Marcel Böhme

Sorry about that. We'll investigate. Worst case, we'll trade memory for disk storage and write the trial specific coverage data to the (trial specific) subject-fuzzer/trial folder to handle concurrency in...

What are path or state transitions?

Great idea! I suppose this would show the coverage overlap (difference) between fuzzers? Might help with debugging a fuzzer.

Fuzzbench distinguishes runner and measurer and only the seed corpus ever reaches the measurer. So, getting coverage statistics right from the fuzzing process might be a bit more difficult. If...

The following is based on data from [Stephan Lipp](https://www.in.tum.de/i04/lipp/) (@sphl) of TU Munich. I used that data to play around with ways to visualize coverage progress. The graphs can be...

Thanks Danushka! Maybe I can add an interpretation. We use the log10(hits) just because the scale is substantial. The X axis shows the basic block IDs ordered by log10(AFL_hits) -...

That's from the coverage profile generated by executing the entire queue at the end of the campaign.

> Is there a way to access this data? PR #778 is to generate that data in Fuzzbench. > I wonder if it would be helpful to display how often...

That's log10(hits) sorted by Honggfuzz hits. 

Still committed to do the analysis 😄 Let me know once the run is done.