alvarofe / bcov Goto Github PK

A tool for efficient binary-level coverage analysis. bcov statically instruments x86-64 ELF binaries without compiler support. It features probe pruning, precise CFG analyses, and sophisticated instrumentation techniques.

• Details are available in our paper which is accepted to ESEC/FSE'20.
• This blog post elaborates on the availability of function definitions in stripped binaries.

The following software must be available:

• capstone branch next commit #c3b4ce1901
• unicorn branch master commit #536c4e77c4

Later versions of both frameworks should work in principle but have not been tested yet. The script install.sh can be used for installation.

We provide a Dockerfile which installs bcov and runs the available experiment. Please checkout the supplemental artifacts for more details.

The tool supports the following operation modes which are set using the option --mode (or simply -m):

• patch. Patch a given binary.
• report. Report coverage given a patched binary and a coverage data file.
• dump. Dump various program graphs for a given function. For example, dump the CFG and dominator trees.

The following command can be issued to patch a binary,

bcov -m patch -p any -v 5 -i perl -o perl.any

The instrumentation policy can be set to any, which refers to the any-node policy, or all which refers to the leaf-node policy.

Coverage data can be dumped by injecting libbcov-rt.so using the LD_PRELOAD mechanism. For example, you can try the sample binary perl.any which can be found in the artifacts repository,

export BCOV_OPTIONS="coverage_dir=$PWD"   # sets the directory for dumping coverage data. Defaults to $PWD
export LD_PRELOAD="[full-path-to-bcov-rt]/libbcov-rt.so"
./perl.any -e 'print "Hello, bcov!\n"'

This will produce a dump file that has the extension '.bcov' in your current directory. This file can be supplied to bcov for coverage reporting,

bcov -m report -p any -i ./perl -d perl.any.1588260679.1816.bcov > report.out

Currently, bcov can not persist analysis results to disk. Therefore, the original binary must be re-analyzed to report coverage. Coverage will be reported for each basic block in the file report.out. The data in each line lists:

• BB address
• BB instruction count
• is covered
• is fallthrough (i.e., does not terminate with a branch)

Also, a coverage summary is reported for each function. For example, it shows the basic block and instruction coverage ratios.

For a given function, it is possible to selectively dump various program graphs like the CFG and superblock dominator graph. For example, consider function S_search_const in perl,

bcov -m dump -f "S_search_const" -i ./perl

This command will dump the following files:

• func_421d90.cfg.dot. The CFG of the function.
• func_421d90.rev.cfg.dot. Similar to the CFG but with all edges reversed.
• func_421d90.pre.dom.dot. Predominator tree.
• func_421d90.post.dom.dot. Postdominator tree.
• func_421d90.sb.dom.dot. Superblock dominator graph.

Graphs are dumped in the standard DOT format and can be viewed using a dot viewer like xdot. Please refer to this blog post for additional details.

For citation in an academic work please use:

@inproceedings{BenKhadra:FSE2020,
address = {Sacramento, CA, USA},
author = {{Ben Khadra}, M. Ammar and Stoffel, Dominik and Kunz, Wolfgang},
booktitle = {ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering - ESEC/FSE'20 (accepted)},
publisher = {ACM Press},
title = {{Efficient Binary-Level Coverage Analysis}},
year = {2020}
}

This software is distributed under the MIT license. See LICENSE.txt for details.