Consider separating the TTD coverage functionality into trace provider and trace consumer

[xusheng6]

We might want to make the TTD trace generation separate from the visualization. This allows us to support other traces or traces produced from other tools

[xusheng6]

This architectural change is important and will unlock several powerful features. Here's a summary of the benefits and implementation approach:

Why Separate Trace Collection from Analysis

Current Architecture:

• Coverage is tightly coupled to active debugging session
• Only one trace at a time
• Coverage lost when debugger closes
• Can't use coverage from external tools

Proposed Architecture:

Coverage Providers          Coverage Manager          Coverage Consumers
├─ TTD                     ├─ Load/Save             ├─ Render Layer
├─ DynamoRIO               ├─ Multiple sets         ├─ Function Table (#988)
├─ Intel Pin               ├─ Composition (A&B)     ├─ Statistics
├─ File Import             └─ Persistence           └─ Export/Reports
└─ Custom tools

Key Benefits

1. Offline Analysis - Analyze coverage without running debugger
2. Multiple Traces - Load and compare different execution runs
3. Coverage Composition - Powerful differential analysis:
   • Crash - Normal → Find code unique to crash
   • A & B & C → Find common code paths
   • TestSuite → Aggregate test coverage
4. Tool Agnostic - Import coverage from DynamoRIO, Pin, fuzzers, etc.
5. Persistence - Coverage survives beyond debug session
6. Better Testing - Analyze test suite coverage systematically

File Format Support

Priority 1: DRCov (DynamoRIO Coverage Format)

• Industry standard, widely supported
• Used by DynamoRIO, Intel Pin, AFL++, WinAFL
• Handles multi-module programs
• Compact binary or text format
• Best compatibility with existing tools

Priority 2: Simple formats

• Module+Offset: modulename+offset (human-readable)
• Trace: One address per line (simplest)
• Custom JSON: Flexible metadata support

Priority 3: Native format

• Optimized for Binary Ninja debugger
• Preserves execution counts and metadata

Suggested Implementation

1. Phase 1: Data Model Separation

   • Extract coverage data structure from DebuggerController
   • Create CoverageData class (address → hit count map + metadata)
   • Keep existing TTD workflow working

2. Phase 2: Provider Interface

   class ICoverageProvider {
       virtual CoverageData CollectCoverage() = 0;
   };

   • TTDCoverageProvider - Current TTD implementation
   • FileCoverageProvider - Load from disk
   • Future: DynamoRIO, Pin, etc.

3. Phase 3: Coverage Manager

   • Load multiple coverage sets ("A", "B", "Crash", "Normal")
   • Boolean operations (A & B, A - B, A | B)
   • Persistence (save/load from .bndb or standalone files)

4. Phase 4: File Format I/O

   • DRCov parser/writer (highest priority)
   • ModOff, Trace format support
   • Export capabilities

Use Cases

Bug Hunting:

Normal = ./program good_input.txt
Crash = ./program crash_input.txt
Crash - Normal = code only executed during crash

Test Coverage:

Test1 | Test2 | Test3 = total coverage
Test1 & Test2 & Test3 = always-executed code

Fuzzing Integration:

Load corpus.drcov
Find uncovered high-complexity functions
Generate targeted inputs

Related Work

This architecture is proven in similar tools:

• Lighthouse - Coverage explorer for IDA/Binary Ninja, supports multiple formats
• Tenet - Trace explorer, separates trace from analysis
• Industry-standard fuzzing pipelines use DRCov for coverage feedback

Timeline Suggestion

• Week 1-2: Data model refactoring + persistence
• Week 2-3: Multiple coverage sets + basic composition
• Week 3-4: DRCov format support
• Week 4+: Function-level analysis (Add Function-Level Coverage Overview and Statistics #988) and advanced features

This change will transform the coverage feature from a simple visualization tool into a professional-grade coverage analysis system, especially powerful with TTD's deterministic traces.

[xusheng6]

We might want to switch to have the TTD trace generator produce DRCov format or at least mod + offset