You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Lighthouse is a code coverage plugin for [IDA Pro](https://www.hex-rays.com/products/ida/), and [Binary Ninja](https://binary.ninja/). The plugin makes use of interactive disassemblers to map, explore, and visualize externally collected code coverage data when symbols or source may not be available for a given binary.
8
+
Lighthouse is a powerful code coverage plugin for [IDA Pro](https://www.hex-rays.com/products/ida/) and [Binary Ninja](https://binary.ninja/). As an extension of the leading disassemblers, this plugin enables one to interactively explore code coverage data in new and innovative ways when symbols or source may not be available for a given binary.
9
9
10
10
This plugin is labeled only as a prototype & code resource for the community.
11
11
12
12
Special thanks to [@0vercl0k](https://twitter.com/0vercl0k) for the inspiration.
13
13
14
14
## Releases
15
15
16
+
* v0.9 -- Python 3 support, custom coverage formats, coverage cross-refs, theming subsystem, much more.
16
17
* v0.8 -- Binary Ninja support, HTML coverage reports, consistent styling, many tweaks, bugfixes.
17
18
* v0.7 -- Frida, C++ demangling, context menu, function prefixing, tweaks, bugfixes.
Lighthouse is a cross-platform (Windows, macOS, Linux) python plugin, supporting IDA Pro 6.8 and newer.
28
+
Lighthouse is a cross-platform (Windows, macOS, Linux) Python 2/3 plugin. It takes zero third party dependencies, making the code both portable and easy to install.
28
29
29
-
- Copy the contents of the `plugin` folder to the IDA plugins folder
30
-
- On Windows, the folder is at `C:\Program Files (x86)\IDA 6.8\plugins`
31
-
- On macOS, the folder is at `/Applications/IDA\ Pro\ 6.8/idaq.app/Contents/MacOS/plugins`
32
-
- On Linux, the folder may be at `/opt/IDA/plugins/`
30
+
1. From your disassembler's python console, run the following command to find its plugin directory:
2. Copy the contents of the `/plugin/` folder in this repo to your Binary Ninja [plugins folder](https://docs.binary.ninja/guide/plugins/index.html#using-plugins).
51
-
52
-
## Linux Installation
53
-
54
-
1. Install PyQt5 from a Linux shell with the following command:
55
-
56
-
```
57
-
sudo apt install python-pyqt5
58
-
```
59
-
60
-
2. Copy the contents of the `/plugin/` folder in this repo to your Binary Ninja [plugins folder](https://docs.binary.ninja/guide/plugins/index.html#using-plugins).
61
-
62
-
## macOS Installation
63
-
64
-
¯\\\_(ツ)\_/¯
34
+
2. Copy the contents of this repository's `/plugin/` folder to the listed directory.
35
+
3. Restart your disassembler.
65
36
66
37
# Usage
67
38
68
-
Lighthouse loads automatically when a database is opened, installing a handful of menu entries into the disassembler.
39
+
Once properly installed, there will be a few new menu entries available in the disassembler. These are the entry points for a user to load coverage data and start using Lighthouse.
69
40
70
41
<palign="center">
71
42
<imgalt="Lighthouse Menu Entries"src="screenshots/open.gif"/>
72
43
</p>
73
44
74
-
These are the entry points for a user to load and view coverage data.
45
+
Lighthouse is able to load a few different 'flavors' of coverage data. To generate coverage data that can be loaded into Lighthouse, please look at the [README](https://github.com/gaasedelen/lighthouse/tree/master/coverage) in the coverage directory of this repository.
75
46
76
47
## Coverage Painting
77
48
78
-
Lighthouse 'paints' the active coverage data across the three major IDA views as applicable. Specifically, the Disassembly, Graph, and Pseudocode views.
49
+
While Lighthouse is in use, it will 'paint' the active coverage data across all of the code viewers available in the disassembler. Specifically, this will apply to your linear disassembly, graph, and decompiler windows.
In Binary Ninja, only the Disassembly and Graph views are supported.
55
+
In Binary Ninja, only the linear disassembly, graph, and IL views are supported. Support for painting decompiler output in Binary Ninja will be added to Lighthouse in the *near future* as the feature stabilizes.
85
56
86
-
##Coverage Overview
57
+
# Coverage Overview
87
58
88
-
The Coverage Overview is a dockable widget that provides a function level view of the active coverage data for the database.
59
+
The Coverage Overview is a dockable widget that will open up once coverage has been loaded into Lighthouse.
This table can be sorted by column, and entries can be double clicked to jump to their corresponding disassembly.
65
+
This interactive widget provides a function level view of the loaded coverage data. It also houses a number of tools to manage loaded data and drive more advanced forms of coverage analysis.
95
66
96
67
## Context Menu
97
68
98
-
Right clicking the table in the Coverage Overview will produce a context menu with a few basic amenities.
69
+
Right clicking the table in the Coverage Overview will produce a context menu with a few basic amenities to extract information from the table, or manipulate the database as part of your reverse engineering process.
These actions can be used to quickly manipulate or interact with entries in the table.
75
+
If there are any other actions that you think might be useful to add to this context menu, please file an issue and they will be considered for a future release of Lighthouse.
76
+
77
+
## Coverage ComboBox
78
+
79
+
Loaded coverage data and user constructed compositions can be selected or deleted through the coverage combobox.
Lighthouse can generate a rudimentary HTML coverage report of the active coverage.
88
+
A sample report can be seen [here](https://rawgit.com/gaasedelen/lighthouse/master/testcase/report.html).
105
89
106
-
## Coverage Composition
90
+
<palign="center">
91
+
<imgalt="Lighthouse HTML Report"src="screenshots/html_report.gif"/>
92
+
</p>
93
+
94
+
# Coverage Shell
107
95
108
-
Building relationships between multiple sets of coverage data often distills deeper meaning than their individual parts. The shell at the bottom of the [Coverage Overview](#coverage-overview) provides an interactive means of constructing these relationships.
96
+
At the bottom of the coverage overview window is the coverage shell. This shell can be used to perform logic-based operations that combine or manipulate the loaded coverage sets.
Pressing `enter` on the shell will evaluate and save a user constructed composition.
102
+
This feature is extremely useful in exploring the relationships of program execution across multiple runs. In other words, the shell can be used to 'diff' execution between coverage sets and extract a deeper meaning that is otherwise obscured within the noise of their individual parts.
115
103
116
104
## Composition Syntax
117
105
118
106
Coverage composition, or _Composing_ as demonstrated above is achieved through a simple expression grammar and 'shorthand' coverage symbols (A to Z) on the composing shell.
119
107
120
108
### Grammar Tokens
121
109
* Logical Operators: `|, &, ^, -`
122
-
* Coverage Symbol: `A, B, C, ..., Z`
123
-
* Coverage Range: `A,C`, `Q,Z`, ...
110
+
* Coverage Symbol: `A, B, C, ..., Z, *`
124
111
* Parenthesis: `(...)`
125
112
126
113
### Example Compositions
127
-
*`A & B`
128
-
*`(A & B) | C`
129
-
*`(C & (A - B)) | (F,H & Q)`
130
114
131
-
The evaluation of the composition may occur right to left, parenthesis are suggested for potentially ambiguous expressions.
115
+
1. Executed code that is *shared* between coverage `A` and coverage `B`:
116
+
```
117
+
A & B
118
+
```
119
+
120
+
2. Executed code that is *unique* only to coverage `A`:
121
+
```
122
+
A - B
123
+
```
124
+
125
+
3. Executed code that is *unique* to `A` or `B`, but not `C`:
126
+
```
127
+
(A | B) - C
128
+
```
129
+
130
+
Expressions can be of arbitrary length or complexity, but the evaluation of the composition may occur right to left. So parenthesis are suggested for potentially ambiguous expressions.
132
131
133
132
## Hot Shell
134
133
@@ -142,7 +141,7 @@ The hot shell serves as a natural gateway into the unguided exploration of compo
142
141
143
142
## Search
144
143
145
-
Using the shell, one can search and filter the functions listed in the coverage table by prefixing their query with `/`.
144
+
Using the shell, you can search and filter the functions listed in the coverage table by prefixing their query with `/`.
Loaded coverage data and user constructed compositions can be selected or deleted through the coverage combobox.
162
+
While using Lighthouse, you can right click any basic block (or instruction) and use the 'Coverage Xref' action to see which coverage sets executed the selected block. Double clicking any of the listed entries will instantly switch to that coverage set.
This pairs well with the 'Coverage Batch' feature, which allows you to quickly load and aggregate thousands of coverage files into Lighthouse. Cross-referencing a block and selecting a 'set' will load the 'guilty' set from disk as a new coverage set for you to explore separate from the batch.
170
169
171
-
Lighthouse can generate a rudimentary HTML coverage report of the active coverage.
172
-
A sample report can be seen [here](https://rawgit.com/gaasedelen/lighthouse/master/testcase/report.html).
170
+
# Themes
171
+
172
+
Lighthouse ships with two default themes -- a 'light' theme, and a 'dark' one. Depending on the colors currently used by your disassembler, Lighthouse will attempt to select the theme that seems most appropriate.
173
173
174
174
<palign="center">
175
-
<imgalt="Lighthouse HTML Report"src="screenshots/html_report.gif"/>
Before using Lighthouse, one will need to collect code coverage data for their target binary / application.
181
-
182
-
The examples below demonstrate how one can use [DynamoRIO](http://www.dynamorio.org), [Intel Pin](https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool) or [Frida](https://www.frida.re) to collect Lighthouse compatible coverage against a target. The `.log` files produced by these instrumentation tools can be loaded directly into Lighthouse.
183
-
184
-
## DynamoRIO
178
+
The theme files are stored as simple JSON on disk and are highly configurable. If you are not happy with the default themes or colors, you can create your own themes and simply drop them in the user theme directory.
