20 files changed, 4241 insertions, 66 deletions

diff --git a/frida_mode/GNUmakefile b/frida_mode/GNUmakefile
index f9c0f1f7..a0387cac 100644
--- a/frida_mode/GNUmakefile
+++ b/frida_mode/GNUmakefile
@@ -36,10 +36,6 @@ else
 CFLAGS+=-Wno-pointer-arith
 endif
 
-ifdef FRIDA_DEBUG
-CFLAGS += -DFRIDA_DEBUG
-endif
-
 FRIDA_BUILD_DIR:=$(BUILD_DIR)frida/
 FRIDA_TRACE:=$(BUILD_DIR)afl-frida-trace.so
 FRIDA_TRACE_EMBEDDED:=$(BUILD_DIR)afl-frida-trace-embedded
diff --git a/frida_mode/README.md b/frida_mode/README.md
index ecce0bfd..0103a395 100644
--- a/frida_mode/README.md
+++ b/frida_mode/README.md
@@ -21,7 +21,7 @@ perhaps leverage some of its design and implementation.
   | Feature/Instrumentation  | frida-mode | Notes                                        |
   | -------------------------|:----------:|:--------------------------------------------:|
   | NeverZero                |     x      |                                              |
-  | Persistent Mode          |     x      | (x86/x64 only)(Only on function boundaries)  |  
+  | Persistent Mode          |     x      | (x86/x64 only)(Only on function boundaries)  |
   | LAF-Intel / CompCov      |     -      | (CMPLOG is better 90% of the time)           |
   | CMPLOG                   |     x      | (x86/x64 only)                               |
   | Selective Instrumentation|     x      |                                              |
@@ -43,16 +43,16 @@ system does not support cross compilation.
 
 ## Getting Started
 
-To build everything run `make`. To build for x86 run `make 32`. Note that in 
+To build everything run `make`. To build for x86 run `make 32`. Note that in
 x86 bit mode, it is not necessary for afl-fuzz to be built for 32-bit. However,
 the shared library for frida_mode must be since it is injected into the target
 process.
 
 Various tests can be found in subfolders within the `test/` directory. To use
 these, first run `make` to build any dependencies. Then run `make qemu` or
-`make frida` to run on either QEMU of FRIDA mode respectively. To run frida 
-tests in 32-bit mode, run `make ARCH=x86 frida`. When switching between 
-architectures it may be necessary to run `make clean` first for a given build 
+`make frida` to run on either QEMU of FRIDA mode respectively. To run frida
+tests in 32-bit mode, run `make ARCH=x86 frida`. When switching between
+architectures it may be necessary to run `make clean` first for a given build
 target to remove previously generated binaries for a different architecture.
 
 ## Usage
@@ -74,6 +74,8 @@ following options are currently supported:
 * `AFL_FRIDA_PERSISTENT_ADDR` - See `AFL_QEMU_PERSISTENT_ADDR`
 * `AFL_FRIDA_PERSISTENT_CNT` - See `AFL_QEMU_PERSISTENT_CNT`
 * `AFL_FRIDA_PERSISTENT_HOOK` - See `AFL_QEMU_PERSISTENT_HOOK`
+* `AFL_FRIDA_PERSISTENT_RET` - See `AFL_QEMU_PERSISTENT_RET`
+* `AFL_FRIDA_PERSISTENT_RETADDR_OFFSET` - See `AFL_QEMU_PERSISTENT_RETADDR_OFFSET`
 
 To enable the powerful CMPLOG mechanism, set `-c 0` for `afl-fuzz`.
 
@@ -127,34 +129,144 @@ instances run CMPLOG mode and instrumentation of the binary is less frequent
 
 ## Advanced configuration options
 
+* `AFL_FRIDA_INST_DEBUG_FILE` - File to write raw assembly of original blocks
+and their instrumented counterparts during block compilation.
+```
+***
+
+Creating block for 0x7ffff7953313:
+        0x7ffff7953313  mov qword ptr [rax], 0
+        0x7ffff795331a  add rsp, 8
+        0x7ffff795331e  ret
+
+Generated block 0x7ffff75e98e2
+        0x7ffff75e98e2  mov qword ptr [rax], 0
+        0x7ffff75e98e9  add rsp, 8
+        0x7ffff75e98ed  lea rsp, [rsp - 0x80]
+        0x7ffff75e98f5  push rcx
+        0x7ffff75e98f6  movabs rcx, 0x7ffff795331e
+        0x7ffff75e9900  jmp 0x7ffff75e9384
+
+
+***
+```
 * `AFL_FRIDA_INST_NO_OPTIMIZE` - Don't use optimized inline assembly coverage
 instrumentation (the default where available). Required to use
 `AFL_FRIDA_INST_TRACE`.
 * `AFL_FRIDA_INST_NO_PREFETCH` - Disable prefetching. By default the child will
 report instrumented blocks back to the parent so that it can also instrument
 them and they be inherited by the next child on fork.
-* `AFL_FRIDA_INST_TRACE` - Generate some logging when running instrumented code.
-Requires `AFL_FRIDA_INST_NO_OPTIMIZE`.
-
+* `AFL_FRIDA_INST_TRACE` - Log to stdout the address of executed blocks
+`AFL_FRIDA_INST_NO_OPTIMIZE`.
+* `AFL_FRIDA_OUTPUT_STDOUT` - Redirect the standard output of the target
+application to the named file (supersedes the setting of `AFL_DEBUG_CHILD`)
+* `AFL_FRIDA_OUTPUT_STDERR` - Redirect the standard error of the target
+application to the named file (supersedes the setting of `AFL_DEBUG_CHILD`)
+* `AFL_FRIDA_PERSISTENT_DEBUG` - Insert a Breakpoint into the instrumented code
+at `AFL_FRIDA_PERSISTENT_HOOK` and `AFL_FRIDA_PERSISTENT_RET` to allow the user
+to determine the value of `AFL_FRIDA_PERSISTENT_RETADDR_OFFSET` using a
+debugger.
+
+```
+
+gdb \
+		--ex 'set environment AFL_FRIDA_PERSISTENT_ADDR=XXXXXXXXXX' \
+		--ex 'set environment AFL_FRIDA_PERSISTENT_RET=XXXXXXXXXX' \
+		--ex 'set environment AFL_FRIDA_PERSISTENT_DEBUG=1' \
+		--ex 'set environment AFL_DEBUG_CHILD=1' \
+		--ex 'set environment LD_PRELOAD=afl-frida-trace.so' \
+		--args <my-executable> [my arguments]
+
+```
+* `AFL_FRIDA_STATS_FILE` - Write statistics information about the code being
+instrumented to the given file name. The statistics are written only for the
+child process when new block is instrumented (when the
+`AFL_FRIDA_STATS_INTERVAL` has expired). Note that simply because a new path is
+found does not mean a new block needs to be compiled. It could simply be that
+the existing blocks instrumented have been executed in a different order.
+```
+stats
+-----
+Index:                          2
+Pid:                            1815944
+Time:                           2021-05-28 15:26:41
+Blocks:                         1985
+Instructions:                   9192
+Avg Instructions / Block:       4
+
+Call Immediates:                391 (4.25%)
+Call Immediates Excluded:       65 (0.71%)
+Call Register:                  0 (0.00%)
+Call Memory:                    0 (0.00%)
+
+Jump Immediates:                202 (2.20%)
+Jump Register:                  10 (0.11%)
+Jump Memory:                    12 (0.13%)
+
+Conditional Jump Immediates:    1210 (13.16%)
+Conditional Jump CX Immediate:  0 (0.00%)
+Conditional Jump Register:      0 (0.00%)
+Conditional Jump Memory:        0 (0.00%)
+
+Returns:                        159 (0.00%)
+
+Rip Relative:                   247 (0.00%)
+
+```
+* `AFL_FRIDA_STATS_INTERVAL` - The maximum frequency to output statistics
+information. Stats will be written whenever they are updated if the given
+interval has elapsed since last time they were written.
+* `AFL_FRIDA_STATS_TRANSITIONS` - Also dump the internal stalker counters to
+stderr when the regular stats are written. Note that these stats are reset in
+the child each time a new fork occurs since they are not stored in shared
+memory. Unfortunately, these stats are internal to stalker, so this is the best
+we can do for now.
+```
+stats
+-----
+Index: 2
+Pid:   1816794
+Time:  2021-05-28 15:26:41
+
+
+total_transitions: 786
+        call_imms: 97
+        call_regs: 0
+        call_mems: 0
+        post_call_invokes: 86
+        excluded_call_imms: 29
+        ret_slow_paths: 23
+
+        jmp_imms: 58
+        jmp_mems: 7
+        jmp_regs: 26
+
+        jmp_cond_imms: 460
+        jmp_cond_mems: 0
+        jmp_cond_regs: 0
+        jmp_cond_jcxzs: 0
+
+        jmp_continuations: 0
+```
 ## FASAN - Frida Address Sanitizer Mode
 Frida mode also supports FASAN. The design of this is actually quite simple and
 very similar to that used when instrumenting applications compiled from source.
 
 ### Address Sanitizer Basics
 
-When Address Sanitizer is used to instrument programs built from source, the 
+When Address Sanitizer is used to instrument programs built from source, the
 compiler first adds a dependency (`DT_NEEDED` entry) for the Address Sanitizer
 dynamic shared object (DSO). This shared object contains the main logic for Address
 Sanitizer, including setting and managing up the shadow memory. It also provides
-replacement implementations for a number of functions in standard libraries. 
+replacement implementations for a number of functions in standard libraries.
 
 These replacements include things like `malloc` and `free` which allows for those
 allocations to be marked in the shadow memory, but also a number of other fuctions.
-Consider `memcpy` for example, this is instrumented to validate the paramters 
-(test the source and destination buffers against the shadow memory. This is much 
-easier than instrumenting those standard libraries since, first it would require 
+Consider `memcpy` for example, this is instrumented to validate the paramters
+(test the source and destination buffers against the shadow memory. This is much
+easier than instrumenting those standard libraries since, first it would require
 you to re-compile them and secondly it would mean that the instrumentation would
-be applied at a more expensive granular level. Lastly, load-widening (typically 
+be applied at a more expensive granular level. Lastly, load-widening (typically
 found in highy optimized code) can also make this instrumentation more difficult.
 
 Since the DSO is loaded before all of the standard libraries (in fact it insists
@@ -165,9 +277,9 @@ modules which depend on it.
 
 FASAN takes a similar approach. It requires the user to add the Address Sanitizer
 DSO to the `AFL_PRELOAD` environment variable such that it is loaded into the target.
-Again, it must be first in the list. This means that it is not necessary to 
-instrument the standard libraries to detect when an application has provided an 
-incorrect argument to `memcpy` for example. This avoids issues with load-widening 
+Again, it must be first in the list. This means that it is not necessary to
+instrument the standard libraries to detect when an application has provided an
+incorrect argument to `memcpy` for example. This avoids issues with load-widening
 and should also mean a huge improvement in performance.
 
 FASAN then adds instrumentation for any instrucutions which use memory operands and
@@ -176,7 +288,7 @@ to validate memory accesses against the shadow memory.
 
 ## TODO
 
-The next features to be added are Aarch64 and Aarch32 support as well as looking at 
+The next features to be added are Aarch64 and Aarch32 support as well as looking at
 potential performance improvements. The intention is to achieve feature parity with
 QEMU mode in due course. Contributions are welcome, but please get in touch to
 ensure that efforts are deconflicted.
diff --git a/frida_mode/include/instrument.h b/frida_mode/include/instrument.h
index 75ee6396..ed92c25a 100644
--- a/frida_mode/include/instrument.h
+++ b/frida_mode/include/instrument.h
@@ -19,6 +19,7 @@ gboolean instrument_is_coverage_optimize_supported(void);
 void instrument_coverage_optimize(const cs_insn *   instr,
                                   GumStalkerOutput *output);
 
+void instrument_debug_init(void);
 void instrument_debug_start(uint64_t address, GumStalkerOutput *output);
 void instrument_debug_instruction(uint64_t address, uint16_t size);
 void instrument_debug_end(GumStalkerOutput *output);
diff --git a/frida_mode/include/output.h b/frida_mode/include/output.h
new file mode 100644
index 00000000..53a9fdd3
--- /dev/null
+++ b/frida_mode/include/output.h
@@ -0,0 +1,9 @@
+#ifndef _OUTPUT_H
+#define _OUTPUT_H
+
+#include "frida-gum.h"
+
+void output_init(void);
+
+#endif
+
diff --git a/frida_mode/include/stats.h b/frida_mode/include/stats.h
new file mode 100644
index 00000000..4271132a
--- /dev/null
+++ b/frida_mode/include/stats.h
@@ -0,0 +1,28 @@
+#ifndef _STATS_H
+#define _STATS_H
+
+#include "frida-gum.h"
+
+typedef struct {
+
+  guint64 num_blocks;
+  guint64 num_instructions;
+  guint64 stats_last_time;
+  guint64 stats_idx;
+  guint64 transitions_idx;
+
+} stats_data_header_t;
+
+extern stats_data_header_t *stats_data;
+
+void stats_init(void);
+void stats_collect(const cs_insn *instr, gboolean begin);
+void stats_print(char *format, ...);
+
+gboolean stats_is_supported_arch(void);
+size_t   stats_data_size_arch(void);
+void     stats_collect_arch(const cs_insn *instr);
+void     stats_write_arch(void);
+
+#endif
+
diff --git a/frida_mode/src/instrument/instrument.c b/frida_mode/src/instrument/instrument.c
index c4f18797..cd1ac0be 100644
--- a/frida_mode/src/instrument/instrument.c
+++ b/frida_mode/src/instrument/instrument.c
@@ -13,6 +13,7 @@
 #include "prefetch.h"
 #include "ranges.h"
 #include "stalker.h"
+#include "stats.h"
 #include "util.h"
 
 static gboolean               tracing = false;
@@ -113,6 +114,9 @@ static void instr_basic_block(GumStalkerIterator *iterator,
      * fork-server and thus start executing in the child.
      */
     excluded = range_is_excluded(GSIZE_TO_POINTER(instr->address));
+
+    stats_collect(instr, begin);
+
     if (unlikely(begin)) {
 
       instrument_debug_start(instr->address, output);
@@ -180,6 +184,7 @@ void instrument_init(void) {
   transformer =
       gum_stalker_transformer_make_from_callback(instr_basic_block, NULL, NULL);
 
+  instrument_debug_init();
   asan_init();
   cmplog_init();
 
diff --git a/frida_mode/src/instrument/instrument_debug.c b/frida_mode/src/instrument/instrument_debug.c
index 3a554ad0..124843d8 100644
--- a/frida_mode/src/instrument/instrument_debug.c
+++ b/frida_mode/src/instrument/instrument_debug.c
@@ -1,26 +1,34 @@
+#include <fcntl.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <unistd.h>
 
 #include "frida-gum.h"
 
-#include "util.h"
+#include "debug.h"
 
-#ifdef FRIDA_DEBUG
+#include "util.h"
 
+static int      debugging_fd = -1;
 static gpointer instrument_gen_start = NULL;
 
 static void instrument_debug(char *format, ...) {
 
   va_list ap;
   char    buffer[4096] = {0};
+  int     ret;
+  int len;
 
   va_start(ap, format);
 
-  vsnprintf(buffer, sizeof(buffer) - 1, format, ap);
+  ret = vsnprintf(buffer, sizeof(buffer) - 1, format, ap);
   va_end(ap);
 
-  IGNORED_RETURN(write(STDOUT_FILENO, buffer, sizeof(buffer)));
+  if (ret < 0) { return; }
+
+  len = strnlen(buffer, sizeof(buffer));
+
+  IGNORED_RETURN(write(debugging_fd, buffer, len));
 
 }
 
@@ -53,76 +61,70 @@ static void instrument_disasm(guint8 *code, guint size) {
 
 static gpointer instrument_cur(GumStalkerOutput *output) {
 
-  #if defined(__i386__) || defined(__x86_64__)
+#if defined(__i386__) || defined(__x86_64__)
   return gum_x86_writer_cur(output->writer.x86);
-  #elif defined(__aarch64__)
+#elif defined(__aarch64__)
   return gum_arm64_writer_cur(output->writer.arm64);
-  #elif defined(__arm__)
+#elif defined(__arm__)
   return gum_arm_writer_cur(output->writer.arm);
-  #else
-    #error "Unsupported architecture"
-  #endif
+#else
+  #error "Unsupported architecture"
+#endif
 
 }
 
-void instrument_debug_start(uint64_t address, GumStalkerOutput *output) {
-
-  GumDebugSymbolDetails details;
+void instrument_debug_init(void) {
 
-  instrument_gen_start = instrument_cur(output);
+  char *filename = getenv("AFL_FRIDA_INST_DEBUG_FILE");
+  OKF("Instrumentation debugging - enabled [%c]", filename == NULL ? ' ' : 'X');
 
-  if (gum_symbol_details_from_address(GSIZE_TO_POINTER(address), &details)) {
+  if (filename == NULL) { return; }
 
-    instrument_debug("\n\n***\n\nCreating block for 0x%" G_GINT64_MODIFIER
-                     "x (%s!%s):\n",
-                     address, details.module_name, details.symbol_name);
+  OKF("Instrumentation debugging - file [%s]", filename);
 
-  } else {
+  if (filename == NULL) { return; }
 
-    instrument_debug(
-        "\n\n***\n\nCreating block for 0x%" G_GINT64_MODIFIER "x:\n", address);
+  char *path = g_canonicalize_filename(filename, g_get_current_dir());
 
-  }
+  OKF("Instrumentation debugging - path [%s]", path);
 
-}
+  debugging_fd = open(path, O_RDWR | O_CREAT | O_TRUNC,
+                      S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
 
-void instrument_debug_instruction(uint64_t address, uint16_t size) {
+  if (debugging_fd < 0) { FATAL("Failed to open stats file '%s'", path); }
 
-  uint8_t *start = (uint8_t *)GSIZE_TO_POINTER(address);
-  instrument_disasm(start, size);
+  g_free(path);
 
 }
 
-void instrument_debug_end(GumStalkerOutput *output) {
-
-  gpointer instrument_gen_end = instrument_cur(output);
-  uint16_t size = GPOINTER_TO_SIZE(instrument_gen_end) -
-                  GPOINTER_TO_SIZE(instrument_gen_start);
-
-  instrument_debug("\nGenerated block %p\n", instrument_gen_start);
-  instrument_disasm(instrument_gen_start, size);
+void instrument_debug_start(uint64_t address, GumStalkerOutput *output) {
 
