OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Sunday, January 16 2011 09:08.46 CST Modified: Sunday, January 16 2011 09:11.41 CST

Printer Friendly ...

Generic tracer 0.5 beta

Author: modest

# Views: 6385

Generic Tracer 0.5 beta is published for testing.

Among fixes and one small feature (see changelog.txt file), major feature I added is TRACE.

TRACE: trace each instruction in function and collect all interesting values from registers and memory. After execution, all that information is saved to process.exe.idc, process.exe.txt, process.exe_clear.idc files. .idc-files are IDA scripts, .txt file is grepable by grep, awk and sed.

For example, let's take add_member function from Using Uninitialized Memory for Fun and Profit article:



int dense[256];

int dense_next=0;

int sparse[256];



void add_member(int i)

{

	dense[dense_next]=i;

	sparse[ i ]=dense_next;

	dense_next++;



};



int main ()

{

	add_member(123);

	add_member(5);

	add_member(71);

	add_member(99);

}

Let's compile it and run tracing on add_member function (determine function address in IDA before):

gt -l:trace_test4.exe bpf=0x00401000,trace

We'll get trace_test4.exe.txt file:



0x401000, e=       4

0x401001, e=       4

0x401003, e=       4, [0x403818]=0..3

0x401008, e=       4, [EBP+8]=5, 0x47('G'), 0x63('c'), 0x7b('{')

0x40100b, e=       4, ECX=5, 0x47('G'), 0x63('c'), 0x7b('{')

0x401012, e=       4, [EBP+8]=5, 0x47('G'), 0x63('c'), 0x7b('{')

0x401015, e=       4, [0x403818]=0..3

0x40101a, e=       4, EAX=0..3

0x401021, e=       4, [0x403818]=0..3

0x401027, e=       4, ECX=0..3

0x40102a, e=       4, ECX=1..4

0x401030, e=       4

0x401031, e=       4, EAX=0..3

e field in how many times was executed this instruction.

Let's execute trace_test4.exe.idc script in IDA and we'll see:

Now it is much simpler to understand how this function work during execution.

Executed instructions are highlighed by blue color. Not-executed instructions are leaved white.

If you need to clear all comments and highlight, execute trace_test4.exe_clear.idc script.

All collected information in IDA-script may be reduced to shorten form like EAX=[ 64 unique items. min=0xbca6eb7, max=0xffffffed ] (because IDA has comment size limitation). On contrary, everything is saved to text file without shortening, that is why resulting text file may be sometimes pretty big.

One problem of TRACE feature that it is slow, however, functions from system DLLs are skipped (system DLL is that DLL residing in %SystemRoot%) Another problem is that things like exceptions, setjmp/longjmp and other unexpected codeflow alterations are not correctly handled so far.

One more problem is that this feature is only available in x86 (because only x86-disassembler currently present in gt project)

More examples

Download gt executables, source code and manuals.

Blog Comments

mugg	Posted: Wednesday, January 26 2011 13:06.27 CST
Slow but the buffer dumps are nice. Tx for sharing. :)

GynvaelColdwind

Posted: Friday, January 28 2011 06:26.39 CST

Hey,

Great tool, very useful! :)

I have a feature request: if you could add an option where the values logged during the trace, are logged not before an instruction is executed (it's done this way now), but after it's executed?
E.g. if EAX=5, and you have INC EAX, the noted down value would be "5", since at break time (i.e. before execution) EAX is still "5".
I guess the value after the execution of the command might also be interesting, being in this case "6" :)

Cheers,

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit