search

gaasedelen / tenet

A Trace Explorer for Reverse Engineers
MIT License
1.33k stars 130 forks source link

Support address-only tracing formats #1

Open guye1296 opened 3 years ago

guye1296 commented 3 years ago

First of all, awesome project!

It would be very helpful if you can add support for additional, more basic, tracing formats. In many cases a collection of execution addresses is available but not the registers / memory.

If would be awesome if you could add support for a module + offset format like lighthouse (or additional formats as described here).

gaasedelen commented 3 years ago

Sure, this sounds reasonable.

Since Tenet traces are 'lossy' as is, you can just output an trace containing eip=... or rip=... and it should just work without any putting any other registers/mem in the trace. Try it!

I can certainly add 'mod+off' support, and it makes sense when dealing with something as simple as an instruction trace. I have to be at least a little bit more careful with how I translate or represent 'mod+off' in the views for a more standard trace though. I think that's probably one of the main reasons I didn't try to get it into the initial release.

ViRb3 commented 3 years ago

Just as a note, x64dbg can be easily used to produce an address-only trace file and it works great:

image

Make sure that the base address (i.e. +0x180000000) matches that of IDA. Of course, it is just as easy to add more register information if necessary.