How to trace every instruction that was executed?

Question

When I use "trace into" it doesn't log every single executed instruction in the "Run Trace" window only some of them. I have to set breakpoints in order for some of the instructions to be logged.

For example right now I'm tracing a program with a TLS callback. I break on system entry point, so I start in ntdll and hit "trace into" but the TLS callback which is from the main executable is not logged if I don't put a breakpoint on it. If I put a breakpoint on it then it appears in the run trace. How can I log every single instruction without setting breakpoints?

I have unchecked the box for "Don't enter system dlls" and checked the box for "always trace over string functions" (and all other combinations thereof).

I have also tried setting a trace condition "pause trace when EIP is between 400000-500000" which only works when I set a breakpoint on the TLS (i.e clicking "trace into" will single-step through the TLS code once the breakpoint is hit and will not pause not before the breakpoint I set), and doesn't work if I don't set the breakpoint. There is obviously something I'm missing, but I've tried everything that I can think of.

Also another thing: When I press "Execute till user code" from ntdll, it doesn't stop on the TLS callbacks (unless I put breakpoints on there). Why does that happen?

UPDATE: Turns out problem was I was using 64 bit OS. I ran it again in 32 bit windows and the TLS was traced fine.

"Execute till user code" still doesn't break on TLS callbacks though.

Answer 1

how did you confirm that the tls call back is not present in run trace ?

AFAIK ollydbg properly traces through LdrpCallInitRoutine

Run trace, selected line
 Back=1663410.
 Thread=Main
 Module=ntdll
 Address=7C91C4F5
 Command=CALL    ntdll.LdrpCallInitRoutine
 Comment=ELdrpCallInitRoutine <------------

do you log the trace to some file the buffer entries drop out in last in first out fashion (buffer size is configurable and default size of buffer is set at its lowest size )

even if you configure the buffer to its maximun size there is a chance that the log entries were dropped

do you know the address of tls callback

if yes did you try right click -> mark address and using + / - to navigate ?

here is a tls entry as logged by ollydbg

Run trace, selected line
 Back=1663399.  <------------------ i have paused the binary so much instruction forward     
notice the earlier index is farther back in ldrpcallinitroutine paste above
 Thread=Main
 Module=kernl
 Address=10001000 <ModuleEntryPoint>  <---- a dll (LDR_PROCESS_ATTACH Init Call)

Command=PUSH EBP