Is there a tool that logs the value the IP register of a specific process running? I am trying to compare the instruction excution before and after a file modification.


Depending on the CPU architecture the process targets, there are many dynamic instrumentation tools that can perform this function. However, you have not specified the environment the process of interest runs in.

Architecture-specific examples:

  • Intel's pintool. Someone on stackoverflow has already asked about how to use pintool to print all executed instructions

  • PANDA. This framework includes a plugin called PANDA_CB_INSN_TRANSLATE which is triggered prior to instruction translation and can be paired with PANDA_CB_INSN_EXEC

  • The DynamoRIO-based tool instrace. "instrace" is short for "instruction trace".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.