AFLの総tmoutはどこに保存されていますか？

afl-fuzz.c: save_if_interesting() 関数

switch (fault) {
  
      case FAULT_TMOUT:
  
        /* Timeouts are not very interesting, but we're still obliged to keep
           a handful of samples. We use the presence of new bits in the
           hang-specific bitmap as a signal of uniqueness. In "dumb" mode, we
           just keep everything. */
  
        total_tmouts++;
        //some_code
        fn = alloc_printf("%s/replayable-hangs/id_%06llu", out_dir,
                                   unique_hangs);

したがって、探しているテストケースはreplayable-hangsフォルダに配置する必要があります。

しかし、あなたの場合、ターゲットがより寛大なタイムアウトについて譲歩しないと、フォルダが空になる可能性があると思います。

        /* Before saving, we make sure that it's a genuine hang by re-running
           the target with a more generous timeout (unless the default timeout
           is already generous). */
  
        if (exec_tmout < hang_tmout) {
  
          u8 new_fault;
          write_to_testcase(mem, len);
          new_fault = run_target(argv, hang_tmout);
  
          /* A corner case that one user reported bumping into: increasing the
             timeout actually uncovers a crash. Make sure we don't discard it if
             so. */
  
          if (!stop_soon && new_fault == FAULT_CRASH) goto keep_as_crash;
  
          if (stop_soon || new_fault != FAULT_TMOUT) return keeping;
  
        }