I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the register of ecx that comes into my function from another function. I try to trace which function calls the function I need, it usually worked for other programs. But now when i trace the functions the trace lagging and stops. I set a breakpoint when creating the window to see all the actions that occur. I have an idea that the tracing stops, because in this program a lot of things work through additional Qt5 libraries as example Qt5Core.dll.enter image description here

1 Answer 1


By default tracing is limited to reduce its overhead: it stops once it goes to a location not in the current database (external modules, runtime-allocated memory etc.), as well as functions marked as library code. You can change this behavior in tracing options (disable the “trace over” checkboxes).

Note that in some cases IDA may be unable to trace the execution even if you ask it to trace everything. For example, it is unable to trace any kernel code, as well as user code that is called by the kernel indirectly (e.g. window procedures, exception handlers and so on)

  • I turned off "trace over debugger segments" and "trace over library functions" Now the program does not stop, and trace works. But in that case, I only get instructions from my breakpoint. I have text in the program window that changes, and I need to find the address to get its value each time the window is restarted. Commented Mar 28, 2019 at 13:54
  • Previously, traces helped me, thanks to a search for instructions, I entered the address (which I took through cheat engine) and was able to figure out how it is generated. But how to be now? I found 3 functions that are called one after another, but I need a register from another function, because its value has already been obtained by the previous function and put on the stack. How can I track this? Commented Mar 28, 2019 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.