-}
+  if (likely(debugging_fd < 0)) { return; }
 
-#else
-void instrument_debug_start(void *address) {
+  instrument_gen_start = instrument_cur(output);
 
-  UNUSED_PARAMETER(address);
+  instrument_debug("\n\n***\n\nCreating block for 0x%" G_GINT64_MODIFIER "x:\n",
+                   address);
 
 }
 
 void instrument_debug_instruction(uint64_t address, uint16_t size) {
 
-  UNUSED_PARAMETER(address);
-  UNUSED_PARAMETER(size);
+  if (likely(debugging_fd < 0)) { return; }
+  uint8_t *start = (uint8_t *)GSIZE_TO_POINTER(address);
+  instrument_disasm(start, size);
 
 }
 
 void instrument_debug_end(GumStalkerOutput *output) {
 
-  UNUSED_PARAMETER(output);
+  if (likely(debugging_fd < 0)) { return; }
+  gpointer instrument_gen_end = instrument_cur(output);
+  uint16_t size = GPOINTER_TO_SIZE(instrument_gen_end) -
+                  GPOINTER_TO_SIZE(instrument_gen_start);
 
-}
+  instrument_debug("\nGenerated block %p\n", instrument_gen_start);
+  instrument_disasm(instrument_gen_start, size);
 
-#endif
+}
 
diff --git a/frida_mode/src/main.c b/frida_mode/src/main.c
index e8015905..1ab9993f 100644
--- a/frida_mode/src/main.c
+++ b/frida_mode/src/main.c
@@ -19,10 +19,12 @@
 #include "instrument.h"
 #include "interceptor.h"
 #include "lib.h"
+#include "output.h"
 #include "persistent.h"
 #include "prefetch.h"
 #include "ranges.h"
 #include "stalker.h"
+#include "stats.h"
 #include "util.h"
 
 #ifdef __APPLE__
@@ -95,9 +97,11 @@ void afl_frida_start() {
   lib_init();
   entry_init();
   instrument_init();
+  output_init();
   persistent_init();
   prefetch_init();
   ranges_init();
+  stats_init();
 
