fred26

Tracing

20 posts in this topic

Could someone provide me a step by step on how to trace?

Can you log the output to a file like OllyDbg does ?

thanks

Share this post


Link to post
Share on other sites

Relevant sections of the manual:

Without writing a plugin you cannot output the same format as ollydbg does, but you can output data of your choice (EIP + instruction text + some registers)

1 person likes this

Share this post


Link to post
Share on other sites

Posted (edited)

Thanks. It seems you need a plugin and not a default command in the current builds?

How can you do a trace via the GUI?

Edited by fred26

Share this post


Link to post
Share on other sites

Debug -> Trace into?

What version are you using?

Share this post


Link to post
Share on other sites

Posted (edited)

I downloaded the latest version and now it works.

But, after setting the txt file and when the trace finishes after 50000 steps the file is empty - it was created though.

What can I do to see the content of the trace or make the debugger dump to the txt file?

Also, can I do an indefinite trace ?

Thanks!

 

Edited by fred26

Share this post


Link to post
Share on other sites

The file will only have the contents you tell it to have. My guess is that you didn't read any of the resources I pointed you to because one of them clearly answers your question.

Share this post


Link to post
Share on other sites

Posted (edited)

23 minutes ago, mrexodia said:

The file will only have the contents you tell it to have. My guess is that you didn't read any of the resources I pointed you to because one of them clearly answers your question.

Thanks. Ok, I understand that you need to tell the debugger what to write.

I added {p:cip} {i:cip} to the Log Text and I see the counter and instruction. How can I output all register values ? Can I add a break line between each instruction?

Thanks again

Edited by fred26

Share this post


Link to post
Share on other sites

I could create a trace such as {p:cip} {i:cip} rax: {rax} rcx: {rcx}, which logs the RAX and RCX registers together with the current rip address and instruction.

However, I can't make line breaks in the text file, any hints how to?

Also, how can I write the content of let's say [rsp+0x24] ? E.g. [rsp+0x24] = 0x0000000000000001 ?

Thanks

Share this post


Link to post
Share on other sites

Posted (edited)

@fred26 The text file uses line breaks in the form of \n, which notepad.exe won't properly display. See http://utf8everywhere.org/#faq.crlf for the reason. If you want UTF16+\r\n you can use the option Misc -> UTF-16 Log Redirect (I added this a minute ago so you might have to wait a little for the snapshot to be updated).

You can display the contents of [rsp+0x24] with something like "[rsp+0x24] = {[rsp+0x24]}" See http://help.x64dbg.com/en/latest/introduction/Input.html and http://help.x64dbg.com/en/latest/introduction/Expressions.html for what things you can use as an expression (the format string takes "{expression}"). If you want to display something similar to what is shown in the registers view (string/symbol if found) you can use "[rsp+0x24] = {a:[rsp+0x24]}"

If you know how to program, you can use CB_TRACEEXECUTE to do things fully manually. You can also use a trace command (_plugin_registercommand) or add your own custom format function (_plugin_registerformatfunction) to do more custom-things.

Edited by mrexodia
2 people like this

Share this post


Link to post
Share on other sites

Posted (edited)

@Kurapica you should take a look at CB_TRACEEXECUTE. This function allows you to work in full tracing performance without all these nasty timer hacks. It also allows you to use x64dbg's trace condition and log functionality.

Also to log all jumps/calls with the native tracing functionality, you can use "dis.isbranch()" as log condition.

Edited by mrexodia

Share this post


Link to post
Share on other sites

Interesting !

I was too lazy to study the APIs updates :)

Thanks.

Share this post


Link to post
Share on other sites

Posted (edited)

Thanks both.

@mrexodia thanks for the insights. I will try the plugin as well. Just a last question; can you text out the value addressed by the operands? Let's say you have: mov rax, [rsp+20], can you do something to read the memory addressed in the instruction ?

Thanks

Edited by fred26

Share this post


Link to post
Share on other sites

@fred26 No, but you could write your own expression function that does this.

Share this post


Link to post
Share on other sites

Posted (edited)

@mrexodiathanks so much

Edited by fred26

Share this post


Link to post
Share on other sites

Posted (edited)

Last question. How about a really large trace. Do you need to input the number of max instructions?

Edited by fred26

Share this post


Link to post
Share on other sites

Generally I would recommend against doing a really large trace, but you can just change the settings to something like 4 billion.

Share this post


Link to post
Share on other sites

It registers an event callback. You can use PLUG_CB_TRACEEXECUTE.stop to control the 'break condition' but the default routine will run first. So for example if the user trace condition is "rax == 0" and this is true, you callback will get info->stop == true. If you change info->stop to false it will continue execution anyway. You can find exactly how this is implemented at: https://github.com/x64dbg/x64dbg/blob/development/src/dbg/debugger.cpp#L1331

Share this post


Link to post
Share on other sites
7 hours ago, mrexodia said:

It registers an event callback. You can use PLUG_CB_TRACEEXECUTE.stop to control the 'break condition' but the default routine will run first. So for example if the user trace condition is "rax == 0" and this is true, you callback will get info->stop == true. If you change info->stop to false it will continue execution anyway. You can find exactly how this is implemented at: https://github.com/x64dbg/x64dbg/blob/development/src/dbg/debugger.cpp#L1331

Thanks

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now