I have been looking for the equivalent of the "Run Trace" option of OllyDbg in IDA Pro. Can anyone mention if there is one and how to use it ?
IDA Pro offers two tracing options:
- Instruction tracing Debugger->Tracing->Instruction Tracing It is very slow tracing process, since IDA monitors registers and has to record the address, the instruction, and changes values of registers, that were changed by the instruction.
- Function tracing Debugger->Tracing->Function Tracing. It is a subcategory of instruction tracing, where only function calls are logged.
There are also three types of tracing events: execution traces, write traces, and read/write traces.
A trace in IDA Pro could by replayed by using Trace replayer. It is located within Debuggers submenu. You could switch to Trace-replayer by going to Debugger->Switch Debugger...->Trace replayer
One thing to remember that you have to have trace created before you can replay it. In order to create a trace you will need to do the following:
- Set a breakpoint at the point where you want you trace started.
- Run the program with the debugger of your choice.
- Whenever it breaks, select desired tracing style (Instruction or Function)
- Run as far as necessary. You could set a second breakpoint to stop the trace.
- You can optionally save the trace.
- Replay the trace by switching debugger to Trace replayer.