Log in

View Full Version : How to use hit trace???


yaa
November 21st, 2002, 15:34
Hello,

could anyone explain how the hit trace feature should/can be used???
Thx.

Regards,
yaa

TBD
November 21st, 2002, 22:49
yaa:
- hit trace is used to see if the code you selected is run. for example you have a portion of code that goes wrong and you dont know why - then use hittrace or run trace for more detailed info
- can be used also for highlighting blocks of code (explain in another post)

yaa
November 22nd, 2002, 08:44
How do you use it??? I mean how do you "trace" (or see) the executed code???
Thx.

Regards,
yaa

_Servil_
November 22nd, 2002, 11:09
go view | run trace and you see here all traced ops, and all registers that are changed.
you can turn on logging to file (right mous click on top of the window)

you start either with trace into (ctrl-f11) or trace over(ctrl-f21).
you can set up a condition to break tracing (ctrl-t), this is useful when finding OEP of some less aggresive packed proggies

yaa
November 22nd, 2002, 16:24
_Servil_ I got lost. What is the relationship between hit trace and run trace???
Thx.

Regards,
yaa

TBD
November 23rd, 2002, 00:30
yaa: hit trace records only that a instruction was executed and run trace records what registers modifies that instruction

_Servil_
November 23rd, 2002, 00:59
i was talking about something other
sorry

yaa
November 23rd, 2002, 03:23
TBD where is it that you see instructions executed??? Also, how do you start hit trace??? I see how I can set an instruction to be "hit traced" but where is it that you start the tracing and where is it that you see the results???
Thx.

Regards,
yaa

TBD
November 23rd, 2002, 03:37
yaa: please read the ollydbg.hlp and try and will see the difference. as english is not my native language is hard to explain

yaa
November 23rd, 2002, 05:00
TBD I have read the help file on the subject more than once before posting and did not find the answer to my question. I wouldn't have asked my questions here otherwise.
English isn't my first language either.

Regards,
yaa

TBD
November 24th, 2002, 00:15
yaa: "how do you start hit trace?" - select instructions to be "hit traced" and run program. to see the result look for some colors near the hex dump

gfplus
November 24th, 2002, 13:08
Little help to old TBD ;-)
Hit trace you can use very nice if you wan't to see which part of program is executed and which is not.
So what that means:
1. Before your break point - or from begining of procedure select code
2. use pop up menu hit-trace-add selection to add this selection in hit trace
3. When your program NEXT time stop on break point you will see which line he really execute and which not.
(if you have standard olly schema then this parts have red colors)
- this metod is really good when you really want find your 'execution path'

TBD
November 24th, 2002, 22:37
gfplus: thanks & welcome back ! ... everything ok on your side ?
i hope so