search

gaasedelen / lighthouse

A Coverage Explorer for Reverse Engineers
MIT License
2.23k stars 308 forks source link

Extended 'shorthand' symbols to 3 chars each, to enable support of mo… #59

Closed MosheWagner closed 4 years ago

MosheWagner commented 5 years ago

…re than 26 test cases.

(This is especially relevant for visualizing coverage of test cases created by fuzzing)

gaasedelen commented 5 years ago

Thanks for the contribution, I am going to hold off merging this into dev until I can test and evaluate it myself. I have been hesitant to integrate this kind of change in the past but perhaps it is becoming necessary.

Related to #57

gaasedelen commented 4 years ago

I just wanted to loop back on this PR because I feel the Lighthouse development branch is now better equipped to avoid bumping into this limitation.

If you are working with a large number of coverage files (say, 1,000 files from a fuzzer), use the following workflow:

  1. Use the File --> Load file --> Load coverage batch menu option. This will load and aggregate all your selected coverage files into 'one' set. It will load much faster, and use far less memory than loading all files individually.
  2. While viewing your 'batch' coverage set, you can now use the Xref coverage set right click context menu in the graph/intruction views of IDA. This will list all the coverage files (or loaded sets!) that hit the given block.
  3. Double click any of the listed Coverage Xrefs, and Lighthouse will automatically load that testcase as a new coverage set (if not yet loaded) and switch to it.
  4. If you are nearing the end of the symbol pool (A-Z), you can close / unload some of the coverage sets through the Coverage Combox / Dropdown.

The shorthand symbols were meant to make writing compositions simple and fast to explore the relationships between a handful of sets (eg, 2-5) at one time. There should never be a use case where you need 26+ unique sets loaded for a query, and this PR further enables a workflow that I don't want to promote.

Sorry this has taken so long, but unless you come up with a more compelling use case -- I will be declining this PR.

Thanks again for the contribution! And I hope you find the above useful going forward :-)