Understand the output of drcov tool for code coverage

[Mingyi Zhao]

Hello,

Could you please help me understand the output format of drcov tool? I am using it on Windows. For the following snippet, does it shows the sequence of basic blocks executed? Does each entry tells the module, the start address of the bbl, and the size of the basic block? 

Thank you!

A snippet:

BB Table: 27461 bbs

module id, start, size:

module[ 36]: 0x0003c73c,  13

module[ 36]: 0x00050b76,  16

module[ 36]: 0x00050b37,  14

module[ 36]: 0x00050b45,  26

module[ 36]: 0x00050b5f,  18

module[ 36]: 0x00050b86,  11

module[ 36]: 0x00050b97,  12

module[ 36]: 0x00040240,  69

module[ 36]: 0x00050ba3,  18

module[ 36]: 0x00050bb5,   6

module[ 33]: 0x00019191,   9

module[ 33]: 0x0001919a,   5

module[  0]: 0x0025e9be,   5

module[  0]: 0x00271078,  37

module[  0]: 0x0027109d,   4

module[  0]: 0x002710a1,   9

module[  0]: 0x0027110f,   4 

....

[Qin Zhao]

On Sun, Nov 2, 2014 at 11:21 AM, Mingyi Zhao <rvl...@gmail.com> wrote:

Hello,

Could you please help me understand the output format of drcov tool? I am using it on Windows. For the following snippet, does it shows the sequence of basic blocks executed? Does each entry tells the module, the start address of the bbl, and the size of the basic block? 

yes, they are  module id, start, size:

Thank you!

A snippet:

BB Table: 27461 bbs

module id, start, size:

module[ 36]: 0x0003c73c,  13

module[ 36]: 0x00050b76,  16

module[ 36]: 0x00050b37,  14

module[ 36]: 0x00050b45,  26

module[ 36]: 0x00050b5f,  18

module[ 36]: 0x00050b86,  11

module[ 36]: 0x00050b97,  12

module[ 36]: 0x00040240,  69

module[ 36]: 0x00050ba3,  18

module[ 36]: 0x00050bb5,   6

module[ 33]: 0x00019191,   9

module[ 33]: 0x0001919a,   5

module[  0]: 0x0025e9be,   5

module[  0]: 0x00271078,  37

module[  0]: 0x0027109d,   4

module[  0]: 0x002710a1,   9

module[  0]: 0x0027110f,   4 

....

--
You received this message because you are subscribed to the Google Groups "DynamoRIO Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dynamorio-use...@googlegroups.com.
To post to this group, send email to dynamor...@googlegroups.com.
Visit this group at http://groups.google.com/group/dynamorio-users.
For more options, visit https://groups.google.com/d/optout.

--
Interested in Yoga? Be careful of The Yoga Cult or The Scary Yoga Obsession.

More information from  Lorie Anderson and Rick Ross.

[Derek Bruening]

Generally, you would use the drcov2lcov tool to generate human-readable output.

[Qin Zhao]

drcov2lcov only works for binary format output of drcov, not the text format output (the one pasted).

[Mingyi Zhao]

Thank you for your replies!

To better understand the output, I have created a very simple c program with 100 iterations (see below). I assume that the coverage output should have one basic block entry that appears 100 times.

However, when checking the the output of the result by drcov in text, I find that all entries have only executed once or twice.

Could you please tell me where I could go wrong?

Thank you!

Sample program:

#include<stdio.h>

int main(){

    int i;

    int x = 0;

    for(i = 0; i < 100; i++){

        x += i;

    }

    printf("Loop sum is %d\n", x);

}

[Qin Zhao]

On Wed, Nov 12, 2014 at 4:05 PM, Mingyi Zhao <rvl...@gmail.com> wrote:

Thank you for your replies!

To better understand the output, I have created a very simple c program with 100 iterations (see below). I assume that the coverage output should have one basic block entry that appears 100 times.

However, when checking the the output of the result by drcov in text, I find that all entries have only executed once or twice.

Could you please tell me where I could go wrong?

 

DrCov only provide if any instructions has been executed or not instead of execution count.

That is mainly for the best performance reason.

It is not difficult to make DrCov to collect execution count by adding a counter update in every basic block, but it could slowdown the execution, which I think the benefit not worth the cost.

[Mingyi Zhao]

I see. I misunderstood drcov... it is a code coverage tool rather than a tracing tool.

Thank you!

[Mingyi Zhao]

Hi Qin,

I would like to ask one follow up question. Since DrCov only tells whether an instruction has been executed or not, I assume that each entry in the drcov output will only appear once. However, I found that there are some entries that appear multiple times (2, 3 or 4). Could you please tell me the reason? Thank you!

On Wednesday, November 12, 2014 4:21:24 PM UTC-5, qin wrote:

[Qin Zhao]

DynamoRIO using software code cache to execute the application code basic block by basic block.

DrCov just track what code has been put into the code cache.

Due to reasons like code cache management and some other reasons, the same basic block might be evicted out and copied into the code cache several times, that's why DrCov may report multiple times on the same entry.

[Mingyi Zhao]

Thank you!

[Charith Mendis]

I wrote a code coverage diff tool based on DRCOV  for stripped binaries. Some caveats are as follows.

1. DRCOV will sometimes give the same module two different numbers. This is because of module loading and unloading. 

2. There will be unknown modules, mainly for dynamically generated code.

3. As you said before, the same basic block will be repeated, be sure to remove the duplicates.