remove dead code, code-format

3 files changed, 71 insertions, 599 deletions

diff --git a/docs/Changelog.md b/docs/Changelog.md
index cadfcb04..d3d5063b 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -14,6 +14,8 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
      - added -F option to allow -M main fuzzers to sync to foreign fuzzers,
        e.g. honggfuzz or libfuzzer
      - eliminated CPU affinity race condition for -S/-M runs
+     - expanded havoc mode added, on no cycle finds add extra splicing and
+       MOpt into the mix
   - llvm_mode:
      - now supports llvm 12!
      - fixes for laf-intel float splitting (thanks to mark-griffin for
@@ -21,7 +23,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
      - LTO: autodictionary mode is a default
      - LTO: instrim instrumentation disabled, only classic support used
             as it is always better
-  - added honggfuzz mangle as a custom mutator in custom_mutators/honggfuzz :)
+  - added honggfuzz mangle as a custom mutator in custom_mutators/honggfuzz
   - added afl-frida gum solution to examples/afl_frida (mostly imported
     from https://github.com/meme/hotwax/)
   - small fixes to afl-plot, afl-whatsup and man page creation
diff --git a/src/afl-fuzz-one.c b/src/afl-fuzz-one.c
index f8680100..a42bb0fc 100644
--- a/src/afl-fuzz-one.c
+++ b/src/afl-fuzz-one.c
@@ -27,10 +27,6 @@
 #include <string.h>
 #include <limits.h>
 
-/* static u8 *strnstr(const u8 *s, const u8 *find, size_t slen);
-static u32 string_replace(u8 **out_buf, s32 *temp_len, u32 pos, u8 *from,
-                          u8 *to); */
-
 /* MOpt */
 
 static int select_algorithm(afl_state_t *afl) {
@@ -370,524 +366,6 @@ static void locate_diffs(u8 *ptr1, u8 *ptr2, u32 len, s32 *first, s32 *last) {
 
 #define BUF_PARAMS(name) (void **)&afl->name##_buf, &afl->name##_size
 
-#if 0
-/* search a string */
-
-static u8 *strnstr(const u8 *s, const u8 *find, size_t slen) {
-
-  char   c, sc;
-  size_t len;
-
-  if ((c = *find++) != '\0') {
-
-    len = strlen(find);
-    do {
-
-      do {
-
-        if (slen-- < 1 || (sc = *s++) == '\0') return (NULL);
-
-      } while (sc != c);
-
-      if (len > slen) return (NULL);
-
-    } while (strncmp(s, find, len) != 0);
-
-    s--;
-
-  }
-
-  return ((u8 *)s);
-
-}
-
-/* replace between deliminators, if rep == NULL, then we will duplicate the
- * target */
-
-static u32 delim_replace(u8 **out_buf, s32 *temp_len, size_t pos,
-                         const u8 *ldelim, const u8 *rdelim, u8 *rep) {
-
-  u8 *end_buf = *out_buf + *temp_len;
-  u8 *ldelim_start = strnstr(*out_buf + pos, ldelim, *temp_len - pos);
-
-  if (ldelim_start != NULL) {
-
-    u32 max = (end_buf - ldelim_start - 1 > AFL_TXT_STRING_MAX_LEN
-                   ? AFL_TXT_STRING_MAX_LEN
-                   : end_buf - ldelim_start - 1);
-
-    if (max > 0) {
-
-      u8 *rdelim_end = strnstr(ldelim_start + 1, rdelim, max);
-
-      if (rdelim_end != NULL) {
-
-        u32 rep_len, delim_space_len = rdelim_end - ldelim_start - 1, xtra = 0;
-
-        if (rep != NULL) {
-
-          rep_len = (u32)strlen(rep);
-
-        } else {  // NULL? then we copy the value in between the delimiters
-
-          rep_len = delim_space_len;
-          delim_space_len = 0;
-          rep = ldelim_start + 1;
-          xtra = rep_len;
-
-        }
-
-        if (rep_len != delim_space_len) {
-
-          memmove(ldelim_start + rep_len + xtra + 1, rdelim_end,
-                  *temp_len - (rdelim_end - *out_buf));
-
-        }
-
