Topic created on: September 20, 2012 00:42 CDT by rwartell .
So I've been writing plugins and scripts for IDA Pro for a while now, but the majority of them have been for static analysis. Switching gears now to getting information from a trace and I need a little help.
Here's the plugin that I need. I don't think it can be accomplished with an idapython script but feel free to correct me.
First functionality, I need to print out the trace of every instruction address executed inside the binary (I do not need information from imported libraries, etc.). I know I can print the trace information after the execution, but I need the full trace, which could be 1 billion instructions, and I can't set the trace that large I'm guessing. Is there a way to print trace information as it is being populated?
Secondary functionality: Is there a way to determine when an instruction has loaded an address from the .text section. For example, when the following instruction executes:
mov eax, [0x401024 + ecx*4]
ecx = 3 at runtime
I want a plugin that would print 0x401030 to a file, since data was loaded from that address. Does anyone know a way to do this simply? Or would I have to interpret each executed instruction and determine myself what data it loads or doesn't load?
Thanks in advance for the help.