Learning Malware Analysis

2.9 Tracing Execution in x64dbg

Tracing allows you to log events while the process is executing. x64dbg supports trace into and trace over conditional tracing options. You can access these options via Trace | Trace into (Ctrl+Alt+F7) and Trace | Trace over (Ctrl+Alt+F8). In trace into, the debugger internally traces the program by setting step into breakpoint, until a condition is satisfied or the maximum number of steps is reached. In trace over, the debugger traces the program by setting step over breakpoint, until the condition is satisfied or the maximum number of steps is reached. The following screenshot shows the Trace into dialog (the same options are provided in the Trace over dialog). To trace the logs, at a minimum, you need to ...