 3460 | 15 3461 | 22 3462 | 21 3463 | 20 3464 | 20 3465 | 20 3466 | 21 3467 | 15 3468 | 15 3469 | 15 3470 | 15 3471 | 15 3472 | 15 3473 | 15 3474 | 15 3475 | 21 3476 | 27 3477 | 20 3478 | 20 3479 | 21 3480 | 21 3481 | 12 3482 | 15 3483 | 19 3484 | 19 3485 | 19 3486 | 15 3487 | 15 3488 | 15 3489 | 15 3490 | 15 3491 | 13 3492 | 15 3493 | 15 3494 | 15 3495 | 15 3496 | 10 3497 | 10 3498 | 10 3499 | 10 3500 | 10 3501 | 10 3502 | 15 3503 | 15 3504 | 18 3505 | 15 3506 | 15 3507 | 16 3508 | 18 3509 | 15 3510 | 15 3511 | 18 3512 | 18 3513 | 15 3514 | 15 3515 | 19 3516 | 15 3517 | 15 3518 | 17 3519 | 17 3520 | 18 3521 | 17 3522 | 18 3523 | 18 3524 | 18 3525 | 18 3526 | 18 3527 | 22 3528 | 12 3529 | 17 3530 | 12 3531 | 12 3532 | 12 3533 | 12 3534 | 17 3535 | 19 3536 | 14 3537 | 17 3538 | 17 3539 | 19 3540 | 15 3541 | 19 3542 | 18 3543 | 18 3544 | 15 3545 | 15 3546 | 18 3547 | 13 3548 | 13 3549 | 13 3550 | 13 3551 | 13 3552 | 15 3553 | 15 3554 | 18 3555 | 18 3556 | 15 3557 | 18 3558 | 18 3559 | 18 3560 | 18 3561 | 18 3562 | 16 3563 | 17 3564 | 18 3565 | 18 3566 | 18 3567 | 18 3568 | 18 3569 | 18 3570 | 18 3571 | 15 3572 | 15 3573 | 17 3574 | 18 3575 | 12 3576 | 17 3577 | 14 3578 | 14 3579 | 17 3580 | 15 3581 | 25 3582 | 25 3583 | 25 3584 | 25 3585 | 25 3586 | 29 3587 | 18 3588 | 18 3589 | 18 3590 | 19 3591 | 20 3592 | 18 3593 | 16 3594 | 18 3595 | 18 3596 | 15 3597 | 32 3598 | 32 3599 | 28 3600 | 27 3601 | 32 3602 | 17 3603 | 17 3604 | 15 3605 | 15 3606 | 16 3607 | 16 3608 | 16 3609 | 15 3610 | 25 3611 | 25 3612 | 15 3613 | 15 3614 | 11 3615 | 15 3616 | 18 3617 | 18 3618 | 18 3619 | 18 3620 | 18 3621 | 18 3622 | 16 3623 | 20 3624 | 16 3625 | 15 3626 | 12 3627 | 14 3628 | 15 3629 | 27 3630 | 42 3631 | 18 3632 | 15 3633 | 18 3634 | 15 3635 | 26 3636 | 24 3637 | 21 3638 | 27 3639 | 22 3640 | 11 3641 | 18 3642 | 18 3643 | 18 3644 | 18 3645 | 19 3646 | 19 3647 | 16 3648 | 14 3649 | 14 3650 | 14 3651 | 28 3652 | 18 3653 | 19 3654 | 18 3655 | 18 3656 | 18 3657 | 18 3658 | 20 3659 | 18 3660 | 18 3661 | 18 3662 | 19 3663 | 18 3664 | 18 3665 | 18 3666 | 18 3667 | 19 3668 | 19 3669 | 18 3670 | 18 3671 | 18 3672 | 18 3673 | 18 3674 | 14 3675 | 20 3676 | 25 3677 | 25 3678 | 18 3679 | 18 3680 | 19 3681 | 18 3682 | 18 3683 | 18 3684 | 18 3685 | 18 3686 | 18 3687 | 14 3688 | 18 3689 | 15 3690 | 18 3691 | 18 3692 | 18 3693 | 10 3694 | 18 3695 | 18 3696 | 18 3697 | 16 3698 | 18 3699 | 20 3700 | 19 3701 | 18 3702 | 15 3703 | 15 3704 | 18 3705 | 18 3706 | 18 3707 | 20 3708 | 18 3709 | 18 3710 | 18 3711 | 18 3712 | 14 3713 | 18 3714 | 14 3715 | 14 3716 | 15 3717 | 14 3718 | 14 3719 | 18 3720 | 14 3721 | 18 3722 | 20 3723 | 20 3724 | 20 3725 | 20 3726 | 20 3727 | 20 3728 | 18 3729 | 18 3730 | 16 3731 | 16 3732 | 10 3733 | 10 3734 | 10 3735 | 10 3736 | 19 3737 | 19 3738 | 10 3739 | 18 3740 | 18 3741 | 18 3742 | 18 3743 | 19 3744 | 19 3745 | 19 3746 | 27 3747 | 27 3748 | 27 3749 | 19 3750 | 19 3751 | 19 3752 | 18 3753 | 16 3754 | 19 3755 | 18 3756 | 15 3757 | 18 3758 | 15 3759 | 14 3760 | 14 3761 | 14 3762 | 14 3763 | 14 3764 | 18 3765 | 18 3766 | 20 3767 | 20 3768 | 15 3769 | 15 3770 | 18 3771 | 19 3772 | 10 3773 | 18 3774 | 19 3775 | 19 3776 | 18 3777 | 16 3778 | 19 3779 | 16 3780 | 20 3781 | 18 3782 | 19 3783 | 18 3784 | 19 3785 | 18 3786 | 14 3787 | 14 3788 | 19 3789 | 19 3790 | 18 3791 | 19 3792 | 16 3793 | 18 3794 | 15 3795 | 18 3796 | 19 3797 | 19 3798 | 14 3799 | 19 3800 | 14 3801 | 18 3802 | 14 3803 | 18 3804 | 18 3805 | 18 3806 | 18 3807 | 14 3808 | 14 3809 | 14 3810 | 18 3811 | 18 3812 | 14 3813 | 15 3814 | 10 3815 | 10 3816 | 19 3817 | 19 3818 | 19 3819 | 19 3820 | 232 3821 | 267 3822 | 18 3823 | 18 3824 | 18 3825 | 15 3826 | 15 3827 | 15 3828 | 14 3829 | 19 3830 | 19 3831 | 19 3832 | 18 3833 | 18 3834 | 14 3835 | 14 3836 | 18 3837 | 18 3838 | 14 3839 | 14 3840 | 14 3841 | 18 3842 | 14 3843 | 14 3844 | 18 3845 | 19 3846 | 14 3847 | 14 3848 | 16 3849 | 19 3850 | 16 3851 | 16 3852 | 19 3853 | 18 3854 | 18 3855 | 18 3856 | 18 3857 | 12 3858 | 19 3859 | 10 3860 | 10 3861 | 15 3862 | 19 3863 | 19 3864 | 19 3865 | 18 3866 | 15 3867 | 15 3868 | 14 3869 | 18 3870 | 18 3871 | 14 3872 | 14 3873 | 14 3874 | 15 3875 | 14 3876 | 18 3877 | 18 3878 | 19 3879 | 18 3880 | 18 3881 | 14 3882 | 18 3883 | 18 3884 | 14 3885 | 14 3886 | 15 3887 | 16 3888 | 16 3889 | 19 3890 | 15 3891 | 15 3892 | 16 3893 | 12 3894 | 11 3895 | 19 3896 | 19 3897 | 19 3898 | 19 3899 | 17 3900 | 18 3901 | 21 3902 | 19 3903 | 19 3904 | 19 3905 | 15 3906 | 19 3907 | 15 3908 | 50 3909 | 15 3910 | 14 3911 | 14 3912 | 15 3913 | 16 3914 | 18 3915 | 14 3916 | 14 3917 | 15 3918 | 14 3919 | 18 3920 | 18 3921 | 18 3922 | 18 3923 | 15 3924 | 19 3925 | 14 3926 | 19 3927 | 19 3928 | 14 3929 | 18 3930 | 15 3931 | 14 3932 | 15 3933 | 18 3934 | 15 3935 | 15 3936 | 15 3937 | 15 3938 | 12 3939 | 12 3940 | 12 3941 | 12 3942 | 12 3943 | 21 3944 | 19 3945 | 16 3946 | 19 3947 | 19 3948 | 18 3949 | 19 3950 | 18 3951 | 19 3952 | 15 3953 | 15 3954 | 14 3955 | 18 3956 | 18 3957 | 18 3958 | 18 3959 | 18 3960 | 18 3961 | 18 3962 | 19 3963 | 15 3964 | 15 3965 | 15 3966 | 15 3967 | 15 3968 | 15 3969 | 14 3970 | 15 3971 | 15 3972 | 15 3973 | 15 3974 | 18 3975 | 12 3976 | 12 3977 | 18 3978 | 25 3979 | 25 3980 | 18 3981 | 18 3982 | 18 3983 | 18 3984 | 18 3985 | 15 3986 | 18 3987 | 18 3988 | 13 3989 | 14 3990 | 18 3991 | 49 3992 | 18 3993 | 15 3994 | 15 3995 | 15 3996 | 19 3997 | 19 3998 | 15 3999 | 15 4000 | 18 4001 | 15 4002 | 14 4003 | 14 4004 | 10 4005 | 10 4006 | 10 4007 | 15 4008 | 25 4009 | 18 4010 | 18 4011 | 18 4012 | 18 4013 | 18 4014 | 18 4015 | 18 4016 | 18 4017 | 15 4018 | 13 4019 | 14 4020 | 14 4021 | 14 4022 | 18 4023 | 18 4024 | 15 4025 | 18 4026 | 15 4027 | 15 4028 | 15 4029 | 15 4030 | 14 4031 | 10 4032 | 18 4033 | 18 4034 | 18 4035 | 18 4036 | 27 4037 | 28 4038 | 27 4039 | 31 4040 | 13 4041 | 13 4042 | 14 4043 | 18 4044 | 14 4045 | 14 4046 | 15 4047 | 15 4048 | 15 4049 | 15 4050 | 18 4051 | 18 4052 | 14 4053 | 14 4054 | 10 4055 | 10 4056 | 10 4057 | 18 4058 | 18 4059 | 16 4060 | 16 4061 | 16 4062 | 13 4063 | 14 4064 | 14 4065 | 18 4066 | 15 4067 | 18 4068 | 18 4069 | 18 4070 | 18 4071 | 18 4072 | 15 4073 | 18 4074 | 15 4075 | 18 4076 | 18 4077 | 18 4078 | 10 4079 | 10 4080 | 16 4081 | 15 4082 | 16 4083 | 16 4084 | 17 4085 | 15 4086 | 18 4087 | 18 4088 | 18 4089 | 18 4090 | 18 4091 | 14 4092 | 15 4093 | 18 4094 | 15 4095 | 10 4096 | 16 4097 | 17 4098 | 15 4099 | 18 4100 | 19 4101 | 19 4102 | 15 4103 | 15 4104 | 15 4105 | 15 4106 | 18 4107 | 18 4108 | 18 4109 | 15 4110 | 16 4111 | 15 4112 | 15 4113 | 18 4114 | 15 4115 | 18 4116 | 15 4117 | 15 4118 | 16 4119 | 10 4120 | 18 4121 | 18 4122 | 15 4123 | 15 4124 | 18 4125 | 18 4126 | 18 4127 | 15 4128 | 15 4129 | 18 4130 | 18 4131 | 18 4132 | 15 4133 | 15 4134 | 15 4135 | 12 4136 | 15 4137 | 10 4138 | 11 4139 | 10 4140 | 12 4141 | 22 4142 | 25 4143 | 10 4144 | 25 4145 | 22 4146 | 12 4147 | 13 4148 | 18 4149 | 25 4150 | 18 4151 | 12 4152 | 12 4153 | 14 4154 | 10 4155 | 19 4156 | 18 4157 | 16 4158 | 16 4159 | 15 4160 | 14 4161 | 14 4162 | 12 4163 | 15 4164 | 18 4165 | 10 4166 | 14 4167 | 10 4168 | 14 4169 | 10 4170 | 14 4171 | 14 4172 | 10 4173 | 15 4174 | 15 4175 | 15 4176 | 18 4177 | 18 4178 | 18 4179 | 18 4180 | 15 4181 | 18 4182 | 18 4183 | 18 4184 | 18 4185 | 18 4186 | 18 4187 | 18 4188 | 16 4189 | 20 4190 | 19 4191 | 18 4192 | 14 4193 | 14 4194 | 14 4195 | 15 4196 | 14 4197 | 15 4198 | 19 4199 | 15 4200 | 14 4201 | 15 4202 | 18 4203 | 18 4204 | 18 4205 | 18 4206 | 18 4207 | 17 4208 | 10 4209 | 25 4210 | 25 4211 | 25 4212 | 25 4213 | 25 4214 | 25 4215 | 25 4216 | 25 4217 | 25 4218 | 12 4219 | 12 4220 | 15 4221 | 15 4222 | 15 4223 | 19 4224 | 18 4225 | 19 4226 | 87 4227 | 19 4228 | 19 4229 | 18 4230 | 20 4231 | 18 4232 | 14 4233 | 18 4234 | 18 4235 | 15 4236 | 14 4237 | 15 4238 | 14 4239 | 10 4240 | 10 4241 | 18 4242 | 10 4243 | 10 4244 | 18 4245 | 14 4246 | 14 4247 | 10 4248 | 18 4249 | 10 4250 | 10 4251 | 18 4252 | 20 4253 | 18 4254 | 18 4255 | 18 4256 | 18 4257 | 18 4258 | 18 4259 | 19 4260 | 19 4261 | 19 4262 | 19 4263 | 14 4264 | 15 4265 | 14 4266 | 14 4267 | 14 4268 | 18 4269 | 18 4270 | 18 4271 | 18 4272 | 15 4273 | 25 4274 | 15 4275 | 15 4276 | 15 4277 | 18 4278 | 18 4279 | 14 4280 | 18 4281 | 19 4282 | 18 4283 | 18 4284 | 10 4285 | 19 4286 | 18 4287 | 16 4288 | 12 4289 | 18 4290 | 18 4291 | 15 4292 | 10 4293 | 18 4294 | 10 4295 | 14 4296 | 13 4297 | 14 4298 | 14 4299 | 13 4300 | 13 4301 | 13 4302 | 10 4303 | 13 4304 | 13 4305 | 18 4306 | 18 4307 | 14 4308 | 18 4309 | 14 4310 | 14 4311 | 18 4312 | 18 4313 | 18 4314 | 18 4315 | 18 4316 | 18 4317 | 14 4318 | 14 4319 | 14 4320 | 14 4321 | 14 4322 | 10 4323 | 15 4324 | 19 4325 | 19 4326 | 19 4327 | 19 4328 | 19 4329 | 19 4330 | 19 4331 | 19 4332 | 19 4333 | 14 4334 | 19 4335 | 15 4336 | 15 4337 | 14 4338 | 14 4339 | 18 4340 | 18 4341 | 18 4342 | 18 4343 | 18 4344 | 18 4345 | 15 4346 | 18 4347 | 18 4348 | 18 4349 | 18 4350 | 18 4351 | 25 4352 | 30 4353 | 18 4354 | 18 4355 | 18 4356 | 18 4357 | 18 4358 | 18 4359 | 18 4360 | 18 4361 | 18 4362 | 19 4363 | 16 4364 | 19 4365 | 19 4366 | 10 4367 | 18 4368 | 14 4369 | 14 4370 | 20 4371 | 14 4372 | 14 4373 | 14 4374 | 14 4375 | 14 4376 | 14 4377 | 14 4378 | 10 4379 | 14 4380 | 14 4381 | 18 4382 | 14 4383 | 10 4384 | 18 4385 | 18 4386 | 19 4387 | 18 4388 | 18 4389 | 18 4390 | 18 4391 | 18 4392 | 18 4393 | 18 4394 | 14 4395 | 14 4396 | 14 4397 | 15 4398 | 15 4399 | 15 4400 | 15 4401 | 18 4402 | 15 4403 | 15 4404 | 15 4405 | 15 4406 | 15 4407 | 15 4408 | 15 4409 | 18 4410 | 15 4411 | 26 4412 | 26 4413 | 12 4414 | 10 4415 | 21 4416 | 19 4417 | 19 4418 | 15 4419 | 15 4420 | 19 4421 | 15 4422 | 19 4423 | 12 4424 | 12 4425 | 12 4426 | 18 4427 | 18 4428 | 18 4429 | 18 4430 | 25 4431 | 25 4432 | 25 4433 | 12 4434 | 18 4435 | 18 4436 | 18 4437 | 18 4438 | 18 4439 | 18 4440 | 18 4441 | 25 4442 | 25 4443 | 25 4444 | 14 4445 | 14 4446 | 18 4447 | 14 4448 | 18 4449 | 18 4450 | 14 4451 | 14 4452 | 15 4453 | 18 4454 | 18 4455 | 18 4456 | 18 4457 | 18 4458 | 14 4459 | 14 4460 | 14 4461 | 18 4462 | 14 4463 | 10 4464 | 10 4465 | 12 4466 | 19 4467 | 15 4468 | 15 4469 | 18 4470 | 18 4471 | 14 4472 | 14 4473 | 14 4474 | 14 4475 | 15 4476 | 18 4477 | 18 4478 | 12 4479 | 12 4480 | 12 4481 | 10 4482 | 10 4483 | 12 4484 | 12 4485 | 28 4486 | 32 4487 | 30 4488 | 37 