-        memcpy(ldelim_start + 1, rep, rep_len);
-        *temp_len = (*temp_len - delim_space_len + rep_len);
-
-        return 1;
-
-      }
-
-    }
-
-  }
-
-  return 0;
-
-}
-
-static u32 delim_swap(u8 **out_buf, s32 *temp_len, size_t pos, const u8 *ldelim,
-                      const u8 *mdelim, const u8 *rdelim) {
-
-  u8 *out_buf_end = *out_buf + *temp_len;
-  u32 max = (*temp_len - pos > AFL_TXT_STRING_MAX_LEN ? AFL_TXT_STRING_MAX_LEN
-                                                      : *temp_len - pos);
-  u8 *ldelim_start = strnstr(*out_buf + pos, ldelim, max);
-
-  if (ldelim_start != NULL) {
-
-    max = (out_buf_end - ldelim_start - 1 > AFL_TXT_STRING_MAX_LEN
-               ? AFL_TXT_STRING_MAX_LEN
-               : out_buf_end - ldelim_start - 1);
-    if (max > 1) {
-
-      u8 *mdelim_pos = strnstr(ldelim_start + 1, mdelim, max);
-
-      if (mdelim_pos != NULL) {
-
-        max = (out_buf_end - mdelim_pos - 1 > AFL_TXT_STRING_MAX_LEN
-                   ? AFL_TXT_STRING_MAX_LEN
-                   : out_buf_end - mdelim_pos - 1);
-        if (max > 0) {
-
-          u8 *rdelim_end = strnstr(mdelim + 1, rdelim, max);
-
-          if (rdelim_end != NULL) {
-
-            u32 first_len = mdelim_pos - ldelim_start - 1;
-            u32 second_len = rdelim_end - mdelim_pos - 1;
-            u8  scratch[AFL_TXT_STRING_MAX_LEN];
-
-            memcpy(scratch, ldelim_start + 1, first_len);
-
-            if (first_len != second_len) {
-
-              memmove(ldelim_start + second_len + 1, mdelim_pos,
-                      out_buf_end - mdelim_pos);
-
-            }
-
-            memcpy(ldelim_start + 1, mdelim_pos + 1, second_len);
-
-            if (first_len != second_len) {
-
-              memmove(mdelim_pos + first_len + 1, rdelim_end,
-                      out_buf_end - rdelim_end);
-
-            }
-
-            memcpy(mdelim_pos + 1, scratch, first_len);
-
-            return 1;
-
-          }
-
-        }
-
-      }
-
-    }
-
-  }
-
-  return 0;
-
-}
-
-/* replace a string */
-
-static u32 string_replace(u8 **out_buf, s32 *temp_len, u32 pos, u8 *from,
-                          u8 *to) {
-
-  u8 *start = strnstr(*out_buf + pos, from, *temp_len - pos);
-
-  if (start) {
-
-    u32 from_len = strlen(from);
-    u32 to_len = strlen(to);
-
-    if (from_len != to_len) {
-
-      memmove(start + to_len, start + from_len,
-              *temp_len - from_len - (start - *out_buf));
-
-    }
-
-    memcpy(start, to, to_len);
-    *temp_len = (*temp_len - from_len + to_len);
-
-    return 1;
-
-  }
-
-  return 0;
-
-}
-
-/* Returns 1 if a mutant was generated and placed in out_buf, 0 if none
- * generated. */
-
-static const uint8_t text_mutation_special_chars[] = {
-
-    '\t', '\n', '\r', ' ', '!', '"', '$', '%', '&', '\'', '(', ')', '*',
-    '+',  ',',  '-',  '.', '/', ':', ';', '<', '=', '>',  '?', '@', '[',
-    '\\', ']',  '^',  '_', '`', '{', '|', '}', '~', ' '  // space is here twice
-
-};
-
-static int text_mutation(afl_state_t *afl, u8 **out_buf, s32 *orig_temp_len) {
-
-  if (*orig_temp_len < AFL_TXT_MIN_LEN) { return 0; }
-
-  s32 temp_len;
-  u32 pos, yes = 0,
-           mutations = rand_below(afl, AFL_TXT_STRING_MAX_MUTATIONS) + 16;
-  u8 *new_buf =
-      ck_maybe_grow(BUF_PARAMS(out_scratch),
-                    *orig_temp_len + AFL_TXT_STRING_MAX_MUTATIONS + 16);
-  u8 fromc[2] = {0, 0}, toc[2] = {0, 0};
-  temp_len = *orig_temp_len;
-  memcpy(new_buf, *out_buf, temp_len);
-  new_buf[temp_len] = 0;
-
-  for (u32 i = 0; i < mutations; i++) {
-
-    if (temp_len < AFL_TXT_MIN_LEN) { return 0; }
-
-    pos = rand_below(afl, temp_len - 1);
-    int choice = rand_below(afl, 100);
-
-    switch (choice) {
-
-        /* 50% -> fixed replacements */
-
-      case 0:                                /* Semantic statement deletion */
-        yes += string_replace(&new_buf, &temp_len, pos, "\n", "#");
-        break;
-      case 1:
-        yes += string_replace(&new_buf, &temp_len, pos, "(", "(!");
-        break;
-      case 2:
-        yes += string_replace(&new_buf, &temp_len, pos, "==", "!=");
-        break;
-      case 3:
-        yes += string_replace(&new_buf, &temp_len, pos, "!=", "==");
-        break;
-      case 4:
-        yes += string_replace(&new_buf, &temp_len, pos, "==", "<");
-        break;
-      case 5:
-        yes += string_replace(&new_buf, &temp_len, pos, "<", "==");
-        break;
-      case 6:
-        yes += string_replace(&new_buf, &temp_len, pos, "==", ">");
-        break;
-      case 7:
-        yes += string_replace(&new_buf, &temp_len, pos, ">", "==");
-        break;
-      case 8:
-        yes += string_replace(&new_buf, &temp_len, pos, "=", "<");
-        break;
-      case 9:
-        yes += string_replace(&new_buf, &temp_len, pos, "=", ">");
-        break;
-      case 10:
-        yes += string_replace(&new_buf, &temp_len, pos, "<", ">");
-        break;
-      case 11:
-        yes += string_replace(&new_buf, &temp_len, pos, ">", "<");
-        break;
-      case 12:
-        yes += string_replace(&new_buf, &temp_len, pos, "++", "--");
-        break;
-      case 13:
-        yes += string_replace(&new_buf, &temp_len, pos, "--", "++");
-        break;
-      case 14:
-        yes += string_replace(&new_buf, &temp_len, pos, "+", "-");
-        break;
-      case 15:
-        yes += string_replace(&new_buf, &temp_len, pos, "-", "+");
-        break;
-      case 16:
-        yes += string_replace(&new_buf, &temp_len, pos, "0", "1");
-        break;
-      case 17:
-        yes += string_replace(&new_buf, &temp_len, pos, "1", "0");
-        break;
-      case 18:
-        yes += string_replace(&new_buf, &temp_len, pos, "&&", "||");
-        break;
-      case 19:
-        yes += string_replace(&new_buf, &temp_len, pos, "||", "&&");
-        break;
-      case 20:
-        yes += string_replace(&new_buf, &temp_len, pos, "!", "");
-        break;
-      case 21:
-        yes += string_replace(&new_buf, &temp_len, pos, "==", "=");
-        break;
-      case 22:
-        yes += string_replace(&new_buf, &temp_len, pos, "=", "==");
-        break;
-      case 23:
-        yes += string_replace(&new_buf, &temp_len, pos, "--", "");
-        break;
-      case 24:
-        yes += string_replace(&new_buf, &temp_len, pos, "<<", "<");
-        break;
-      case 25:
-        yes += string_replace(&new_buf, &temp_len, pos, ">>", ">");
-        break;
-      case 26:
-        yes += string_replace(&new_buf, &temp_len, pos, "<", "<<");
-        break;
-      case 27:
-        yes += string_replace(&new_buf, &temp_len, pos, ">", ">>");
-        break;
-      case 28:
-        yes += string_replace(&new_buf, &temp_len, pos, "'", "\"");
-        break;
-      case 29:
-        yes += string_replace(&new_buf, &temp_len, pos, "\"", "'");
-        break;
-      case 30:  /* Remove a semicolon delimited statement after a semicolon */
-        yes += delim_replace(&new_buf, &temp_len, pos, ";", ";", ";");
-        break;
-      case 31: /* Remove a semicolon delimited statement after a left curly
