diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 34 |
1 files changed, 34 insertions, 0 deletions
@@ -98,6 +98,10 @@ nothing: ./ida-tui fw.bin --processor arm --base 0x8000000 ``` +ARM images that use Thumb need one more thing: press `t` on the listing to switch +ARM/Thumb decoding at the cursor (it sets IDA's `T` register, and the segment to +32-bit, since Thumb doesn't exist in AArch64). + `--base` is a real address (IDA's own `-b` is in paragraphs; the conversion is done for you). In a project the options are recorded per binary, which is what a multi-image firmware wants. They apply to the first open only — after that the @@ -108,6 +112,36 @@ multi-image firmware wants. They apply to the first open only — after that the > reopen. Delete those stale files (never the `.i64`) and retry — `ida-tui` does > this automatically. +## Execution traces + +Load a [Tenet](https://github.com/gaasedelen/tenet) trace alongside the binary +and explore it in time: + +```sh +./ida-tui /path/to/binary --trace trace.0.log +``` + +A docked pane on the right shows the registers at the current timestamp (the +ones the current instruction wrote are highlighted) and a timeline. `]` and `[` +step one instruction forward and back; `}` and `{` step over a call by following +the stack pointer. The code view follows. + +Both code views are painted with the execution trail: where you just came from, +where you're about to go, and the instruction you're standing on. The pseudocode +view is painted too — a trace records instructions, but `decomp_map` says which +instructions each C line covers, so the same trail lands on the decompilation. + +The dock also shows the **stack as of that instant**, read out of the trace. +Bytes the trace never observed print as `??` rather than zeros — a trace knows +what it saw and nothing else. The hex view (`\`) gets the same treatment: bytes +the trace saw at this timestamp are shown in green over the file's own contents. + +Trace addresses are rebased onto the database automatically — a traced process +is relocated, so nothing lines up until that's solved. + +Traces are recorded separately; see `~/dev/tenet/tenet-original/tracers/` for the +QEMU tracer. + ## RPC / driving the TUI Give the TUI `--rpc <sock>` to expose a unix-socket control channel, then drive |