# 20.3.5 Tracing facilities

The '!trace' command provides a simple way to get execution traces of opcodes.

This command accepts a numeric argument specifying the verbose level. But you can also tune its output using eval variables.

    [0x4A13B8C0]> !trace?
    !trace [level]
      0  no output
      1  show addresses
      2  address and disassembly
      3  address, disassembly and registers
      4  address, disassembly and registers and stack
      > eval trace.calls = true ; only trace calls
      > eval trace.smart = true ; smart output
      > eval trace.bps = true   ; do not stop on breakpoints
      > eval trace.libs = true  ; trace into libraries
      > eval trace.bt = true    ; to show backtrace
      > eval trace.sleep = 1    ; animated stepping (1fps)
      > eval cmd.trace = x@eip  ; execute a cmd on every traced opcode

The nice thing is that with cmd.trace you can extend its functionality with your own code. For example. you can for example !dump if the traced opcode is a call and then you will be able to read the program log and be able to perform a 'stepback' using !restore <id> command, restoring the process memory and registers.

Let's make a test:

    [0x4A13C000]> !bp 0x4a13c009
    new hw breakpoint 0 at 0x4a13c009

    [0x4A13C000]> !trace 3
    Trace level: 3
      eax  0xbfae23b0    esi  0x00000000    eip    0x4a13c000
      ebx  0x00000000    edi  0x00000000    oeax   0xffffffff
      ecx  0x00000000    esp  0xbfae23ac    eflags 0x200382
      edx  0x00000000    ebp  0x00000000    cpazSTIdor0 (STI)
    _shstrtab:0x4a13c001    0        eip: 89e5            mov ebp, esp
      eax  0xbfae23b0    esi  0x00000000    eip    0x4a13c001
      ebx  0x00000000    edi  0x00000000    oeax   0xffffffff
      ecx  0x00000000    esp  0xbfae23a8    eflags 0x200382
      edx  0x00000000    ebp  0x00000000    cpazSTIdor0 (STI)

    _shstrtab:0x4a13c003    8_       eip: 57              push edi
      eax  0xbfae23b0    esi  0x00000000    eip    0x4a13c003
      ebx  0x00000000    edi  0x00000000    oeax   0xffffffff
      ecx  0x00000000    esp  0xbfae23a8    eflags 0x200382
      edx  0x00000000    ebp  0xbfae23a8    cpazSTIdor0 (STI)

    _shstrtab:0x4a13c004,   8_       eip: 56              push esi
      eax  0xbfae23b0    esi  0x00000000    eip    0x4a13c004
      ebx  0x00000000    edi  0x00000000    oeax   0xffffffff
      ecx  0x00000000    esp  0xbfae23a4    eflags 0x200382
      edx  0x00000000    ebp  0xbfae23a8    cpazSTIdor0 (STI)

    _shstrtab:0x4a13c005    8_       eip: 53              push ebx
      eax  0xbfae23b0    esi  0x00000000    eip    0x4a13c005
      ebx  0x00000000    edi  0x00000000    oeax   0xffffffff
      ecx  0x00000000    esp  0xbfae23a0    eflags 0x200382
      edx  0x00000000    ebp  0xbfae23a8    cpazSTIdor0 (STI)

    _shstrtab:0x4a13c006   64_       eip: 83ec40          sub esp, 0x40
      eax  0xbfae23b0    esi  0x00000000    eip    0x4a13c006
      ebx  0x00000000    edi  0x00000000    oeax   0xffffffff
      ecx  0x00000000    esp  0xbfae239c    eflags 0x200382
      edx  0x00000000    ebp  0xbfae23a8    cpazSTIdor0 (STI)

    HW breakpoint hit!
    _shstrtab:0x4a13c009    0        eip: e8bd480100      call 0x4a1508cb
      eax  0xbfae23b0    esi  0x00000000    eip    0x4a13c009
      ebx  0x00000000    edi  0x00000000    oeax   0xffffffff
      ecx  0x00000000    esp  0xbfae235c    eflags 0x200386
      edx  0x00000000    ebp  0xbfae23a8    cPazSTIdor0 (PSTI)
    Breakpoint!

    7 traced opcodes

    [0x4A13C000]> :pd 7
    0x4a13c000,   8_ push ebp
    0x4a13c001    8  mov ebp, esp
    0x4a13c003   16_ push edi
    0x4a13c004,  24_ push esi
    0x4a13c005   32_ push ebx
    0x4a13c006   96_ sub esp, 0x40
    0x4a13c009   96  call 0x4a1508cb