Skip to content

An x64dbg plugin designed to append additional trace information into .trace32 and .trace64 files.

Notifications You must be signed in to change notification settings

g0th1c54e4/supertrace

Repository files navigation

Introduction

This is an x64dbg plugin aimed at appending additional information to trace files (.trace32 & .trace64). With it, the trace files can include helpful data for reverse engineering research on execution traces, such as symbols, loaded modules, memory maps (including corresponding binary data), thread information, etc.

For details, see blockdef.h

It is recommended to use x64dbg-trace-parser for parsing

Attention

The extra information is appended by introducing user-defined blocks (see Block Format). Therefore, it does not interfere with the native parsing behavior of x64dbg TraceFileReader. In other words, opening the trace file in x64dbg and viewing the trace records continues to work normally.

Usage

Once the plugin is successfully loaded, it collects extra information whenever trace recording starts (StartTraceRecording \ StartRunTrace). When tracing stops, the collected information will be written into the trace file. The serialized information is archived in Binary format.

I also provide Python bindings to assist with parsing tasks on Python(Based on pybind11): supertrace-pybind

Third-party Library

cereal:A C++11 library for serialization
pybind11: Seamless operability between C++11 and Python

About

An x64dbg plugin designed to append additional trace information into .trace32 and .trace64 files.

Topics

Resources

Stars

Watchers

Forks