Where are 'total tmouts' stored?

[michaellrowley]

I've been fuzzing an application for a few hours and under the 'findings in depth' section of AFL's UI, there's a section that says 'total tmouts' followed by a number but I can't seem to find where the input/test cases that caused those time-outs are stored on my local drive(s), as the only logged cases seems to be crashes, hangs, and queued inputs - I'd appreciate any help with finding the inputs that caused timeouts.

This was also asked on Stack Exchange a few years ago.

Thanks in advance,
Michael.

[morozkod]

afl-fuzz.c : save_if_interesting() function

switch (fault) {
  
      case FAULT_TMOUT:
  
        /* Timeouts are not very interesting, but we're still obliged to keep
           a handful of samples. We use the presence of new bits in the
           hang-specific bitmap as a signal of uniqueness. In "dumb" mode, we
           just keep everything. */
  
        total_tmouts++;
        //some_code
        fn = alloc_printf("%s/replayable-hangs/id_%06llu", out_dir,
                                   unique_hangs);

So the test cases you're looking for should be in replayable-hangs folder.

But I suppose that in your case, this folder could be emply if the target doesn't yield in timeout when a latter is more generous

        /* Before saving, we make sure that it's a genuine hang by re-running
           the target with a more generous timeout (unless the default timeout
           is already generous). */
  
        if (exec_tmout < hang_tmout) {
  
          u8 new_fault;
          write_to_testcase(mem, len);
          new_fault = run_target(argv, hang_tmout);
  
          /* A corner case that one user reported bumping into: increasing the
             timeout actually uncovers a crash. Make sure we don't discard it if
             so. */
  
          if (!stop_soon && new_fault == FAULT_CRASH) goto keep_as_crash;
  
          if (stop_soon || new_fault != FAULT_TMOUT) return keeping;
  
        }

[michaellrowley]

Thanks for that information, when I reported this I don't think I had a /replayable-hangs/ folder (or it was empty) but now that I know where to look for timeout-handling code I should be able to change it so that it logs all timeouts next time I use AFL.