how to open Windbg run/trace file?

[username7778]

hello i want to open a trace from windbg preview but debugger-open trace is not showing the trace file.

thx for help

[d-millar]

Hi @username7778,

Thanks for your question - and apologies in advance. We really have not figured out a good story regarding how we want to process TTD files and what our time-travel debugging interface should look like. We're very interested in these things, but getting the debugger up and running for more basic targets has been out priority.

That said, try this:

Assuming your target is notepad.exe and you have a trace file called "notepad01.run"....
(1) Load notepad.exe into the debugger tool, much as you normally would in the Ghidra CodeBrowser tool, i.e. File->Import..., answer the relevant question, let the analysis complete. NB: This step is actually important. If notepad.exe isn't the focused program in the (static) Listing window in the tool, you're unlikely to see anything.
(2) In the Objects Viewer, open Debugger->Connectors and select Load trace/dump.
(3) With that node selected, hit the button marked "Launch".
(4) You should get a dialog with two fields, Cmd and File. Leave the Cmd entry as ".opendump". For the File parameter, enter the full path to "notepad01.run" (probably with double slashes, if I remember correctly) - something like C:\Users\d-millar\Downloads\notepad01.run.
(5) Hit launch and wait a bit depending on the size of your trace file. (This can take a while.)
(6) Ignore what currently seem to be a lot of stack traces and error messages in the background, which are (hopefully) not going to stop the trace from loading.
(7) If it didn't happen automatically (and it might not), open the node Sesssions->0x0->Processes->....

If you don't see anything at this point, well, things have gone wrong. Write back - I'll try to get you past whatever happened!

A couple of notes:
(1) You may want to read the comments in the #2730 Design choice for timeless debugging. They're somewhat relevant.
(2) The time marker concepts in TTD and in Ghidra are currently not synchronized, so you probably want to use the Interpreter window and the standard Windbg commands to navigate the TTD time position. The Threads window can be used to navigate Ghidra's position in time but that window will only reflect actions taken in Ghidra - not in the trace in general.
(3) As in the #2730 discussion, there are ways to populate the Ghidra trace from the TTD trace, but they're expensive and slow.

Again, many apologies - even as I'm writing these instructions, I'm cringing. Would be pretty unlikely anyone would figure this out on their own in the current state.

D

[d-millar]

Hmmmm, looking at this again and apparently step (1) is NOT necessary, also in step (4) double backslashes (which - aarrgh - did not show up in my post) are not required. I do, however, think (7) might be the crucial bit. For reasons, I have yet to nail down, the active process may or may not get selected. Appears to be a timing issue. In any case, if it is not selected, the trace will not be activated and most of the GUI will be empty. Opening the Session[0x0] should re-trigger the trace and "solve" the problem.

[zucler]

Is there a better way to open a .run file after a year? :)

I'm still trying to follow the above instructions, but it looks like a lot has been changed. Am unable to locate "Objects Viewer -> Debugger -> Connectors -> Load trace/dump"

[d-millar]

@zucler So, right now, "Objects Viewer->Debugger->Connectors->Load trace/dump" should be available when connecting with the GADP variant of dbgmodel. Have recently added it to the IN-VM variant, but that code isn't in the build yet. (The GADP dbgeng version might (?) also have "Load trace/dump", but I wouldn't recommend it if you have dbgmodel working because the support for tracing is better under Windbg Preview".) Just as a heads up, there are still issues populating the Ghidra trace backend from a TTD trace if that's something you're interested in.