Here's a handful of scripts/tools to get block coverage information from a binary.
Accompanying blog post: https://seeinglogic.com/posts/getting-code-coverage/
- Scriptable debugger
- TTD debugger
- See 0vercl0k's script for WinDbg
- Emulator
- Script to parse QEMU's
-d in_asm
debug output
- Script to parse QEMU's
- Dynamic Binary Instrumentation (DBI)
- Static rewriting
- Script to parse DynInst's codeCoverage example