   void *fork_addr =
       GSIZE_TO_POINTER(gum_module_find_export_by_name(NULL, "fork"));
diff --git a/frida_mode/src/output.c b/frida_mode/src/output.c
new file mode 100644
index 00000000..8a222b25
--- /dev/null
+++ b/frida_mode/src/output.c
@@ -0,0 +1,45 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "output.h"
+
+static int output_fd = -1;
+
+static void output_redirect(int fd, char *variable) {
+
+  char *filename = getenv(variable);
+  char *path = NULL;
+
+  if (filename == NULL) { return; }
+
+  path = g_canonicalize_filename(filename, g_get_current_dir());
+
+  OKF("Redirect %d -> '%s'", fd, path);
+
+  output_fd = open(path, O_RDWR | O_CREAT | O_TRUNC,
+                   S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+
+  g_free(path);
+
+  if (output_fd < 0) { FATAL("Failed to open fd(%d) error %d", fd, errno); }
+
+  if (dup2(output_fd, fd) < 0) {
+
+    FATAL("Failed to set fd(%d) error %d", fd, errno);
+
+  }
+
+}
+
+void output_init(void) {
+
+  output_redirect(STDOUT_FILENO, "AFL_FRIDA_OUTPUT_STDOUT");
+  output_redirect(STDERR_FILENO, "AFL_FRIDA_OUTPUT_STDERR");
+
+}
+
diff --git a/frida_mode/src/stats/stats.c b/frida_mode/src/stats/stats.c
new file mode 100644
index 00000000..890a8d6b
--- /dev/null
+++ b/frida_mode/src/stats/stats.c
@@ -0,0 +1,208 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/shm.h>
+#include <sys/mman.h>
+
+#include "frida-gum.h"
+
+#include "config.h"
+#include "debug.h"
+#include "util.h"
+
+#include "stats.h"
+
+#define MICRO_TO_SEC 1000000
+
+stats_data_header_t *stats_data = NULL;
+
+static int      stats_parent_pid = -1;
+static int      stats_fd = -1;
+static gboolean stats_transitions = FALSE;
+static guint64  stats_interval = 0;
+
+void stats_init(void) {
+
+  stats_parent_pid = getpid();
+  char *filename = getenv("AFL_FRIDA_STATS_FILE");
+  stats_interval = util_read_num("AFL_FRIDA_STATS_INTERVAL");
+  if (getenv("AFL_FRIDA_STATS_TRANSITIONS") != NULL) {
+
+    stats_transitions = TRUE;
+
+  }
+
+  OKF("Stats - file [%s]", filename);
+  OKF("Stats - interval [%" G_GINT64_MODIFIER "u]", stats_interval);
+
+  if (stats_interval != 0 && filename == NULL) {
+
+    FATAL(
+        "AFL_FRIDA_STATS_FILE must be specified if "
+        "AFL_FRIDA_STATS_INTERVAL is");
+
+  }
+
+  if (stats_interval == 0) { stats_interval = 10; }
+
+  if (filename == NULL) { return; }
+
+  if (!stats_is_supported_arch()) {
+
+    FATAL("Stats is not supported on this architecture");
+
+  }
+
+  char *path = NULL;
+
+  if (filename == NULL) { return; }
+
+  if (stats_transitions) { gum_stalker_set_counters_enabled(TRUE); }
+
+  path = g_canonicalize_filename(filename, g_get_current_dir());
+
+  OKF("Stats - path [%s]", path);
+
+  stats_fd = open(path, O_RDWR | O_CREAT | O_TRUNC,
+                  S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
+
+  if (stats_fd < 0) { FATAL("Failed to open stats file '%s'", path); }
+
+  g_free(path);
+
+  size_t data_size = stats_data_size_arch();
+
+  int shm_id = shmget(IPC_PRIVATE, data_size, IPC_CREAT | IPC_EXCL | 0600);
+  if (shm_id < 0) { FATAL("shm_id < 0 - errno: %d\n", errno); }
+
+  stats_data = shmat(shm_id, NULL, 0);
+  g_assert(stats_data != MAP_FAILED);
+
+  /*
+   * Configure the shared memory region to be removed once the process dies.
+   */
+  if (shmctl(shm_id, IPC_RMID, NULL) < 0) {
+
+    FATAL("shmctl (IPC_RMID) < 0 - errno: %d\n", errno);
+
+  }
+
+  /* Clear it, not sure it's necessary, just seems like good practice */
+  memset(stats_data, '\0', data_size);
+
+}
+
+void stats_vprint(int fd, char *format, va_list ap) {
+
+  char buffer[4096] = {0};
+  int ret;
+  int  len;
+
+  if(vsnprintf(buffer, sizeof(buffer) - 1, format, ap) < 0) { return; }
+
+  len = strnlen(buffer, sizeof(buffer));
+  IGNORED_RETURN(write(fd, buffer, len));
+
+}
+
+void stats_print_fd(int fd, char *format, ...) {
+
+  va_list ap;
+  va_start(ap, format);
+  stats_vprint(fd, format, ap);
+  va_end(ap);
+
+}
+
+void stats_print(char *format, ...) {
+
+  va_list ap;
+  va_start(ap, format);
+  stats_vprint(stats_fd, format, ap);
+  va_end(ap);
+
+}
+
+void stats_write(void) {
+
+  if (stats_parent_pid == getpid()) { return; }
+
+  GDateTime *date_time = g_date_time_new_now_local();
+  char *date_time_string = g_date_time_format(date_time, "%Y-%m-%e %H:%M:%S");
+
+  stats_print("stats\n");
+  stats_print("-----\n");
+
+  stats_print("Index:                          %" G_GINT64_MODIFIER "u\n",
+              stats_data->stats_idx++);
+  stats_print("Pid:                            %d\n", getpid());
+  stats_print("Time:                           %s\n", date_time_string);
+  stats_print("Blocks:                         %" G_GINT64_MODIFIER "u\n",
+              stats_data->num_blocks);
+  stats_print("Instructions:                   %" G_GINT64_MODIFIER "u\n",
+              stats_data->num_instructions);
+  stats_print("Avg Instructions / Block:       %" G_GINT64_MODIFIER "u\n",
+              stats_data->num_instructions / stats_data->num_blocks);
+
+  stats_print("\n");
+
+  g_free(date_time_string);
+  g_date_time_unref(date_time);
+
+  stats_write_arch();
+
+  if (stats_transitions) {
+
+    GDateTime *date_time = g_date_time_new_now_local();
+    char *date_time_string = g_date_time_format(date_time, "%Y-%m-%e %H:%M:%S");
+
+    stats_print_fd(STDERR_FILENO, "stats\n");
+    stats_print_fd(STDERR_FILENO, "-----\n");
+    stats_print_fd(STDERR_FILENO, "Index: %" G_GINT64_MODIFIER "u\n",
+                   stats_data->transitions_idx++);
+    stats_print_fd(STDERR_FILENO, "Pid:   %d\n", getpid());
+    stats_print_fd(STDERR_FILENO, "Time:  %s\n", date_time_string);
+
+    g_free(date_time_string);
+    g_date_time_unref(date_time);
+    gum_stalker_dump_counters();
+
+  }
+
+}
+
+static void stats_maybe_write(void) {
+
+  guint64 current_time;
+
+  if (stats_interval == 0) { return; }
+
+  current_time = g_get_monotonic_time();
+
+  if ((current_time - stats_data->stats_last_time) >
+      (stats_interval * MICRO_TO_SEC)) {
+
+    stats_write();
+    stats_data->stats_last_time = current_time;
+
+  }
+
+}
+
+void stats_collect(const cs_insn *instr, gboolean begin) {
+
+  UNUSED_PARAMETER(instr);
+  UNUSED_PARAMETER(begin);
+
+  if (stats_fd < 0) { return; }
+
+  if (begin) { stats_data->num_blocks++; }
+  stats_data->num_instructions++;
+
+  stats_collect_arch(instr);
+
+  stats_maybe_write();
+
+}
+
diff --git a/frida_mode/src/stats/stats_arm.c b/frida_mode/src/stats/stats_arm.c
new file mode 100644
index 00000000..7eea7f91
--- /dev/null
+++ b/frida_mode/src/stats/stats_arm.c
@@ -0,0 +1,36 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "stats.h"
+#include "util.h"
+
+#if defined(__arm__)
+
+gboolean stats_is_supported_arch(void) {
+
+  return FALSE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_write_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+  UNUSED_PARAMETER(instr);
+  FATAL("Stats not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/src/stats/stats_arm64.c b/frida_mode/src/stats/stats_arm64.c
new file mode 100644
index 00000000..592af87a
--- /dev/null
+++ b/frida_mode/src/stats/stats_arm64.c
@@ -0,0 +1,36 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "stats.h"
+#include "util.h"
+
+#if defined(__aarch64__)
+
+gboolean stats_is_supported_arch(void) {
+
+  return FALSE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_write_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+  UNUSED_PARAMETER(instr);
+  FATAL("Stats not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/src/stats/stats_x64.c b/frida_mode/src/stats/stats_x64.c
new file mode 100644
index 00000000..c3e8742a
--- /dev/null
+++ b/frida_mode/src/stats/stats_x64.c
@@ -0,0 +1,307 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "ranges.h"
+#include "stats.h"
+#include "util.h"
+
+#if defined(__x86_64__)
+
+typedef struct {
+
+  stats_data_header_t header;
+
+  guint64 num_call_imm;
+  guint64 num_call_imm_excluded;
+  guint64 num_call_reg;
+  guint64 num_call_mem;
+
+  guint64 num_jmp_imm;
+  guint64 num_jmp_reg;
+  guint64 num_jmp_mem;
+
+  guint64 num_jmp_cond_imm;
+  guint64 num_jmp_cond_reg;
+  guint64 num_jmp_cond_mem;
+
+  guint64 num_jmp_cond_jcxz;
+
+  guint64 num_ret;
+
+  guint64 num_rip_relative;
+
+} stats_data_arch_t;
+
+gboolean stats_is_supported_arch(void) {
+
+  return TRUE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+  return sizeof(stats_data_arch_t);
+
+}
+
+void stats_write_arch(void) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  guint64 num_instructions = stats_data_arch->header.num_instructions;
+
+  stats_print(
+      "Call Immediates:                %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_call_imm,
+      ((float)(stats_data_arch->num_call_imm * 100) / num_instructions));
+  stats_print("Call Immediates Excluded:       %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_call_imm_excluded,
+              ((float)(stats_data_arch->num_call_imm_excluded * 100) /
+               num_instructions));
+  stats_print(
+      "Call Register:                  %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_call_reg,
+      ((float)(stats_data_arch->num_call_reg * 100) / num_instructions));
+  stats_print(
+      "Call Memory:                    %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_call_mem,
+      ((float)(stats_data_arch->num_call_mem * 100) / num_instructions));
+
+  stats_print("\n");
+
+  stats_print("Jump Immediates:                %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_jmp_imm,
+              ((float)(stats_data_arch->num_jmp_imm * 100) / num_instructions));
+  stats_print("Jump Register:                  %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_jmp_reg,
+              ((float)(stats_data_arch->num_jmp_reg * 100) / num_instructions));
+  stats_print("Jump Memory:                    %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_jmp_mem,
+              ((float)(stats_data_arch->num_jmp_mem * 100) / num_instructions));
+
+  stats_print("\n");
+
