Generic Tracer 0.5 beta is published for testing.
Among fixes and one small feature (see changelog.txt file), major feature I added is TRACE.
TRACE: trace each instruction in function and collect all interesting values from registers and memory. After execution, all that information is saved to process.exe.idc, process.exe.txt, process.exe_clear.idc files. .idc-files are IDA scripts, .txt file is grepable by grep, awk and sed.
For example, let's take add_member function from Using Uninitialized Memory for Fun and Profit article:
int dense[256];
int dense_next=0;
int sparse[256];
void add_member(int i)
{
dense[dense_next]=i;
sparse[i]=dense_next;
dense_next++;
};
int main ()
{
add_member(123);
add_member(5);
add_member(71);
add_member(99);
}
Let's compile it and run tracing on add_member function (determine function address in IDA before):
gt -l:trace_test4.exe bpf=0x00401000,trace
We'll get trace_test4.exe.txt file:
0x401000, e= 4
0x401001, e= 4
0x401003, e= 4, [0x403818]=0..3
0x401008, e= 4, [EBP+8]=5, 0x47('G'), 0x63('c'), 0x7b('{')
0x40100b, e= 4, ECX=5, 0x47('G'), 0x63('c'), 0x7b('{')
0x401012, e= 4, [EBP+8]=5, 0x47('G'), 0x63('c'), 0x7b('{')
0x401015, e= 4, [0x403818]=0..3
0x40101a, e= 4, EAX=0..3
0x401021, e= 4, [0x403818]=0..3
0x401027, e= 4, ECX=0..3
0x40102a, e= 4, ECX=1..4
0x401030, e= 4
0x401031, e= 4, EAX=0..3
e field in how many times was executed this instruction.
Let's execute trace_test4.exe.idc script in IDA and we'll see:
Now it is much simpler to understand how this function work during execution.
Executed instructions are highlighed by blue color. Not-executed instructions are leaved white.
If you need to clear all comments and highlight, execute trace_test4.exe_clear.idc script.
All collected information in IDA-script may be reduced to shorten form like EAX=[ 64 unique items. min=0xbca6eb7, max=0xffffffed ] (because IDA has comment size limitation). On contrary, everything is saved to text file without shortening, that is why resulting text file may be sometimes pretty big.
One problem of TRACE feature that it is slow, however, functions from system DLLs are skipped (system DLL is that DLL residing in %SystemRoot%) Another problem is that things like exceptions, setjmp/longjmp and other unexpected codeflow alterations are not correctly handled so far.
One more problem is that this feature is only available in x86 (because only x86-disassembler currently present in gt project)
More examples: http://conus.info/gt/gt05beta/manual/gt.html#bpf_ex_trace
Download gt executables, source code and manuals: http://conus.info/gt/gt05beta/gt05beta.rar
→ [list of blog posts] Please drop me email about bug(s) and/or suggestion(s): my emails.