0

How can I print the opcodes in a trace log?

I can use {x:bswap([cip])} but this will print a fix amount of bytes (which most of the time will end up as either more or less number of bytes), regardless of the ones that the instruction does have

2

You can use {mem;dis.len(cip)@cip}. See http://help.x64dbg.com/en/latest/introduction/Formatting.html for the relevant documentation.

  • @ mr exodia mem;ken@ addr is broken or does nit work it either says format error or unknow blah blah from long time – blabb Jan 27 at 11:20
  • Perhaps you are using an older version? – mrexodia Jan 27 at 11:24
  • I tried and there appears to be a bug in the command separator so when using the command: log “{mem;dis.len(cip)@cip}” it will separate it into two commands and fail. But when using it in the log text everything works as expected... – mrexodia Jan 27 at 11:32
  • @ mrexodia yes that command does not accept the semicolon and no i am using a fairly new snapshot but that doesn't matter it has been so for a long time i've tried. it i just pulled the v25 14nov2016 build and it exhibits the same behaviour – blabb Jan 27 at 17:09
  • See my previous post. The command is broken, but the trace “log text” field is working perfectly fine for me. – mrexodia Jan 27 at 17:10
0

trace record log file already logs opcodes
select the trace window
select start run trace
accept the file name
and start tracing
it will trace 50000 steps (default can be configured in preferences) and stop

and the format of trace file is documented so you can code some utility to parse it if you want

enter image description here

  • Yes, that is the Trace tab (Run Trace), but I am using the "trace into" which logs the results into a file directly – user1156544 Jan 27 at 2:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.