+  stats_print(
+      "Conditional Jump Immediates:    %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_jmp_cond_imm,
+      ((float)(stats_data_arch->num_jmp_cond_imm * 100) / num_instructions));
+  stats_print(
+      "Conditional Jump CX Immediate:  %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_jmp_cond_jcxz,
+      ((float)(stats_data_arch->num_jmp_cond_jcxz * 100) / num_instructions));
+  stats_print(
+      "Conditional Jump Register:      %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_jmp_cond_reg,
+      ((float)(stats_data_arch->num_jmp_cond_reg * 100) / num_instructions));
+  stats_print(
+      "Conditional Jump Memory:        %" G_GINT64_MODIFIER
+      "u "
+      "(%3.2f%%)\n",
+      stats_data_arch->num_jmp_cond_mem,
+      ((float)(stats_data_arch->num_jmp_cond_mem * 100) / num_instructions));
+
+  stats_print("\n");
+
+  stats_print("Returns:                        %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_ret,
+              (stats_data_arch->num_ret * 100 / num_instructions));
+
+  stats_print("\n");
+
+  stats_print("Rip Relative:                   %" G_GINT64_MODIFIER
+              "u "
+              "(%3.2f%%)\n",
+              stats_data_arch->num_rip_relative,
+              (stats_data_arch->num_rip_relative * 100 / num_instructions));
+
+  stats_print("\n");
+  stats_print("\n");
+
+}
+
+static x86_op_type stats_get_operand_type(const cs_insn *instr) {
+
+  cs_x86 *   x86 = &instr->detail->x86;
+  cs_x86_op *operand;
+
+  if (x86->op_count != 1) {
+
+    FATAL("Unexpected operand count (%d): %s %s\n", x86->op_count,
+          instr->mnemonic, instr->op_str);
+
+  }
+
+  operand = &x86->operands[0];
+
+  return operand->type;
+
+}
+
+static void stats_collect_call_imm_excluded_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  cs_x86 *           x86 = &instr->detail->x86;
+  cs_x86_op *        operand = &x86->operands[0];
+
+  if (range_is_excluded((gpointer)operand->imm)) {
+
+    stats_data_arch->num_call_imm_excluded++;
+
+  }
+
+}
+
+static void stats_collect_call_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  x86_op_type        type = stats_get_operand_type(instr);
+  switch (type) {
+
+    case X86_OP_IMM:
+      stats_data_arch->num_call_imm++;
+      stats_collect_call_imm_excluded_arch(instr);
+      break;
+    case X86_OP_REG:
+      stats_data_arch->num_call_reg++;
+      break;
+    case X86_OP_MEM:
+      stats_data_arch->num_call_mem++;
+      break;
+    default:
+      FATAL("Invalid operand type: %s %s\n", instr->mnemonic, instr->op_str);
+
+  }
+
+}
+
+static void stats_collect_jump_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  x86_op_type        type = stats_get_operand_type(instr);
+  switch (type) {
+
+    case X86_OP_IMM:
+      stats_data_arch->num_jmp_imm++;
+      break;
+    case X86_OP_REG:
+      stats_data_arch->num_jmp_reg++;
+      break;
+    case X86_OP_MEM:
+      stats_data_arch->num_jmp_mem++;
+      break;
+    default:
+      FATAL("Invalid operand type: %s %s\n", instr->mnemonic, instr->op_str);
+
+  }
+
+}
+
+static void stats_collect_jump_cond_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  x86_op_type        type = stats_get_operand_type(instr);
+  switch (type) {
+
+    case X86_OP_IMM:
+      stats_data_arch->num_jmp_cond_imm++;
+      break;
+    case X86_OP_REG:
+      stats_data_arch->num_jmp_cond_reg++;
+      break;
+    case X86_OP_MEM:
+      stats_data_arch->num_jmp_cond_mem++;
+      break;
+    default:
+      FATAL("Invalid operand type: %s %s\n", instr->mnemonic, instr->op_str);
+
+  }
+
+}
+
+static void stats_collect_rip_relative_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  cs_x86 *           x86 = &instr->detail->x86;
+  guint              mod;
+  guint              rm;
+
+  if (x86->encoding.modrm_offset == 0) { return; }
+
+  mod = (x86->modrm & 0xc0) >> 6;
+  if (mod != 0) { return; }
+
+  rm = (x86->modrm & 0x07) >> 0;
+  if (rm != 5) { return; }
+
+  stats_data_arch->num_rip_relative++;
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+  stats_data_arch_t *stats_data_arch = (stats_data_arch_t *)stats_data;
+  switch (instr->id) {
+
+    case X86_INS_CALL:
+      stats_collect_call_arch(instr);
+      break;
+    case X86_INS_JMP:
+      stats_collect_jump_arch(instr);
+      break;
+    case X86_INS_JA:
+    case X86_INS_JAE:
+    case X86_INS_JB:
+    case X86_INS_JBE:
+    case X86_INS_JE:
+    case X86_INS_JG:
+    case X86_INS_JGE:
+    case X86_INS_JL:
+    case X86_INS_JLE:
+    case X86_INS_JNE:
+    case X86_INS_JNO:
+    case X86_INS_JNP:
+    case X86_INS_JNS:
+    case X86_INS_JO:
+    case X86_INS_JP:
+    case X86_INS_JS:
+      stats_collect_jump_cond_arch(instr);
+      break;
+    case X86_INS_JECXZ:
+    case X86_INS_JRCXZ:
+      stats_data_arch->num_jmp_cond_jcxz++;
+      break;
+    case X86_INS_RET:
+      stats_data_arch->num_ret++;
+      break;
+    default:
+      stats_collect_rip_relative_arch(instr);
+      break;
+
+  }
+
+}
+
+#endif
+
diff --git a/frida_mode/src/stats/stats_x86.c b/frida_mode/src/stats/stats_x86.c
new file mode 100644
index 00000000..1906e809
--- /dev/null
+++ b/frida_mode/src/stats/stats_x86.c
@@ -0,0 +1,36 @@
+#include "frida-gum.h"
+
+#include "debug.h"
+
+#include "stats.h"
+#include "util.h"
+
+#if defined(__i386__)
+
+gboolean stats_is_supported_arch(void) {
+
+  return FALSE;
+
+}
+
+size_t stats_data_size_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_write_arch(void) {
+
+  FATAL("Stats not supported on this architecture");
+
+}
+
+void stats_collect_arch(const cs_insn *instr) {
+
+  UNUSED_PARAMETER(instr);
+  FATAL("Stats not supported on this architecture");
+
+}
+
+#endif
+
diff --git a/frida_mode/test/output/GNUmakefile b/frida_mode/test/output/GNUmakefile
new file mode 100644
index 00000000..eaa1c4dc
--- /dev/null
+++ b/frida_mode/test/output/GNUmakefile
@@ -0,0 +1,47 @@
+PWD:=$(shell pwd)/
+ROOT:=$(shell realpath $(PWD)../../..)/
+BUILD_DIR:=$(PWD)build/
+TESTINSTR_DATA_DIR:=$(BUILD_DIR)in/
+TESTINSTR_DATA_FILE:=$(TESTINSTR_DATA_DIR)in
+
+TESTINSTBIN:=$(BUILD_DIR)testinstr
+TESTINSTSRC:=$(PWD)testinstr.c
+
+QEMU_OUT:=$(BUILD_DIR)qemu-out
+FRIDA_OUT:=$(BUILD_DIR)frida-out
+
+.PHONY: all 32 clean qemu frida
+
+all: $(TESTINSTBIN)
+	make -C $(ROOT)frida_mode/
+
+32:
+	CFLAGS="-m32" LDFLAGS="-m32" ARCH="x86" make all
+
+$(BUILD_DIR):
+	mkdir -p $@
+
+$(TESTINSTR_DATA_DIR): | $(BUILD_DIR)
+	mkdir -p $@
+
+$(TESTINSTR_DATA_FILE): | $(TESTINSTR_DATA_DIR)
+	echo -n "000" > $@
+
+$(TESTINSTBIN): $(TESTINSTSRC) | $(BUILD_DIR)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $<
+
+clean:
+	rm -rf $(BUILD_DIR)
+
+frida: $(TESTINSTBIN) $(TESTINSTR_DATA_FILE)
+	AFL_FRIDA_OUTPUT_STDOUT=frida_stdout.txt \
+	AFL_FRIDA_OUTPUT_STDERR=frida_stderr.txt \
+	AFL_FRIDA_STATS_FILE=frida_stats.txt \
+	AFL_FRIDA_STATS_INTERVAL=1 \
+	$(ROOT)afl-fuzz \
+		-D \
+		-O \
+		-i $(TESTINSTR_DATA_DIR) \
+		-o $(FRIDA_OUT) \
+		-- \
+			$(TESTINSTBIN) @@
diff --git a/frida_mode/test/output/Makefile b/frida_mode/test/output/Makefile
new file mode 100644
index 00000000..07b139e9
--- /dev/null
+++ b/frida_mode/test/output/Makefile
@@ -0,0 +1,13 @@
+all:
+	@echo trying to use GNU make...
+	@gmake all || echo please install GNUmake
+
+32:
+	@echo trying to use GNU make...
+	@gmake 32 || echo please install GNUmake
+
+clean:
+	@gmake clean
+
+frida:
+	@gmake frida
diff --git a/frida_mode/test/output/frida_stderr.txt b/frida_mode/test/output/frida_stderr.txt
new file mode 100644
index 00000000..103216cf
--- /dev/null
+++ b/frida_mode/test/output/frida_stderr.txt
@@ -0,0 +1,2824 @@
+
+
+total_transitions: 9
+	call_imms: 1
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 1
+	jmp_mems: 2
+	jmp_regs: 0
+
+	jmp_cond_imms: 2
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 19
+	call_imms: 4
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 2
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 1
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 6
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 29
+	call_imms: 6
+	call_regs: 1
+	call_mems: 0
+	post_call_invokes: 3
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 2
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 11
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 39
+	call_imms: 6
+	call_regs: 2
+	call_mems: 0
+	post_call_invokes: 5
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 2
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 18
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 49
+	call_imms: 7
+	call_regs: 2
+	call_mems: 1
+	post_call_invokes: 6
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 2
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 25
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 59
+	call_imms: 8
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 6
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 3
+	jmp_mems: 3
+	jmp_regs: 0
+
+	jmp_cond_imms: 31
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 69
+	call_imms: 9
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 7
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 3
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 38
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 79
+	call_imms: 10
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 7
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 4
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 46
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 89
+	call_imms: 10
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 7
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 4
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 56
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 99
+	call_imms: 11
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 9
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 4
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 63
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 109
+	call_imms: 12
+	call_regs: 2
+	call_mems: 3
+	post_call_invokes: 12
