I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower than them =(


I searched for various articles on tracers on anything other than event debug loop, but I didn't find them. Maybe someone can tell me in which direction I should move in order to study this (the topic of creating fast tracers) topic?

My attempts to solve this problem

as I understand it, tracing (step in) works by events, i.e. the TF flag is raised, an interrupt is generated and the event is intercepted, and I go like this throughout the time. I tried to create a tracer on 0xEBFE(infinite loop), but I crashed, as this is a rather inconvenient and not particularly fast approach to tracing. Can someone tell me at least in which direction I should move?


I will ask you not to offer options for using something ready-made, since I want to STUDY it

  • Pin tools etc dont depend on trap flag and debug event loops. They hook and divert flow to and back to thier handlers. For ex they install an unconditional jump at the start of a particular func/addr to thier handler save next legitimatel addrees to return to , do what needs to be done and return back to the original func/addr -> next legitimate
    – blabb
    Commented Jul 30, 2023 at 7:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.