Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support 32 bits traces #5

Open
commial opened this issue Apr 1, 2022 · 1 comment
Open

Support 32 bits traces #5

commial opened this issue Apr 1, 2022 · 1 comment

Comments

@commial
Copy link
Owner

commial commented Apr 1, 2022

For now, the binding lib has been made around the 64 bits versions of TTDReplay and TTDReplayCPU.
As a result, only 64 bits traces are supported.

The API is likely to be similar, but offsets must be adapted.

@kweatherman
Copy link

It actually works the same.
You can load and operate/trace on 32bit traces (from 64bit projects using these TTD DLLs) too. Nicely all the memory values are homogenized 64bit wide values.

My IDA MissingLink plugin works this way.
And how I'd recommend anyone do it. Since everyone uses a 64bit Windows OS (almost, does anyone really use the 32bit version of Windows anymore?) best to target 64bit and then your code can operate on both.

Although 32bit has some annoying caveats. Like you will notice in Windows API module load events the 32bit paths will be the WOW64 emulated paths: "C:\Windows\System32" when in reality they are from "C:\Windows\SysWOW64"..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants