2

When I use "trace into" it doesn't log every single executed instruction in the "Run Trace" window only some of them. I have to set breakpoints in order for some of the instructions to be logged.

For example right now I'm tracing a program with a TLS callback. I break on system entry point, so I start in ntdll and hit "trace into" but the TLS callback which is from the main executable is not logged if I don't put a breakpoint on it. If I put a breakpoint on it then it appears in the run trace. How can I log every single instruction without setting breakpoints?

I have unchecked the box for "Don't enter system dlls" and checked the box for "always trace over string functions" (and all other combinations thereof).

I have also tried setting a trace condition "pause trace when EIP is between 400000-500000" which only works when I set a breakpoint on the TLS (i.e clicking "trace into" will single-step through the TLS code once the breakpoint is hit and will not pause not before the breakpoint I set), and doesn't work if I don't set the breakpoint. There is obviously something I'm missing, but I've tried everything that I can think of.

Also another thing: When I press "Execute till user code" from ntdll, it doesn't stop on the TLS callbacks (unless I put breakpoints on there). Why does that happen?

UPDATE: Turns out problem was I was using 64 bit OS. I ran it again in 32 bit windows and the TLS was traced fine.

"Execute till user code" still doesn't break on TLS callbacks though.

1

how did you confirm that the tls call back is not present in run trace ?

AFAIK ollydbg properly traces through LdrpCallInitRoutine

Run trace, selected line
 Back=1663410.
 Thread=Main
 Module=ntdll
 Address=7C91C4F5
 Command=CALL    ntdll.LdrpCallInitRoutine
 Comment=ELdrpCallInitRoutine <------------

do you log the trace to some file the buffer entries drop out in last in first out fashion (buffer size is configurable and default size of buffer is set at its lowest size )

even if you configure the buffer to its maximun size there is a chance that the log entries were dropped

do you know the address of tls callback

if yes did you try right click -> mark address and using + / - to navigate ?

here is a tls entry as logged by ollydbg

Run trace, selected line
 Back=1663399.  <------------------ i have paused the binary so much instruction forward     
notice the earlier index is farther back in ldrpcallinitroutine paste above
 Thread=Main
 Module=kernl
 Address=10001000 <ModuleEntryPoint>  <---- a dll (LDR_PROCESS_ATTACH Init Call)

Command=PUSH EBP

  • I confirmed it by searching through the run trace written to a text file looking for the address of the TLS callback - it wasn't there. I could not even find anything from user code (starting 401000) even though I definitely know the code in there was executed. The log had something like 560000 entries and most of it was just ntdll code and code from other modules but nothing from the user code. Yes I configured the buffer to maximum size. – user2108462 Aug 16 '15 at 12:21
  • I don't know what you mean by "mark address". It's not there in the right click menu. – user2108462 Aug 16 '15 at 12:26
  • By the way when tracing into with ollydbg 2.01 I got an error "unable to step over command at address 00000020 memory is not readable".The log had 41391 entries btw. – user2108462 Aug 16 '15 at 12:28
  • ollydbg 1.10 mark address / ollydbg 2.01 find address – blabb Aug 16 '15 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.