| IDA SDK

Classes | Typedefs | Enumerations | Functions
Tracing events
Debugger functions » Tracing

## Detailed Description

## Classes
struct | tev_info_t
| Common information for all trace events. More...
struct | memreg_info_t
| Required typedef for get_insn_tev_reg_mem() More...
struct | tev_reg_value_t
| Structure used for dbg_add_many_tevs() More...
struct | tev_info_reg_t
| Structure used for dbg_add_many_tevs() More...

## Typedefs
typedef qvector< debug_event_t > | dbgevt_vec_t
| vector of debug events
typedef qvector< tev_info_t > | tevinfo_vec_t
| vector of trace event info objects
typedef qvector< memreg_info_t > | memreg_infos_t
typedef qvector< tev_reg_value_t > | tev_reg_values_t
| vector of trace event reg values
typedef qvector< tev_info_reg_t > | tevinforeg_vec_t
| vector of trace elements

## Enumerations
enum | tev_type_t { tev_none = 0 , tev_insn , tev_call , tev_ret , tev_bpt , tev_mem , tev_event , tev_max }
| Trace event types. More...
enum | save_reg_values_t { SAVE_ALL_VALUES = 0 , SAVE_DIFF , SAVE_NONE }
| Se dbg_add_insn_tev()

## Functions
int idaapi | get_tev_qty (void)
| Get number of trace events available in trace buffer. More...
bool idaapi | get_tev_info (int n, tev_info_t *tev_info)
| Get main information about a trace event. More...
bool idaapi | get_insn_tev_reg_val (int n, const char *regname, regval_t *regval)
| Read a register value from an instruction trace event. More...
bool idaapi | get_insn_tev_reg_val (int n, const char *regname, uint64 *ival)
bool idaapi | get_insn_tev_reg_mem (int n, memreg_infos_t *memmap)
| Read the memory pointed by register values from an instruction trace event. More...
bool idaapi | get_insn_tev_reg_result (int n, const char *regname, regval_t *regval)
| Read the resulting register value from an instruction trace event. More...
bool idaapi | get_insn_tev_reg_result (int n, const char *regname, uint64 *ival)
ea_t idaapi | get_call_tev_callee (int n)
| Get the called function from a function call trace event. More...
ea_t idaapi | get_ret_tev_return (int n)
| Get the return address from a function return trace event. More...
ea_t idaapi | get_bpt_tev_ea (int n)
| Get the address associated to a read, read/write or execution trace event. More...
bool idaapi | get_tev_memory_info (int n, meminfo_vec_t *mi)
| Get the memory layout, if any, for the specified tev object. More...
bool idaapi | get_tev_event (int n, debug_event_t *d)
| Get the corresponding debug event, if any, for the specified tev object. More...
ea_t idaapi | get_trace_base_address (void)
| Get the base address of the current trace. More...
void idaapi | set_trace_base_address (ea_t ea)
| Set the base address of the current trace. More...
void idaapi | dbg_add_thread (thid_t tid)
| Add a thread to the current trace. More...
void idaapi | dbg_del_thread (thid_t tid)
| Delete a thread from the current trace. More...
void idaapi | dbg_add_tev (tev_type_t type, thid_t tid, ea_t address)
| Add a new trace element to the current trace. More...
bool idaapi | dbg_add_many_tevs (tevinforeg_vec_t *new_tevs)
| Add many new trace elements to the current trace. More...
bool idaapi | dbg_add_insn_tev (thid_t tid, ea_t ea, save_reg_values_t save=SAVE_DIFF)
| Add a new instruction trace element to the current trace. More...
bool idaapi | dbg_add_bpt_tev (thid_t tid, ea_t ea, ea_t bp)
| Add a new breakpoint trace element to the current trace. More...
void idaapi | dbg_add_call_tev (thid_t tid, ea_t caller, ea_t callee)
| Add a new call trace element to the current trace. More...
void idaapi | dbg_add_ret_tev (thid_t tid, ea_t ret_insn, ea_t return_to)
| Add a new return trace element to the current trace. More...
void idaapi | dbg_add_debug_event (debug_event_t *event)
| Add a new debug event to the current trace. More...

## Enumeration Type Documentation

## ◆ tev_type_t

enum tev_type_t

Trace event types.

Enumerator
tev_none | no event
tev_insn | an instruction trace
tev_call | a function call trace
tev_ret | a function return trace
tev_bpt | write, read/write, execution trace
tev_mem | memory layout changed
tev_event | debug event occurred
tev_max | first unused event type

## Function Documentation

## ◆ get_tev_qty()

int idaapi get_tev_qty | ( | void |  | ) |
| inline

Get number of trace events available in trace buffer.

Type | Synchronous function
Notification | none (synchronous function)

## ◆ get_tev_info()

bool idaapi get_tev_info | ( | int | n,
|  | tev_info_t * | tev_info
| ) |  |
| inline

Get main information about a trace event.

Type | Synchronous function
Notification | none (synchronous function)

Parameters

  | n | number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
  [out] | tev_info | result

Returns
  success

## ◆ get_insn_tev_reg_val()

bool idaapi get_insn_tev_reg_val | ( | int | n,
|  | const char * | regname,
|  | regval_t * | regval
| ) |  |
| inline

Read a register value from an instruction trace event.

Type | Synchronous function
Notification | none (synchronous function)

Parameters

  | n | number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
  | regname | name of desired register
  [out] | regval | result

Returns
  false if not an instruction event.

Note
  This is the value of the register before the execution of the instruction.

## ◆ get_insn_tev_reg_mem()

bool idaapi get_insn_tev_reg_mem | ( | int | n,
|  | memreg_infos_t * | memmap
| ) |  |
| inline

Read the memory pointed by register values from an instruction trace event.