-                  brace */
-        yes += delim_replace(&new_buf, &temp_len, pos, "}", ";", "}");
-        break;
-      case 32:                            /* Remove a curly brace construct */
-        yes += delim_replace(&new_buf, &temp_len, pos, "{", "}", "");
-        break;
-      case 33:         /* Replace a curly brace construct with an empty one */
-        yes += delim_replace(&new_buf, &temp_len, pos, "{", "}", "{}");
-        break;
-      case 34:
-        yes += delim_swap(&new_buf, &temp_len, pos, ";", ";", ";");
-        break;
-      case 35:
-        yes += delim_swap(&new_buf, &temp_len, pos, "}", ";", ";");
-        break;
-      case 36:                        /* Swap comma delimited things case 1 */
-        yes += delim_swap(&new_buf, &temp_len, pos, "(", ",", ")");
-        break;
-      case 37:                        /* Swap comma delimited things case 2 */
-        yes += delim_swap(&new_buf, &temp_len, pos, "(", ",", ",");
-        break;
-      case 38:                        /* Swap comma delimited things case 3 */
-        yes += delim_swap(&new_buf, &temp_len, pos, ",", ",", ",");
-        break;
-      case 39:                        /* Swap comma delimited things case 4 */
-        yes += delim_swap(&new_buf, &temp_len, pos, ",", ",", ")");
-        break;
-      case 40:                                        /* Just delete a line */
-        yes += delim_replace(&new_buf, &temp_len, pos, "\n", "\n", "");
-        break;
-      case 41:                      /* Delete something like "const" case 1 */
-        yes += delim_replace(&new_buf, &temp_len, pos, " ", " ", "");
-        break;
-      case 42:                      /* Delete something like "const" case 2 */
-        yes += delim_replace(&new_buf, &temp_len, pos, "\n", " ", "");
-        break;
-      case 43:                      /* Delete something like "const" case 3 */
-        yes += delim_replace(&new_buf, &temp_len, pos, "(", " ", "");
-        break;
-      case 44:                        /* Swap space delimited things case 1 */
-        yes += delim_swap(&new_buf, &temp_len, pos, " ", " ", " ");
-        break;
-      case 45:                        /* Swap space delimited things case 2 */
-        yes += delim_swap(&new_buf, &temp_len, pos, " ", " ", ")");
-        break;
-      case 46:                        /* Swap space delimited things case 3 */
-        yes += delim_swap(&new_buf, &temp_len, pos, "(", " ", " ");
-        break;
-      case 47:                        /* Swap space delimited things case 4 */
-        yes += delim_swap(&new_buf, &temp_len, pos, "(", " ", ")");
-        break;
-      case 48:                           /* Duplicate a single line of code */
-        yes += delim_replace(&new_buf, &temp_len, pos, "\n", "\n", NULL);
-        break;
-      case 49:  /* Duplicate a construct (most often, a non-nested for loop */
-        yes += delim_replace(&new_buf, &temp_len, pos, "\n", "}", NULL);
-        break;
-      default: {
-
-        /* 5% is transforming ascii numbers */
-
-        if (choice < 55) {
-
-          for (u32 j = pos; j < temp_len; ++j) {
-
-            if (isdigit(new_buf[j])) {
-
-              new_buf[temp_len] =
-                  0;  // should be safe thanks to the initial grow
-
-              u8 *               endptr;
-              unsigned long long num =
-                  strtoull(new_buf + j, (char **)&endptr, 0);
-
-              switch (rand_below(afl, 8)) {
-
