implement switch mode

3 files changed, 39 insertions, 5 deletions

diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index d9c792d1..a937c96d 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -529,6 +529,18 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
     close(fd);
     add_to_queue(afl, queue_fn, len, 0);
 
+    if (unlikely(afl->fuzz_mode) && likely(afl->switch_fuzz_mode)) {
+
+      if (afl->afl_env.afl_no_ui) {
+
+        ACTF("New coverage found, switching back to exploration mode.");
+
+      }
+
+      afl->fuzz_mode = 0;
+
+    }
+
 #ifdef INTROSPECTION
     if (afl->custom_mutators_count && afl->current_custom_fuzz) {
 
diff --git a/src/afl-fuzz-state.c b/src/afl-fuzz-state.c
index 907861e9..9dc258b1 100644
--- a/src/afl-fuzz-state.c
+++ b/src/afl-fuzz-state.c
@@ -108,7 +108,7 @@ void afl_state_init(afl_state_t *afl, uint32_t map_size) {
   afl->cmplog_lvl = 2;
   afl->min_length = 1;
   afl->max_length = MAX_FILE;
-  afl->switch_fuzz_mode = STRATEGY_SWITCH_TIME;
+  afl->switch_fuzz_mode = STRATEGY_SWITCH_TIME * 1000;
 #ifndef NO_SPLICING
   afl->use_splicing = 1;
 #endif
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index 315107d7..c50b271b 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -577,7 +577,7 @@ int main(int argc, char **argv_orig, char **envp) {
         if (!stricmp(optarg, "explore") || !stricmp(optarg, "exploration")) {
 
           afl->fuzz_mode = 0;
-          afl->switch_fuzz_mode = 1;
+          afl->switch_fuzz_mode = 0;
 
         } else if (!stricmp(optarg, "exploit") ||
 
@@ -588,12 +588,16 @@ int main(int argc, char **argv_orig, char **envp) {
 
         } else {
 
-          if ((s32)(afl->switch_fuzz_mode = (u32)atoi(optarg)) < 1) {
+          if ((afl->switch_fuzz_mode = (u32)atoi(optarg)) > INT_MAX) {
 
             FATAL(
                 "Parameter for option -P must be \"explore\", \"exploit\" or a "
                 "number!");
 
+          } else {
+
+            afl->switch_fuzz_mode *= 1000;
+
           }
 
         }
@@ -2689,13 +2693,31 @@ int main(int argc, char **argv_orig, char **envp) {
 
     } while (skipped_fuzz && afl->queue_cur && !afl->stop_soon);
 
+    u64 cur_time = get_cur_time();
+
+    if (likely(afl->switch_fuzz_mode && afl->fuzz_mode == 0) &&
+        unlikely(cur_time > afl->last_find_time + afl->switch_fuzz_mode)) {
+
+      if (afl->afl_env.afl_no_ui) {
+
+        ACTF(
+            "No new coverage found for %llu seconds, switching to exploitation "
+            "strategy.",
+            afl->switch_fuzz_mode / 1000);
+
+      }
+
+      afl->fuzz_mode = 1;
+
+    }
+
     if (likely(!afl->stop_soon && afl->sync_id)) {
 
       if (likely(afl->skip_deterministic)) {
 
         if (unlikely(afl->is_main_node)) {
 
-          if (unlikely(get_cur_time() >
+          if (unlikely(cur_time >
                        (afl->sync_time >> 1) + afl->last_sync_time)) {
 
             if (!(sync_interval_cnt++ % (SYNC_INTERVAL / 3))) {
@@ -2708,7 +2730,7 @@ int main(int argc, char **argv_orig, char **envp) {
 
         } else {
 
-          if (unlikely(get_cur_time() > afl->sync_time + afl->last_sync_time)) {
+          if (unlikely(cur_time > afl->sync_time + afl->last_sync_time)) {
 
             if (!(sync_interval_cnt++ % SYNC_INTERVAL)) { sync_fuzzers(afl); }