itrace is an x86/linux instruction tracing program. It gives an instruction-by-instruction trace of an another program, using linux's ptrace API. This program is meant to assist in very low-level debugging where need to know the exact sequence of instructions that are occuring dynamically. The latest version is itrace 1.1.2. Access to the current repository is through bitbucket using Mercurial:
hg clone http://bitbucket.org/thermostat/itrace
The using the repository should be considered experimental. As with all versions, any bugs reports are welcome.
Building itrace:
scons itrace
itrace and disinst depend on the nasm project (http://nasm.sourceforge.net/) for x86 disassembly. The necessary files are taken from the nasm-0.98.39 tree. Note, itrace also includes a Makefile for system that do not have scons, however, scons is the prefered build tool.
The following is the current output to itrace -h:
itrace gives an assembly-level trace of the x86 program. USAGE itrace [options] -- command [args] itrace uses the ptrace API to single-step through program specified by command. It prints the disassembly of the PC at every step. The disassembly is in Intel format, and is implemented with code by the NASM project (http://nasm.sourceforge.net/). OPTIONS -k n Skip instructions. Don't print to first n instructions --after Begin loging after encounting the following symbol. -o FILENAME Print to FILENAME instead of stdout. --no-hex Do not print the hex of the instructions -x --no-syms Do not print symbols --only-syms Only print instructions which are associated with symbols --range LOWER UPPER Only print in instructions that execute in the -r given range. --esp Watch the stack pointer on calls and returns. -z Gzip the output. (must be used in conjuction with -o) --last n Only print the last n instructions. --no-cache Do not use the disassembly cache for performance. --help Print this message and exit -h COPYRIGHT Copyright 2007 Dan Williams and Ross Gore. Distrubtion allowed under the GNU GPLv2. CONTACT Send comments, bug reports, feature requests, etc. to: dan_williams[AT]cs.virginia.edu
A basic invocation of itrace:
./itrace -o ls.itrace -- /bin/ls
Skip the first 1000000 instructions, then gzip the output:
./itrace -o ls.trace -z -k 1000000 -- /bin/ls
A minor bugfix addressing a problem occuring when the executable does not have a symtab. More work on the ELF code needs to be done to make it more robust.
The itrace 1.1.0 release turns caching on by default, and now includes the option --only-syms which only prints out lines associated with symbols. The allows for a rudamentory function trace for programs with symbol tables.
The command line argument --no-cache now disables disassembly caching. Also, now by default itrace attempts to find a symbol table and print symbols when they are found.
itrace's handling of signals is not generalized. itrace will attempt to continue execution if it recieves any signal stop signal (WIFSTOPPED(x) == 1) unless it is a signal 11.
| Author: | Dan Williams (dan_williams@cs.virginia.edu) |
|---|---|
| Last update: | August 2008 |