ATrace is a tool for tracing execution of binaries on Windows.
Implemented in C but has some interesting properties that may make it suitable for tracing binaries when other methods are not sufficient, in particular EhTrace does not require changes to a binary to enable traces, despite being able to collect the same information as hooker type instrumentation, zero knowledge is needed to inspect complete code coverage and binary execution flow, register state and more.
We maintain high performance using an adaption of some known methods for high performance tracing, yet there is no requirement to use a debugger or enable debug/trace MSR capabilities.
Branch stepping not single stepping. We get for free basic block's and do not have to worry about multipath evaluation or doing complex static analysis. State is automatically maintained temporally due to the nature of VEH. All of this is inproc also which saves context switching that impacts typical debug engines. Next update is to include get_tsc into the current struct to demonstate our event rate more clearly.
CSW16 demo of notepad generated this trace, no symbols
More help/info on how todo whatever soon.