📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  intelli-trace for x86emu

Topic created on: October 31, 2007 17:29 CDT by bodzcount .

I have a really nice idea i guess *g*

how about an intelligent trace feature for x86emu?
The problem with ordinary tracing is, that the trace log becomes quickly very large so that you can hardly handle it anymore. A solution for this would be an intelligent tracer, that checks every jump if it goes to an address that has already been traced. If so, the tracelog creates a comment at the jump that tells to which line in tracelog the jump goes. than all the new register contents are just added in a new column to the old rows.
Maybe some special care has to be taken for self-modifying code. One could check on every instruction, if code has been modified, if so, than add new instruction in a seperate column or just branch to new trace-lines...

My goal is, to create addressfree code from the trace, that can be assembled again :)

Is it a nice idea or a nice idea?

  hochi   November 1, 2007 11:16.29 CDT
Is this possible with Dtrace?

> bodzcount: I have a really nice idea i guess *g*
>
> how about an intelligent trace feature for x86emu?
> The problem with ordinary tracing is, that the trace log becomes quickly very large so that you can hardly handle it anymore. A solution for this would be an intelligent tracer, that checks every jump if it goes to an address that has already been traced. If so, the tracelog creates a comment at the jump that tells to which line in tracelog the jump goes. than all the new register contents are just added in a new column to the old rows.
> Maybe some special care has to be taken for self-modifying code. One could check on every instruction, if code has been modified, if so, than add new instruction in a seperate column or just branch to new trace-lines...
>
> My goal is, to create addressfree code from the trace, that can be assembled again :)
>
> Is it a nice idea or a nice idea?

  trufae   November 13, 2007 05:04.05 CST
I got the same idea some time ago and it's planed to be done in radare and maybe with some SQL magic we can use all this info for painting graphs and colorizing sourcecode when debugging or analyzing.

Something like binnavi already does.

About the trace of automodifcable code can be handled by
storing the N bytes of the opcode on each step starting at the program counter... And well..this is what the IDA debugger does in the trace window when debugging, so it stores the opcode and the register changes.

Uhm I find it quite complicated and probably pointless to assemble a self-modifying application from its trace.. What I will find more interesting is the possibility to reassemble funrolled parts of a binary by analyzing the trace avoiding unnecessary jumps and serializing stuff.

This can be interesting for binary optimization and to avoid some of the trash noise of tones of jumps or traps (nanomites).

A decent trace log viewer would be the key too.. Overlapping all traces by it's address you can easily detect loops, bottlenecks.. by colorizing each address by the number of times it has been reached for example..

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit