covtool

a multitool for manipulating coverage traces for dynamic analysis

primarily built around the standard-ish DrCov coverage trace format; but supports converting other, simpler trace formats. also supports a custom backwards-compatible extension to the DrCov format to track block hitcounts.

features

• a flagship tui for inspecting traces
• view stats about coverage traces
• perform queries (intersection, difference, etc.) on multiple traces
• edit traces (rebase modules, adjust offsets)
• lift simple formats to drcov (write your own coverage tools)

install

uv tool install covtool

usage

viewing coverage traces

open the tui inspector to navigate through a trace with:

covtool inspect <trace>

or just view a summary:

covtool info <trace>

editing coverage traces

sometimes due to things like aslr, we need to adjust module addresses:

covtool -v edit <trace> -o <trace> --rebase 'SomeModule->0x0'

coverage formats

flagship: drcov (+hits)

this is either the standard DrCov format (any version), or the custom extension to support hitcounts.

simple formats (lifted to drcov)

you can make a file that just outputs block traces in very simple formats (one entry per line). these get auto-detected and can be converted to drcov using the lift tool:

• module+offset: boombox+3a06
• address: 14000419c or 0x14000419c
• address+hits: 14000419c 24

you can lift to the standard format by specifying module names and optionally base addresses:

covtool lift input.txt -o output.drcov -M module@base_addr