-                case 0:
-                  num = rand_below(afl, INT_MAX);
-                  break;
-                case 1:
-                  num = rand_next(afl);
-                  break;
-                case 2:
-                  num += 1 + rand_below(afl, 255);
-                  break;
-                case 3:
-                  num -= 1 + rand_below(afl, 255);
-                  break;
-                case 4:
-                  num *= 1 + rand_below(afl, 255);
-                  break;
-                case 5:
-                  num /= 1 + rand_below(afl, 255);
-                  break;
-                case 6:
-                  num /= 1 + rand_below(afl, 255);
-                  break;
-                case 7:
-                  num = ~num;
-                  break;
-
-              }
-
-              const char *fmt = "%llu";
-              if (rand_below(afl, 5) == 0)  // add - sign with 1/5 probability
-                fmt = "-%llu";
-
-              size_t num_len = snprintf(NULL, 0, fmt, num);
-              size_t old_len = endptr - (new_buf + j);
-              if (num_len < old_len) {
-
-                memmove(new_buf + j + num_len, new_buf + j + old_len,
-                        temp_len - (j + old_len));
-                snprintf(new_buf + j, num_len, fmt, num);
-                temp_len -= old_len - num_len;
-
-              } else if (num_len == old_len) {
-
-                snprintf(new_buf + j, num_len, fmt, num);
-
-              } else {
-
-                new_buf = ck_maybe_grow(BUF_PARAMS(out_scratch),
-                                        temp_len + (num_len - old_len) +
-                                            AFL_TXT_STRING_MAX_MUTATIONS + 1);
-                memmove(new_buf + j + num_len, new_buf + j + old_len,
-                        temp_len - (j + old_len));
-                snprintf(new_buf + j, num_len, fmt, num);
-                temp_len += num_len - old_len;
-
-              }
-
-              yes += 1;
-              break;
-
-            }
-
-          }
-
-        } else if (choice < 85) {
-
-          /* 30% is special character transform */
-
-          fromc[0] = text_mutation_special_chars[rand_below(
-              afl, sizeof(text_mutation_special_chars))];
-
-          do {
-
-            toc[0] = text_mutation_special_chars[rand_below(
-                afl, sizeof(text_mutation_special_chars))];
-
-          } while (toc[0] == fromc[0]);
-
-          yes += string_replace(&new_buf, &temp_len, pos, fromc, toc);
-          break;
-
-        } else {
-
-          /* 15% is random text character transform */
-
-          u32 iter, cnt, loc, prev_loc = temp_len;
-          if (temp_len > 32) {
-
-            cnt = 1 + rand_below(afl, 5);
-
-          } else {
-
-            cnt = rand_below(afl, 2);
-
-          }
-
-          for (iter = 0; iter <= cnt; iter++) {
-
-            while ((loc = rand_below(afl, temp_len)) == prev_loc)
-              ;
-            new_buf[loc] = 32 + rand_below(afl, 'z' - ' ' + 1);
-            prev_loc = loc;
-
-          }
-
-        }
-
-      }
-
-    }
-
-  }
-
-  if (yes == 0 || temp_len <= 0) { return 0; }
-
-  swap_bufs(BUF_PARAMS(out), BUF_PARAMS(out_scratch));
-  *out_buf = new_buf;
-  *orig_temp_len = temp_len;
-
-  return 1;
-
-}
-
-#endif                                                              /* if 0 */
-
 /* Take the current entry from the queue, fuzz it for a while. This
    function is a tad too long... returns 0 if fuzzed successfully, 1 if