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 5
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 68
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 119
+	call_imms: 12
+	call_regs: 2
+	call_mems: 4
+	post_call_invokes: 14
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 6
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 74
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 129
+	call_imms: 14
+	call_regs: 2
+	call_mems: 4
+	post_call_invokes: 16
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 6
+	jmp_mems: 4
+	jmp_regs: 0
+
+	jmp_cond_imms: 80
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 139
+	call_imms: 14
+	call_regs: 2
+	call_mems: 5
+	post_call_invokes: 17
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 6
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 87
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 149
+	call_imms: 14
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 17
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 6
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 96
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 159
+	call_imms: 15
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 18
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 8
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 102
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 170
+	call_imms: 15
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 18
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 10
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 111
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 180
+	call_imms: 15
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 20
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 11
+	jmp_mems: 5
+	jmp_regs: 0
+
+	jmp_cond_imms: 118
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 190
+	call_imms: 16
+	call_regs: 2
+	call_mems: 6
+	post_call_invokes: 20
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 11
+	jmp_mems: 6
+	jmp_regs: 1
+
+	jmp_cond_imms: 125
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 201
+	call_imms: 16
+	call_regs: 2
+	call_mems: 7
+	post_call_invokes: 21
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 13
+	jmp_mems: 6
+	jmp_regs: 1
+
+	jmp_cond_imms: 132
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 211
+	call_imms: 17
+	call_regs: 2
+	call_mems: 7
+	post_call_invokes: 22
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 14
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 138
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 223
+	call_imms: 18
+	call_regs: 2
+	call_mems: 8
+	post_call_invokes: 24
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 15
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 145
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 233
+	call_imms: 18
+	call_regs: 2
+	call_mems: 8
+	post_call_invokes: 25
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 16
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 153
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 244
+	call_imms: 19
+	call_regs: 2
+	call_mems: 9
+	post_call_invokes: 26
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 16
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 161
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+
+
+total_transitions: 254
+	call_imms: 20
+	call_regs: 2
+	call_mems: 9
+	post_call_invokes: 27
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 18
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 167
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 264
+	call_imms: 20
+	call_regs: 2
+	call_mems: 9
+	post_call_invokes: 29
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 20
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 173
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 275
+	call_imms: 21
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 30
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 22
+	jmp_mems: 7
+	jmp_regs: 1
+
+	jmp_cond_imms: 179
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 285
+	call_imms: 22
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 30
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 23
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 186
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 295
+	call_imms: 22
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 30
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 23
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 196
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 305
+	call_imms: 22
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 30
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 24
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 205
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 315
+	call_imms: 22
+	call_regs: 2
+	call_mems: 10
+	post_call_invokes: 31
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 26
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 212
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 326
+	call_imms: 22
+	call_regs: 3
+	call_mems: 10
+	post_call_invokes: 32
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 27
+	jmp_mems: 8
+	jmp_regs: 1
+
+	jmp_cond_imms: 220
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 337
+	call_imms: 23
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 36
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 27
+	jmp_mems: 9
+	jmp_regs: 1
+
+	jmp_cond_imms: 224
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 348
+	call_imms: 24
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 38
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 27
+	jmp_mems: 10
+	jmp_regs: 1
+
+	jmp_cond_imms: 231
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 362
+	call_imms: 26
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 39
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 28
+	jmp_mems: 11
+	jmp_regs: 1
+
+	jmp_cond_imms: 240
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 375
+	call_imms: 27
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 40
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 28
+	jmp_mems: 12
+	jmp_regs: 1
+
+	jmp_cond_imms: 250
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 387
+	call_imms: 28
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 41
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 28
+	jmp_mems: 12
+	jmp_regs: 3
+
+	jmp_cond_imms: 258
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 397
+	call_imms: 29
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 42
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 30
+	jmp_mems: 12
+	jmp_regs: 3
+
+	jmp_cond_imms: 264
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 407
+	call_imms: 29
+	call_regs: 4
+	call_mems: 10
+	post_call_invokes: 42
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 31
+	jmp_mems: 12
+	jmp_regs: 3
+
+	jmp_cond_imms: 273
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 418
+	call_imms: 29
+	call_regs: 4
+	call_mems: 11
+	post_call_invokes: 43
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 32
+	jmp_mems: 12
+	jmp_regs: 3
+
+	jmp_cond_imms: 281
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+
+
+total_transitions: 430
+	call_imms: 32
+	call_regs: 4
+	call_mems: 11
+	post_call_invokes: 45
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 33
+	jmp_mems: 13
+	jmp_regs: 3
+
+	jmp_cond_imms: 286
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 441
+	call_imms: 32
+	call_regs: 4
+	call_mems: 12
+	post_call_invokes: 46
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 33
+	jmp_mems: 13
+	jmp_regs: 3
+
+	jmp_cond_imms: 295
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+
+
+total_transitions: 453
+	call_imms: 33
+	call_regs: 4
+	call_mems: 12
+	post_call_invokes: 49
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 34
+	jmp_mems: 13
+	jmp_regs: 3
+
+	jmp_cond_imms: 302
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 465
+	call_imms: 35
+	call_regs: 4
+	call_mems: 12
+	post_call_invokes: 50
+	excluded_call_imms: 2
+	ret_slow_paths: 1
+
+	jmp_imms: 35
+	jmp_mems: 15
+	jmp_regs: 3
+
+	jmp_cond_imms: 308
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 475
+	call_imms: 38
+	call_regs: 4
+	call_mems: 12
+	post_call_invokes: 51
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 35
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 310
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 485
+	call_imms: 38
+	call_regs: 5
+	call_mems: 12
+	post_call_invokes: 52
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 36
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 317
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 495
+	call_imms: 38
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 52
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 38
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 324
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 506
+	call_imms: 38
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 53
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 39
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 333
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 516
+	call_imms: 40
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 53
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 40
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 340
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 526
+	call_imms: 40
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 54
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 40
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 349
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 540
+	call_imms: 42
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 55
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 42
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 358
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 552
+	call_imms: 43
+	call_regs: 5
+	call_mems: 13
+	post_call_invokes: 57
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 43
