tracealyzer

tracealyzer

Trace debuggee execution — stepping into or over calls — for a specified number of instructions or until a condition is met. The full instruction log is captured to a file and then analyzed.

Instructions

Follow these steps exactly:

1. Verify debugger connection

Call mcp__x64dbg__get_debugger_status to confirm the debugger is connected and a debuggee is loaded and paused. If it is running, call mcp__x64dbg__pause. If no debuggee is loaded, tell the user and stop.

2. Gather trace parameters

Ask the user for the following if not already provided:

• Trace mode: trace into calls or trace over calls (default: over)
• Stop condition — one of:
  • A maximum number of instructions (e.g. 1000)
  • An x64dbg expression that stops when true (e.g. cip == 0x7FF6A0001000, rax != 0)
  • Both (whichever triggers first)

If the user provides a symbol or address for the stop condition, resolve it with mcp__x64dbg__eval_expression and build the break_condition expression (e.g. cip == <resolved_addr>).

When the user only specifies a step count N and no explicit break condition, use break_condition 0 (never true — the trace runs until max_steps is hit).

3. Capture starting context

Call mcp__x64dbg__get_all_registers and mcp__x64dbg__disassemble at the current instruction pointer to record the starting state. Note the starting address.

4. Run the trace

Prepare the output log path: ./traces/trace_<timestamp>.log (create the traces directory if it doesn't exist via Bash).

Call the appropriate trace tool (mcp__x64dbg__trace_into or mcp__x64dbg__trace_over) with:

Parameter	Value
break_condition	The user's condition, or 0 if only a step count was given
max_steps	The user's step count, or 50000 if only a condition was given
log_text	`{p:cip} {i:cip}
log_file	The output log path from above
wait_timeout	Scale with max_steps — use max(60, max_steps // 500) seconds