Tenet cannot follow the trace if the traced imagebase does not match the database

[NarutoGit]

Hello, thanks for the amazing work😊

I use pintenet to generate trace.log for calc.exe, but the trace.log looks like can't work. I did the following:

ps: windows 10 + IDA 7.5 + pin 3.18 1、download pin and pintenet.dll/pintenet64.dll; 2、in a CMD execute: pin\pin.exe -t pintenet.dll -w calc.exe -o "calc" -- "C:\Users\ml\Desktop\software\pin\calc.exe" After successful execution, nothing is displayed on the CMD 3、a file named calc.0.log generated,the size of it is 988k 4、load the calc.0.log in IDA, The interface looks like this：

when I scroll while hovering over the timeline on the right side of the disassembler， The code doesn't move forward or backward with it.

I did the same thing for BoomBox.exe, and it's trace file is available. so I thought maybe there was something wrong with the trace files for calc.exe.

[gaasedelen]

First, the problem here is most likely that the imagebase of the calc.exe that you traced does not match the calc.exe that you have loaded in IDA. You either need to rebase the executable in IDA to match that of your trace, and / or disable ASLR on the target binary so all traces will yield the same imagebase going forward.

Second, it is pretty easy to end up off in 'limbo' like you picture above when exploring an unfiltered trace. What is happening here is that Tenet is trying to navigate IDA to an address that is not actually loaded in the database. This is what happens when you try to 'step' into a function call to kernel32.exe, for example. Since that code / library is not mapped into the database, Tenet can't really 'navigate' to a suitable location.

There's definitely ways I can improve both of these behaviors by default, but they did not make it into the initial release. The project will need some time to mature before some of the rough edges like this can be smoothed out.

[NarutoGit]

First, the problem here is most likely that the imagebase of the calc.exe that you traced does not match the calc.exe that you have loaded in IDA. You either need to rebase the executable in IDA to match that of your trace, and / or disable ASLR on the target binary so all traces will yield the same imagebase going forward.

Second, it is pretty easy to end up off in 'limbo' like you picture above when exploring an unfiltered trace. What is happening here is that Tenet is trying to navigate IDA to an address that is not actually loaded in the database. This is what happens when you try to 'step' into a function call to kernel32.exe, for example. Since that code / library is not mapped into the database, Tenet can't really 'navigate' to a suitable location.

There's definitely ways I can improve both of these behaviors by default, but they did not make it into the initial release. The project will need some time to mature before some of the rough edges like this can be smoothed out.

Thanks very much for your prompt reply After I rebase the executable in IDA to match the trace , it works. And I also test another .exe，it also works too. That's great. That's really helpful for static analysis. Thank you very much.😁

[maskelihileci]

When loading your project, enabling the manual load option and entering the base address manually can synchronize the project with the log file.

[gaasedelen]

This should mostly be resolved now by the following:

4902141df6bcffecdb5392c3aaf4d0d67cf98671 / 3511e9d745835b3f40d755633b733cb26d2a6aeb / 2155f0f47083eaf168af786e9367bde163989716

It's not perfect, but should at least be better than what Tenet currently does.

I'm hoping to finish up cleaning up the development branch and merge to master as v0.2 in the next day or two.