GNATCoverage (Ada-only) has interesting binary coverage capabilities. Qemu trace, valgrind instrumentation, nexus... If interested I built once A gdb-branch-trace script, a pintool to generate the trace or an Intel-PT-based prototype. Dyninst and dynamo rio too. Neat exercise