Learning Malware Analysis

2.9.1 Instruction Tracing

To perform instruction tracing (for example, trace into) on the previous program, you can use the following settings in the Trace into dialog. As mentioned previously, to capture the trace events in a log file, you need to specify the full path to the log file and the Log Text:

The Log Text value in the preceding screenshot (0x{p:cip} {i:cip}) is in the string format, which specifies the debugger to log the address and the disassembly of all the traced instructions. The following is the trace log of the program. As a result of choosing the Trace into option, the instructions inside the function (0xdf1000) are also ...