execution_tracer.py

import re
import sys
import pefile
from pydbg import *
from pydbg.defines import *

def parseidalog(file):
	all_funcs = []
	f = open(file)
	funcs = f.readlines()
	f.close()
	for func in funcs:
		if 'sub_' in func:
			m = re.search('.text .+ 0', func)
			addr = '0x'+m.group(0)[6:-2].replace('\n','')
			addr = int(addr, 16)
			all_funcs.append(addr)
	return all_funcs
def printeip(dbg):
	eip = dbg.context.Eip
	if eip not in most_used_funcs:
		most_used_funcs.append(eip)
		print 'Break Point Hit  ', hex(eip)
	return DBG_CONTINUE
def setallbp(dbg):
	for fun in all_func:
		#print '[+] Setting soft bp on ',hex(fun)
		dbg.bp_set(fun,handler=printeip)
	return DBG_CONTINUE
def main():
	global all_func
	global most_used_funcs
	most_used_funcs = []
	all_func = parseidalog('ida-export.txt')
	dbg = pydbg()
	exe_file = sys.argv[1]
	pe = pefile.PE(exe_file)
	dbg = pydbg()
	dbg.load(exe_file)
	entry = pe.OPTIONAL_HEADER.ImageBase + pe.OPTIONAL_HEADER.AddressOfEntryPoint
	dbg.bp_set(entry,handler=setallbp)
	dbg.run()

if __name__ == '__main__':
	main()