    skipped or bailed out. */
@@ -2926,15 +2404,7 @@ havoc_stage:
 
           }
 
-          /*              default:
-
-                          // perform ascii mutations
-                          if (text_mutation(afl, &out_buf, &temp_len) == 0)
-                            goto retry_havoc;
-
-                      }  // end default: switch(r)
-
-          */
+          // end of default:
 
       }
 
diff --git a/src/afl-fuzz-stats.c b/src/afl-fuzz-stats.c
index 9b16c226..7b30b5ea 100644
--- a/src/afl-fuzz-stats.c
+++ b/src/afl-fuzz-stats.c
@@ -82,60 +82,59 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
   if (getrusage(RUSAGE_CHILDREN, &rus)) { rus.ru_maxrss = 0; }
 #endif
 
-  fprintf(
-      f,
-      "start_time        : %llu\n"
-      "last_update       : %llu\n"
-      "run_time          : %llu\n"
-      "fuzzer_pid        : %u\n"
-      "cycles_done       : %llu\n"
-      "cycles_wo_finds   : %llu\n"
-      "execs_done        : %llu\n"
-      "execs_per_sec     : %0.02f\n"
-      "execs_ps_last_min : %0.02f\n"
-      "paths_total       : %u\n"
-      "paths_favored     : %u\n"
-      "paths_found       : %u\n"
-      "paths_imported    : %u\n"
-      "max_depth         : %u\n"
-      "cur_path          : %u\n"        /* Must match find_start_position() */
-      "pending_favs      : %u\n"
-      "pending_total     : %u\n"
-      "variable_paths    : %u\n"
-      "stability         : %0.02f%%\n"
-      "bitmap_cvg        : %0.02f%%\n"
-      "unique_crashes    : %llu\n"
-      "unique_hangs      : %llu\n"
-      "last_path         : %llu\n"
-      "last_crash        : %llu\n"
-      "last_hang         : %llu\n"
-      "execs_since_crash : %llu\n"
-      "exec_timeout      : %u\n"
-      "slowest_exec_ms   : %u\n"
-      "peak_rss_mb       : %lu\n"
-      "cpu_affinity      : %d\n"
-      "edges_found       : %u\n"
-      "var_byte_count    : %u\n"
-      "havoc_expansion   : %u\n"
-      "afl_banner        : %s\n"
-      "afl_version       : " VERSION
-      "\n"
-      "target_mode       : %s%s%s%s%s%s%s%s%s\n"
-      "command_line      : %s\n",
-      afl->start_time / 1000, cur_time / 1000,
-      (cur_time - afl->start_time) / 1000, (u32)getpid(),
-      afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->cycles_wo_finds,
-      afl->fsrv.total_execs,
-      afl->fsrv.total_execs /
-          ((double)(get_cur_time() - afl->start_time) / 1000),
-      afl->last_avg_execs_saved,
-      afl->queued_paths, afl->queued_favored, afl->queued_discovered,
-      afl->queued_imported, afl->max_depth, afl->current_entry,
-      afl->pending_favored, afl->pending_not_fuzzed, afl->queued_variable,
-      stability, bitmap_cvg, afl->unique_crashes, afl->unique_hangs,
-      afl->last_path_time / 1000, afl->last_crash_time / 1000,
-      afl->last_hang_time / 1000, afl->fsrv.total_execs - afl->last_crash_execs,
-      afl->fsrv.exec_tmout, afl->slowest_exec_ms,
+  fprintf(f,
+          "start_time        : %llu\n"
+          "last_update       : %llu\n"
+          "run_time          : %llu\n"
+          "fuzzer_pid        : %u\n"
+          "cycles_done       : %llu\n"
+          "cycles_wo_finds   : %llu\n"
+          "execs_done        : %llu\n"
+          "execs_per_sec     : %0.02f\n"
+          "execs_ps_last_min : %0.02f\n"
+          "paths_total       : %u\n"
+          "paths_favored     : %u\n"
+          "paths_found       : %u\n"
+          "paths_imported    : %u\n"
+          "max_depth         : %u\n"
+          "cur_path          : %u\n"    /* Must match find_start_position() */
