Learning Malware Analysis

3.8 Tracing Execution Using IDA

Tracing allows you to record (log) specific events while a process is executing. It can provide detailed execution information on a binary. IDA supports three types of tracing: instruction tracing, function tracing, and basic block tracing. To enable tracing in IDA, you need to set a breakpoint, then right-click on the breakpoint address and choose Edit breakpoint, which will bring up a breakpoint settings dialog. In the dialog, check the Enable tracing option, and choose the appropriate Tracing type. Then, select the debugger via the Debugger | Select debugger menu (as covered previously), and Run (F9) the program. The location field in the following screenshot specifies the breakpoint being edited, and it ...