fuzz_jpeg.cfg

[moriarty]
target_bin=@target/savior-djpeg 
target_bc=@target/savior-djpeg.dma.bc 
sync_dir=@target/out
bitmodel=64
inputtype=stdin
;moriarty will inovke each explorer $(max_instance) times
max_explorer_instance=1
;how many seed each explorer will run in a batch
batch_run_input_num=20

[afl]
root=/root/work/savior/AFL/
in_dir=@target/in
slave_num=1
; use_dict=@target/png.dict
use_ui=0

[klee conc_explorer]
bin=/root/work/savior/KLEE/klee-build/bin/klee
;klee searcher could be [AFLUnCovSearcher|SANGuidedSearcher] 
;use ':' to separate the heuristics, klee will apply both searchers 
search_heuristic=AFLUnCovSearcher:SANGuidedSearcher
klee_seed_dir=@target/klee_new_input
converter=/root/work/savior/KLEE/klee-build/bin/converter
max_interesting_output=65536
;location of klee errors will be stored 
error_dir=@target/klee_errors
;how many seconds we allow each seed to run.
max_time_per_seed=150

;c++ options
;klee_ctor_stub = 1
;klee_uclibcxx = 1

[switch oracle]
;fuzzing switching heuristic can be [random|saturate|driller_saturate]
strategy=random

[edge oracle]
;seed selecting heurisitic could be [random|san-guided|bug-potential|avg-bug-potential] 
;use ':' to separate the heuristics, edge oracle will use them in round-robin 
heuristics=avg-bug-potential
bug_potential_weight=10
code_potential_weight=50


[auxiliary info]
bug_reach_map=@target/djpeg.reach.bug
pair_edge_file=@target/djpeg.edge