Stop offsets

In some cases, we may want to pause the execution of the traced module (it can be done for variety of reasons, i.e. to dump the unpacked buffer, connect a debugger after the antidebug checks passed, and so on).

TinyTracer allows to define a list of offsets where its execution will pause (aka "Stop Offsets"). Once such offset is hit, TinyTracer will wait the time defined in TinyTracer.ini as STOP_OFFSET_TIME (in seconds). If STOP_OFFSET_TIME is set to 0 this feature will be disabled.

The list of stop offsets is defined per traced module by a dedicated file.

The stop offsets definitions file (.stop_offsets.txt)

The definition file must be located in the same directory as the one where the TAG file will be stored (by default, it is the directory where the run executable resides). It needs be named by the following pattern: [traced_module_name].stop_offsets.txt (i.e. crackme.exe.stop_offsets.txt)

Stop offsets are defined as relative offsets within the traced module (RVA). We may also specify how many times execution should stop at particular offset (by default it is 0 - meaning infinite number of times).

Example of the stop offsets list:

1451
11ee;2

Once the offset was hit, TinyTracer will log into the tracelog (and on std::out if available) the information line about the wait.

# Stop offset reached: RVA = 0x11ee. Sleeping 30 s. Hits remaining: 1

After the wait has finished, another line will be logged:

# Resuming execution