Tracing all functions in executable conditionally, to find function of interest

Question

I would like to alter the behavior of some executable (in my case, a videogame). One way of doing this is to hook function calls (e.g., a function like Player::ReceiveDamage) and adjust parameters/return values.

I know how to inject code and how to hook functions. The challenge currently is to find the address of the function of interest. The source code of the target is not available, neither are debug symbols.

An approach I successfully used before is the following:

1. Find all function addresses in the target executable (e.g., with IDA, radare2, Pyew, ...)
2. With the executable running, hook all functions
3. Black-list (and un-hook) functions that are called during moments that are not of interest
4. White-list functions that are called during moments of interest
5. Repeat steps (4,5) until function list is narrowed down sufficiently

Unfortunately, I have misplaced the code I was using for this process. I can re-write it, but I noticed that there is already an enormous offering of tools and libraries that may do exactly what I need.

Performance is a challenge: logging all function calls in a videogame introduces significant overhead. I noticed previously that it would take some time for my old tool to black-list enough irrelevant functions for the target to become responsive. This likely makes Frida not a good choice, as it injects javascript.

Does anyone know of a performant tool/library, supporting Windows and x64, that I can use to find functions of interest in a target executable?

Answer 1

You can use a binary dynamic instrumentation framework, such as:

• Intel Pin (and specifically the TracerPIN tool)
• Frida
• DynamoRIO
• Dyninst
• Valgrind

Answer 2

What I would do is the following steps:

1. use IDA Pro to get all functions names and addresses (hopefully names if you renamed any of them) in the binary and export it as a python dictionary. examples can be found here.
2. Install PyKd as described here and here.
3. Create a PyKd script to set conditional breakpoints to print something everytime they are hit and then continue execution, like:

import pykd
funcList = { 'funcA': 0xAAAAAAAA,
             'funcB': 0xBBBBBBBB, 
               ...
           }

for funcName, funcAddr in funcList.items():
   pykd.DbgCommand('bp ' + funcAddr + ' ".echo ' + funcName + ' executed; gc"')

4. Execute in WinDbg:

.load pykd
!py <path to script>
g

this will trace each function during the execution with the function names from your IDA Pro database.