IDA SDK
Classes | Typedefs | Enumerations | Functions
Tracing events

Detailed Description

Classes

struct  tev_info_t
 Common information for all trace events. More...
 
struct  memreg_info_t
 Required typedef for get_insn_tev_reg_mem() More...
 
struct  tev_reg_value_t
 Structure used for dbg_add_many_tevs() More...
 
struct  tev_info_reg_t
 Structure used for dbg_add_many_tevs() More...
 

Typedefs

typedef qvector< debug_event_tdbgevt_vec_t
 vector of debug events
 
typedef qvector< tev_info_ttevinfo_vec_t
 vector of trace event info objects
 
typedef qvector< memreg_info_tmemreg_infos_t
 
typedef qvector< tev_reg_value_ttev_reg_values_t
 vector of trace event reg values
 
typedef qvector< tev_info_reg_ttevinforeg_vec_t
 vector of trace elements
 

Enumerations

enum  tev_type_t {
  tev_none = 0, tev_insn, tev_call, tev_ret,
  tev_bpt, tev_mem, tev_event, tev_max
}
 Trace event types. More...
 
enum  save_reg_values_t { SAVE_ALL_VALUES = 0, SAVE_DIFF, SAVE_NONE }
 Se dbg_add_insn_tev()
 

Functions

int idaapi get_tev_qty (void)
 Get number of trace events available in trace buffer. More...
 
bool idaapi get_tev_info (int n, tev_info_t *tev_info)
 Get main information about a trace event. More...
 
bool idaapi get_insn_tev_reg_val (int n, const char *regname, regval_t *regval)
 Read a register value from an instruction trace event. More...
 
bool idaapi get_insn_tev_reg_mem (int n, memreg_infos_t *memmap)
 Read the memory pointed by register values from an instruction trace event. More...
 
bool get_insn_tev_reg_val (int n, const char *regname, uint64 *ival)
 
bool idaapi get_insn_tev_reg_result (int n, const char *regname, regval_t *regval)
 Read the resulting register value from an instruction trace event. More...
 
bool get_insn_tev_reg_result (int n, const char *regname, uint64 *ival)
 
ea_t idaapi get_call_tev_callee (int n)
 Get the called function from a function call trace event. More...
 
ea_t idaapi get_ret_tev_return (int n)
 Get the return address from a function return trace event. More...
 
ea_t idaapi get_bpt_tev_ea (int n)
 Get the address associated to a read, read/write or execution trace event. More...
 
bool idaapi get_tev_memory_info (int n, meminfo_vec_t *mi)
 Get the memory layout, if any, for the specified tev object. More...
 
bool idaapi get_tev_event (int n, debug_event_t *d)
 Get the corresponding debug event, if any, for the specified tev object. More...
 
ea_t idaapi get_trace_base_address (void)
 Get the base address of the current trace. More...
 
void idaapi set_trace_base_address (ea_t ea)
 Set the base address of the current trace. More...
 
void idaapi dbg_add_thread (thid_t tid)
 Add a thread to the current trace. More...
 
void idaapi dbg_del_thread (thid_t tid)
 Delete a thread from the current trace. More...
 
void idaapi dbg_add_tev (tev_type_t type, thid_t tid, ea_t address)
 Add a new trace element to the current trace. More...
 
bool idaapi dbg_add_many_tevs (tevinforeg_vec_t *new_tevs)
 Add many new trace elements to the current trace. More...
 
bool idaapi dbg_add_insn_tev (thid_t tid, ea_t ea, save_reg_values_t save=SAVE_DIFF)
 Add a new instruction trace element to the current trace. More...
 
bool idaapi dbg_add_bpt_tev (thid_t tid, ea_t ea, ea_t bp)
 Add a new breakpoint trace element to the current trace. More...
 
void idaapi dbg_add_call_tev (thid_t tid, ea_t caller, ea_t callee)
 Add a new call trace element to the current trace. More...
 
void idaapi dbg_add_ret_tev (thid_t tid, ea_t ret_insn, ea_t return_to)
 Add a new return trace element to the current trace. More...
 
void idaapi dbg_add_debug_event (debug_event_t *event)
 Add a new debug event to the current trace. More...
 

Enumeration Type Documentation

enum tev_type_t

Trace event types.

Enumerator
tev_none 

no event

tev_insn 

an instruction trace

tev_call 

a function call trace

tev_ret 

a function return trace

tev_bpt 

write, read/write, execution trace

tev_mem 

memory layout changed

tev_event 

debug event occurred

tev_max 

first unused event type

Function Documentation

int idaapi get_tev_qty ( void  )
inline

Get number of trace events available in trace buffer.

TypeSynchronous function
Notificationnone (synchronous function)
bool idaapi get_tev_info ( int  n,
tev_info_t tev_info 
)
inline

Get main information about a trace event.

TypeSynchronous function
Notificationnone (synchronous function)
Parameters
nnumber of trace event, is in range 0..get_bpt_qty()-1. 0 represents the latest added trace event.
[out]tev_inforesult
Returns
success
bool idaapi get_insn_tev_reg_val ( int  n,
const char *  regname,
regval_t regval 
)
inline

Read a register value from an instruction trace event.

