Follow program execution through .DLL in hex representation

Question

Is there a way to follow a program's execution through DLL code in hex?

For example, I want to see what sections have just been read when I press a button. It has to work for x64 DLL's.

Thanks!

Answer 1

Yes you load the process into debugger and single step it.

Answer 2

You can use the tool at http://ircdb.org to log function calls arbitrary DLLs.

It's name is SocketSpy, because initially it was created for tracing winsock.dll only, but it does allow you to trace other dlls.

From http://fixunix.com/programmer/95098-tracing-library-dll-calls-win32.html

Use Option->Default Break Point List Menu to add or remove soft breakpoints from attached DLLs. Put soft breakpoints only at function you need to maximize execution time.

Soft breakpoint means that socketspy does not stop at this breakpoint, only log breakpoint information. Hard breakpoint means that socketspy DOES STOP at this breakpoint, and Breakpoint dialog is opened. Specify what calls should be captured ALL, FROM EXE FILE or from DLLs (Combobox).

Specify log file File->Open Log File menu if you want to save function DLLs' calls into the text file, enable logging (check box).

Then select a new or already action process (Select Process button). The tool can be used in NT/2000/XP only

Alternatively, there is StraceNT, which can trace arbitrary Dlls. It is available for free from http://www.intellectualheaven.com/default.asp?BH=projects&H=strace.htm

Answer 3

I've not used it, but I once stumble upon an Intel tool, which samples the context of the Instruction Pointer, and is able to use symbol files to convert IP to an actual function name... VTune maybe?

I guess there might be other such tools

UPDATE: aka. "statistical profilers"...

Answer 4

1. Load the project in visual studio.
2. Press 'Play' or F5 to start the program in the debugger.
3. You will need to eventually halt execution sometime so you can start stepping through code or assembly code. You can do this by inserting a breakpoint, or breaking the execution by hitting the break command in the visual studio IDE.
4. Once halted, you can right click in the code view window, and select "Show Disassembly". Then it will show you the machine instructions.
5. Also in the watch window in the visual studio debugger, the right click pop up menu has an option to display all variables as hexidecimal. I'm beginning to prefer hex myself lately, because I can see invalid memory patterns easier.

Answer 5

Debugging using IDE does not show you the assembly language equivalent of the execution of an IL instruction. You need to write your own hooks to a proper disassembler.