I wonder, whether there is a way to get a code coverage of a r0 code? PIN tool is designed for usermode, if i'm right. Though i've seen on twitter somebody mentioned such a tool, that's why i'm sure it exists.

  • 1
    I guess you need to get a kernel module loaded that will give you the needed access to kernel-space. It would be better if you could give the name of the OS that you are targeting.
    – perror
    Jun 8, 2013 at 12:30

2 Answers 2


If you just want a simple analysis such as code coverage or path coverage, consider using a dynamic emulation framework such as Bochs or QEMU. This has the advantage over Jason's solution that it does not require the user to provide the addresses ahead of time (which is subject to undecidability, and placing a single breakpoint incorrectly can corrupt code or data and result in the system crashing), instead discovering such addresses dynamically as the target executes.

The tool you are referring to might be BochsPwn.

  • I'll take a look on it, but it seems to be the right thing.
    – fasmotol
    Jun 13, 2013 at 4:21

Assuming you're talking about Windows, the least invasive way would likely be to write an IDC script to statically generate a list of all basic block addresses, and write a WinDbg script that sets a one-shot logging breakpoint on each of those addresses. You can then run the WinDbg script and diff the breakpoint logs with the full basic block list to see which basic blocks were executed and which were not.

  • I don't think it's a good idea. WinDbg scripts work so slow, so tracing using it's scripts is just nightmare , imho.
    – fasmotol
    Jun 13, 2013 at 4:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.