Can Windbg trace function calls within a module?

Question

I want to log any functions within a specific module that are called during an execution.

I tried !for_each_function and wt command. However, since the target module doesn't have any symbols, !for_each_function cannot recognize any functions. wt command seems only able to trace with one function.

I know IDA debugger can trace function calls. But my current problem is that I only want to trace the functions in a specific module. I'm not sure if IDA can do that. Also I'm wondering if IDA debugger can break on module load (similar to 'sxe ld:modulename' in windbg..

I actually just need the address of all the function that are called. I was thinking if there is any way to set breakpoint on all RET within a module...But haven't figure out how to do that ...

Answer 1

opening calc.exe in windbg

windbg calc    

skipping all the ldrint system calls

bp calc!WinMain ; g    

tracing only calc module from eip to some specific address and printing the return values (please note using arbitrary values as EndAddress may possibly corrupt the code by inserting 0xcc in middle of instruction )

0:000> wt -l 2 -oR -m calc =@eip @eip+5fa   

trace result with return values (trimmed )

   30     0 [  0] calc!WinMain
    5     0 [  1]   kernel32!GetModuleHandleWStub
    1     0 [  1]   kernel32!GetModuleHandleW
   11     0 [  1]   KERNELBASE!GetModuleHandleW eax = b40000
   32    17 [  0] calc!WinMain
   11     0 [  1]   USER32!LoadStringW eax = a
   36    28 [  0] calc!WinMain
    3     0 [  1]   calc!CCalculatorSQM::onAppEntry
    5     0 [  2]     msvcrt!time
   24     0 [  2]     msvcrt!_time32 eax = 574fd43e
    5    29 [  1]   calc!CCalculatorSQM::onAppEntry eax = 574fd43e
   41    62 [  0] calc!WinMain
   12     0 [  1]   calc!McGenEventRegister
   38     0 [  2]     ntdll!EtwEventRegister eax = 0
   14    38 [  1]   calc!McGenEventRegister eax = 0
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  364 12901 [  0] calc!WinMain
   24     0 [  1]   USER32!GetMessageW eax = 1
  372 12925 [  0] calc!WinMain
   21     0 [  1]   USER32!TranslateAcceleratorW eax = 0
  378 12946 [  0] calc!WinMain
   19     0 [  1]   calc!CContainer::HandleGlobalTabbing eax = 0
  382 12965 [  0] calc!WinMain

13347 instructions were executed in 13346 events (0 from other threads)

summary and wt broke where instructed

ole32!CoInitialize                                    1       8       8       8
oleacc!ATL::CComObject<CPropMgr>::Release             1      16      16      16
oleacc!CPropMgr::SetHwndPropStr                       5      66      66      66

0 system calls were executed

eax=000cf030 ebx=00000000 ecx=00b94210 edx=76f070b4 esi=00b94210 edi=766e667e
eip=00b41c2f esp=000cef5c ebp=000cfcc4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
calc!WinMain+0x7d5:
00b41c2f e8e2010000      call    calc!CEditBoxInput::HandleWinMainMessage (00b41e16)
0:000> ? calc!WinMain+5fa

note eip expression and EndAddress in wt command 
    Evaluate expression: 11803695 = 00b41c2f