How can I print the opcodes in a trace log?
I can use {x:bswap([cip])} but this will print a fix amount of bytes (which most of the time will end up as either more or less number of bytes), regardless of the ones that the instruction does have
Add a comment
|
2 Answers
You can use {mem;dis.len(cip)@cip}. See http://help.x64dbg.com/en/latest/introduction/Formatting.html for the relevant documentation.
-
@ mr exodia mem;ken@ addr is broken or does nit work it either says format error or unknow blah blah from long time– blabbJan 27, 2019 at 11:20
-
-
I tried and there appears to be a bug in the command separator so when using the command: log “{mem;dis.len(cip)@cip}” it will separate it into two commands and fail. But when using it in the log text everything works as expected...– mrexodiaJan 27, 2019 at 11:32
-
@ mrexodia yes that command does not accept the semicolon and no i am using a fairly new snapshot but that doesn't matter it has been so for a long time i've tried. it i just pulled the v25 14nov2016 build and it exhibits the same behaviour– blabbJan 27, 2019 at 17:09
-
See my previous post. The command is broken, but the trace “log text” field is working perfectly fine for me.– mrexodiaJan 27, 2019 at 17:10
trace record log file already logs opcodes
select the trace window
select start run trace
accept the file name
and start tracing
it will trace 50000 steps (default can be configured in preferences) and stop
and the format of trace file is documented so you can code some utility to parse it if you want
-
Yes, that is the Trace tab (Run Trace), but I am using the "trace into" which logs the results into a file directly Jan 27, 2019 at 2:25