20.3.7 Touch Tracing

The 'touch trace' is a special tracing engine that was born from an idea of Gadix (Thanks! ;D)

The main idea of '!tt' (which is the assigned command name for this feature) is to fill N bytes of the process memory with software breakpoints while the debugger keeps a copy of the original bytes.

When a breakpoint not swapped by the debugger is catched between this memory range the debugger swaps the original bytes into the process memory and continues the execution. When the program counter stops outside this range, the program memory of the traced program is restored and the debugger keeps the tracing information accessible with the 'at' command explained in another chapter.

In this way it is possible to create a fast trace, so each instruction will only be tracked one time. So you will be able to generate multiple traces of different parts of the program without a high cpu load and allowing you to easily identify the executed regions of a program with a decent user interaction.

To use this command just give an argument with the size of the tracing area to be swapped and the program will start running

[0xB7F75810]> !tt 10K
[0xB7F75810]> at
0xb7f75810 - 0xb7f7585a
0xb7f75860 - 0xb7f75876
0xb7f75a60 - 0xb7f75b8b
0xb7f75b95 - 0xb7f75b9f
...