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 366
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 563
+	call_imms: 43
+	call_regs: 5
+	call_mems: 14
+	post_call_invokes: 58
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 43
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 375
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 573
+	call_imms: 43
+	call_regs: 5
+	call_mems: 15
+	post_call_invokes: 59
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 44
+	jmp_mems: 16
+	jmp_regs: 3
+
+	jmp_cond_imms: 382
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 583
+	call_imms: 44
+	call_regs: 5
+	call_mems: 15
+	post_call_invokes: 59
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 45
+	jmp_mems: 17
+	jmp_regs: 3
+
+	jmp_cond_imms: 389
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 593
+	call_imms: 45
+	call_regs: 5
+	call_mems: 15
+	post_call_invokes: 60
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 46
+	jmp_mems: 17
+	jmp_regs: 3
+
+	jmp_cond_imms: 396
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 603
+	call_imms: 46
+	call_regs: 6
+	call_mems: 15
+	post_call_invokes: 64
+	excluded_call_imms: 3
+	ret_slow_paths: 3
+
+	jmp_imms: 46
+	jmp_mems: 17
+	jmp_regs: 3
+
+	jmp_cond_imms: 400
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 615
+	call_imms: 46
+	call_regs: 7
+	call_mems: 17
+	post_call_invokes: 64
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 46
+	jmp_mems: 17
+	jmp_regs: 3
+
+	jmp_cond_imms: 407
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 626
+	call_imms: 48
+	call_regs: 8
+	call_mems: 18
+	post_call_invokes: 66
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 46
+	jmp_mems: 18
+	jmp_regs: 3
+
+	jmp_cond_imms: 411
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 637
+	call_imms: 50
+	call_regs: 9
+	call_mems: 19
+	post_call_invokes: 68
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 47
+	jmp_mems: 19
+	jmp_regs: 3
+
+	jmp_cond_imms: 414
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 648
+	call_imms: 52
+	call_regs: 9
+	call_mems: 20
+	post_call_invokes: 70
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 47
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 419
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 660
+	call_imms: 52
+	call_regs: 10
+	call_mems: 20
+	post_call_invokes: 72
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 49
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 426
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 672
+	call_imms: 52
+	call_regs: 10
+	call_mems: 20
+	post_call_invokes: 72
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 51
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 436
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 683
+	call_imms: 53
+	call_regs: 11
+	call_mems: 21
+	post_call_invokes: 73
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 52
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 442
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 697
+	call_imms: 53
+	call_regs: 11
+	call_mems: 22
+	post_call_invokes: 74
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 53
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 453
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 709
+	call_imms: 53
+	call_regs: 13
+	call_mems: 22
+	post_call_invokes: 77
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 53
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 460
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 720
+	call_imms: 53
+	call_regs: 13
+	call_mems: 22
+	post_call_invokes: 77
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 55
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 469
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 730
+	call_imms: 54
+	call_regs: 13
+	call_mems: 24
+	post_call_invokes: 77
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 56
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 475
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 740
+	call_imms: 54
+	call_regs: 13
+	call_mems: 24
+	post_call_invokes: 80
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 57
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 481
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 753
+	call_imms: 54
+	call_regs: 14
+	call_mems: 24
+	post_call_invokes: 81
+	excluded_call_imms: 5
+	ret_slow_paths: 3
+
+	jmp_imms: 58
+	jmp_mems: 20
+	jmp_regs: 3
+
+	jmp_cond_imms: 491
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+
+
+total_transitions: 3
+	call_imms: 0
+	call_regs: 0
+	call_mems: 0
+	post_call_invokes: 0
+	excluded_call_imms: 0
+	ret_slow_paths: 0
+
+	jmp_imms: 1
+	jmp_mems: 1
+	jmp_regs: 0
+
+	jmp_cond_imms: 1
+	jmp_cond_mems: 0
+	jmp_cond_regs: 0
+	jmp_cond_jcxzs: 0
+
+	jmp_continuations: 0
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Running: /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input
+Running:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
+Done:    /home/jon/git/AFLplusplus/frida_mode/test/output/build/frida-out/default/.cur_input: (3 bytes)
diff --git a/frida_mode/test/output/frida_stdout.txt b/frida_mode/test/output/frida_stdout.txt
new file mode 100644
index 00000000..8832681d
--- /dev/null
+++ b/frida_mode/test/output/frida_stdout.txt
@@ -0,0 +1,349 @@
+OG Range - 0x00007FFFF7FFE000 - 0x00007FFFF7FFF000
+[+] CMPLOG Range - 0x00007FFFF7FFD000 - 0x00007FFFF7FFE000
+[+] CMPLOG Range - 0x00007FFFF7FFC000 - 0x00007FFFF7FFD000
+[+] CMPLOG Range - 0x00007FFFF7FF3000 - 0x00007FFFF7FFB000
+[+] CMPLOG Range - 0x00007FFFF7FD0000 - 0x00007FFFF7FF3000
+[+] CMPLOG Range - 0x00007FFFF7FCF000 - 0x00007FFFF7FD0000
+[+] CMPLOG Range - 0x00007FFFF7FCE000 - 0x00007FFFF7FCF000
+[+] CMPLOG Range - 0x00007FFFF7FCB000 - 0x00007FFFF7FCE000
+[+] CMPLOG Range - 0x00007FFFF7DC4000 - 0x00007FFFF7FCB000
+[+] CMPLOG Range - 0x00007FFFF7DBC000 - 0x00007FFFF7DC4000
+[+] CMPLOG Range - 0x00007FFFF7DB0000 - 0x00007FFFF7DBC000
+[+] CMPLOG Range - 0x00007FFFF7A94000 - 0x00007FFFF7DB0000
+[+] CMPLOG Range - 0x00007FFFF7942000 - 0x00007FFFF7A94000
+[+] CMPLOG Range - 0x00007FFFF78BF000 - 0x00007FFFF7942000
+[+] CMPLOG Range - 0x00007FFFF78AF000 - 0x00007FFFF78BF000
+[+] CMPLOG Range - 0x00007FFFF78AA000 - 0x00007FFFF78AB000
+[+] CMPLOG Range - 0x00007FFFF78A9000 - 0x00007FFFF78AA000
+[+] CMPLOG Range - 0x00007FFFF78A2000 - 0x00007FFFF78A6000
+[+] CMPLOG Range - 0x00007FFFF789F000 - 0x00007FFFF78A2000
+[+] CMPLOG Range - 0x00007FFFF789C000 - 0x00007FFFF789F000
+[+] CMPLOG Range - 0x00007FFFF7851000 - 0x00007FFFF789B000
+[+] CMPLOG Range - 0x00007FFFF76DB000 - 0x00007FFFF7851000
+[+] CMPLOG Range - 0x00007FFFF76DA000 - 0x00007FFFF76DB000
+[+] CMPLOG Range - 0x00007FFFF76D9000 - 0x00007FFFF76DA000
+[+] CMPLOG Range - 0x00007FFFF76B4000 - 0x00007FFFF76D9000
+[+] CMPLOG Range - 0x00007FFFF76B0000 - 0x00007FFFF76B4000
+[+] CMPLOG Range - 0x00007FFFF76AF000 - 0x00007FFFF76B0000
+[+] CMPLOG Range - 0x00007FFFF76AE000 - 0x00007FFFF76AF000
+[+] CMPLOG Range - 0x00007FFFF76A9000 - 0x00007FFFF76AE000
+[+] CMPLOG Range - 0x00007FFFF7698000 - 0x00007FFFF76A9000
+[+] CMPLOG Range - 0x00007FFFF7691000 - 0x00007FFFF7698000
+[+] CMPLOG Range - 0x00007FFFF768F000 - 0x00007FFFF7691000
+[+] CMPLOG Range - 0x00007FFFF768E000 - 0x00007FFFF768F000
+[+] CMPLOG Range - 0x00007FFFF768D000 - 0x00007FFFF768E000
+[+] CMPLOG Range - 0x00007FFFF7689000 - 0x00007FFFF768C000
+[+] CMPLOG Range - 0x00007FFFF7679000 - 0x00007FFFF7689000
+[+] CMPLOG Range - 0x00007FFFF7675000 - 0x00007FFFF7679000
+[+] CMPLOG Range - 0x00007FFFF7674000 - 0x00007FFFF7675000
+[+] CMPLOG Range - 0x00007FFFF7673000 - 0x00007FFFF7674000
+[+] CMPLOG Range - 0x00007FFFF7672000 - 0x00007FFFF7673000
+[+] CMPLOG Range - 0x00007FFFF7670000 - 0x00007FFFF7672000
+[+] CMPLOG Range - 0x00007FFFF766F000 - 0x00007FFFF7670000
+[+] CMPLOG Range - 0x00007FFFF766D000 - 0x00007FFFF766F000
+[+] Redirect 1 -> '/home/jon/git/AFLplusplus/frida_mode/test/output/frida_stdout.txt'
+[+] Redirect 2 -> '/home/jon/git/AFLplusplus/frida_mode/test/output/frida_stderr.txt'
+[+] Instrumentation - persistent mode [ ] (0x0000000000000000)
+[+] Instrumentation - persistent count [ ] (0)
+[+] Instrumentation - hook [(null)]
+[+] Instrumentation - persistent ret [ ] (0x0000000000000000)
+[+] Instrumentation - persistent ret offset [ ] (0)
+[+] Instrumentation - prefetch [X]
+[+] Range: Modules Length: 54
+[+] Range: Modules Idx:   0 - 0x0000555555554000-0x0000555555555000
+[+] Range: Modules Idx:   1 - 0x0000555555555000-0x0000555555556000
+[+] Range: Modules Idx:   2 - 0x0000555555556000-0x0000555555557000
+[+] Range: Modules Idx:   3 - 0x0000555555557000-0x0000555555558000
+[+] Range: Modules Idx:   4 - 0x0000555555558000-0x0000555555559000
+[+] Range: Modules Idx:   5 - 0x0000555555559000-0x000055555557a000
+[+] Range: Modules Idx:   6 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: Modules Idx:   7 - 0x00007ffff766d000-0x00007ffff766f000
+[+] Range: Modules Idx:   8 - 0x00007ffff766f000-0x00007ffff7670000
+[+] Range: Modules Idx:   9 - 0x00007ffff7670000-0x00007ffff7672000
+[+] Range: Modules Idx:  10 - 0x00007ffff7672000-0x00007ffff7673000
+[+] Range: Modules Idx:  11 - 0x00007ffff7673000-0x00007ffff7674000
+[+] Range: Modules Idx:  12 - 0x00007ffff7674000-0x00007ffff7675000
+[+] Range: Modules Idx:  13 - 0x00007ffff7675000-0x00007ffff7679000
+[+] Range: Modules Idx:  14 - 0x00007ffff7679000-0x00007ffff7689000
+[+] Range: Modules Idx:  15 - 0x00007ffff7689000-0x00007ffff768c000
+[+] Range: Modules Idx:  16 - 0x00007ffff768c000-0x00007ffff768d000
+[+] Range: Modules Idx:  17 - 0x00007ffff768d000-0x00007ffff768e000
+[+] Range: Modules Idx:  18 - 0x00007ffff768e000-0x00007ffff768f000
+[+] Range: Modules Idx:  19 - 0x00007ffff768f000-0x00007ffff7691000
+[+] Range: Modules Idx:  20 - 0x00007ffff7691000-0x00007ffff7698000
+[+] Range: Modules Idx:  21 - 0x00007ffff7698000-0x00007ffff76a9000
+[+] Range: Modules Idx:  22 - 0x00007ffff76a9000-0x00007ffff76ae000
+[+] Range: Modules Idx:  23 - 0x00007ffff76ae000-0x00007ffff76af000
+[+] Range: Modules Idx:  24 - 0x00007ffff76af000-0x00007ffff76b0000
