coverdiff

Tool tools/triage/coverdiff.py (program, Triage). Find the code that runs only when you do something in the game: compare the code coverage of two runs, one without the action and one with it.

Run it with ./gameframe run coverdiff ARGS or python3 tools/triage/coverdiff.py. Source on GitHub.

Its own help

This is the help text in the tool itself, as ./gameframe tool coverdiff prints it.

Find the code that runs only when you do something in the game: compare the code coverage
of two runs, one without the action and one with it.

Usage: coverdiff.py BASELINE ACTION [--module NAME] [--base ADDR] [--functions functions.tsv]
                    [--both] [--json]

  BASELINE, ACTION   two coverage logs of the original: DynamoRIO's drcov format (drrun -t
                     drcov, also written by Frida and other tracers for Lighthouse), or text
                     files with one address per line
  --module NAME      only the blocks of the module whose path contains NAME (the game's .exe)
  --base ADDR        add this to the module offsets in a drcov log: the image base Ghidra uses
                     (0x400000, 0x140000000), so the addresses match the export
  --functions FILE   a Ghidra export's functions.tsv: name the function each block is in
  --both             also list the code that ran only in the baseline

A game runs most of its code every frame. The code that handles one action, such as buying a
unit, opening a door or saving, runs only when you do it. Record coverage while playing
without the action, then again doing the same and the action once. The blocks in the second
log and not in the first are the action's code, usually a handful of functions out of
thousands. Start tracing there.

Keep the two runs as alike as you can: same save, same menus, same length. The fewer
differences, the shorter the list. A drcov log lists each basic block once, however often it
ran. Standard library only.

Named by

Skills: re-observe.