How to convert TimeTravel recorded session to some human readable format

[Swiftly1]

Hi,

I'm not sure if this is the right place to ask, but

How can I convert the recording files into some human readable format?

I've got those files:

---

-a---- 19.02.2025 20:08 33292288 ConsoleApplication101.idx
-a---- 19.02.2025 20:07 2330 ConsoleApplication101.out
-a---- 19.02.2025 20:07 25165824 ConsoleApplication101.run

For example I'd want to convert it into json

and then I'd extract functions visited and how the locals changed when function was executing

Or maybe I should interact with DebugEngine somehow in order to go thru events 1-by-1?

Thanks in advance

[KenSykes]

Today you need to use the debugger interfaces to extract information from the trace. You will want to look at https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-calls-objects and https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-memory-objects to get call and memory access information, respectively. These are the fastest way to extract the information. You can write Javascript code to call these and process the results. You can also navigate to the corresponding positions in the trace using .SwitchTo() on the returned positions and do further investigation. If you do lots of position navigations the performance will get slow, it is a full seek / synchronization with the debugger engine each time.

You can also write a debugger extension and talk to the debugger interfaces directly https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/client-com-interfaces, and/or the C++ data model library to make it easy to access .Calls() / .Memory() mentioned above from a C++ debugger extension. https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/data-model-cpp-overview#-using-the-dbgmodelclientex-library

Converting all events to JSON is not practical: a 2GHz computer is capable of executing ~2 billion instructions / second, each of which is an event.

Hope this helps!