Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns 0xFFFFFFFF. Also I've tried to save the trace to file, but it's in IDA proprietary format, and there's no API to manipulate the trace data, but load_trace_file/save_trace_file in SDK neither. Then I tried to export trace log into text file and parse it. But it's totally useless. Ida for some reason saves not the RVA, and not the virtual address of the traced instruction, but demangled name of the function + offset like this:

.text:dllmain_dispatch(HINSTANCE__ * const,ulong,void * const)+3D

So even if you're able to extract "dllmain_dispatch(HINSTANCE__ * const,ulong,void * const)" you need to mangle it back to use it in get_name_ea(). Seems like IDA tracing information is not supposed to be used anywhere, but displaying the instructions within trace window...

  • What 2nd parameter did you used? CIC_ITEM? – Biswapriyo Sep 19 '18 at 16:33
  • yep. Seems like the only way is to parse trace log file manually. – Anton Kukoba Sep 20 '18 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.