5

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?

I've used trace over option, but basically it just traces all the insturctions but doesn't "step in" into a call statement.

Here I found a way to do this using windbg(notice the treeview of functions and return values), but is there any way I can do same using x64dbg? or maybe trace all the api calls of a module. thanks.

Ojs
  • 203
  • 3
  • 10

2 Answers2

7

It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which will log the module name, address and the instruction after a space.

As far as I am concerned, there is unfortunately no support for string comparison in x64dbg, so you cannot write something like {modname@rip}==some_module_name in Log condition field. However, you may use the module entry point as a module identifier, like here: x64dbg_log_condition

After clicking OK button, only instructions in the specified module will appear in the log panel and you should see something like this:

x64dbg_log

The only problem that is still to solve is to find the module entry address. I've done it by logging every module name and entry point until I find the relevant one. If I find any better way to do that, I will update my answer.

Community
  • 1
bart1e
  • 3,369
  • 2
  • 8
  • 24
0

This is the solution. Same dialog as before but these values, replace prog1 with the name of your executable:

break condition: 0
log text: {p:cip} {i:cip}
log condition: dis.isbranch(cip) && prog1.EntryPoint == mod.entry(dis.branchdest(cip))
command text: 
command condition:
maximum trace count: 232323

This will log all the conditionals in the userspace program only, and if you need more trace count just raise the value. It will take awhile but you end up with a file of je/jne where you can compare and see what was different between different runs of your program. Priceless and extremely poorly documented.

test
  • 21
  • 1