Skip to content

Commit

Permalink
Minor clarifications in the documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
sebastianpoeplau committed Dec 11, 2023
1 parent 4d58a97 commit 4910ea2
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 7 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ of PRs, we will try to merge them when possible.

# SymCC: efficient compiler-based symbolic execution

SymCC is a compiler wrapper which embeds symbolic execution into the program
SymCC is a compiler pass which embeds symbolic execution into the program
during compilation, and an associated run-time support library. In essence, the
compiler inserts code that computes symbolic expressions for each value in the
program. The actual computation happens through calls to the support library at
Expand Down
15 changes: 9 additions & 6 deletions docs/Configuration.txt
Original file line number Diff line number Diff line change
Expand Up @@ -79,12 +79,15 @@ environment variables.
repeatedly (QSYM backend only). See the QSYM paper for details; highly
recommended for fuzzing and enabled automatically by the fuzzing helper.

- SYMCC_AFL_COVERAGE_MAP (default empty): When set to the file name of an AFL
coverage map, load the map before executing the target program and use it to
skip solver queries for paths that have already been covered (QSYM backend
only). The map is updated in place, so beware of races when running multiple
instances of SymCC! The fuzzing helper uses this to remember the state of
exploration across multiple executions of the target program.
- SYMCC_AFL_COVERAGE_MAP (default empty): When set to the file name of an
AFL-style coverage map, load the map before executing the target program and
use it to skip solver queries for paths that have already been covered (QSYM
backend only). The map is updated in place, so beware of races when running
multiple instances of SymCC! The fuzzing helper uses this to remember the
state of exploration across multiple executions of the target program.
Warning: This setting has a misleading name - while the format of the map
follows (classic) AFL, the variable isn't meant to point at a map file that
AFL uses too!

(Most people should stop reading here.)

Expand Down

0 comments on commit 4910ea2

Please sign in to comment.