How do I study path coverage for SymQEMU?

Hello, I want to explore the testing efficiency of SymQEMU for some embedded software to a certain extent, how can I study the path coverage of SymQEMU? Tools like AFL-COVID require source code, and what we're doing is binary-only symbolic execution. Can you give some suggestions or suitable tools to test coverage? How are your experiments tested?