9

When I execute a program using IDA's debugger interface, I would like to see the basic blocks that were executed highlighted in the IDB. Is there a way to do this?

10

Process Stalker is designed to do exactly what you want.

Snippet of Process Stalker's basic block highlighting

Sample usage: https://www.openrce.org/articles/full_view/12

PowerPoint slides: http://2005.recon.cx/recon2005/papers/Pedram_Amini/process_stalking-recon05.pdf

4

I don't know of a ready-made way to achieve that, but you could probably relatively easy write a IDA python script to do it.

On the other hand, deroko has written a tool, called Pinlog that uses Pin to trace the execution and records a trace which you then parse using IDA script, it ends up highlighting the executed instructions:

Tool which traces execution of program with Pin, and logs execution path. Produces log file which can be imported into IDA thus parts of code which are executed more times will be highlighted. x32/x64 both Windows and Linux

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.