1

I am trying to use vmware for debugging. What I am trying to achieve is once an executable has been opened inside a vm which runs on Windows, I would like to extract the runtime traces for that executable, the assembly instructions. Could somebody please help me with this, if it is possible?

Also, if anybody knows any alternatives for extracting the runtime instructions, I would like to hear them. I tried to use PIN from Intel, PANDA, and other debuggers such as OllyDBG and Immunity Debugger, but unfortunately I did not get them to work.

Thank you!

Improve this question
1
  • 1
    Cuckoo sandbox might give you part of what you're looking for (runtime executable behavior), but for the assembly instructions you'll need to disassemble the binary. Unless you mean that the binary has encrypted blobs that are decrypted at runtime and you want to dump those?
    – Mega Tonnage
    Jul 13, 2022 at 23:26

1 Answer 1

Reset to default
1

There is a a difference between debugging and tracing, basically you can debug an executable by using tools such as Immunity Debugger, OllyDbg, WinDbg, x64dbg etc.

While debugging you can use breakpoints on specific Win32 API functions to print messages about the function calls and their arguments to build a very basic tracer.

Another approach would be to build a DLL that places hooks on specific API functions and would log the function call and the arguments passed and that would give you a basic trace output as well.

Also from your question it was not clear what were the problems that you had while try to debug using a debugger, why it didn't work for you, and what were the specific problems you had.

Hope I helped.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.