Welcome to tiny_tracer Discussions!

[hasherezade]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[HongThatCong]

I recommend new features for tiny_tracer:

1. Log return address
2. Log return value: IARG_FUNCRET_EXITPOINT_REFERENCE or IARG_FUNCRET_EXITPOINT_VALUE or IARG_RETURN_REGS
   Many API functions take no parameters, (params=0), only return a value.
   Example: GetLastError, Getxxxx
3. Allow to log parameters when entering the function or when leaving the function.
   (IPOINT_BEFORE or IPOINT_AFTER)
   It is possible to add a parameter "b" or "e" or even "be" to the API function declaration in the file params.txt
   "b" = begin, "e" = end, "be" = both begin and end
   If b and e are not present, the default is begin
   Ex: kernel32;CheckRemoteDebuggerPresent;2;e

Best regards

[hasherezade]

hi @HongThatCong !
Thank you for your ideas, they all make sense. Some of those things I was already planning to add - for example logging the return values of the function, and logging the arguments at function exit. In the past I started implementing it, but didn't finish. I have some draft in an old, unmerged branch watch_output. I will review that changes in the upcoming weekend to see what I can take from it, and will finish this feature soon.

[Puffinme]

Hi @hasherezade
Can I attach to running 64 bit process using the pin_attach.bat in cmd? If yes, I am getting an error saying 32 bit selected:

C:\pin\source\tools\tiny_tracer\install32_64>pin_attach.bat "C:\Windows\system32\notepad.exe" 7572
PIN is trying to attach to the app:
"C:\Windows\system32\notepad.exe"
KDB: Disabled
32bit selected
Target module: "C:\Windows\system32\notepad.exe"
Tag file: "C:\Windows\system32\notepad.exe.tag"
Press any key to continue . . .

This is basic example, do I have to pass some argument for the tool to use the 64 bit dll or would it choose automatically?
Love your work!

Thank you

[hasherezade]

hi @Puffinme ! there was a bug in pe_check utility, due to which the bitness of some of the system apps was wrongly identified. sorry for this. please update and let me know if it works.
51429b8

[IamHuskar]

maybe we can add some new features like FlameGraph view?