Classes
struct	tev_info_t
	Common information for all trace events. More...

struct	memreg_info_t
	Required typedef for get_insn_tev_reg_mem() More...

struct	tev_reg_value_t
	Structure used for dbg_add_many_tevs() More...

struct	tev_info_reg_t
	Structure used for dbg_add_many_tevs() More...

Typedefs
typedef qvector< debug_event_t >	dbgevt_vec_t
	vector of debug events

typedef qvector< tev_info_t >	tevinfo_vec_t
	vector of trace event info objects

typedef qvector< memreg_info_t >	memreg_infos_t

typedef qvector< tev_reg_value_t >	tev_reg_values_t
	vector of trace event reg values

typedef qvector< tev_info_reg_t >	tevinforeg_vec_t
	vector of trace elements

Enumerations
enum	tev_type_t { tev_none = 0 , tev_insn , tev_call , tev_ret , tev_bpt , tev_mem , tev_event , tev_max }
	Trace event types. More...

enum	save_reg_values_t { SAVE_ALL_VALUES = 0 , SAVE_DIFF , SAVE_NONE }
	Se dbg_add_insn_tev()

Functions
int idaapi	get_tev_qty (void)
	Get number of trace events available in trace buffer. More...

bool idaapi	get_tev_info (int n, tev_info_t *tev_info)
	Get main information about a trace event. More...

bool idaapi	get_insn_tev_reg_val (int n, const char regname, regval_t regval)
	Read a register value from an instruction trace event. More...

bool idaapi	get_insn_tev_reg_val (int n, const char regname, uint64 ival)

bool idaapi	get_insn_tev_reg_mem (int n, memreg_infos_t *memmap)
	Read the memory pointed by register values from an instruction trace event. More...

bool idaapi	get_insn_tev_reg_result (int n, const char regname, regval_t regval)
	Read the resulting register value from an instruction trace event. More...

bool idaapi	get_insn_tev_reg_result (int n, const char regname, uint64 ival)

ea_t idaapi	get_call_tev_callee (int n)
	Get the called function from a function call trace event. More...

ea_t idaapi	get_ret_tev_return (int n)
	Get the return address from a function return trace event. More...

ea_t idaapi	get_bpt_tev_ea (int n)
	Get the address associated to a read, read/write or execution trace event. More...

bool idaapi	get_tev_memory_info (int n, meminfo_vec_t *mi)
	Get the memory layout, if any, for the specified tev object. More...

bool idaapi	get_tev_event (int n, debug_event_t *d)
	Get the corresponding debug event, if any, for the specified tev object. More...

ea_t idaapi	get_trace_base_address (void)
	Get the base address of the current trace. More...

void idaapi	set_trace_base_address (ea_t ea)
	Set the base address of the current trace. More...

void idaapi	dbg_add_thread (thid_t tid)
	Add a thread to the current trace. More...

void idaapi	dbg_del_thread (thid_t tid)
	Delete a thread from the current trace. More...

void idaapi	dbg_add_tev (tev_type_t type, thid_t tid, ea_t address)
	Add a new trace element to the current trace. More...

bool idaapi	dbg_add_many_tevs (tevinforeg_vec_t *new_tevs)
	Add many new trace elements to the current trace. More...

bool idaapi	dbg_add_insn_tev (thid_t tid, ea_t ea, save_reg_values_t save=SAVE_DIFF)
	Add a new instruction trace element to the current trace. More...

bool idaapi	dbg_add_bpt_tev (thid_t tid, ea_t ea, ea_t bp)
	Add a new breakpoint trace element to the current trace. More...

void idaapi	dbg_add_call_tev (thid_t tid, ea_t caller, ea_t callee)
	Add a new call trace element to the current trace. More...

void idaapi	dbg_add_ret_tev (thid_t tid, ea_t ret_insn, ea_t return_to)
	Add a new return trace element to the current trace. More...

void idaapi	dbg_add_debug_event (debug_event_t *event)
	Add a new debug event to the current trace. More...

