IDA Help: Tracing options

 Action    name: SetupTracing
 

This dialog box allows you to specify different settings related to the tracing features.

Trace buffer size

  This setting indicates how many tracing events can fit in the trace buffer.
  If the debugger must insert a new event and the buffer is full,
  the oldest tracing event will be removed.
  However, if you specify a size of 0, the buffer size isn't limited.
  Notice that, for example, in the case of an instructions trace,
  all executed instructions could be logged, which would quickly fill
  up the memory!

Trace file

  If a filename is specified, all future traced events will be appended to it.

Trace directory

  The directory were trace files for the current database will be saved. If not
  specified, the IDB directory will be used.

Stop condition

  This IDC expression will be evaluated before the execution
  of each instruction. If the expression returns true, the debugger will
  suspend the execution. Please note that you can use register names in
  the condition.

Tracing

  - Trace over debugger segments

      If selected, the debugger will not go step by step in debugger segments
      (segments not available in the database).

  - Trace over library functions

      If selected, the debugger will not go step by step in library functions.

  Enabling these options will speed up the execution, as many instructions
  (from debugger segments and/or library functions) will not be traced.
  Disabling these options can quickly fill the Tracing window, as all
  instructions in DLLs and system functions will be executed step by step.
  Notice that both options influence the way instruction and function tracings
  will work.
  Internally, the debugger proceeds like this:
  - memorize the return address associated with the last executed call
    instruction in database segments (the previously saved one is overwriten).
  - setup a temporary breakpoint on this address once the IP is in a debugger
    segment or library function, disable step by step, and run the thread.
  - reenable step by step once this temporary breakpoint is reached.

  - Do not log already logged IP

      If selected, already executed instructions will not be logged if
      they are executed again.

  - Skip loops

      If selected, tracing will be temporarily disabled for some loops
      constructs.

Highlight

  - Highlight instructions in IDA views

    If selected, recorded instructions will be displayed in IDA views (disassembly
    views) with a different background color.

  - Main color

    The main background color for traced instructions.

  - Diff color

    The background color for the instructions recorded and being diffed against the
    currently loaded trace.

Instruction tracing

  - Log if same IP

    If selected, the debugger will also log all register modifications occuring
    during the execution of prefixed instructions like REP MOVSB, ...

Function tracing

  - Log return instructions

      If selected, the debugger will also log function returns.
      If disabled, only function calls are logged.

Basic block tracing

  - Log basic block instructions

      If selected, all instructions from the current basic block will be logged
      and displayed in the 'Tracing' window, instead of only the last instruction of
      the basic block.

 See also Tracing window
          Trace management
          Clear trace
          Instruction tracing
          Function tracing
          Basic block tracing
          Add write trace
          Add read/write trace
          Add execution trace
          Tracing submenu.

Index | Previous topic | Next topic