config.sample

### A sample configuration file. All options are key-value pairs, separated by =.

### NOTE: Arguments are processed in the order you provide them. 
### Make sure not to overwrite your preferred configuration.
### for example, the following arguments conflict with each other:
# FUZZING_STATE_UNIFORM_DISTRIBUTION = 1
# d1 = 0.2

################################################################################

### Probability of choosing mutation-guided fuzzing
CHOOSE_MUTATION = 0.5

### If set to 1, then we assume b = 0.5 and ci = 1/15 for (c1, ..., c15).
PACKET_SELECTION_UNIFORM_DISTRIBUTION = 1

### If set to 1, then we assume di = 1/3 for (d1, d2, d3) and d4 = 0.5.
FUZZING_STATE_UNIFORM_DISTRIBUTION = 1

### Probability of selecting/generating seed input from response log 
b = 0.5

### Probability of selecting CONNECT packet
# c1 = 1/15

### Probability of selecting/generating CONNACK packet
# c2 = 1/15

### Probability of selecting/generating PUBLISH packet
# c3 = 1/15

### Probability of selecting/generating PUBACK packet
# c4 = 1/15

### Probability of selecting/generating PUBREC packet
# c5 = 1/15

### Probability of selecting/generating PUBREL packet
# c6 = 1/15

### Probability of selecting/generating PUBCOMP packet
# c7 = 1/15

### Probability of selecting/generating SUBSCRIBE packet
# c8 = 1/15

### Probability of selecting/generating SUBACK packet
# c9 = 1/15

### Probability of selecting/generating UNSUBSCRIBE packet
# c10 = 1/15

### Probability of selecting/generating UNSUBACK packet
# c11 = 1/15

### Probability of selecting/generating PINGREQ packet
# c12 = 1/15

### Probability of selecting/generating PINGRESP packet
# c13 = 1/15

### Probability of selecting/generating/generating DISCONNECT packet
# c14 = 1/15

### Probability of selecting/generating/generating AUTH packet
# c15 = 1/15

### Probability of selecting the Inject fuzzing state
# d1 = 1/3

### Probability of selecting the Delete fuzzing state
# d2 = 1/3

### Probability of selecting the Mutate fuzzing state
# d3 = 1/3

### Probability of selecting the BOF fuzzing state
# d4 = 1/8

### Probability of transitioning from state S1 to state S2
# X1 = 0.1

### Probability of transitioning from state S2 to state Send
# X2 = 0.1

### Probability of transitioning from state Send to state Sf
# X3 = 0.1

### Determines the percentage of bytes that should be fuzzed
FUZZING_INTENSITY = 0.25

### Determines the maximum number of MQTT packets in a single payload
CONSTRUCTION_INTENSITY = 3

### Set the target address 
TARGET_ADDR = 0.0.0.0

### Set the target port
TARGET_PORT = 1883

### Set the verbosity - 0 (mute), 1 (normal), 2 (verbose), 3 (debug)
VERBOSITY = 1

### Provide the command to start the target.
### This argument MUST be given if you want to monitor console responses or automatically restart the target.
# START_COMMAND = /home/user1/mosquitto/src/mosquitto

### The number of seconds it takes to start the target
# TARGET_START_TIME = 0.5

### For console responses, if they are at least this similar to any other
### response, then we discard it.
SIMILARITY_THRESHOLD = 0.3

### If set to 1, the 'fast' version of crash triage is used.
### If set to 0, the 'slow' version is used.
TRIAGE_FAST = 0

### The maximum depth that the crash triage script may reach.
### Higher depths may find smaller inputs, but it will probably 
take a while to find them.
TRIAGE_MAX_DEPTH = 3

### Provide the crash directory
CRASH_DIRECTORY = crashes

### Provide the crash filename prefix. This will be appended with a timestamp.
CRASH_FILENAME_PREFIX = target

### Self-explanatory
MAXIMUM_PAYLOAD_LENGTH = 10000