7

I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists.

I'd like to find a specific part of code in the binary. Searching for strings, etc is not helping much. So, I had the thought, what if I could run the program twice, once I would have the program do the thing that corresponds to the code I'm looking for, and the second time I would not perform that action.

If I had a trace of say basic blocks executed during both runs, I might be able to do a "diff" and use that to narrow down where the functionality lies in the binary.

Does such a tool already exist, or is there a better way to narrow down the part of code executing.

9

This approach is commonly called "differential debugging". I know of the following tools that can help with it:

It's not too hard to implement something quick in any debugger that allows scriptable breakpoints:

  1. Put breakpoints on every function/basic block/instruction (depending on your preference and what the debugger allows). In the breakpoint handler, record the hit then disable/remove the breakpoint.
  2. Run the program and do everything you can except for the part you're interested in.
  3. Exit the program.
  4. Change the breakpoint handler to stop execution, or record it in a separate log file.
  5. Run the program again and exercise the part you need. One or more of the remaining breakpoints should hit. They will point you to the interesting code.
| improve this answer | |
3

you may check out an ollydbg plugin conditional branch logger

http://www.woodmann.com/collaborative/tools/index.php/Conditional_Branch_Logger

it parses the executable for conditional branches (je , jne .... jecxz....loopd etc) sets logging breakpoints on them and logs the results to a txt which can be used to diff the diversion in paths between two different execution scenarios

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.