CODEWITHSUNDEEP
linuxassemblygdbtraceatt
raoof
raoof

Reputation: 572

how to record a process execution as assembly instruction?

I'm writing an x86-64 interpreter and as a way to debug and test my program I need to record the process as list of assembly instruction preferably in at&t syntax and also ignoring dynamic library function calls. and also record the cpu registers

do you know of any tool that could help.

I tried to use gdb record save ... command but the output file is very large compared to the source program

int main() {
  return 42;
}

and after disassembling the file the instruction address is wrong.

my desired output format is something like this for the above program (compiled with tcc)

  400300: 31 ed                    xor    %ebp,%ebp
  400302: 49 89 d1                 mov    %rdx,%r9
  400305: 5e                       pop    %rsi
  400306: 48 89 e2                 mov    %rsp,%rdx
  400309: 48 83 e4 f0              and    $0xfffffffffffffff0,%rsp
  40030d: 50                       push   %rax
  40030e: 54                       push   %rsp
  40030f: 4c 8b 05 62 02 20 00     mov    0x200262(%rip),%r8        # 600578
  400316: 48 8b 0d 63 02 20 00     mov    0x200263(%rip),%rcx           # 600580
  40031d: 48 8b 3d 64 02 20 00     mov    0x200264(%rip),%rdi        # 600588
  400324: ff 15 66 02 20 00        callq  *0x200266(%rip)        # 600590
__libc_start_main
  400331: 55                       push   %rbp
  400332: 48 89 e5                 mov    %rsp,%rbp
  400335: 48 81 ec 00 00 00 00     sub    $0x0,%rsp
  40033c: b8 2a 00 00 00           mov    $0x2a,%eax
  400341: c9                       leaveq
  400342: c3                       retq
  40032a: f4                       hlt
42

Upvotes: 1

Views: 422

Answers (1)

raoof
raoof

Reputation: 572

I find a partial solution using qemu.

qemu-x86_64 -singlestep -d in_asm,cpu,fpu -dfilter beg..end myProgram 2>&1 | vim -

replace beg and end with the first and last instruction address of your program you can find them with

objdump -d yourProgram | vim -

notice that the output file for my very simple program that draw a rectangle is 55MB. and it was slow to run.

Upvotes: 1

Related Questions