Maybe try to glue things together with AFL or perhaps a lighter fuzzer. AFL may not be the best for binary-only analysis. This will involve implementing concolic execution following a specific trace.