Type | Synchronous function
Notification | none (synchronous function)

Parameters

  | n | number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
  [out] | memmap | result

Returns
  false if not an instruction event or no memory is available

## ◆ get_insn_tev_reg_result()

bool idaapi get_insn_tev_reg_result | ( | int | n,
|  | const char * | regname,
|  | regval_t * | regval
| ) |  |
| inline

Read the resulting register value from an instruction trace event.

Type | Synchronous function
Notification | none (synchronous function)

Parameters

  | n | number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
  | regname | name of desired register
  [out] | regval | result

Returns
  false if not an instruction trace event or register wasn't modified.

## ◆ get_call_tev_callee()

ea_t idaapi get_call_tev_callee | ( | int | n | ) |
| inline

Get the called function from a function call trace event.

Type | Synchronous function
Notification | none (synchronous function)

Parameters

  n | number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.

Returns
  BADADDR if not a function call event.

## ◆ get_ret_tev_return()

ea_t idaapi get_ret_tev_return | ( | int | n | ) |
| inline

Get the return address from a function return trace event.

Type | Synchronous function
Notification | none (synchronous function)

Parameters

  n | number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.

Returns
  BADADDR if not a function return event.

## ◆ get_bpt_tev_ea()

ea_t idaapi get_bpt_tev_ea | ( | int | n | ) |
| inline

Get the address associated to a read, read/write or execution trace event.

Type | Synchronous function
Notification | none (synchronous function)

Parameters

  n | number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.

Returns
  BADADDR if not a read, read/write or execution trace event.

Note
  Usually, a breakpoint is associated with a read, read/write or execution trace event. However, the returned address could be any address in the range of this breakpoint. If the breakpoint was deleted after the trace event, the address no longer corresponds to a valid breakpoint.

## ◆ get_tev_memory_info()

bool idaapi get_tev_memory_info | ( | int | n,
|  | meminfo_vec_t * | mi
| ) |  |
| inline

Get the memory layout, if any, for the specified tev object.

Type | Synchronous function
Notification | none (synchronous function)

Parameters

  | n | number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
  [out] | mi | result

Returns
  false if the tev_t object is not of type tev_mem, true otherwise, with the new memory layout in "mi".

## ◆ get_tev_event()

bool idaapi get_tev_event | ( | int | n,
|  | debug_event_t * | d
| ) |  |
| inline

Get the corresponding debug event, if any, for the specified tev object.

Type | Synchronous function
Notification | none (synchronous function)

Parameters

  | n | number of trace event, is in range 0..get_tev_qty()-1. 0 represents the latest added trace event.
  [out] | d | result

Returns
  false if the tev_t object doesn't have any associated debug event, true otherwise, with the debug event in "d".

## ◆ get_trace_base_address()

ea_t idaapi get_trace_base_address | ( | void |  | ) |
| inline

Get the base address of the current trace.

Type | Synchronous function
Notification | none (synchronous function)

Returns
  the base address of the currently loaded trace

## ◆ set_trace_base_address()

void idaapi set_trace_base_address | ( | ea_t | ea | ) |
| inline

Set the base address of the current trace.

Type | Synchronous function
Notification | none (synchronous function)

## ◆ dbg_add_thread()

void idaapi dbg_add_thread | ( | thid_t | tid | ) |
| inline

Add a thread to the current trace.

Type | Synchronous function
Notification | none (synchronous function)

## ◆ dbg_del_thread()

void idaapi dbg_del_thread | ( | thid_t | tid | ) |
| inline

Delete a thread from the current trace.

Type | Synchronous function
Notification | none (synchronous function)

## ◆ dbg_add_tev()

void idaapi dbg_add_tev | ( | tev_type_t | type,
|  | thid_t | tid,
|  | ea_t | address
| ) |  |
| inline

Add a new trace element to the current trace.

Type | Synchronous function
Notification | none (synchronous function)

## ◆ dbg_add_many_tevs()

bool idaapi dbg_add_many_tevs | ( | tevinforeg_vec_t * | new_tevs | ) |
| inline

Add many new trace elements to the current trace.

Type | Synchronous function
Notification | none (synchronous function)

Returns
  false if the operation failed for any tev_info_t object

## ◆ dbg_add_insn_tev()

bool idaapi dbg_add_insn_tev | ( | thid_t | tid,
|  | ea_t | ea,
|  | save_reg_values_t | save = `SAVE_DIFF`
| ) |  |
| inline

Add a new instruction trace element to the current trace.

Type | Synchronous function
Notification | none (synchronous function)

Returns
  false if the operation failed, true otherwise

## ◆ dbg_add_bpt_tev()

bool idaapi dbg_add_bpt_tev | ( | thid_t | tid,
|  | ea_t | ea,
|  | ea_t | bp
| ) |  |
| inline

Add a new breakpoint trace element to the current trace.

Type | Synchronous function
Notification | none (synchronous function)

Returns
  false if the operation failed, true otherwise

## ◆ dbg_add_call_tev()

void idaapi dbg_add_call_tev | ( | thid_t | tid,
|  | ea_t | caller,
|  | ea_t | callee
| ) |  |
| inline

Add a new call trace element to the current trace.

Type | Synchronous function
Notification | none (synchronous function)

## ◆ dbg_add_ret_tev()

void idaapi dbg_add_ret_tev | ( | thid_t | tid,
|  | ea_t | ret_insn,
|  | ea_t | return_to
| ) |  |
| inline

Add a new return trace element to the current trace.

Type | Synchronous function
Notification | none (synchronous function)

## ◆ dbg_add_debug_event()

void idaapi dbg_add_debug_event | ( | debug_event_t * | event | ) |
| inline

Add a new debug event to the current trace.

Type | Synchronous function
Notification | none (synchronous function)