+          "pending_favs      : %u\n"
+          "pending_total     : %u\n"
+          "variable_paths    : %u\n"
+          "stability         : %0.02f%%\n"
+          "bitmap_cvg        : %0.02f%%\n"
+          "unique_crashes    : %llu\n"
+          "unique_hangs      : %llu\n"
+          "last_path         : %llu\n"
+          "last_crash        : %llu\n"
+          "last_hang         : %llu\n"
+          "execs_since_crash : %llu\n"
+          "exec_timeout      : %u\n"
+          "slowest_exec_ms   : %u\n"
+          "peak_rss_mb       : %lu\n"
+          "cpu_affinity      : %d\n"
+          "edges_found       : %u\n"
+          "var_byte_count    : %u\n"
+          "havoc_expansion   : %u\n"
+          "afl_banner        : %s\n"
+          "afl_version       : " VERSION
+          "\n"
+          "target_mode       : %s%s%s%s%s%s%s%s%s\n"
+          "command_line      : %s\n",
+          afl->start_time / 1000, cur_time / 1000,
+          (cur_time - afl->start_time) / 1000, (u32)getpid(),
+          afl->queue_cycle ? (afl->queue_cycle - 1) : 0, afl->cycles_wo_finds,
+          afl->fsrv.total_execs,
+          afl->fsrv.total_execs /
+              ((double)(get_cur_time() - afl->start_time) / 1000),
+          afl->last_avg_execs_saved, afl->queued_paths, afl->queued_favored,
+          afl->queued_discovered, afl->queued_imported, afl->max_depth,
+          afl->current_entry, afl->pending_favored, afl->pending_not_fuzzed,
+          afl->queued_variable, stability, bitmap_cvg, afl->unique_crashes,
+          afl->unique_hangs, afl->last_path_time / 1000,
+          afl->last_crash_time / 1000, afl->last_hang_time / 1000,
+          afl->fsrv.total_execs - afl->last_crash_execs, afl->fsrv.exec_tmout,
+          afl->slowest_exec_ms,
 #ifndef __HAIKU__
   #ifdef __APPLE__
           (unsigned long int)(rus.ru_maxrss >> 20),
@@ -150,19 +149,20 @@ void write_stats_file(afl_state_t *afl, double bitmap_cvg, double stability,
 #else
           -1,
 #endif
-      t_bytes, afl->var_byte_count, afl->expand_havoc, afl->use_banner,
-      afl->unicorn_mode ? "unicorn" : "", afl->fsrv.qemu_mode ? "qemu " : "",
-      afl->non_instrumented_mode ? " non_instrumented " : "",
-      afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
-      afl->persistent_mode ? "persistent " : "",
-      afl->shmem_testcase_mode ? "shmem_testcase " : "",
-      afl->deferred_mode ? "deferred " : "",
-      (afl->unicorn_mode || afl->fsrv.qemu_mode || afl->non_instrumented_mode ||
-       afl->no_forkserver || afl->crash_mode || afl->persistent_mode ||
-       afl->deferred_mode)
-          ? ""
-          : "default",
-      afl->orig_cmdline);
+          t_bytes, afl->var_byte_count, afl->expand_havoc, afl->use_banner,
+          afl->unicorn_mode ? "unicorn" : "",
+          afl->fsrv.qemu_mode ? "qemu " : "",
+          afl->non_instrumented_mode ? " non_instrumented " : "",
+          afl->no_forkserver ? "no_fsrv " : "", afl->crash_mode ? "crash " : "",
+          afl->persistent_mode ? "persistent " : "",
+          afl->shmem_testcase_mode ? "shmem_testcase " : "",
+          afl->deferred_mode ? "deferred " : "",
+          (afl->unicorn_mode || afl->fsrv.qemu_mode ||
+           afl->non_instrumented_mode || afl->no_forkserver ||
+           afl->crash_mode || afl->persistent_mode || afl->deferred_mode)
+              ? ""
+              : "default",
+          afl->orig_cmdline);
   /* ignore errors */
 
   if (afl->debug) {