Generic tracer 0.5 beta
Dennis Yurichev (modest) <dennisconusinfo> Sunday, January 16 2011 09:08.46 CST


Generic Tracer 0.5 beta is published for testing.

Among fixes and one small feature (see changelog.txt file), major feature I added is TRACE.

TRACE: trace each instruction in function and collect all interesting values from registers and memory. After execution, all that information is saved to process.exe.idc, process.exe.txt, process.exe_clear.idc files. .idc-files are IDA scripts, .txt file is grepable by grep, awk and sed.

For example, let's take add_member function from Using Uninitialized Memory for Fun and Profit article:


int dense[256];
int dense_next=0;
int sparse[256];

void add_member(int i)
{
dense[dense_next]=i;
sparse[ i ]=dense_next;
dense_next++;

};

int main ()
{
add_member(123);
add_member(5);
add_member(71);
add_member(99);
}


Let's compile it and run tracing on add_member function (determine function address in IDA before):

gt -l:trace_test4.exe bpf=0x00401000,trace

We'll get trace_test4.exe.txt file:


0x401000, e=       4
0x401001, e=       4
0x401003, e=       4, [0x403818]=0..3
0x401008, e=       4, [EBP+8]=5, 0x47('G'), 0x63('c'), 0x7b('{')
0x40100b, e=       4, ECX=5, 0x47('G'), 0x63('c'), 0x7b('{')
0x401012, e=       4, [EBP+8]=5, 0x47('G'), 0x63('c'), 0x7b('{')
0x401015, e=       4, [0x403818]=0..3
0x40101a, e=       4, EAX=0..3
0x401021, e=       4, [0x403818]=0..3
0x401027, e=       4, ECX=0..3
0x40102a, e=       4, ECX=1..4
0x401030, e=       4
0x401031, e=       4, EAX=0..3


e field in how many times was executed this instruction.

Let's execute trace_test4.exe.idc script in IDA and we'll see:



Now it is much simpler to understand how this function work during execution.

Executed instructions are highlighed by blue color. Not-executed instructions are leaved white.

If you need to clear all comments and highlight, execute trace_test4.exe_clear.idc script.

All collected information in IDA-script may be reduced to shorten form like EAX=[ 64 unique items. min=0xbca6eb7, max=0xffffffed ] (because IDA has comment size limitation). On contrary, everything is saved to text file without shortening, that is why resulting text file may be sometimes pretty big.

One problem of TRACE feature that it is slow, however, functions from system DLLs are skipped (system DLL is that DLL residing in %SystemRoot%) Another problem is that things like exceptions, setjmp/longjmp and other unexpected codeflow alterations are not correctly handled so far.

One more problem is that this feature is only available in x86 (because only x86-disassembler currently present in gt project)

More examples

Download gt executables, source code and manuals.


Comments
mugg Posted: Wednesday, January 26 2011 13:06.27 CST
Slow but the buffer dumps are nice. Tx for sharing.  :)

GynvaelColdwind Posted: Friday, January 28 2011 06:26.39 CST
Hey,

Great tool, very useful! :)

I have a feature request: if you could add an option where the values logged during the trace, are logged not before an instruction is executed (it's done this way now), but after it's executed?
E.g. if EAX=5, and you have INC EAX, the noted down value would be "5", since at break time (i.e. before execution) EAX is still "5".
I guess the value after the execution of the command might also be interesting, being in this case "6" :)

Cheers,