Questions tagged [tracing]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
6
votes
1answer
1k views

Reconstruct control-flow graph from x86 instruction trace

Can anyone suggest a free and preferably open source software tool that can reconstruct / build / generate a control-flow graph from a set of x86 execution traces of the same program? I found an ...
5
votes
1answer
424 views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
4
votes
1answer
1k views

Decompile binary executable into c / asm code by emulation, is it possible?

I am thinking on a decompilation method which uses the runtime behavior of the binary executable to extract usable compilation data. Analysing the runtime behavior (i.e. trapping after every cpu ...
4
votes
1answer
3k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
2
votes
1answer
138 views

There is any way to see the subroutine local variables values and who actually access them?

I know that it exists gdb, but i'm talking about windows, i would like know if there is any way to see who access to current stackframe of a specified variable on an X subroutine... i've tried using ...
2
votes
0answers
136 views

Instruction and memory tracer for executing program on windows

Anyone know any popular x86 tracer which can capture the instruction and memory change by a running program on windows?
1
vote
1answer
109 views

Isolating encrypt/decrypt instructions in an execution trace

If you have an execution trace of a program, and know it uses say AES for encryption. Can you isolate the instructions for encryption with that knowledge alone?
1
vote
1answer
43 views

How to track/debug/manipulate Windows processes in a VM?

I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization. Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
1
vote
1answer
373 views

Compare two traces from ollydbg

I have a program that executes differently depending on what files are present on my computer. I'd like to run a trace in two scenarios (with the default file and with an edited version of the file) ...
1
vote
0answers
37 views

Memory modified at jump far

Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused ... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 ...
1
vote
0answers
156 views

Is there a way to trace the differences of a software in x64dbg?

Why does Immunity Debugger unable to start my application? I want to compare the differences of a software: Immunity Debugger can trace all assembly instruction with the Add entries of all procedures ...
1
vote
0answers
92 views

Getting a full trace (every line) from ollydbg

When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see: Address hexDumb Command comments EAX ECX etc... 0042AD43 ...
1
vote
0answers
1k views

Tracing calls, rets and instructions with Intel Pin

I am writing a Pin tool with the following functionality: It has to record instructions with arguments. (works well) It has to record memory access operations associated with instructions. (works ...
1
vote
0answers
133 views

x64dbg flow-indent style trace logs

I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
1
vote
0answers
132 views

Tracing what references a buffer in memory using Olly?

im wondering if anyone knows how i would go about finding references to a buffer in memory, the scenario is that i have found the buffer that the program receives from a server, the buffer is encoded ...
0
votes
1answer
51 views

Trace back regularly used .data variable in IDA

I am reversing Cryptex.exe 1.0 from Eldad. There is unknown-data buffer address stored in edx which gets used as parameter for CryptHashData, which will hash 20 Bytes from there. Now I want to find ...
0
votes
2answers
181 views

How to compare two different executions of the same file?

When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
0
votes
1answer
518 views

IDA PRO Tracing stopps

I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
0
votes
1answer
316 views

Finding source of memory modification

I'm trying to disable the modification of a byte array in a C++ application. I know where the original array is created and where to find the modified one, but I'm having trouble finding the function ...
0
votes
0answers
25 views

IDA - tracing strings

Is it possible for IDA to save string/memory content pointed by one of the registers during run-time?
0
votes
1answer
44 views

IDA - How can I get a list of differing instructions from 2 recorded instruction traces?

I have 2 recorded IDA pro instruction traces, how can I get a list of differing instructions? I am able to load the diffs as overlays but there are a large amount of instructions recorded that are ...
0
votes
1answer
91 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
0answers
22 views

How to retrace Database Changes from a Software

i need to retrace database changes by an specific application. The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the ...
0
votes
0answers
125 views

How to find first/next instruction in IDA trace via IDC

Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns ...
0
votes
2answers
79 views

Tracing the last written value of a memory location without slowdown

I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and ...