TypeSynchronous function
Notificationnone (synchronous function)
Parameters
nnumber of trace event, is in range 0..get_bpt_qty()-1. 0 represents the latest added trace event.
regnamename of desired register
[out]regvalresult
Returns
false if not an instruction event.
Note
This is the value of the register before the execution of the instruction.
bool idaapi get_insn_tev_reg_mem ( int  n,
memreg_infos_t memmap 
)
inline

Read the memory pointed by register values from an instruction trace event.

TypeSynchronous function
Notificationnone (synchronous function)
Parameters
nnumber of trace event, is in range 0..get_bpt_qty()-1. 0 represents the latest added trace event.
[out]memmapresult
Returns
false if not an instruction event or no memory is available
bool idaapi get_insn_tev_reg_result ( int  n,
const char *  regname,
regval_t regval 
)
inline

Read the resulting register value from an instruction trace event.

TypeSynchronous function
Notificationnone (synchronous function)
Parameters
nnumber of trace event, is in range 0..get_bpt_qty()-1. 0 represents the latest added trace event.
regnamename of desired register
[out]regvalresult
Returns
false if not an instruction trace event or register wasn't modified.
ea_t idaapi get_call_tev_callee ( int  n)
inline

Get the called function from a function call trace event.

TypeSynchronous function
Notificationnone (synchronous function)
Parameters
nnumber of trace event, is in range 0..get_bpt_qty()-1. 0 represents the latest added trace event.
Returns
BADADDR if not a function call event.
ea_t idaapi get_ret_tev_return ( int  n)
inline

Get the return address from a function return trace event.

TypeSynchronous function
Notificationnone (synchronous function)
Parameters
nnumber of trace event, is in range 0..get_bpt_qty()-1. 0 represents the latest added trace event.
Returns
BADADDR if not a function return event.
ea_t idaapi get_bpt_tev_ea ( int  n)
inline

Get the address associated to a read, read/write or execution trace event.

TypeSynchronous function
Notificationnone (synchronous function)
Parameters
nnumber of trace event, is in range 0..get_bpt_qty()-1. 0 represents the latest added trace event.
Returns
BADADDR if not a read, read/write or execution trace event.
Note
Usually, a breakpoint is associated with a read, read/write or execution trace event. However, the returned address could be any address in the range of this breakpoint. If the breakpoint was deleted after the trace event, the address no longer corresponds to a valid breakpoint.
bool idaapi get_tev_memory_info ( int  n,
meminfo_vec_t mi 
)
inline

Get the memory layout, if any, for the specified tev object.

TypeSynchronous function
Notificationnone (synchronous function)
Parameters
nnumber of trace event, is in range 0..get_bpt_qty()-1. 0 represents the latest added trace event.
[out]miresult
Returns
false if the tev_t object is not of type tev_mem, true otherwise, with the new memory layout in "mi".
bool idaapi get_tev_event ( int  n,
debug_event_t d 
)
inline

Get the corresponding debug event, if any, for the specified tev object.

TypeSynchronous function
Notificationnone (synchronous function)
Parameters
nnumber of trace event, is in range 0..get_bpt_qty()-1. 0 represents the latest added trace event.
[out]dresult
Returns
false if the tev_t object doesn't have any associated debug event, true otherwise, with the debug event in "d".
ea_t idaapi get_trace_base_address ( void  )
inline

Get the base address of the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
Returns
the base address of the currently loaded trace
void idaapi set_trace_base_address ( ea_t  ea)
inline

Set the base address of the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
void idaapi dbg_add_thread ( thid_t  tid)
inline

Add a thread to the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
void idaapi dbg_del_thread ( thid_t  tid)
inline

Delete a thread from the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
void idaapi dbg_add_tev ( tev_type_t  type,
thid_t  tid,
ea_t  address 
)
inline

Add a new trace element to the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
bool idaapi dbg_add_many_tevs ( tevinforeg_vec_t new_tevs)
inline

Add many new trace elements to the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
Returns
false if the operation failed for any tev_info_t object
bool idaapi dbg_add_insn_tev ( thid_t  tid,
ea_t  ea,
save_reg_values_t  save = SAVE_DIFF 
)
inline

Add a new instruction trace element to the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
Returns
false if the operation failed, true otherwise
bool idaapi dbg_add_bpt_tev ( thid_t  tid,
ea_t  ea,
ea_t  bp 
)
inline

Add a new breakpoint trace element to the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
Returns
false if the operation failed, true otherwise
void idaapi dbg_add_call_tev ( thid_t  tid,
ea_t  caller,
ea_t  callee 
)
inline

Add a new call trace element to the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
void idaapi dbg_add_ret_tev ( thid_t  tid,
ea_t  ret_insn,
ea_t  return_to 
)
inline

Add a new return trace element to the current trace.

TypeSynchronous function
Notificationnone (synchronous function)
void idaapi dbg_add_debug_event ( debug_event_t event)
inline

Add a new debug event to the current trace.

TypeSynchronous function
Notificationnone (synchronous function)