# Seed corpus for TestFuzzServer

The seeds are byte-for-byte captures of the `client->server`
stream of a real FreeRDP client connection against the fuzz
server configuration:

- RDP security, local (plaintext) peer path;
- RemoteFX + NSCodec enabled;
- multitransport + network autodetect enabled;
- MCS channel join enabled;

`handshake_input` includes post-activation input PDUs
(keyboard/mouse), `handshake_noinput` is the plain handshake up to
the Confirm Active PDU. The `cut*` files are truncations at phase
boundaries to give the fuzzer incremental starting points.

The captured stream is deterministic: the fuzz server uses a fixed
embedded RSA certificate/key and the local peer path performs no
encryption, so the server responses are identical on every
connection. This means the captured client stream replays cleanly
against a fresh fuzz server session.

## Regenerating the seeds

The corpus is generated by `TestFuzzServerSeedGen` (built by the
same CMake configuration as the fuzz target):

```
# With post-connect input PDUs:
./Testing/TestFuzzServerSeedGen <output-dir> 1
# Handshake only:
./Testing/TestFuzzServerSeedGen <output-dir> 0
```

Notes:

- The generator runs a real `freerdp-client` in-process against the
  fuzz server configuration (the server side is identical to
  `TestFuzzServer.c`) and captures the `client->server` stream
  through a TCP relay.
- It requires a build with `WITH_CHANNELS=ON` so the client
  channel addins (e.g. rdpdr) are available and the client can
  negotiate the MCS message channel. `WITH_CLIENT_COMMON`
  (default ON) provides the client library.
- Byte-exact reproducibility is not guaranteed: the client stream
  may contain random values that differ between runs. The corpus
  entries are starting points for the fuzzer, minor differences do
  not matter.
- Keep the fuzz server configuration in `TestFuzzServer.c` in sync
  with `configure_server()` in `TestFuzzServerSeedGen.c`,
  otherwise freshly generated seeds will not replay against the
  fuzzer.
