PETE
PETE is a standalone debugging tool with tracing, partial trace
exploration, and CFG recovery and visualization features. The main
features are:
- GUI application with debugger-style interface. PETE is a
standalone GUI application similar to a debugger. Its trace and
debug navigation controls are similar to those of a debugger (Step
Into, Step Over, Run to Cursor, Return to Top-level, etc) and
include additional rewinding primitives that allow review of
executed instructions and limited review of prior execution state
(Step Backwards Into/Over, etc.)
- Tracing capabilities. PETE can collect traces while
debugging an application. Traces can be single- or multi-threaded,
and optionally include context information at each basic block. Two
types of traces are supported: compressed wpp traces with no
context information, and full-context traces that contain a certain
amount of context at each point along the trace. PETE is designed
to scale to very large traces.
- Trace Queries. Many advanced queries are possible given
enough context, such as finding the last or next instruction to
access a certain register, the last or next call to a specific
function, or defining and skipping (stepping over) whole patterns
of code.
- Partial Trace Exploration. At any breakpoint, PETE
provides queries on the trace accumulated up to that point.
- Disassembly View. In debugging mode, PETE shows a
built-in disassembled view of the application being debugged. The
disassembly is typically annotated with symbolic information, such
as exports and PDB/debug symbols if such information exists, as
well as comments derived from internal information that PETE keeps
about system code and variables.
- Call Stack. In debugging mode, PETE optionally shows a
view of the call stack.
- Trace View. In exploration mode, at any point, PETE
shows a disassembled view of the trace collected up to that
point. The trace view may be annotated with symbolic information
(if such information exists). Entries in the trace view may be
shown or elided, either manually or automatically depending on
PETE's persistent settings.
- Integration with Code Visualization Tools. In trace
exploration mode, PETE can make use of either its built-in
disassembly viewer, or it can work together with a capable back-end
application such as IDA Pro or CodeSurfer®/x86 to show trace points
in context (in their respective binary modules). The back-end being
used can be changed at runtime as many times as necessary.
- Platform. PETE is a Windows application.
The tool's primary audience consists of developers and reverse
engineers.