Skip to content

Pykd script to perform simple code tracing and so inspecting control flow executed (CFE).

License

Notifications You must be signed in to change notification settings

tin-z/windbg-code-tracing

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

3 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

windbg-code-tracing

Pykd script to trace the control flow executed (CFE) from source to sink point.

Notes:

  • external calls are not supported, for now

  • there can be more than one path from source to sink point, but only one source point and sink point, for now

  • For generating the path from source to sink point alleycat idc script can be used.


usage:

.load pykd.pyd

!py cfe_trace.py --help

usage: cfe_trace.py [-h] --source SOURCE --sink SINK --binary_name BINARY_NAME
                    --old_baddr OLD_BADDR --chains CHAINS [--sink_is_bb]
                    [--debug] [--stop] [--dec]

Trace control flow executed from source to sink point

optional arguments:
  -h, --help            show this help message and exit
  --source SOURCE       Source point address
  --sink SINK           Sink point address
  --binary_name BINARY_NAME
                        Binary file name
  --old_baddr OLD_BADDR
                        Base address used on the variable 'chains' which does
                        represent addresses to trace
  --chains CHAINS       List of addresses (path) to trace
  --sink_is_bb          Sink point is a basic block (BB) and not a function
                        block (FB)
  --debug               increase output verbosity (default: False)
  --stop                Stop after reachng sink point (default: True)
  --dec                 Do not decrement counters after leaving a FB, this can
                        put less pressure on control-flow path restrictions
                        (default: True)
  • example: trace CFE from 0x66601AA0 to 0x66601130
!py cfe_trace.py --debug --source 0x66601AA0 --sink 0x66601130 --binary_name "egghunter_extra_mile.exe" --old_baddr 0x66600000 --chains "[ [0x66601AA0, 0x66601690, 0x66601130]]"

wdbg.gif

About

Pykd script to perform simple code tracing and so inspecting control flow executed (CFE).

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages