Introduction

• Full encapsulation of the Win32 debug API
• PE file format parsing (.exe, .dll files)
• Codeview, COFF and FPO debug symbol support (no PDB yet)
• Single-shot soft breakpoints and automatic restore of original code
• Single stepping
• Disassembly using a libdisasm Windows port, including jump prediction
• Handling of exceptions, breakpoints and other important stuff either by specification of call-back functions or by overloading virtual prototypes provided in the class in case you prefer to inherit the functionality.

ltrace for Windows

How it works

int printf( char *, char *);
"haxor" == int sprintf( [out] char *buffer, [in] fmtchar *format);

• You can specify plain C notation function prototypes
• You can name arguments for more readable output
• It supports argument directions. Specification of [in] will cause the argument to be inspected in depth only when the function is entered, [out] only then the function returns and [both] or no direction information causes inspection in both cases. This allows you to ignore uninitialized buffers, for example the output buffer of a sprintf() call.
• You can perform output matching on the returned buffer (or the first [out] char buffer, in case the return value is not a char* or wchar* buffer). This way, you will only see functions whose result contains this string
• Variable number of arguments such as with sprintf(char *, char *, ...) is not supported and you have to rely on the actual output
• wchar type is supported and the output is tailored to be ASCII again

• char - a single character
• char* - a char buffer
• fmtchar* - a char string being a format string
• int - a 32bit integer
• int* - a pointer to a 32bit integer
• void - nothing
• void* - arbirary 32bit pointer
• wchar - a single wide character
• wchar* - a wchar buffer
• fmtwchar* - a wchar string begin a format string

Getting the stuff