0

How can I print the opcodes in a trace log?

I can use {x:bswap([cip])} but this will print a fix amount of bytes (which most of the time will end up as either more or less number of bytes), regardless of the ones that the instruction does have

2 Answers 2

2

You can use {mem;dis.len(cip)@cip}. See http://help.x64dbg.com/en/latest/introduction/Formatting.html for the relevant documentation.

5
  • @ mr exodia mem;ken@ addr is broken or does nit work it either says format error or unknow blah blah from long time
    – blabb
    Jan 27, 2019 at 11:20
  • Perhaps you are using an older version?
    – mrexodia
    Jan 27, 2019 at 11:24
  • I tried and there appears to be a bug in the command separator so when using the command: log “{mem;dis.len(cip)@cip}” it will separate it into two commands and fail. But when using it in the log text everything works as expected...
    – mrexodia
    Jan 27, 2019 at 11:32
  • @ mrexodia yes that command does not accept the semicolon and no i am using a fairly new snapshot but that doesn't matter it has been so for a long time i've tried. it i just pulled the v25 14nov2016 build and it exhibits the same behaviour
    – blabb
    Jan 27, 2019 at 17:09
  • See my previous post. The command is broken, but the trace “log text” field is working perfectly fine for me.
    – mrexodia
    Jan 27, 2019 at 17:10
0

trace record log file already logs opcodes
select the trace window
select start run trace
accept the file name
and start tracing
it will trace 50000 steps (default can be configured in preferences) and stop

and the format of trace file is documented so you can code some utility to parse it if you want

enter image description here

1
  • Yes, that is the Trace tab (Run Trace), but I am using the "trace into" which logs the results into a file directly Jan 27, 2019 at 2:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.