4489 | 10 4490 | 10 4491 | 18 4492 | 25 4493 | 25 4494 | 25 4495 | 12 4496 | 12 4497 | 15 4498 | 18 4499 | 15 4500 | 19 4501 | 19 4502 | 12 4503 | 18 4504 | 18 4505 | 18 4506 | 18 4507 | 18 4508 | 31 4509 | 31 4510 | 31 4511 | 18 4512 | 31 4513 | 31 4514 | 31 4515 | 12 4516 | 12 4517 | 12 4518 | 10 4519 | 10 4520 | 10 4521 | 18 4522 | 12 4523 | 25 4524 | 19 4525 | 10 4526 | 18 4527 | 18 4528 | 18 4529 | 18 4530 | 18 4531 | 18 4532 | 18 4533 | 25 4534 | 25 4535 | 18 4536 | 14 4537 | 14 4538 | 14 4539 | 13 4540 | 14 4541 | 14 4542 | 14 4543 | 14 4544 | 14 4545 | 18 4546 | 15 4547 | 15 4548 | 18 4549 | 15 4550 | 15 4551 | 18 4552 | 15 4553 | 15 4554 | 15 4555 | 18 4556 | 15 4557 | 18 4558 | 12 4559 | 12 4560 | 12 4561 | 12 4562 | 28 4563 | 29 4564 | 30 4565 | 27 4566 | 35 4567 | 27 4568 | 30 4569 | 18 4570 | 18 4571 | 20 4572 | 18 4573 | 18 4574 | 18 4575 | 12 4576 | 18 4577 | 25 4578 | 907 4579 | 18 4580 | 12 4581 | 12 4582 | 12 4583 | 19 4584 | 19 4585 | 19 4586 | 18 4587 | 18 4588 | 19 4589 | 19 4590 | 23 4591 | 31 4592 | 18 4593 | 31 4594 | 31 4595 | 31 4596 | 31 4597 | 31 4598 | 31 4599 | 24 4600 | 31 4601 | 31 4602 | 19 4603 | 18 4604 | 25 4605 | 13 4606 | 13 4607 | 14 4608 | 14 4609 | 18 4610 | 18 4611 | 10 4612 | 10 4613 | 10 4614 | 10 4615 | 10 4616 | 10 4617 | 10 4618 | 14 4619 | 18 4620 | 14 4621 | 12 4622 | 12 4623 | 25 4624 | 25 4625 | 13 4626 | 10 4627 | 10 4628 | 10 4629 | 10 4630 | 10 4631 | 10 4632 | 10 4633 | 10 4634 | 10 4635 | 10 4636 | 17 4637 | 18 4638 | 18 4639 | 18 4640 | 18 4641 | 18 4642 | 18 4643 | 15 4644 | 19 4645 | 19 4646 | 121 4647 | 13 4648 | 14 4649 | 18 4650 | 18 4651 | 18 4652 | 18 4653 | 18 4654 | 25 4655 | 14 4656 | 14 4657 | 14 4658 | 14 4659 | 15 4660 | 18 4661 | 15 4662 | 15 4663 | 18 4664 | 15 4665 | 15 4666 | 15 4667 | 15 4668 | 12 4669 | 26 4670 | 26 4671 | 23 4672 | 25 4673 | 18 4674 | 25 4675 | 19 4676 | 19 4677 | 15 4678 | 18 4679 | 19 4680 | 15 4681 | 14 4682 | 15 4683 | 14 4684 | 15 4685 | 18 4686 | 10 4687 | 10 4688 | 10 4689 | 12 4690 | 12 4691 | 10 4692 | 10 4693 | 18 4694 | 10 4695 | 10 4696 | 10 4697 | 14 4698 | 18 4699 | 18 4700 | 19 4701 | 18 4702 | 25 4703 | 14 4704 | 14 4705 | 14 4706 | 18 4707 | 15 4708 | 26 4709 | 26 4710 | 12 4711 | 12 4712 | 18 4713 | 19 4714 | 20 4715 | 20 4716 | 16 4717 | 15 4718 | 18 4719 | 18 4720 | 15 4721 | 18 4722 | 18 4723 | 18 4724 | 18 4725 | 18 4726 | 10 4727 | 10 4728 | 10 4729 | 15 4730 | 15 4731 | 19 4732 | 10 4733 | 14 4734 | 18 4735 | 18 4736 | 18 4737 | 18 4738 | 18 4739 | 15 4740 | 12 4741 | 20 4742 | 20 4743 | 22 4744 | 22 4745 | 18 4746 | 18 4747 | 19 4748 | 18 4749 | 18 4750 | 18 4751 | 18 4752 | 10 4753 | 18 4754 | 18 4755 | 18 4756 | 15 4757 | 19 4758 | 15 4759 | 20 4760 | 10 4761 | 10 4762 | 10 4763 | 10 4764 | 10 4765 | 18 4766 | 18 4767 | 18 4768 | 18 4769 | 18 4770 | 14 4771 | 14 4772 | 18 4773 | 10 4774 | 10 4775 | 10 4776 | 10 4777 | 10 4778 | 10 4779 | 10 4780 | 10 4781 | 10 4782 | 10 4783 | 10 4784 | 18 4785 | 21 4786 | 18 4787 | 18 4788 | 18 4789 | 18 4790 | 12 4791 | 12 4792 | 14 4793 | 14 4794 | 12 4795 | 18 4796 | 21 4797 | 18 4798 | 18 4799 | 18 4800 | 14 4801 | 18 4802 | 18 4803 | 18 4804 | 19 4805 | 18 4806 | 18 4807 | 18 4808 | 21 4809 | 18 4810 | 19 4811 | 19 4812 | 18 4813 | 18 4814 | 18 4815 | 12 4816 | 10 4817 | 10 4818 | 10 4819 | 10 4820 | 10 4821 | 10 4822 | 10 4823 | 10 4824 | 10 4825 | 25 4826 | 25 4827 | 25 4828 | 25 4829 | 25 4830 | 25 4831 | 25 4832 | 25 4833 | 25 4834 | 25 4835 | 12 4836 | 13 4837 | 12 4838 | 18 4839 | 18 4840 | 18 4841 | 18 4842 | 18 4843 | 18 4844 | 34 4845 | 12 4846 | 18 4847 | 15 4848 | 22 4849 | 22 4850 | 22 4851 | 22 4852 | 12 4853 | 12 4854 | 12 4855 | 12 4856 | 12 4857 | 12 4858 | 12 4859 | 12 4860 | 12 4861 | 25 4862 | 25 4863 | 25 4864 | 17 4865 | 15 4866 | 12 4867 | 12 4868 | 12 4869 | 18 4870 | 11 4871 | 10 4872 | 23 4873 | 31 4874 | 14 4875 | 14 4876 | 18 4877 | 14 4878 | 10 4879 | 27 4880 | 19 4881 | 12 4882 | 19 4883 | 12 4884 | 12 4885 | 18 4886 | 16 4887 | 18 4888 | 10 4889 | 12 4890 | 16 4891 | 10 4892 | 18 4893 | 24 4894 | 18 4895 | 14 4896 | 10 4897 | 12 4898 | 13 4899 | 10 4900 | 12 4901 | 12 4902 | 12 4903 | 12 4904 | 25 4905 | 23 4906 | 18 4907 | 19 4908 | 19 4909 | 19 4910 | 19 4911 | 19 4912 | 19 4913 | 19 4914 | 18 4915 | 18 4916 | 15 4917 | 19 4918 | 19 4919 | 19 4920 | 16 4921 | 15 4922 | 15 4923 | 15 4924 | 15 4925 | 15 4926 | 18 4927 | 15 4928 | 15 4929 | 15 4930 | 15 4931 | 15 4932 | 15 4933 | 25 4934 | 25 4935 | 15 4936 | 15 4937 | 18 4938 | 14 4939 | 14 4940 | 19 4941 | 19 4942 | 19 4943 | 19 4944 | 19 4945 | 16 4946 | 21 4947 | 18 4948 | 19 4949 | 18 4950 | 18 4951 | 16 4952 | 14 4953 | 14 4954 | 15 4955 | 15 4956 | 14 4957 | 15 4958 | 15 4959 | 15 4960 | 15 4961 | 15 4962 | 14 4963 | 15 4964 | 12 4965 | 15 4966 | 18 4967 | 18 4968 | 18 4969 | 18 4970 | 18 4971 | 18 4972 | 18 4973 | 18 4974 | 18 4975 | 18 4976 | 18 4977 | 19 4978 | 18 4979 | 18 4980 | 18 4981 | 18 4982 | 18 4983 | 18 4984 | 18 4985 | 14 4986 | 14 4987 | 18 4988 | 14 4989 | 15 4990 | 15 4991 | 12 4992 | 18 4993 | 18 4994 | 102 4995 | 520 4996 | 10 4997 | 25 4998 | 26 4999 | 25 5000 | 25 5001 | 25 5002 | 20 