dbg_trace

summary: react to trace notifications

description:

This script demonstrates using the low-level tracing hook (ida_dbg.DBG_Hooks.dbg_trace). It can be run like so:

ida.exe -B -Sdbg_trace.py -Ltrace.log file.exe

level: advanced

Attributes

under_test

Classes

TraceHook

Functions

do_trace([then_quit_ida])

Module Contents

dbg_trace.under_test

class dbg_trace.TraceHook

Bases: ida_dbg.DBG_Hooks

traces = 0

epReached = False

dbg_trace(tid, ea)

A step occurred (one instruction was executed). This event notification is only generated if step tracing is enabled.

Parameters:

• tid – (thid_t) thread ID

• ip – (::ea_t) current instruction pointer. usually points after the executed instruction

Returns:

1: do not log this trace event

Returns:

0: log it

dbg_run_to(pid, tid=0, ea=0)

dbg_process_exit(pid, tid, ea, code)

dbg_trace.do_trace(then_quit_ida=True)