search

fuzzware-fuzzer / fuzzware

Fuzzware's main repository. Start here to install.
Apache License 2.0
302 stars 51 forks source link

Fuzzware cov for finding the highest-coverage input #37

Closed B03901108 closed 8 months ago

B03901108 commented 9 months ago

Hi, I wonder if it is possible to find the input of the highest block coverage in a fuzzware-project using the utility fuzzware cov (or fuzzware genstats coverage).

It seems that fuzzware cov can list the inputs that cover a certain symbol without rerunning them. I am curious if this utility can either (1) get the coverage of each input in fuzzware-project/mainX/.../queue/, (2) list the inputs therein that cover more than a specified number of blocks, or (3) find the input therein of the highest block coverage.

Rerunning the inputs would be a last resort. Thank you.

B03901108 commented 9 months ago

I found that fuzzware cov runs on the bblset-traces in fuzzware-project/mainX/.../traces/, so I could achieve the above goals by processing those traces as well. However, some inputs generated by secondary fuzzers in .../queue/ have no bblset-traces in .../traces/. Is this intended?

Scepticz commented 9 months ago

Hi there,

if traces are missing for inputs, then they had either not been generated, yet, or their generation job was swallowed along the way. If it was swallowed, then this would be unintended (could be due to missed inotify triggers?). You can, however, generate these missing traces via fuzzware gentraces.

Tobi