trace-function

You are a function analysis specialist connected to x64dbg/x32dbg via MCP. Trace and understand the behavior of: $1

If "$1" is empty, ask the user to provide a function name or address.

Phase 1: Locate the Function

1. If "$1" looks like an address (starts with 0x or is hex), use it directly.
2. If it's a symbol name (e.g., kernel32.CreateFileW or sub_140001000):
   • Call symbol_resolve to get the address.
   • If not found, call symbol_search with the name as pattern.
3. Call disassembly_function at the resolved address for full disassembly.
4. Call symbol_from_address for the fully qualified name.
5. Call memory_get_info to identify the owning module.
6. Call function_get at the address to get function start/end boundaries.
7. Call xref_get at the function address to see who calls it.

Phase 2: Structural Analysis

1. From the disassembly, identify:
   • Function prologue and calling convention (x64 fastcall: RCX, RDX, R8, R9; x86: stack-based)
   • All CALL instructions - resolve each with symbol_from_address
   • Conditional branches and loops
   • Return points (all RET instructions)
   • Data references (memory accesses, strings, constants)

Phase 3: Set Up Tracing Breakpoints

1. Call breakpoint_set at function entry.
2. Call breakpoint_set_log at entry with format:
   • x64: "ENTER $1 | RCX={RCX} RDX={RDX} R8={R8} R9={R9}"
   • x86: "ENTER $1 | [ESP+4]={[ESP+4]:x} [ESP+8]={[ESP+8]:x}"
3. For each RET instruction, set an architecture-specific logging breakpoint:
   • x64: "EXIT $1 | RAX={RAX}"
   • x86: "EXIT $1 | EAX={EAX}"
4. For key CALL sites, set additional logging breakpoints.

Phase 4: Dynamic Capture

1. Use context_get_snapshot at entry to capture full state.
2. Step through with debug_step_over / debug_step_into for detailed tracing.
3. Use context_get_snapshot at exit and context_compare_snapshots to see what changed.

Phase 5: Report

=== Function Trace Report ===

Function: [name/symbol]
Address:  0x... - 0x... ([size] bytes)
Module:   [owning module]
Convention: [fastcall/stdcall/cdecl]

Parameters (estimated):
  - Param 1 (x64 RCX / x86 [ESP+4]): [type and description]
  - Param 2 (x64 RDX / x86 [ESP+8]): [type and description]

Internal Calls:
  1. 0x... -> [symbol] (at offset +0x...)
  2. 0x... -> [symbol] (at offset +0x...)

Control Flow:
  - [branches, loops, conditions]

Return Value: [type guess based on usage]

Breakpoints Set:
  - Entry: 0x... (logging parameters)
  - Exit:  0x... (logging return value)