mesos: Binary coverage tool without binary modification for Windows
Mesos is a tool to gather binary code coverage on all user-land Windows targets without the need for source or recompilation. It also provides an automatic mechanism to save a full minidump of a process if it crashes under mesos.
Mesos is technically just a really fast debugger, capable of handling tens of millions of breakpoints. Using this debugger, we apply breakpoints to every single basic block in a program. These breakpoints are removed as they are hit. Thus, mesos converges to 0-cost coverage as gathering coverage only has a cost the first time the basic block is hit.
Features
Code coverage
Automatic full minidump saving
IDA Coloring
Performance
- We can register (request breakpoints to be at module load) about ~6 million/second
- We can apply them (actually install the breakpoints into the target at about ~3 million/second
- We can clear breakpoints at about 15 million/second
- We can hit and handle about 10k breakpoints/second
Given breakpoints are cleared as they’re hit for coverage, that means you can observe 10k new blocks per second. Once you’ve hit a breakpoint they no longer have a performance cost!