5003 | 12 5004 | 10 5005 | 25 5006 | 25 5007 | 25 5008 | 25 5009 | 25 5010 | 25 5011 | 25 5012 | 19 5013 | 12 5014 | 12 5015 | 12 5016 | 12 5017 | 15 5018 | 14 5019 | 15 5020 | 15 5021 | 15 5022 | 18 5023 | 18 5024 | 18 5025 | 18 5026 | 18 5027 | 18 5028 | 25 5029 | 25 5030 | 25 5031 | 22 5032 | 22 5033 | 18 5034 | 12 5035 | 12 5036 | 12 5037 | 12 5038 | 12 5039 | 12 5040 | 12 5041 | 12 5042 | 18 5043 | 31 5044 | 31 5045 | 31 5046 | 31 5047 | 31 5048 | 12 5049 | 18 5050 | 18 5051 | 27 5052 | 12 5053 | 12 5054 | 12 5055 | 12 5056 | 18 5057 | 18 5058 | 90 5059 | 19 5060 | 19 5061 | 31 5062 | 12 5063 | 12 5064 | 12 5065 | 12 5066 | 12 5067 | 18 5068 | 12 5069 | 16 5070 | 18 5071 | 18 5072 | 20 5073 | 12 5074 | 12 5075 | 12 5076 | 12 5077 | 12 5078 | 18 5079 | 19 5080 | 18 5081 | 18 5082 | 18 5083 | 18 5084 | 19 5085 | 16 5086 | 16 5087 | 18 5088 | 18 5089 | 18 5090 | 16 5091 | 22 5092 | 16 5093 | 16 5094 | 16 5095 | 21 5096 | 14 5097 | 18 5098 | 18 5099 | 12 5100 | 12 5101 | 12 5102 | 15 5103 | 15 5104 | 18 5105 | 18 5106 | 18 5107 | 18 5108 | 25 5109 | 10 5110 | 10 5111 | 13 5112 | 14 5113 | 18 5114 | 18 5115 | 18 5116 | 18 5117 | 19 5118 | 19 5119 | 18 5120 | 19 5121 | 18 5122 | 18 5123 | 18 5124 | 18 5125 | 18 5126 | 18 5127 | 18 5128 | 11 5129 | 18 5130 | 18 5131 | 18 5132 | 14 5133 | 14 5134 | 14 5135 | 18 5136 | 11 5137 | 12 5138 | 12 5139 | 12 5140 | 18 5141 | 18 5142 | 15 5143 | 18 5144 | 15 5145 | 15 5146 | 18 5147 | 20 5148 | 20 5149 | 20 5150 | 25 5151 | 25 5152 | 25 5153 | 12 5154 | 12 5155 | 12 5156 | 12 5157 | 12 5158 | 18 5159 | 18 5160 | 18 5161 | 18 5162 | 18 5163 | 19 5164 | 18 5165 | 25 5166 | 25 5167 | 26 5168 | 25 5169 | 25 5170 | 25 5171 | 25 5172 | 25 5173 | 25 5174 | 25 5175 | 25 5176 | 25 5177 | 25 5178 | 25 5179 | 25 5180 | 25 5181 | 25 5182 | 25 5183 | 25 5184 | 22 5185 | 22 5186 | 22 5187 | 25 5188 | 22 5189 | 12 5190 | 20 5191 | 12 5192 | 31 5193 | 31 5194 | 16 5195 | 30 5196 | 31 5197 | 414 5198 | 12 5199 | 18 5200 | 18 5201 | 18 5202 | 19 5203 | 18 5204 | 18 5205 | 18 5206 | 18 5207 | 18 5208 | 18 5209 | 18 5210 | 18 5211 | 18 5212 | 25 5213 | 18 5214 | 12 5215 | 12 5216 | 12 5217 | 12 5218 | 12 5219 | 12 5220 | 12 5221 | 12 5222 | 18 5223 | 18 5224 | 16 5225 | 19 5226 | 19 5227 | 19 5228 | 31 5229 | 31 5230 | 31 5231 | 31 5232 | 31 5233 | 31 5234 | 31 5235 | 18 5236 | 18 5237 | 18 5238 | 18 5239 | 18 5240 | 18 5241 | 20 5242 | 12 5243 | 12 5244 | 12 5245 | 18 5246 | 18 5247 | 18 5248 | 18 5249 | 18 5250 | 18 5251 | 18 5252 | 18 5253 | 18 5254 | 18 5255 | 18 5256 | 18 5257 | 18 5258 | 18 5259 | 19 5260 | 19 5261 | 19 5262 | 18 5263 | 18 5264 | 19 5265 | 16 5266 | 26 5267 | 18 5268 | 18 5269 | 18 5270 | 18 5271 | 18 5272 | 18 5273 | 18 5274 | 18 5275 | 18 5276 | 18 5277 | 18 5278 | 18 5279 | 18 5280 | 18 5281 | 18 5282 | 16 5283 | 24 5284 | 23 5285 | 32 5286 | 23 5287 | 25 5288 | 24 5289 | 27 5290 | 24 5291 | 24 5292 | 21 5293 | 24 5294 | 22 5295 | 16 5296 | 14 5297 | 18 5298 | 18 5299 | 18 5300 | 14 5301 | 18 5302 | 15 5303 | 15 5304 | 15 5305 | 18 5306 | 87 5307 | 14 5308 | 12 5309 | 18 5310 | 18 5311 | 18 5312 | 18 5313 | 18 5314 | 25 5315 | 14 5316 | 18 5317 | 18 5318 | 18 5319 | 12 5320 | 12 5321 | 12 5322 | 14 5323 | 20 5324 | 20 5325 | 20 5326 | 20 5327 | 12 5328 | 18 5329 | 18 5330 | 18 5331 | 19 5332 | 18 5333 | 19 5334 | 15 5335 | 20 5336 | 25 5337 | 25 5338 | 25 5339 | 25 5340 | 25 5341 | 25 5342 | 16 5343 | 25 5344 | 18 5345 | 12 5346 | 18 5347 | 25 5348 | 12 5349 | 12 5350 | 18 5351 | 18 5352 | 18 5353 | 18 5354 | 18 5355 | 18 5356 | 18 5357 | 18 5358 | 18 5359 | 16 5360 | 16 5361 | 20 5362 | 19 5363 | 19 5364 | 31 5365 | 32 5366 | 160 5367 | 31 5368 | 31 5369 | 31 5370 | 31 5371 | 31 5372 | 31 5373 | 79 5374 | 31 5375 | 31 5376 | 1171 5377 | 12 5378 | 18 5379 | 18 5380 | 18 5381 | 18 5382 | 12 5383 | 18 5384 | 18 5385 | 18 5386 | 18 5387 | 18 5388 | 19 5389 | 19 5390 | 19 5391 | 18 5392 | 18 5393 | 18 5394 | 18 5395 | 16 5396 | 16 5397 | 20 5398 | 17 5399 | 18 5400 | 18 5401 | 18 5402 | 18 5403 | 18 5404 | 19 5405 | 18 5406 | 18 5407 | 18 5408 | 18 5409 | 18 5410 | 19 5411 | 14 5412 | 160 5413 | 122 5414 | 282 5415 | 160 5416 | 18 5417 | 14 5418 | 18 5419 | 19 5420 | 19 5421 | 25 5422 | 14 5423 | 14 5424 | 19 5425 | 19 5426 | 19 5427 | 19 5428 | 19 5429 | 19 5430 | 19 5431 | 19 5432 | 19 5433 | 19 5434 | 19 5435 | 25 5436 | 25 5437 | 25 5438 | 18 5439 | 18 5440 | 12 5441 | 12 5442 | 14 5443 | 19 5444 | 19 5445 | 19 5446 | 19 5447 | 19 5448 | 19 5449 | 18 5450 | 18 5451 | 18 5452 | 15 5453 | 20 5454 | 20 5455 | 25 5456 | 25 5457 | 25 5458 | 25 5459 | 18 5460 | 19 5461 | 19 5462 | 19 5463 | 19 5464 | 19 5465 | 19 5466 | 19 5467 | 18 5468 | 19 5469 | 19 5470 | 18 5471 | 20 5472 | 20 5473 | 20 5474 | 15 5475 | 16 5476 | 19 5477 | 19 5478 | 14 5479 | 15 5480 | 43 5481 | 34 5482 | 31 5483 | 31 5484 | 31 5485 | 31 5486 | 31 5487 | 31 5488 | 32 5489 | 19 5490 | 18 5491 | 19 5492 | 18 5493 | 18 5494 | 18 5495 | 18 5496 | 12 5497 | 18 5498 | 12 5499 | 13 5500 | 12 5501 | 12 5502 | 18 5503 | 18 5504 | 18 5505 | 18 5506 | 18 5507 | 18 5508 | 18 5509 | 18 5510 | 18 5511 | 18 5512 | 18 5513 | 19 5514 | 18 5515 | 18 5516 | 25 