Questions tagged [tracing]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
79 views

Is there a way to trace the differences of a software in x64dbg?

Why does Immunity Debugger unable to start my application? I want to compare the differences of a software: Immunity Debugger can trace all assembly instruction with the Add entries of all procedures ...
0
votes
1answer
61 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
3
votes
1answer
162 views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
0
votes
0answers
26 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
0
votes
1answer
202 views

IDA PRO Tracing stopps

I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
1
vote
0answers
49 views

Getting a full trace (every line) from ollydbg

When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see: Address hexDumb Command comments EAX ECX etc... 0042AD43 ...
0
votes
0answers
22 views

How to retrace Database Changes from a Software

i need to retrace database changes by an specific application. The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the ...
0
votes
0answers
86 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
1answer
151 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
1
vote
0answers
382 views

Tracing calls, rets and instructions with Intel Pin

I am writing a Pin tool with the following functionality: It has to record instructions with arguments. (works well) It has to record memory access operations associated with instructions. (works ...
0
votes
0answers
96 views

How to find first/next instruction in IDA trace via IDC

Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns ...
1
vote
0answers
99 views

x64dbg flow-indent style trace logs

I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
0
votes
1answer
244 views

Finding source of memory modification

I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
2
votes
1answer
128 views

There is any way to see the subroutine local variables values and who actually access them?

I know that it exists gdb, but i'm talking about windows, i would like know if there is any way to see who access to current stackframe of a specified variable on an X subroutine... i've tried using ...
0
votes
2answers
73 views

Tracing the last written value of a memory location without slowdown

I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and ...
2
votes
0answers
126 views

Instruction and memory tracer for executing program on windows

Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?
1
vote
0answers
124 views

Tracing what references a buffer in memory using Olly?

im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded ...
4
votes
1answer
2k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
1
vote
1answer
107 views

Isolating encrypt/decrypt instructions in an execution trace

If you have an execution trace of a program, and know it uses say AES for encryption. Can you isolate the instructions for encryption with that knowledge alone?
4
votes
1answer
1k views

Decompile binary executable into c / asm code by emulation, is it possible?

I am thinking on a decompilation method which uses the runtime behavior of the binary executable to extract usable compilation data. Analysing the runtime behavior (i.e. trapping after every cpu ...
6
votes
1answer
1k views

Reconstruct control-flow graph from x86 instruction trace

Can anyone suggest a free and preferably open source software tool that can reconstruct / build / generate a control-flow graph from a set of x86 execution traces of the same program? I found an ...