I have spent some time restructuring the options for setting the search heuristics in KLEE, to make them more understandable and easier to use, and have a more effective default heuristic (which until now was DFS).
In a nutshell, you can use the --search option to set the search heuristic in KLEE. E.g.: $ klee --search=dfs prog.bc or $ klee --search=random-state prog.bc To interleave multiple heuristics in a round-robin fashion, you can specify the --search option multiple times. E.g. $ klee --search=random-path --search=nurs:covnew prog.bc interleaves the random path heuristic with a non-uniform random search heuristic that takes into account the estimated distance to an uncovered instruction and the number of instructions executed since new code was last covered. This is now KLEE's default search strategy. I have also added some documentation here: http://klee.llvm.org/klee-options.html Best, Cristian _______________________________________________ klee-dev mailing list [email protected] http://keeda.Stanford.EDU/mailman/listinfo/klee-dev
