Implementation of an extension to WinDbg: machine instruction tracer?

Question

Debugging

Task. It took me to write an extension to WinDbg. We need a tracer that can execute one x86-64 machine instruction after another while writing logs in between. Standard commands do not seem p / pa / par / wtto be suitable because a very detailed customization is needed - so that you can specify "do not enter here, fly here without stopping, enter here only if RAX!=0, but do not write logs, write short logs here, and here everything including the contents gets into the log such and such memory addresses ... " Well, in general, it's understandable.
Problem. I've never written anything like this before, so a lot of (maybe stupid) technical questions come up along the way. For example, it is better to put a breakpoint on the next instruction each time by IDebugControl::AddBreakpoint(...)delegating part of the work to the debugger or by SetThreadContext(...)puttingtrap flag and catch EXCEPTION_SINGLE_STEP? And what about multi-threaded applications? Do I need to switch streams manually or "it just sort of happens by itself"?
Actually, a question. Maybe someone knows on the net suitable code examples / open-source projects in which one could peep the implementation of such (or at least similar) extensions? I honestly googled, and even found some bits of information, but I didn’t come across something solid working (at least proof-of-concept) on this topic. It is unlikely that I was the first to need such a feature as tracing machine instructions in WinDbg, for sure someone somewhere has already done this. That would be a glimpse of how it works for them.
Thanks in advance for the links.

Answer 1

Are you sure this will help you? Even an ordinary breakpoint with a macro attached to it, IMHO, does not work very well. And you want to put one of these on each instruction. I'm afraid you won't be able to wait until the end of the log collection. Perhaps it's easier to find a different approach to the problem?
PS how to subscribe to receive e-mail with new replies?