+[+] Range: Modules Idx:  25 - 0x00007ffff76b0000-0x00007ffff76b4000
+[+] Range: Modules Idx:  26 - 0x00007ffff76b4000-0x00007ffff76d9000
+[+] Range: Modules Idx:  27 - 0x00007ffff76d9000-0x00007ffff76da000
+[+] Range: Modules Idx:  28 - 0x00007ffff76da000-0x00007ffff76db000
+[+] Range: Modules Idx:  29 - 0x00007ffff76db000-0x00007ffff7851000
+[+] Range: Modules Idx:  30 - 0x00007ffff7851000-0x00007ffff789b000
+[+] Range: Modules Idx:  31 - 0x00007ffff789b000-0x00007ffff789c000
+[+] Range: Modules Idx:  32 - 0x00007ffff789c000-0x00007ffff789f000
+[+] Range: Modules Idx:  33 - 0x00007ffff789f000-0x00007ffff78a2000
+[+] Range: Modules Idx:  34 - 0x00007ffff78a2000-0x00007ffff78a6000
+[+] Range: Modules Idx:  35 - 0x00007ffff78a9000-0x00007ffff78aa000
+[+] Range: Modules Idx:  36 - 0x00007ffff78aa000-0x00007ffff78ab000
+[+] Range: Modules Idx:  37 - 0x00007ffff78af000-0x00007ffff78bf000
+[+] Range: Modules Idx:  38 - 0x00007ffff78bf000-0x00007ffff7942000
+[+] Range: Modules Idx:  39 - 0x00007ffff7942000-0x00007ffff7a94000
+[+] Range: Modules Idx:  40 - 0x00007ffff7a94000-0x00007ffff7db0000
+[+] Range: Modules Idx:  41 - 0x00007ffff7db0000-0x00007ffff7dbc000
+[+] Range: Modules Idx:  42 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: Modules Idx:  43 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: Modules Idx:  44 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: Modules Idx:  45 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: Modules Idx:  46 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: Modules Idx:  47 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: Modules Idx:  48 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: Modules Idx:  49 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: Modules Idx:  50 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: Modules Idx:  51 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: Modules Idx:  52 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: Modules Idx:  53 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: AFL_INST_LIBS Length: 1
+[+] Range: AFL_INST_LIBS Idx:   0 - 0x0000555555555160-0x0000555555555335
+[+] Range: step1 Length: 1
+[+] Range: step1 Idx:   0 - 0x0000555555555160-0x0000555555555335
+[+] Range: step2 Length: 1
+[+] Range: step2 Idx:   0 - 0x0000555555555160-0x0000555555555335
+[+] Range: step3 Length: 1
+[+] Range: step3 Idx:   0 - 0x0000555555555160-0x0000555555555335
+[+] Range: step4 Length: 55
+[+] Range: step4 Idx:   0 - 0x0000555555554000-0x0000555555555000
+[+] Range: step4 Idx:   1 - 0x0000555555555000-0x0000555555555160
+[+] Range: step4 Idx:   2 - 0x0000555555555335-0x0000555555556000
+[+] Range: step4 Idx:   3 - 0x0000555555556000-0x0000555555557000
+[+] Range: step4 Idx:   4 - 0x0000555555557000-0x0000555555558000
+[+] Range: step4 Idx:   5 - 0x0000555555558000-0x0000555555559000
+[+] Range: step4 Idx:   6 - 0x0000555555559000-0x000055555557a000
+[+] Range: step4 Idx:   7 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: step4 Idx:   8 - 0x00007ffff766d000-0x00007ffff766f000
+[+] Range: step4 Idx:   9 - 0x00007ffff766f000-0x00007ffff7670000
+[+] Range: step4 Idx:  10 - 0x00007ffff7670000-0x00007ffff7672000
+[+] Range: step4 Idx:  11 - 0x00007ffff7672000-0x00007ffff7673000
+[+] Range: step4 Idx:  12 - 0x00007ffff7673000-0x00007ffff7674000
+[+] Range: step4 Idx:  13 - 0x00007ffff7674000-0x00007ffff7675000
+[+] Range: step4 Idx:  14 - 0x00007ffff7675000-0x00007ffff7679000
+[+] Range: step4 Idx:  15 - 0x00007ffff7679000-0x00007ffff7689000
+[+] Range: step4 Idx:  16 - 0x00007ffff7689000-0x00007ffff768c000
+[+] Range: step4 Idx:  17 - 0x00007ffff768c000-0x00007ffff768d000
+[+] Range: step4 Idx:  18 - 0x00007ffff768d000-0x00007ffff768e000
+[+] Range: step4 Idx:  19 - 0x00007ffff768e000-0x00007ffff768f000
+[+] Range: step4 Idx:  20 - 0x00007ffff768f000-0x00007ffff7691000
+[+] Range: step4 Idx:  21 - 0x00007ffff7691000-0x00007ffff7698000
+[+] Range: step4 Idx:  22 - 0x00007ffff7698000-0x00007ffff76a9000
+[+] Range: step4 Idx:  23 - 0x00007ffff76a9000-0x00007ffff76ae000
+[+] Range: step4 Idx:  24 - 0x00007ffff76ae000-0x00007ffff76af000
+[+] Range: step4 Idx:  25 - 0x00007ffff76af000-0x00007ffff76b0000
+[+] Range: step4 Idx:  26 - 0x00007ffff76b0000-0x00007ffff76b4000
+[+] Range: step4 Idx:  27 - 0x00007ffff76b4000-0x00007ffff76d9000
+[+] Range: step4 Idx:  28 - 0x00007ffff76d9000-0x00007ffff76da000
+[+] Range: step4 Idx:  29 - 0x00007ffff76da000-0x00007ffff76db000
+[+] Range: step4 Idx:  30 - 0x00007ffff76db000-0x00007ffff7851000
+[+] Range: step4 Idx:  31 - 0x00007ffff7851000-0x00007ffff789b000
+[+] Range: step4 Idx:  32 - 0x00007ffff789b000-0x00007ffff789c000
+[+] Range: step4 Idx:  33 - 0x00007ffff789c000-0x00007ffff789f000
+[+] Range: step4 Idx:  34 - 0x00007ffff789f000-0x00007ffff78a2000
+[+] Range: step4 Idx:  35 - 0x00007ffff78a2000-0x00007ffff78a6000
+[+] Range: step4 Idx:  36 - 0x00007ffff78a9000-0x00007ffff78aa000
+[+] Range: step4 Idx:  37 - 0x00007ffff78aa000-0x00007ffff78ab000
+[+] Range: step4 Idx:  38 - 0x00007ffff78af000-0x00007ffff78bf000
+[+] Range: step4 Idx:  39 - 0x00007ffff78bf000-0x00007ffff7942000
+[+] Range: step4 Idx:  40 - 0x00007ffff7942000-0x00007ffff7a94000
+[+] Range: step4 Idx:  41 - 0x00007ffff7a94000-0x00007ffff7db0000
+[+] Range: step4 Idx:  42 - 0x00007ffff7db0000-0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
+0x00007ffff7dbc000
+[+] Range: step4 Idx:  43 - 0x00007ffff7dbc000-0x00007ffff7dc4000
+[+] Range: step4 Idx:  44 - 0x00007ffff7dc4000-0x00007ffff7fcb000
+[+] Range: step4 Idx:  45 - 0x00007ffff7fcb000-0x00007ffff7fce000
+[+] Range: step4 Idx:  46 - 0x00007ffff7fce000-0x00007ffff7fcf000
+[+] Range: step4 Idx:  47 - 0x00007ffff7fcf000-0x00007ffff7fd0000
+[+] Range: step4 Idx:  48 - 0x00007ffff7fd0000-0x00007ffff7ff3000
+[+] Range: step4 Idx:  49 - 0x00007ffff7ff3000-0x00007ffff7ffb000
+[+] Range: step4 Idx:  50 - 0x00007ffff7ffc000-0x00007ffff7ffd000
+[+] Range: step4 Idx:  51 - 0x00007ffff7ffd000-0x00007ffff7ffe000
+[+] Range: step4 Idx:  52 - 0x00007ffff7ffe000-0x00007ffff7fff000
+[+] Range: step4 Idx:  53 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: step4 Idx:  54 - 0xffffffffff600000-0xffffffffff601000
+[+] Range: final Length: 9
+[+] Range: final Idx:   0 - 0x0000555555554000-0x0000555555555160
+[+] Range: final Idx:   1 - 0x0000555555555335-0x000055555557a000
+[+] Range: final Idx:   2 - 0x00007ffff7615000-0x00007ffff7625000
+[+] Range: final Idx:   3 - 0x00007ffff766d000-0x00007ffff78a6000
+[+] Range: final Idx:   4 - 0x00007ffff78a9000-0x00007ffff78ab000
+[+] Range: final Idx:   5 - 0x00007ffff78af000-0x00007ffff7ffb000
+[+] Range: final Idx:   6 - 0x00007ffff7ffc000-0x00007ffff7fff000
+[+] Range: final Idx:   7 - 0x00007ffffffdd000-0x00007ffffffff000
+[+] Range: final Idx:   8 - 0xffffffffff600000-0xffffffffff601000
+Looks like a zero to me!
diff --git a/frida_mode/test/output/testinstr.c b/frida_mode/test/output/testinstr.c
new file mode 100644
index 00000000..5e26fc46
--- /dev/null
+++ b/frida_mode/test/output/testinstr.c
@@ -0,0 +1,112 @@
+/*
+   american fuzzy lop++ - a trivial program to test the build
+   --------------------------------------------------------
+   Originally written by Michal Zalewski
+   Copyright 2014 Google Inc. All rights reserved.
+   Copyright 2019-2020 AFLplusplus Project. All rights reserved.
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at:
+     http://www.apache.org/licenses/LICENSE-2.0
+ */
+
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifdef __APPLE__
+  #define TESTINSTR_SECTION
+#else
+  #define TESTINSTR_SECTION __attribute__((section(".testinstr")))
+#endif
+
+void testinstr(char *buf, int len) {
+
+  if (len < 1) return;
+  buf[len] = 0;
+
+  // we support three input cases
+  if (buf[0] == '0')
+    printf("Looks like a zero to me!\n");
+  else if (buf[0] == '1')
+    printf("Pretty sure that is a one!\n");
+  else
+    printf("Neither one or zero? How quaint!\n");
+
+}
+
+TESTINSTR_SECTION int main(int argc, char **argv) {
+
+  char * file;
+  int    fd = -1;
+  off_t  len;
+  char * buf = NULL;
+  size_t n_read;
+  int    result = -1;
+
+  if (argc != 2) { return 1; }
+
+  do {
+
+    file = argv[1];
+
+    dprintf(STDERR_FILENO, "Running: %s\n", file);
+
+    fd = open(file, O_RDONLY);
+    if (fd < 0) {
+
+      perror("open");
+      break;
+
+    }
+
+    len = lseek(fd, 0, SEEK_END);
+    if (len < 0) {
+
+      perror("lseek (SEEK_END)");
+      break;
+
+    }
+
+    if (lseek(fd, 0, SEEK_SET) != 0) {
+
+      perror("lseek (SEEK_SET)");
+      break;
+
+    }
+
+    buf = malloc(len);
+    if (buf == NULL) {
+
+      perror("malloc");
+      break;
+
+    }
+
+    n_read = read(fd, buf, len);
+    if (n_read != len) {
+
+      perror("read");
+      break;
+
+    }
+
+    dprintf(STDERR_FILENO, "Running:    %s: (%zd bytes)\n", file, n_read);
+
+    testinstr(buf, len);
+    dprintf(STDERR_FILENO, "Done:    %s: (%zd bytes)\n", file, n_read);
+
+    result = 0;
+
+  } while (false);
+
+  if (buf != NULL) { free(buf); }
+
+  if (fd != -1) { close(fd); }
+
+  return result;
+
+}
+
diff --git a/include/envs.h b/include/envs.h
index 73cd82a8..08b3284a 100644
--- a/include/envs.h
+++ b/include/envs.h
@@ -55,17 +55,22 @@ static char *afl_environment_variables[] = {
     "AFL_FORCE_UI",
     "AFL_FRIDA_DEBUG_MAPS",
     "AFL_FRIDA_EXCLUDE_RANGES",
+    "AFL_FRIDA_INST_DEBUG_FILE",
     "AFL_FRIDA_INST_NO_OPTIMIZE",
     "AFL_FRIDA_INST_NO_PREFETCH",
     "AFL_FRIDA_INST_RANGES",
-    "AFL_FRIDA_INST_STRICT",
     "AFL_FRIDA_INST_TRACE",
+    "AFL_FRIDA_OUTPUT_STDOUT",
+    "AFL_FRIDA_OUTPUT_STDERR",
     "AFL_FRIDA_PERSISTENT_ADDR",
     "AFL_FRIDA_PERSISTENT_CNT",
     "AFL_FRIDA_PERSISTENT_DEBUG",
     "AFL_FRIDA_PERSISTENT_HOOK",
     "AFL_FRIDA_PERSISTENT_RET",
     "AFL_FRIDA_PERSISTENT_RETADDR_OFFSET",
+    "AFL_FRIDA_STATS_FILE",
+    "AFL_FRIDA_STATS_INTERVAL",
+    "AFL_FRIDA_STATS_TRANSITIONS",
     "AFL_FUZZER_ARGS",  // oss-fuzz
     "AFL_GDB",
     "AFL_GCC_ALLOWLIST",