5517 | 25 5518 | 18 5519 | 18 5520 | 18 5521 | 18 5522 | 18 5523 | 16 5524 | 16 5525 | 16 5526 | 16 5527 | 16 5528 | 16 5529 | 18 5530 | 18 5531 | 19 5532 | 19 5533 | 18 5534 | 22 5535 | 18 5536 | 19 5537 | 18 5538 | 18 5539 | 18 5540 | 18 5541 | 18 5542 | 18 5543 | 21 5544 | 18 5545 | 18 5546 | 18 5547 | 14 5548 | 14 5549 | 14 5550 | 19 5551 | 18 5552 | 14 5553 | 14 5554 | 14 5555 | 19 5556 | 19 5557 | 19 5558 | 19 5559 | 19 5560 | 19 5561 | 20 5562 | 19 5563 | 20 5564 | 19 5565 | 23 5566 | 19 5567 | 19 5568 | 19 5569 | 20 5570 | 20 5571 | 25 5572 | 25 5573 | 26 5574 | 25 5575 | 18 5576 | 18 5577 | 25 5578 | 18 5579 | 18 5580 | 18 5581 | 18 5582 | 18 5583 | 18 5584 | 97 5585 | 18 5586 | 20 5587 | 20 5588 | 20 5589 | 20 5590 | 16 5591 | 16 5592 | 19 5593 | 19 5594 | 25 5595 | 19 5596 | 43 5597 | 43 5598 | 25 5599 | 25 5600 | 20 5601 | 25 5602 | 25 5603 | 18 5604 | 19 5605 | 19 5606 | 19 5607 | 19 5608 | 19 5609 | 19 5610 | 35 5611 | 35 5612 | 35 5613 | 35 5614 | 35 5615 | 35 5616 | 35 5617 | 35 5618 | 33 5619 | 18 5620 | 19 5621 | 18 5622 | 18 5623 | 18 5624 | 25 5625 | 25 5626 | 18 5627 | 18 5628 | 12 5629 | 12 5630 | 12 5631 | 25 5632 | 18 5633 | 18 5634 | 20 5635 | 18 5636 | 18 5637 | 20 5638 | 308 5639 | 25 5640 | 18 5641 | 18 5642 | 18 5643 | 19 5644 | 19 5645 | 19 5646 | 19 5647 | 19 5648 | 18 5649 | 18 5650 | 18 5651 | 18 5652 | 18 5653 | 18 5654 | 18 5655 | 18 5656 | 18 5657 | 18 5658 | 18 5659 | 18 5660 | 18 5661 | 18 5662 | 18 5663 | 18 5664 | 18 5665 | 14 5666 | 14 5667 | 18 5668 | 18 5669 | 18 5670 | 18 5671 | 18 5672 | 14 5673 | 19 5674 | 20 5675 | 24 5676 | 19 5677 | 19 5678 | 20 5679 | 24 5680 | 24 5681 | 19 5682 | 20 5683 | 20 5684 | 25 5685 | 25 5686 | 18 5687 | 18 5688 | 18 5689 | 89 5690 | 20 5691 | 15 5692 | 12 5693 | 12 5694 | 12 5695 | 12 5696 | 12 5697 | 12 5698 | 18 5699 | 19 5700 | 19 5701 | 19 5702 | 25 5703 | 20 5704 | 18 5705 | 25 5706 | 18 5707 | 19 5708 | 19 5709 | 18 5710 | 18 5711 | 31 5712 | 18 5713 | 18 5714 | 18 5715 | 35 5716 | 12 5717 | 18 5718 | 15 5719 | 18 5720 | 18 5721 | 18 5722 | 18 5723 | 18 5724 | 20 5725 | 18 5726 | 18 5727 | 19 5728 | 18 5729 | 18 5730 | 26 5731 | 18 5732 | 18 5733 | 19 5734 | 18 5735 | 18 5736 | 19 5737 | 19 5738 | 19 5739 | 19 5740 | 18 5741 | 18 5742 | 14 5743 | 18 5744 | 14 5745 | 14 5746 | 18 5747 | 19 5748 | 19 5749 | 19 5750 | 19 5751 | 19 5752 | 19 5753 | 19 5754 | 19 5755 | 8048 5756 | 20 5757 | 20 5758 | 25 5759 | 25 5760 | 25 5761 | 25 5762 | 18 5763 | 59 5764 | 59 5765 | 20 5766 | 15 5767 | 18 5768 | 19 5769 | 25 5770 | 25 5771 | 15 5772 | 25 5773 | 25 5774 | 18 5775 | 18 5776 | 18 5777 | 18 5778 | 19 5779 | 19 5780 | 18 5781 | 19 5782 | 31 5783 | 31 5784 | 31 5785 | 31 5786 | 12 5787 | 18 5788 | 19 5789 | 15 5790 | 18 5791 | 18 5792 | 15 5793 | 15 5794 | 19 5795 | 18 5796 | 255 5797 | 18 5798 | 18 5799 | 19 5800 | 18 5801 | 18 5802 | 18 5803 | 89 5804 | 18 5805 | 18 5806 | 18 5807 | 18 5808 | 26 5809 | 26 5810 | 26 5811 | 26 5812 | 18 5813 | 18 5814 | 18 5815 | 18 5816 | 19 5817 | 18 5818 | 18 5819 | 18 5820 | 18 5821 | 18 5822 | 18 5823 | 18 5824 | 18 5825 | 18 5826 | 18 5827 | 18 5828 | 16 5829 | 18 5830 | 18 5831 | 18 5832 | 18 5833 | 18 5834 | 2620 5835 | 25 5836 | 25 5837 | 25 5838 | 15 5839 | 15 5840 | 18 5841 | 19 5842 | 19 5843 | 19 5844 | 19 5845 | 19 5846 | -------------------------------------------------------------------------------- /stat_plot/test/data_scatter/test_afl.txt: -------------------------------------------------------------------------------- 1 | 10:1063 2 | 11:92 3 | 12:1056 4 | 13:194 5 | 14:266 6 | 15:434 7 | 16:171 8 | 17:43 9 | 18:740 10 | 19:356 11 | 20:367 12 | 21:161 13 | 22:37 14 | 23:35 15 | 24:7 16 | 25:406 17 | 26:215 18 | 27:34 19 | 28:34 20 | 29:32 21 | 30:3 22 | 31:7 23 | 32:6 24 | 33:4 25 | 34:2 26 | 36:25 27 | 38:5 28 | 39:4 29 | 40:4 30 | 41:2 31 | 42:2 32 | 43:1 33 | 44:4 34 | 46:1 35 | 49:2 36 | 50:3 37 | 51:1 38 | 52:1 39 | 53:3 40 | 54:1 41 | 55:1 42 | 57:2 43 | 59:1 44 | 60:2 45 | 61:2 46 | 63:2 47 | 67:1 48 | 68:1 49 | 69:1 50 | 73:1 51 | 74:1 52 | 1037:1 53 | 80:2 54 | 351:1 55 | 99:1 56 | 100:3 57 | 104:1 58 | 110:1 59 | 113:1 60 | 1146:1 61 | 123:1 62 | 132:1 63 | 135:1 64 | 141:1 65 | 143:1 66 | 28056:1 67 | 152:1 68 | 1092:1 69 | 154:3 70 | 667:1 71 | 3484:1 72 | 1950:1 73 | 161:1 74 | 1443:1 75 | 4260:1 76 | 168:2 77 | 1194:1 78 | 171:1 79 | 175:1 80 | 186:1 81 | 6851:1 82 | 975:1 83 | 1494:1 84 | 249:1 85 | 218:1 86 | 1508:1 87 | 505:1 88 | -------------------------------------------------------------------------------- /stat_plot/test/data_scatter/test_aflfast.txt: -------------------------------------------------------------------------------- 1 | 282:1 2 | 520:1 3 | 10:1157 4 | 267:1 5 | 12:906 6 | 13:170 7 | 14:474 8 | 15:462 9 | 16:244 10 | 17:62 11 | 18:1093 12 | 19:391 13 | 20:109 14 | 21:50 15 | 22:67 16 | 23:44 17 | 24:27 18 | 25:265 19 | 26:41 20 | 27:35 21 | 28:14 22 | 29:10 23 | 30:10 24 | 31:57 25 | 32:8 26 | 33:3 27 | 34:2 28 | 35:11 29 | 36:3 30 | 37:4 31 | 39:3 32 | 41:1 33 | 42:2 34 | 43:4 35 | 44:1 36 | 45:1 37 | 48:1 38 | 49:1 39 | 50:1 40 | 51:1 41 | 308:1 42 | 414:1 43 | 54:2 44 | 55:1 45 | 59:2 46 | 2620:1 47 | 62:2 48 | 192:1 49 | 160:3 50 | 11:77 51 | 79:1 52 | 87:2 53 | 89:2 54 | 90:1 55 | 97:1 56 | 102:1 57 | 232:1 58 | 907:1 59 | 109:1 60 | 8048:1 61 | 1171:1 62 | 121:1 63 | 122:1 64 | 255:1 65 | -------------------------------------------------------------------------------- /stat_plot/test/data_scatter/test_perffuzz.txt: -------------------------------------------------------------------------------- 1 | 3073:1 2 | 1027:1 3 | 2663:1 4 | 10:1980 5 | 11:181 6 | 12:2085 7 | 13:202 8 | 14:269 9 | 15:362 10 | 16:36 11 | 17:17 12 | 18:260 13 | 19:77 14 | 532:1 15 | 21:24 16 | 22:8 17 | 23:16 18 | 24:5 19 | 25:316 20 | 26:11 21 | 539:3 22 | 28:1 23 | 29:3 24 | 1054:1 25 | 31:3 26 | 32:5 27 | 545:1 28 | 35:4 29 | 36:3 30 | 37:1 31 | 38:2 32 | 39:12 33 | 2088:1 34 | 41:1 35 | 42:4 36 | 43:2 37 | 44:5 38 | 1069:1 39 | 46:5 40 | 560:1 41 | 49:2 42 | 50:1 43 | 51:3 44 | 52:1 45 | 53:1 46 | 55:1 47 | 56:1 48 | 58:1 49 | 61:1 50 | 62:2 51 | 63:3 52 | 481:1 53 | 577:1 54 | 66:1 55 | 67:1 56 | 70:1 57 | 71:1 58 | 72:1 59 | 73:2 60 | 74:2 61 | 76:3 62 | 2125:1 63 | 79:1 64 | 80:1 65 | 81:2 66 | 82:3 67 | 1619:1 68 | 84:1 69 | 86:1 70 | 2647:1 71 | 88:3 72 | 7743:1 73 | 1114:1 74 | 91:1 75 | 92:2 76 | 97:1 77 | 98:1 78 | 99:2 79 | 100:2 80 | 6245:1 81 | 102:1 82 | 103:1 83 | 104:3 84 | 105:1 85 | 106:2 86 | 107:2 87 | 109:15 88 | 111:11 89 | 113:14 90 | 531:2 91 | 116:1 92 | 4725:1 93 | 118:1 94 | 119:3 95 | 120:2 96 | 20:32 97 | 123:1 98 | 24700:1 99 | 126:10 100 | 533:1 101 | 128:8 102 | 129:6 103 | 130:5 104 | 1131:1 105 | 132:1 106 | 133:2 107 | 1159:1 108 | 137:2 109 | 138:1 110 | 6795:1 111 | 192:1 112 | 141:1 113 | 142:8 114 | 8847:1 115 | 144:2 116 | 145:1 117 | 147:7 118 | 90:4 119 | 149:1 120 | 281:47 121 | 20122:1 122 | 2927:4 123 | 156:1 124 | 795:1 125 | 164:2 126 | 165:2 127 | 1308:1 128 | 1710:1 129 | 8883:1 130 | 30:5 131 | 1796:2 132 | 40:5 133 | 697:1 134 | 1722:1 135 | 2069:1 136 | 117:1 137 | 3416:1 138 | 6944:1 139 | 3740:1 140 | 4804:1 141 | 1151:1 142 | 204:1 143 | 5325:1 144 | 206:1 145 | 208:1 146 | 721:1 147 | 210:2 148 | 213:1 149 | 5334:1 150 | 215:2 151 | 728:1 152 | 548:1 153 | 174:1 154 | 4440:1 155 | 1505:1 156 | 4065:1 157 | 228:2 158 | 7911:1 159 | 5355:1 160 | 241:3 161 | 8435:1 162 | 7697:1 163 | 246:1 164 | 127:1 165 | 5845:1 166 | 7938:1 167 | 260:1 168 | 214:1 169 | 266:1 170 | 4311:1 171 | 781:1 172 | 77:2 173 | 45:1 174 | 3346:1 175 | 131:1 176 | 7272:1 177 | 155:1 178 | 283:1 179 | 284:5 180 | 288:1 181 | 48:1 182 | 290:1 183 | 1315:1 184 | 6438:1 185 | 807:1 186 | 297:1 187 | 3884:1 188 | 5426:1 189 | 814:1 190 | 3887:1 191 | 27:4 192 | 305:1 193 | 306:1 194 | 309:1 195 | 5769:1 196 | 8505:1 197 | 826:1 198 | 315:1 199 | 3210:1 200 | 8001:1 201 | 139:7 202 | 23876:1 203 | 4577:1 204 | 1352:1 205 | 5965:1 206 | 5967:1 207 | 1080:1 208 | 4946:1 209 | 20308:1 210 | 654:1 211 | 856:1 212 | 4410:1 213 | 349:1 214 | 4958:1 215 | 354:1 216 | 1379:1 217 | 868:1 218 | 362:1 219 | 1899:1 220 | 7022:1 221 | 1341:1 222 | 1000:1 223 | 6514:1 224 | 884:1 225 | 574:1 226 | 1911:1 227 | 27003:1 228 | 26492:1 229 | 7550:1 230 | 6527:1 231 | 8312:1 232 | 5000:1 233 | 4499:1 234 | 1432:1 235 | 6043:1 236 | 413:1 237 | 8611:1 238 | 8612:1 239 | 421:1 240 | 422:4 241 | 425:1 242 | 8690:1 243 | 6062:1 244 | 87:2 245 | 6580:1 246 | 3000:1 247 | 1465:1 248 | 443:1 249 | 446:9 250 | 508:4 251 | 969:1 252 | 1115:1 253 | 333:1 254 | 471:18 255 | 2520:1 256 | 8161:1 257 | 2019:1 258 | 3560:1 259 | 489:1 260 | 497:2 261 | 5618:1 262 | 12282:1 263 | 6911:1 264 | 8188:1 265 | -------------------------------------------------------------------------------- /stat_plot/test/statistics.csv: -------------------------------------------------------------------------------- 1 | haha,hehe,gaga,gege 2 | 2.55140,4.31765,7.83499,3.79665 3 | 3.99810,1.57894,9.88904,3.24420 4 | 8.54579,6.02648,8.40535,8.91523 5 | 0.02654,4.19968,6.74083,4.29216 6 | 5.22639,6.92802,8.72477,3.10729 7 | 6.18859,0.60225,7.86978,3.38870 8 | 3.61440,4.25484,5.73651,2.34155 9 | 3.99494,8.31530,8.93549,1.99480 10 | 1.50198,4.30140,7.02114,5.45818 11 | 3.78433,3.03363,8.48128,5.06236 12 | -------------------------------------------------------------------------------- /stat_plot/test/test_boxplot.toml: -------------------------------------------------------------------------------- 1 | [fuzzers] 2 | # sub-tables use "." to connect 3 | [fuzzers.afl] 4 | data_files = [ 5 | "test/data_boxplot/out_afl.txt" 6 | ] 7 | line_style = "dashed" 8 | box_color = "xkcd:slate blue" 9 | 10 | [fuzzers.aflfast] 11 | data_files = [ 12 | "test/data_boxplot/out_aflfast.txt" 13 | ] 14 | line_style = "dashdot" 15 | box_color = "xkcd:olive yellow" 16 | 17 | [fuzzers.cerebro] 18 | data_files = [ 19 | "test/data_boxplot/out_cerebro.txt" 20 | ] 21 | line_style = "solid" 22 | box_color = "xkcd:scarlet" 23 | 24 | [misc] 25 | out_dir = "test/out_boxplot" 26 | file_postfix = "-time-to-exposure" 27 | project = "mjs-bug1" 28 | stat_type = "boxplot" 29 | notch = false 30 | plot_title = "mjs-bug1 time-to-exposure (hour)" 31 | ylim = [0, 20] -------------------------------------------------------------------------------- /stat_plot/test/test_confgen.toml: -------------------------------------------------------------------------------- 1 | bucket = "min" 2 | # confidence interval to be used 3 | confidence_lvl = 0.95 4 | # out_dir = "out/plots-1/djpeg-edge" 5 | # ylabel = "edge N.O." 6 | # file_postfix = "-edge-time" 7 | # project = "djpeg" 8 | # max_time is in hours 9 | max_time = 24 10 | stat_type = "overall" 11 | large_font = true 12 | no_legend = false 13 | y_start_0 = true 14 | x_log_scale = false 15 | y_log_scale = false 16 | 17 | # the base dir to search the datagen files from 18 | #base_dir = "out" 19 | #out_dir = "out/plots-1/test" 20 | 21 | # must be UNIQUE (uniq identifier on the path of the output dir for the fuzzer); can use regex pattern 22 | fuzzer_sigs = [ 23 | "/greedy\\d+/", 24 | # "/la-greedy\\d+/", 25 | # "/greedy-rr\\d+/", 26 | # "/la-greedy-rr\\d+/", 27 | # "/random-rr\\d+/", 28 | "/random\\d+/", 29 | "/exp3\\d+/", 30 | # "/la-exp3\\d+/", 31 | # "/fixed\\d+/" 32 | # "/greedy_ts15m\\d+/", 33 | # "/random_ts15m\\d+/", 34 | # "/exp3_ts15m\\d+/", 35 | # "/la-greedy_ts15m\\d+/", 36 | # "/random-rr_ts15m\\d+/", 37 | # "/la-exp3_ts15m\\d+/", 38 | # "/greedy_ts1h\\d+/", 39 | # "/random_ts1h\\d+/", 40 | # "/exp3_ts1h\\d+/", 41 | # "/la-greedy_ts1h\\d+/", 42 | # "/random-rr_ts1h\\d+/", 43 | # "/la-exp3_ts1h\\d+/", 44 | ] 45 | # may not be uniq 46 | fuzzer_names = [ 47 | "greedy_ts30m", 48 | # "la-greedy_ts30m", 49 | # "greedy-rr_ts30m", 50 | # "la-greedy-rr_ts30m", 51 | # "random-rr_ts30m", 52 | "random_ts30m", 53 | "exp3_ts30m", 54 | # "la-exp3_ts30m", 55 | # "fixed_ts30m" 56 | # "greedy_ts15m", 57 | # "random_ts15m", 58 | # "exp3_ts15m", 59 | # "la-greedy_ts15m", 60 | # "random-rr_ts15m", 61 | # "la-exp3_ts15m", 62 | # "greedy_ts1h", 63 | # "random_ts1h", 64 | # "exp3_ts1h", 65 | # "la-greedy_ts1h", 66 | # "random-rr_ts1h", 67 | # "la-exp3_ts1h", 68 | ] 69 | fuzzer_line_styles = [ 70 | "solid", 71 | "dashed", 72 | "dashdot", 73 | # "solid", 74 | # "dashed", 75 | # "dashdot", 76 | # "solid", 77 | # "dashed", 78 | # "dashdot" 79 | ] 80 | fuzzer_line_colors = [ 81 | "xkcd:scarlet", 82 | # "xkcd:deep red", 83 | # "xkcd:wine red", 84 | "xkcd:olive yellow", 85 | # "xkcd:dirty yellow", 86 | # "xkcd:bright yellow", 87 | "xkcd:slate blue", 88 | # "xkcd:sea blue", 89 | # "xkcd:green blue" 90 | ] 91 | 92 | # must be UNIQUE 93 | target_sigs = [ 94 | "objcopy-2.32", 95 | "objdump-2.32", 96 | "lame-3.99.5", 97 | "nm-2.32", 98 | # "exiv2-0.26", 99 | "djpeg-1.5.3", 100 | # "size-2.32", 101 | "readelf-2.32", 102 | # "tcpdump-5830e58aa0", 103 | # "sam2p-0.49.4", 104 | "tiff2bw-4.0.10", 105 | "tiff2ps-4.0.10", 106 | "xmllint-2.9.9", 107 | "flvmeta-1.2.1", 108 | # "radare2-5.5.4", 109 | # "MP4Box-41e48716e0", 110 | ] 111 | target_names = [ 112 | "objcopy-2.32", 113 | "objdump-2.32", 114 | "lame-3.99.5", 115 | "nm-2.32", 116 | # "exiv2-0.26", 117 | "djpeg-1.5.3", 118 | # "size-2.32", 119 | "readelf-2.32", 120 | # "tcpdump-5830e58aa0", 121 | # "sam2p-0.49.4", 122 | "tiff2bw-4.0.10", 123 | "tiff2ps-4.0.10", 124 | "xmllint-2.9.9", 125 | "flvmeta-1.2.1", 126 | # "radare2-5.5.4", 127 | # "MP4Box-41e48716e0", 128 | ] 129 | 130 | # the filename can have wildcard 131 | objective_filenames = [ 132 | "edge_fuzz_time.txt", 133 | "crash_fuzz_time.txt" 134 | ] 135 | # collect edge or crash? 136 | objectives = [ 137 | "edge", 138 | "crash" 139 | ] 140 | objective_y_labels = [ 141 | "edge N.O.", 142 | "crash N.O." 143 | ] 144 | file_postfixes = [ 145 | "-edge-time", 146 | "-crash-time" 147 | ] 148 | 149 | -------------------------------------------------------------------------------- /stat_plot/test/test_config.toml: -------------------------------------------------------------------------------- 1 | [fuzzers] 2 | # sub-tables use "." to connect 3 | [fuzzers.cerebro] 4 | # the content in data files are "time(sec):data number" 5 | data_files = [ 6 | "test/data/cerebro/out-0.txt", 7 | "test/data/cerebro/out-1.txt", 8 | "test/data/cerebro/out-2.txt", 9 | "test/data/cerebro/out-3.txt", 10 | "test/data/cerebro/out-4.txt", 11 | "test/data/cerebro/out-5.txt", 12 | "test/data/cerebro/out-6.txt", 13 | "test/data/cerebro/out-7.txt", 14 | "test/data/cerebro/out-8.txt", 15 | "test/data/cerebro/out-9.txt" 16 | ] 17 | line_style = "solid" 18 | line_color = "xkcd:scarlet" 19 | 20 | [fuzzers.afl] 21 | # the content in data files are "time(sec):data number" 22 | data_files = [ 23 | "test/data/afl/out-0.txt", 24 | "test/data/afl/out-1.txt", 25 | "test/data/afl/out-2.txt", 26 | "test/data/afl/out-3.txt", 27 | "test/data/afl/out-4.txt", 28 | "test/data/afl/out-5.txt", 29 | "test/data/afl/out-6.txt", 30 | "test/data/afl/out-7.txt", 31 | "test/data/afl/out-8.txt", 32 | "test/data/afl/out-9.txt" 33 | ] 34 | line_style = "dashed" 35 | line_color = "xkcd:slate blue" 36 | 37 | [fuzzers.aflfast] 38 | # the content in data files are "time(sec):data number" 39 | data_files = [ 40 | "test/data/aflfast/out-0.txt", 41 | "test/data/aflfast/out-1.txt", 42 | "test/data/aflfast/out-2.txt", 43 | "test/data/aflfast/out-3.txt", 44 | "test/data/aflfast/out-4.txt", 45 | "test/data/aflfast/out-5.txt", 46 | "test/data/aflfast/out-6.txt", 