Trace assisted code identification?

Question

I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists.

I'd like to find a specific part of code in the binary. Searching for strings, etc is not helping much. So, I had the thought, what if I could run the program twice, once I would have the program do the thing that corresponds to the code I'm looking for, and the second time I would not perform that action.

If I had a trace of say basic blocks executed during both runs, I might be able to do a "diff" and use that to narrow down where the functionality lies in the binary.

Does such a tool already exist, or is there a better way to narrow down the part of code executing.

Answer 1

This approach is commonly called "differential debugging". I know of the following tools that can help with it:

• PaiMei from Pedram Amini
• MyNav by Joxean Koret
• IDA's trace replayer allows diffing two execution traces (also implemented by Joxean)
• BinNavi has this feature
• simple differ by @dionthegod
• a script from Carlos Garcia which uses WinAppDbg framework by Mario Vilas

It's not too hard to implement something quick in any debugger that allows scriptable breakpoints:

1. Put breakpoints on every function/basic block/instruction (depending on your preference and what the debugger allows). In the breakpoint handler, record the hit then disable/remove the breakpoint.
2. Run the program and do everything you can except for the part you're interested in.
3. Exit the program.
4. Change the breakpoint handler to stop execution, or record it in a separate log file.
5. Run the program again and exercise the part you need. One or more of the remaining breakpoints should hit. They will point you to the interesting code.

Answer 2

you may check out an ollydbg plugin conditional branch logger

http://www.woodmann.com/collaborative/tools/index.php/Conditional_Branch_Logger

it parses the executable for conditional branches (je , jne .... jecxz....loopd etc) sets logging breakpoints on them and logs the results to a txt which can be used to diff the diversion in paths between two different execution scenarios