185
179
186
-
Code coverage data can be collected via DynamoRIO's [drcov](http://dynamorio.org/docs/page_drcov.html) code coverage module.
Using a [custom pintool](coverage/pin) contributed by [Agustin Gianni](https://twitter.com/agustingianni), the Intel Pin DBI can also be used to collect coverage data.
197
-
198
-
Example usage:
199
-
200
-
```
201
-
pin.exe -t CodeCoverage64.dll -- boombox.exe
202
-
```
203
-
204
-
For convenience, binaries for the Windows pintool can be found on the [releases](https://github.com/gaasedelen/lighthouse/releases) page. macOS and Linux users need to compile the pintool themselves following the [instructions](coverage/pin#compilation) included with the pintool for their respective platforms.
205
-
206
-
## Frida (Experimental)
207
-
208
-
Lighthouse offers limited support for Frida based code coverage via a custom [instrumentation script](coverage/frida) contributed by [yrp](https://twitter.com/yrp604).
209
-
210
-
Example usage:
211
-
212
-
```
213
-
sudo python frida-drcov.py bb-bench
214
-
```
180
+
Lighthouse will remember your theme preference for future loads and uses.
215
181
216
182
# Future Work
217
183
@@ -223,11 +189,11 @@ Time and motivation permitting, future work may include:
I welcome external contributions, issues, and feature requests.
196
+
I welcome external contributions, issues, and feature requests. Please make any pull requests to the `develop` branch of this repository if you would like them to be considered for a future release.
Before using Lighthouse, one will need to collect code coverage data for their target binary / application.
4
+
5
+
The examples below demonstrate how one can use [DynamoRIO](http://www.dynamorio.org), [Intel Pin](https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool) or [Frida](https://www.frida.re) to collect Lighthouse compatible coverage against a target. The `.log` files produced by these instrumentation tools can be loaded directly into Lighthouse.
6
+
7
+
## DynamoRIO
8
+
9
+
Code coverage data can be collected via DynamoRIO's [drcov](http://dynamorio.org/docs/page_drcov.html) code coverage module.
Using a [custom pintool](coverage/pin) contributed by [Agustin Gianni](https://twitter.com/agustingianni), the Intel Pin DBI can also be used to collect coverage data.
20
+
21
+
Example usage:
22
+
23
+
```
24
+
pin.exe -t CodeCoverage64.dll -- boombox.exe
25
+
```
26
+
27
+
For convenience, binaries for the Windows pintool can be found on the [releases](https://github.com/gaasedelen/lighthouse/releases) page. macOS and Linux users need to compile the pintool themselves following the [instructions](coverage/pin#compilation) included with the pintool for their respective platforms.
28
+
29
+
## Frida (Experimental)
30
+
31
+
Lighthouse offers limited support for Frida based code coverage via a custom [instrumentation script](coverage/frida) contributed by [yrp](https://twitter.com/yrp604).
32
+
33
+
Example usage:
34
+
35
+
```
36
+
sudo python frida-drcov.py bb-bench
37
+
```
38
+
39
+
# Other Coverage Formats
40
+
41
+
Lighthouse is flexible as to what kind of coverage or 'trace' file formats it can load. Below is an outline of these human-readable text formats that are arguably the easiest to output from a custom tracer.
42
+
43
+
## Module + Offset (modoff)
44
+
45
+
A 'Module+Offset' coverage file / trace is a highly recommended coverage format due to its simplicity and readability:
46
+
47
+
```
48
+
boombox+3a06
49
+
boombox+3a09
50
+
boombox+3a0f
51
+
boombox+3a15
52
+
...
53
+
```
54
+
55
+
Each line of the trace represents an executed instruction or basic block in the instrumented program. The line *must* name an executed module eg `boombox.exe` and a relative offset to the executed address from the imagebase.
56
+
57
+
It is okay for hits from other modules (say, `kernel32.dll`) to exist in the trace. Lighthouse will not load coverage for them.
58
+
59
+
## Address Trace (Instruction, or Basic Block)
60
+
61
+
Perhaps the most primitive coverage format, Lighthouse can also consume an 'absolute address' style trace:
62
+
63
+
```
64
+
0x14000419c
65
+
0x1400041a0
66
+
0x1400045dc
67
+
0x1400045e1
68
+
0x1400045e2
69
+
...
70
+
```
71
+
72
+
Note that these address traces can be either instruction addresses, or basic block addresses -- it does not matter. The main caveat is that addresses in the trace *must* match the address space within the disassembler database.
73
+
74
+
If an address cannot be mapped into a function in the disassembler database, Lighthouse will simply discard it.
75
+
76
+
## Custom Trace Formats
77
+
78
+
If you are adamant to use a completely custom coverage format, you can try to subclass Lighthouse's `CoverageFile` parser interface. Once complete, simply drop your parser into the `parsers` folder.
0 commit comments