1. Download 0vercl0k's coddecov.js script from https://github.com/0vercl0k/windbg-scripts/blob/master/codecov/codecov.js
2. Launch WinDbg and open the Trace (.run file) you are wanting code coverage for. If a trace has not been created: [[Creating a TTD Trace for Binary Ninja]]
3. Load the codecov.js script and execute
```
.scriptload "C:\Users\user\Downloads\codecov.js"
!codecov "GratefulPos"
```
**The string supplied to !codecov in the last command is the name of the binary being analyzed**
![[Pasted image 20250920141553.png]]
4. Upon successful completion, a .txt output will appear within the location of the .run file supplied into WinDbg.
![[Pasted image 20250920141845.png]]
5. Launching Binary Ninja, bncov will need to be installed from the plugin manager if it hasn't been already
![[Pasted image 20250920142112.png]]
6. Within Binary Ninja navigate to Plugins > bncov > Coverage Data > Import File, and then import the .txt file generated from the !codecov command within WinDbg.
7. Code coverage is only provided for lower level IL. To get code coverage for high level IL the following can be run below within the Python Scripting console per [[https://seeinglogic.com/posts/binary-ninja-ttd-intro/|seeinglogic]] after the code coverage file has been imported.
```Python
# If you installed bncov from plugin manager:
import ForAllSecure_bncov as bncov
# If you installed from GitHub, instead do:
# import bncov
# Snippet to map coverage from disasm to HLIL
def transfer_highlights_to_instructions(covdb: bncov.CoverageDB):
bv = covdb.bv
for block_address in covdb.total_coverage:
for block in bv.get_basic_blocks_starting_at(block_address):
cur_highlight = block.highlight
block.set_user_highlight(HighlightStandardColor.NoHighlightColor)
cur_function = block.function
cur_addr = block.start
for cur_token, cur_inst_size in block:
cur_function.set_user_instr_highlight(cur_addr, cur_highlight)
cur_addr += cur_inst_size
# Get the coverage db for file currently open
covdb = bncov.get_covdb(bv)
# Apply highlights
transfer_highlights_to_instructions(covdb)
```
8. Code should now be highlighted within the Disassembly view. **Important to note, if your are trying to utilize code coverage along side Time Travel Debugging, you will need to import your file prior to launching your TTD trace**.