#!/bin/bash
# #4 LAVA-M 注入 bug 计数:afl-only(8 并行 AFL) vs concolic(SymCC) 各程序,
# 语料 replay 过 cov 二进制数 "Successfully triggered bug N"。base64/md5sum/uniq(who 太大跳过)。
set -u
cd /home/ubuntu/code/symcc
OUT=/tmp/lavabugs; rm -rf "$OUT"; mkdir -p "$OUT"
COUNT=/home/ubuntu/code/symcc/scratch_lava_bugcount.py
T=240

declare -A ARGS=( [base64]="-d" [md5sum]="-c" [uniq]="" )

for prog in base64 md5sum uniq; do
  A=${ARGS[$prog]}
  AFLB=$(realpath benchmark/public/bin/lava-m-afl/$prog)
  SYMB=$(realpath benchmark/public/bin/lava-m/$prog)
  SEEDS=$(realpath benchmark/public/seeds/lava-m/$prog)
  echo "========== $prog (args='$A') =========="

  # ---- afl-only: 8 并行 AFL,${T}s ----
  AO="$OUT/${prog}_afl"; mkdir -p "$AO"
  export AFL_NO_UI=1 AFL_SKIP_CPUFREQ=1 AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1 AFL_BENCH_UNTIL_CRASH=0
  afl-fuzz -M f01 -i "$SEEDS" -o "$AO" -m none -- "$AFLB" $A @@ >"$AO/f01.log" 2>&1 &
  for i in $(seq 2 8); do afl-fuzz -S "f0$i" -i "$SEEDS" -o "$AO" -m none -- "$AFLB" $A @@ >"$AO/f0$i.log" 2>&1 & done
  echo "  [$prog] afl-only: 8 实例已起($(date +%H:%M:%S)),跑 ${T}s"
  sleep $T
  pkill -9 -x afl-fuzz 2>/dev/null; sleep 3

  # ---- concolic: SymCC pure-concolic loop,${T}s ----
  CO="$OUT/${prog}_symcc"; mkdir -p "$CO/in" "$CO/out"; cp "$SEEDS"/* "$CO/in/" 2>/dev/null
  echo "  [$prog] concolic: pure_concolic 跑 ${T}s"
  timeout $T util/pure_concolic_execution.sh -i "$CO/in" -o "$CO/out" "$SYMB" $A @@ >"$CO/log" 2>&1
  pkill -9 -f 'pure_concolic_execution' 2>/dev/null

  # ---- 合并语料并计数 ----
  AC="$OUT/${prog}_afl_corpus"; mkdir -p "$AC"
  for q in "$AO"/*/queue; do cp -n "$q"/id:* "$AC"/ 2>/dev/null; done
  echo "  [$prog] afl 语料 $(ls "$AC"|wc -l) 个 / concolic 语料 $(ls "$CO/out" 2>/dev/null|wc -l) 个"
  echo "  --- afl-only bug 计数 ---"
  python3 "$COUNT" "$prog" "$AC" 2>&1 | grep -aiE "distinct|listed|count|bug|命中|个" | tail -4
  echo "  --- concolic bug 计数 ---"
  python3 "$COUNT" "$prog" "$CO/out" 2>&1 | grep -aiE "distinct|listed|count|bug|命中|个" | tail -4
done
echo "LAVABUGS_DONE"