Detailed Description

Enumeration Type Documentation

◆ tev_type_t

enum tev_type_t

Trace event types.

Enumerator
tev_none	no event
tev_insn	an instruction trace
tev_call	a function call trace
tev_ret	a function return trace
tev_bpt	write, read/write, execution trace
tev_mem	memory layout changed
tev_event	debug event occurred
tev_max	first unused event type

Function Documentation

◆ get_tev_qty()

int idaapi get_tev_qty ( void )

inline

Get number of trace events available in trace buffer.

Type	Synchronous function
Notification	none (synchronous function)

◆ get_tev_info()

bool idaapi get_tev_info	(	int	n,
		tev_info_t *	tev_info
	)

inline

Get main information about a trace event.

Type	Synchronous function
Notification	none (synchronous function)

Parameters

	n	number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
[out]	tev_info	result

Returns: success

◆ get_insn_tev_reg_val()

bool idaapi get_insn_tev_reg_val	(	int	n,
		const char *	regname,
		regval_t *	regval
	)

inline

Read a register value from an instruction trace event.

Type	Synchronous function
Notification	none (synchronous function)

Parameters

	n	number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
	regname	name of desired register
[out]	regval	result

Returns: false if not an instruction event.

Note: This is the value of the register before the execution of the instruction.

◆ get_insn_tev_reg_mem()

bool idaapi get_insn_tev_reg_mem	(	int	n,
		memreg_infos_t *	memmap
	)

inline

Read the memory pointed by register values from an instruction trace event.

Type	Synchronous function
Notification	none (synchronous function)

Parameters

	n	number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
[out]	memmap	result

Returns: false if not an instruction event or no memory is available

◆ get_insn_tev_reg_result()

bool idaapi get_insn_tev_reg_result	(	int	n,
		const char *	regname,
		regval_t *	regval
	)

inline

Read the resulting register value from an instruction trace event.

Type	Synchronous function
Notification	none (synchronous function)

Parameters

	n	number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
	regname	name of desired register
[out]	regval	result

Returns: false if not an instruction trace event or register wasn't modified.

◆ get_call_tev_callee()

ea_t idaapi get_call_tev_callee ( int n )

inline

Get the called function from a function call trace event.

Type	Synchronous function
Notification	none (synchronous function)

Parameters

n	number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.

Returns: BADADDR if not a function call event.

◆ get_ret_tev_return()

ea_t idaapi get_ret_tev_return ( int n )

inline

Get the return address from a function return trace event.

Type	Synchronous function
Notification	none (synchronous function)

Parameters

n	number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.

Returns: BADADDR if not a function return event.

◆ get_bpt_tev_ea()

ea_t idaapi get_bpt_tev_ea ( int n )

inline

Get the address associated to a read, read/write or execution trace event.

Type	Synchronous function
Notification	none (synchronous function)

Parameters

n	number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.

Returns: BADADDR if not a read, read/write or execution trace event.

Note: Usually, a breakpoint is associated with a read, read/write or execution trace event. However, the returned address could be any address in the range of this breakpoint. If the breakpoint was deleted after the trace event, the address no longer corresponds to a valid breakpoint.

◆ get_tev_memory_info()

bool idaapi get_tev_memory_info	(	int	n,
		meminfo_vec_t *	mi
	)

inline

Get the memory layout, if any, for the specified tev object.

Type	Synchronous function
Notification	none (synchronous function)

Parameters

	n	number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
[out]	mi	result

Returns: false if the tev_t object is not of type tev_mem, true otherwise, with the new memory layout in "mi".

◆ get_tev_event()

bool idaapi get_tev_event	(	int	n,
		debug_event_t *	d
	)

inline

Get the corresponding debug event, if any, for the specified tev object.

Type	Synchronous function
Notification	none (synchronous function)

Parameters

	n	number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
[out]	d	result

Returns: false if the tev_t object doesn't have any associated debug event, true otherwise, with the debug event in "d".

◆ get_trace_base_address()

ea_t idaapi get_trace_base_address ( void )

inline

Get the base address of the current trace.

Type	Synchronous function
Notification	none (synchronous function)

Returns: the base address of the currently loaded trace

◆ set_trace_base_address()

void idaapi set_trace_base_address ( ea_t ea )

inline

Set the base address of the current trace.

Type	Synchronous function
Notification	none (synchronous function)

◆ dbg_add_thread()

void idaapi dbg_add_thread ( thid_t tid )

inline

Add a thread to the current trace.

Type	Synchronous function
Notification	none (synchronous function)

◆ dbg_del_thread()

void idaapi dbg_del_thread ( thid_t tid )

inline

Delete a thread from the current trace.

Type	Synchronous function
Notification	none (synchronous function)

◆ dbg_add_tev()

void idaapi dbg_add_tev	(	tev_type_t	type,
		thid_t	tid,
		ea_t	address
	)

inline

Add a new trace element to the current trace.

Type	Synchronous function
Notification	none (synchronous function)

◆ dbg_add_many_tevs()

bool idaapi dbg_add_many_tevs ( tevinforeg_vec_t * new_tevs )

inline

Add many new trace elements to the current trace.

Type	Synchronous function
Notification	none (synchronous function)

Returns: false if the operation failed for any tev_info_t object

◆ dbg_add_insn_tev()

bool idaapi dbg_add_insn_tev	(	thid_t	tid,
		ea_t	ea,
		save_reg_values_t	save = `SAVE_DIFF`
	)

inline

Add a new instruction trace element to the current trace.

Type	Synchronous function
Notification	none (synchronous function)

Returns: false if the operation failed, true otherwise

◆ dbg_add_bpt_tev()

bool idaapi dbg_add_bpt_tev	(	thid_t	tid,
		ea_t	ea,
		ea_t	bp
	)

inline

Add a new breakpoint trace element to the current trace.

Type	Synchronous function
Notification	none (synchronous function)

Returns: false if the operation failed, true otherwise

◆ dbg_add_call_tev()

void idaapi dbg_add_call_tev	(	thid_t	tid,
		ea_t	caller,
		ea_t	callee
	)

inline

Add a new call trace element to the current trace.

Type	Synchronous function
Notification	none (synchronous function)

◆ dbg_add_ret_tev()

void idaapi dbg_add_ret_tev	(	thid_t	tid,
		ea_t	ret_insn,
		ea_t	return_to
	)

inline

Add a new return trace element to the current trace.

Type	Synchronous function
Notification	none (synchronous function)

◆ dbg_add_debug_event()

void idaapi dbg_add_debug_event ( debug_event_t * event )

inline

Add a new debug event to the current trace.

Type	Synchronous function
Notification	none (synchronous function)

IDA SDK: Tracing events

Classes

Typedefs

Enumerations

Functions

Detailed Description

Enumeration Type Documentation

◆ tev_type_t

Function Documentation

◆ get_tev_qty()

◆ get_tev_info()

◆ get_insn_tev_reg_val()

◆ get_insn_tev_reg_mem()

◆ get_insn_tev_reg_result()

◆ get_call_tev_callee()

◆ get_ret_tev_return()

◆ get_bpt_tev_ea()

◆ get_tev_memory_info()

◆ get_tev_event()

◆ get_trace_base_address()

◆ set_trace_base_address()

◆ dbg_add_thread()

◆ dbg_del_thread()

◆ dbg_add_tev()

◆ dbg_add_many_tevs()

◆ dbg_add_insn_tev()

◆ dbg_add_bpt_tev()

◆ dbg_add_call_tev()

◆ dbg_add_ret_tev()

◆ dbg_add_debug_event()