I wonder, whether there is a way to get a code coverage of a r0 code? PIN tool is designed for usermode, if i'm right. Though i've seen on twitter somebody mentioned such a tool, that's why i'm sure it exists.
1
-
1I guess you need to get a kernel module loaded that will give you the needed access to kernel-space. It would be better if you could give the name of the OS that you are targeting.– perrorJun 8, 2013 at 12:30
Add a comment
|
2 Answers
If you just want a simple analysis such as code coverage or path coverage, consider using a dynamic emulation framework such as Bochs or QEMU. This has the advantage over Jason's solution that it does not require the user to provide the addresses ahead of time (which is subject to undecidability, and placing a single breakpoint incorrectly can corrupt code or data and result in the system crashing), instead discovering such addresses dynamically as the target executes.
The tool you are referring to might be BochsPwn.
answered Jun 8, 2013 at 19:37
Assuming you're talking about Windows, the least invasive way would likely be to write an IDC script to statically generate a list of all basic block addresses, and write a WinDbg script that sets a one-shot logging breakpoint on each of those addresses. You can then run the WinDbg script and diff the breakpoint logs with the full basic block list to see which basic blocks were executed and which were not.
answered Jun 8, 2013 at 15:21
-
I don't think it's a good idea. WinDbg scripts work so slow, so tracing using it's scripts is just nightmare , imho.– fasmotolJun 13, 2013 at 4:21