Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [tracing]

The tag has no usage guidance.

0
votes
0answers
6 views

How to retrace Database Changes from a Software

i need to retrace database changes by an specific application. The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the ...
0
votes
0answers
26 views

PTRACE_PEEKTEXT in a execute only permission binary giving EIO

I'm working on a binary with no read/write permissions and reading words with PTRACE_PEEKDATA/TEXT returns -1 EIO. code: #include <string.h> #include <stdio.h> #include <stdlib.h> #...
0
votes
0answers
26 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
1answer
40 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
1
vote
0answers
97 views

Tracing calls, rets and instructions with Intel Pin

I am writing a Pin tool with the following functionality: It has to record instructions with arguments. (works well) It has to record memory access operations associated with instructions. (works ...
0
votes
0answers
62 views

How to find first/next instruction in IDA trace via IDC

Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns ...
1
vote
0answers
52 views

x64dbg flow-indent style trace logs

I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
0
votes
1answer
168 views

Finding source of memory modification

I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
3
votes
1answer
122 views

There is any way to see the subroutine local variables values and who actually access them?

I know that it exists gdb, but i'm talking about windows, i would like know if there is any way to see who access to current stackframe of a specified variable on an X subroutine... i've tried using ...
0
votes
2answers
66 views

Tracing the last written value of a memory location without slowdown

I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and ...
2
votes
0answers
90 views

Instruction and memory tracer for executing program on windows

Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?
1
vote
0answers
110 views

Tracing what references a buffer in memory using Olly?

im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded ...
3
votes
0answers
1k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
1
vote
1answer
105 views

Isolating encrypt/decrypt instructions in an execution trace

If you have an execution trace of a program, and know it uses say AES for encryption. Can you isolate the instructions for encryption with that knowledge alone?
4
votes
1answer
925 views

Decompile binary executable into c / asm code by emulation, is it possible?

I am thinking on a decompilation method which uses the runtime behavior of the binary executable to extract usable compilation data. Analysing the runtime behavior (i.e. trapping after every cpu ...
6
votes
1answer
1k views

Reconstruct control-flow graph from x86 instruction trace

Can anyone suggest a free and preferably open source software tool that can reconstruct / build / generate a control-flow graph from a set of x86 execution traces of the same program? I found an ...