diff --git a/GhidraDocs/GhidraClass/Debugger/A4-MachineState.html b/GhidraDocs/GhidraClass/Debugger/A4-MachineState.html index a0ca3dd35b..6d9f1ea6ff 100644 --- a/GhidraDocs/GhidraClass/Debugger/A4-MachineState.html +++ b/GhidraDocs/GhidraClass/Debugger/A4-MachineState.html @@ -318,10 +318,9 @@ after a call to rand

Just as the Dynamic Listing is the analog of the Static Listing, the Memory viewer is the analog of the Bytes viewer. To open it, use Windows → Byte Viewer → Memory … in the menus. Its -default configuration should be Auto PC, the same as the Dynamic -Listing’s default. It has all the same additional Debugger features as -the Dynamic Listing. Furthermore, bytes that have changed are displayed -in red text.

+configuration should be Auto PC, the same as the Dynamic Listing’s. It +has all the same additional Debugger features as the Dynamic Listing. +Furthermore, bytes that have changed are displayed in red text.

Exercise: Display the Board in Hex

This is a bit quick and dirty, but it works and can be useful. Your @@ -417,6 +416,8 @@ which adds the current selection to the Watches window.

Stubbing External Calls

@@ -803,13 +803,13 @@ is ephemeral. according to the assigned type.

As you step, you may notice the schedule changes. It is displayed in -the stepper’s subtitle as well as the Threads panel’s subtitle. P-code -stepping is denoted by the portion of the schedule following the dot. +the stepper’s subtitle as well as in the trace tab. P-code stepping is +denoted by the portion of the schedule following the dot. NOTE: You cannot mix instruction steps with p-code op -steps. The instruction steps always precede the p-code ops. If you click -Step Into from the global toolbar in the middle of an -instruction, the trailing p-code op steps will be removed and replaced -with a single instruction step. In most cases, this intuitively +steps. The instruction steps always precede the p-code op steps. If you +click Step Into from the global toolbar in the middle +of an instruction, the trailing p-code op steps will be removed and +replaced with a single instruction step. In most cases, this intuitively “finishes” the partial instruction.

diff --git a/GhidraDocs/GhidraClass/Debugger/B2-Emulation.md b/GhidraDocs/GhidraClass/Debugger/B2-Emulation.md index a2062cd75c..8f3ce8b85f 100644 --- a/GhidraDocs/GhidraClass/Debugger/B2-Emulation.md +++ b/GhidraDocs/GhidraClass/Debugger/B2-Emulation.md @@ -40,7 +40,7 @@ This is perhaps the easiest use case, assuming you already have started a live s *Extrapolation* is predicting execution of the target into the future, without allowing the actual target to execute. Instead, we will allow an emulator to step forward, while reading its initial state from the live target. This allows you, e.g., to experiment with various patches, or to force execution down a certain path. -If you devise a patch, you can then apply it the live target and allow it to execute for real. +If you devise a patch, you can then apply it to the live target and allow it to execute for real. *Interpolation* is similar, but from a snapshot that is in the past. It can help answer the question, "How did I get here?" It is more limited, because missing state for snapshots in the past cannot be recovered. @@ -251,7 +251,7 @@ It is possible we may only need to initialize `argc`, since the parser may not a Use the Watches window to set `RDI` to 1, then click ![resume button](images/resume.png) **Resume**. Like before, the emulator will crash, but this time you should see "pc = 00000000" in red. This probably indicates success. -In the Threads window, you should see a schedule similar to `0:t0-{RDI=0x1);t0-16`. +In the trace tab, you should see a schedule similar to `0:t0-{RDI=0x1);t0-16`. This tells us we first patched RDI, then emulated 16 machine instructions before crashing. When the parser function returned, it probably read a stale 0 as the return address, so we would expect a decode error at `00000000`. Step backward once to confirm this hypothesis. @@ -475,9 +475,9 @@ The columns are: * The **Repr** column gives the variable's value according to the assigned type. As you step, you may notice the schedule changes. -It is displayed in the stepper's subtitle as well as the Threads panel's subtitle. +It is displayed in the stepper's subtitle as well as in the trace tab. P-code stepping is denoted by the portion of the schedule following the dot. **NOTE**: You cannot mix instruction steps with p-code op steps. -The instruction steps always precede the p-code ops. +The instruction steps always precede the p-code op steps. If you click **Step Into** from the global toolbar in the middle of an instruction, the trailing p-code op steps will be removed and replaced with a single instruction step. In most cases, this intuitively "finishes" the partial instruction. diff --git a/GhidraDocs/GhidraClass/Debugger/images/Emulation_WatchesForCmdline.png b/GhidraDocs/GhidraClass/Debugger/images/Emulation_WatchesForCmdline.png index 81220e058f..02f7d907f9 100644 Binary files a/GhidraDocs/GhidraClass/Debugger/images/Emulation_WatchesForCmdline.png and b/GhidraDocs/GhidraClass/Debugger/images/Emulation_WatchesForCmdline.png differ diff --git a/GhidraDocs/GhidraClass/Debugger/images/Emulation_WatchesForCmdlineSet.png b/GhidraDocs/GhidraClass/Debugger/images/Emulation_WatchesForCmdlineSet.png index 28951d37c1..5913c71d1e 100644 Binary files a/GhidraDocs/GhidraClass/Debugger/images/Emulation_WatchesForCmdlineSet.png and b/GhidraDocs/GhidraClass/Debugger/images/Emulation_WatchesForCmdlineSet.png differ diff --git a/GhidraDocs/GhidraClass/Debugger/images/State_WatchesInCallSRand.png b/GhidraDocs/GhidraClass/Debugger/images/State_WatchesInCallSRand.png index 45f59b80c9..85b7ff605e 100644 Binary files a/GhidraDocs/GhidraClass/Debugger/images/State_WatchesInCallSRand.png and b/GhidraDocs/GhidraClass/Debugger/images/State_WatchesInCallSRand.png differ