Search the Community

Overview Lighthouse is a powerful code coverage explorer for IDA Pro and Binary Ninja, providing software researchers with uniquely interactive controls to study execution maps for native applications without requiring symbols or source. This project placed 2nd in IDA's 2017 Plug-In Contest and was later nominated in the 2021 Pwnie Awards for its contributions to the security research industry. Special thanks to @0vercl0k for the inspiration. [hide][Hidden Content]]

Overview Lighthouse is a code coverage plugin for IDA Pro. The plugin leverages IDA as a platform to map, explore, and visualize externally collected code coverage data when symbols or source may not be available for a given binary. This plugin is labelled only as a prototype and IDA / Qt code example for the community. Changelog v0.9 + Features |- Added support for ‘module+offset’ style coverage files / traces |- Added a coverage cross-reference dialog, like git-blame for coverage hits |- Theme subsystem for custom user defined Lighthouse themes and colors |- Added a fallback ‘Module Selector’ dialog to pick which ‘binary’ to load coverage for |- Complete refactor for native Binary Ninja 2.0 support, multiple databases |- Updated to fully support IDA 7.0 -> 7.4 |- Python 2/3 compatible for all platforms & disassemblers |- Faster, more accurate database painting subsystem + Minor Changes |- Extensible coverage parser interface makes it easier to load custom coverage formats |- Added support for absolute address (bb, or instr.) style coverage files / traces |- Updated the drcov coverage parser to support newer revisions |- Batch loading no longer loads all files into memory before aggregating data |- Decompilation views in IDA will now refresh coverage paint automatically |- Lighthouse is now ‘accessible’ through the disassembler console, with lighthouse.get_context(…) |- Significantly improved the database painter performance and stability in IDA |- Improved the performance for caching database metadata |- Support ‘interleaved’ instruction coverage in capable disassemblers (Binary Ninja) |- ‘Forcefully’ clearing database paint will now block with a waitbox while running |- Double clicking a function in the coverage table will now jump to the ‘first’ block with coverage |- Added a simple check against GitHub to notify when a new version of Lighthouse is available |- Removed the ‘range’ syntax from the composition grammar — nobody used it anyway |- IDA should now close faster than it previously did after using Lighthouse |- Deprecated support for IDA 6.8 -> 6.95 |- Tons of other minor improvements and code cleanup + UI |- Lighthouse now ships with two default themes, one ‘Light’ and one ‘Dark’ |- Unless the user specifies a theme preference, Lighthouse will pick which one it thinks is best |- Reduced the font size of Lighthouse on macOS by 1pt, text should look a bit less comical |- The coverage overview will more consistently snap to the right-side of the disassembler on open |- Horizontal scrolling in the coverage table is now ‘per-pixel’ vs ‘per-column’ (less jumpy…) |- Changed column sizing for the coverage table, ‘Function Name’ will also stretch by default now |- Improved the coverage shell so that text selection (click+drag) actually works |- Improved overall consistency with opening / closing the coverage combobox |- Improved the combobox and coverage shell styling to look a bit sharper |- Lighthouse error messages should be less likely to look bungled on other platforms |- Continue to improve cross-platform & cross-disassembler UI consistency |- Added tooltips to the coverage overview table header + Bugfixes |- A partially executed basic block should no longer appear fully painted in graph views |- Fixed a bug that could prompt the user ‘several’ times for a coverage name when saving a composition |- Lighthouse will now attempt to rebase itself should the user ‘rebase’ their IDB (IDA only) |- Fixed a bug where the Aggregate set symbol ‘*’ was simply unusable in the coverage shell |- The drcov parser could fail to extract module filenames when parsing a log collected on a different OS |- Fixed some edge cases to improve the stability of metadata collection (caching) |- Fixed a bug where deleted / undefined functions would persist in the coverage table after refresh |- Using the shell to jump to sub_… function names did not work in Binary Ninja due to case sensitivity |- Fixed bug that caused ‘renamed’ functions to lose their navigability (click to jump) in the table + BINJA KNOWN ISSUES |- Highlighting the newly released Binary Ninja HLIL is not yet supported |- Lighthouse will not properly spin down its threads and resources after closing a bndb / bv |- Live rebasing of Lighthouse is *not* supported in Binja — rebase first, and then open Lighthouse [HIDE][Hidden Content]]