47 | "test/data/aflfast/out-7.txt", 48 | "test/data/aflfast/out-8.txt", 49 | "test/data/aflfast/out-9.txt" 50 | ] 51 | line_style = "dashdot" 52 | line_color = "xkcd:olive yellow" 53 | 54 | [misc] 55 | # should be one of the followings: "sec", "s", "min", "m", "hour", "h" 56 | bucket = "min" 57 | # confidence interval to be used 58 | confidence_lvl = 0.95 59 | out_dir = "test/out" 60 | ylabel = "edge N.O." 61 | file_postfix = "-edge-time" 62 | project = "mjs" 63 | # max_time is in hours 64 | max_time = 24 65 | stat_type = "overall" 66 | large_font = false 67 | no_legend = false 68 | y_start_0 = true 69 | x_log_scale = false 70 | y_log_scale = true -------------------------------------------------------------------------------- /stat_plot/test/test_draw_boxplot.toml: -------------------------------------------------------------------------------- 1 | # only for the config filename, not the path! 2 | config_sigs = [ 3 | '.*-edge.toml', 4 | # '.*-crash.toml' 5 | ] 6 | 7 | # in seconds 8 | data_points = [ 9 | 14400, 10 | 43200, 11 | 86400 12 | ] 13 | 14 | # the color palette 15 | # https://i2.wp.com/datavizpyr.com/wp-content/uploads/2020/01/RColorBrewer_colorblind_friendly_palettes.jpeg?fit=598%2C897&ssl=1 16 | color_palette = "YlGnBu" 17 | 18 | # width of the box 19 | width = 0.8 20 | 21 | # y start from 0? 22 | y_start_0 = false -------------------------------------------------------------------------------- /stat_plot/test/test_generator.py: -------------------------------------------------------------------------------- 1 | # run this script under the "test" folder 2 | import random 3 | import os 4 | 5 | 6 | def main(): 7 | fuzzer_list = ['cerebro', 'afl', 'aflfast'] 8 | 9 | for (f, fuzzer) in enumerate(fuzzer_list): 10 | if not os.path.exists("data/"+fuzzer): 11 | os.makedirs("data/"+fuzzer) 12 | # generate 10 data files for each fuzzer 13 | for i in range(0, 10): 14 | file_name = "data/" + fuzzer + "/out-" + str(i) + ".txt" 15 | 16 | # randomly generate 900 - 1000 "seeds" 17 | seeds_no = random.randrange(900, 1001) 18 | 19 | # generate time slots (sec) for the seeds within 24 hours (86400s) 20 | slots = random.sample(range(0, 86400), seeds_no) 21 | 22 | if 0 not in slots: 23 | slots[0] = 0 24 | 25 | slots.sort() 26 | 27 | # generate the data no for the seeds 28 | data_nos = random.sample(range(5, 3000 - f * 100), seeds_no) 29 | 30 | if 5 not in data_nos: 31 | data_nos[0] = 5 32 | 33 | data_nos.sort() 34 | 35 | # write the slots and data_nos to file 36 | with open(file_name, 'w') as out_file: 37 | for (j, slot) in enumerate(slots): 38 | out_file.write('{slot:{fill}{align}{width}}:{data}\n'.format(slot=slot, fill=' ', align=">" 39 | , width=10, data=data_nos[j])) 40 | 41 | 42 | if __name__ == "__main__": 43 | main() 44 | -------------------------------------------------------------------------------- /stat_plot/test/test_histo.toml: -------------------------------------------------------------------------------- 1 | [fuzzers] 2 | # sub-tables use "." to connect 3 | [fuzzers.memfuzz] 4 | data_files = [ 5 | "test/data_histo/test_mem.txt" 6 | ] 7 | line_color = "xkcd:scarlet" 8 | 9 | [fuzzers.afl] 10 | data_files = [ 11 | "test/data_histo/test_afl.txt" 12 | ] 13 | line_color = "xkcd:slate blue" 14 | 15 | [fuzzers.aflfast] 16 | data_files = [ 17 | "test/data_histo/test_aflfast.txt" 18 | ] 19 | line_color = "xkcd:marigold" 20 | 21 | [fuzzers.perffuzz] 22 | data_files = [ 23 | "test/data_histo/test_perffuzz.txt" 24 | ] 25 | line_color = "xkcd:jade green" 26 | 27 | [misc] 28 | out_dir = "test/out_histogram" 29 | ylabel = "# of seed in queue" 30 | xlabel = "stack length" 31 | file_postfix = "-histo" 32 | plot_title = "nasm-16m stack length distribution" 33 | project = "nasm-16m" 34 | stat_type = "histogram" 35 | n_bins = 10 36 | large_font = true -------------------------------------------------------------------------------- /stat_plot/test/test_scatter.toml: -------------------------------------------------------------------------------- 1 | [fuzzers] 2 | # sub-tables use "." to connect 3 | [fuzzers.memfuzz] 4 | # the content in data files are "mem_val:count" 5 | data_files = [ 6 | "test/data_scatter/test_mem.txt" 7 | ] 8 | line_color = "xkcd:scarlet" 9 | 10 | [fuzzers.afl] 11 | # the content in data files are "mem_val:count" 12 | data_files = [ 13 | "test/data_scatter/test_afl.txt" 14 | ] 15 | line_color = "xkcd:slate blue" 16 | 17 | [fuzzers.aflfast] 18 | # the content in data files are "mem_val:count" 19 | data_files = [ 20 | "test/data_scatter/test_aflfast.txt" 21 | ] 22 | line_color = "xkcd:marigold" 23 | 24 | [fuzzers.perffuzz] 25 | # the content in data files are "mem_val:count" 26 | data_files = [ 27 | "test/data_scatter/test_perffuzz.txt" 28 | ] 29 | line_color = "xkcd:jade green" 30 | 31 | [misc] 32 | out_dir = "test/out_scatter" 33 | ylabel = "# of seed in queue" 34 | xlabel = "stack length" 35 | file_postfix = "-scatter" 36 | plot_title = "nasm-16m stack length distribution" 37 | project = "nasm-16m" 38 | stat_type = "scatterplot" 39 | large_font = true --------------------------------------------------------------------------------