I wonder, whether there is a way to get a code coverage of a r0 code? PIN tool is designed for usermode, if i'm right. Though i've seen on twitter somebody mentioned such a tool, that's why i'm sure it exists.
2 Answers
If you just want a simple analysis such as code coverage or path coverage, consider using a dynamic emulation framework such as Bochs or QEMU. This has the advantage over Jason's solution that it does not require the user to provide the addresses ahead of time (which is subject to undecidability, and placing a single breakpoint incorrectly can corrupt code or data and result in the system crashing), instead discovering such addresses dynamically as the target executes.
The tool you are referring to might be BochsPwn.
Assuming you're talking about Windows, the least invasive way would likely be to write an IDC script to statically generate a list of all basic block addresses, and write a WinDbg script that sets a one-shot logging breakpoint on each of those addresses. You can then run the WinDbg script and diff the breakpoint logs with the full basic block list to see which basic blocks were executed and which were not.
-
I don't think it's a good idea. WinDbg scripts work so slow, so tracing using it's scripts is just nightmare , imho.– fasmotolJun 13, 2013 at 4:21