afl-plot 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170
  1. #!/bin/sh
  2. #
  3. # american fuzzy lop - Advanced Persistent Graphing
  4. # -------------------------------------------------
  5. #
  6. # Written and maintained by Michal Zalewski <lcamtuf@google.com>
  7. # Based on a design & prototype by Michael Rash.
  8. #
  9. # Copyright 2014, 2015 Google Inc. All rights reserved.
  10. #
  11. # Licensed under the Apache License, Version 2.0 (the "License");
  12. # you may not use this file except in compliance with the License.
  13. # You may obtain a copy of the License at:
  14. #
  15. # http://www.apache.org/licenses/LICENSE-2.0
  16. #
  17. echo "progress plotting utility for afl-fuzz by <lcamtuf@google.com>"
  18. echo
  19. if [ ! "$#" = "2" ]; then
  20. cat 1>&2 <<_EOF_
  21. This program generates gnuplot images from afl-fuzz output data. Usage:
  22. $0 afl_state_dir graph_output_dir
  23. The afl_state_dir parameter should point to an existing state directory for any
  24. active or stopped instance of afl-fuzz; while graph_output_dir should point to
  25. an empty directory where this tool can write the resulting plots to.
  26. The program will put index.html and three PNG images in the output directory;
  27. you should be able to view it with any web browser of your choice.
  28. _EOF_
  29. exit 1
  30. fi
  31. if [ "$AFL_ALLOW_TMP" = "" ]; then
  32. echo "$1" | grep -qE '^(/var)?/tmp/'
  33. T1="$?"
  34. echo "$2" | grep -qE '^(/var)?/tmp/'
  35. T2="$?"
  36. if [ "$T1" = "0" -o "$T2" = "0" ]; then
  37. echo "[-] Error: this script shouldn't be used with shared /tmp directories." 1>&2
  38. exit 1
  39. fi
  40. fi
  41. if [ ! -f "$1/plot_data" ]; then
  42. echo "[-] Error: input directory is not valid (missing 'plot_data')." 1>&2
  43. exit 1
  44. fi
  45. BANNER="`cat "$1/fuzzer_stats" | grep '^afl_banner ' | cut -d: -f2- | cut -b2-`"
  46. test "$BANNER" = "" && BANNER="(none)"
  47. GNUPLOT=`which gnuplot 2>/dev/null`
  48. if [ "$GNUPLOT" = "" ]; then
  49. echo "[-] Error: can't find 'gnuplot' in your \$PATH." 1>&2
  50. exit 1
  51. fi
  52. mkdir "$2" 2>/dev/null
  53. if [ ! -d "$2" ]; then
  54. echo "[-] Error: unable to create the output directory - pick another location." 1>&2
  55. exit 1
  56. fi
  57. rm -f "$2/high_freq.png" "$2/low_freq.png" "$2/exec_speed.png"
  58. mv -f "$2/index.html" "$2/index.html.orig" 2>/dev/null
  59. echo "[*] Generating plots..."
  60. (
  61. cat <<_EOF_
  62. set terminal png truecolor enhanced size 1000,300 butt
  63. set output '$2/high_freq.png'
  64. set xdata time
  65. set timefmt '%s'
  66. set format x "%b %d\n%H:%M"
  67. set tics font 'small'
  68. unset mxtics
  69. unset mytics
  70. set grid xtics linetype 0 linecolor rgb '#e0e0e0'
  71. set grid ytics linetype 0 linecolor rgb '#e0e0e0'
  72. set border linecolor rgb '#50c0f0'
  73. set tics textcolor rgb '#000000'
  74. set key outside
  75. set autoscale xfixmin
  76. set autoscale xfixmax
  77. plot '$1/plot_data' using 1:4 with filledcurve x1 title 'total paths' linecolor rgb '#000000' fillstyle transparent solid 0.2 noborder, \\
  78. '' using 1:3 with filledcurve x1 title 'current path' linecolor rgb '#f0f0f0' fillstyle transparent solid 0.5 noborder, \\
  79. '' using 1:5 with lines title 'pending paths' linecolor rgb '#0090ff' linewidth 3, \\
  80. '' using 1:6 with lines title 'pending favs' linecolor rgb '#c00080' linewidth 3, \\
  81. '' using 1:2 with lines title 'cycles done' linecolor rgb '#c000f0' linewidth 3
  82. set terminal png truecolor enhanced size 1000,200 butt
  83. set output '$2/low_freq.png'
  84. plot '$1/plot_data' using 1:8 with filledcurve x1 title '' linecolor rgb '#c00080' fillstyle transparent solid 0.2 noborder, \\
  85. '' using 1:8 with lines title ' uniq crashes' linecolor rgb '#c00080' linewidth 3, \\
  86. '' using 1:9 with lines title 'uniq hangs' linecolor rgb '#c000f0' linewidth 3, \\
  87. '' using 1:10 with lines title 'levels' linecolor rgb '#0090ff' linewidth 3
  88. set terminal png truecolor enhanced size 1000,200 butt
  89. set output '$2/exec_speed.png'
  90. plot '$1/plot_data' using 1:11 with filledcurve x1 title '' linecolor rgb '#0090ff' fillstyle transparent solid 0.2 noborder, \\
  91. '$1/plot_data' using 1:11 with lines title ' execs/sec' linecolor rgb '#0090ff' linewidth 3 smooth bezier;
  92. _EOF_
  93. ) | gnuplot
  94. if [ ! -s "$2/exec_speed.png" ]; then
  95. echo "[-] Error: something went wrong! Perhaps you have an ancient version of gnuplot?" 1>&2
  96. exit 1
  97. fi
  98. echo "[*] Generating index.html..."
  99. cat >"$2/index.html" <<_EOF_
  100. <table style="font-family: 'Trebuchet MS', 'Tahoma', 'Arial', 'Helvetica'">
  101. <tr><td style="width: 18ex"><b>Banner:</b></td><td>$BANNER</td></tr>
  102. <tr><td><b>Directory:</b></td><td>$1</td></tr>
  103. <tr><td><b>Generated on:</b></td><td>`date`</td></tr>
  104. </table>
  105. <p>
  106. <img src="high_freq.png" width=1000 height=300><p>
  107. <img src="low_freq.png" width=1000 height=200><p>
  108. <img src="exec_speed.png" width=1000 height=200>
  109. _EOF_
  110. # Make it easy to remotely view results when outputting directly to a directory
  111. # served by Apache or other HTTP daemon. Since the plots aren't horribly
  112. # sensitive, this seems like a reasonable trade-off.
  113. chmod 755 "$2"
  114. chmod 644 "$2/high_freq.png" "$2/low_freq.png" "$2/exec_speed.png" "$2/index.html"
  115. echo "[+] All done - enjoy your charts!"
  116. exit 0