> 1. I set no timeout, AFL does dry run on my 9 inputs and determines 220 ms
> to be a good timeout
> 2. I set '-t 300+' as timeout on a fresh start. AFL goes through my 9 inputs
> and rejects all of them due to timeout.
This is not impossible in persistent mode if you have very slow
startup (since every timeout means a restart of the process). Doing a
dummy exec after every timeout during calibration would... well, "fix"
the problem, but cause problems down the line (since it could trap the
actual fuzzing process in an endless cycle of timeouts). Doing a dummy
exec after every timeout during a fuzzing job... would be expensive.
> Would it be possible to change the dry-run timeout rejection logic to have a
> hard timeout of AFL_HANG_TMOUT (so that we don't wait forever), but only
> reject inputs that have an average execution time larger than what is
> specified by `-t xxx`?
The underlying problem is still that if the timeout is shorter than
the time needed to reinitialize the persistent-mode binary after kill,
your fuzzing can get stuck in an endless loop of restarts and
timeouts. So from that perspective, it's auto-calibration that's
wrong, not -t nnn+ that's misbehaving :-(
The "correct" solution would be probably to time cold startup and
normal startup in persistent mode separately, and enforce that based
on whether the child respawned or not. Except that I'm having a hard
time imagining how this should work with -t nnn+...