Implement requested changes: use curprocess instead of cursession, cache all events, add checkbox filtering UI

Co-authored-by: xusheng6 <[email protected]>

Author: Copilot

api/debuggerapi.h

@@ -759,6 +759,7 @@ namespace BinaryNinjaDebuggerAPI {
 		std::vector<TTDMemoryEvent> GetTTDMemoryAccessForAddress(uint64_t address, uint64_t size, TTDMemoryAccessType accessType = TTDMemoryRead);
 		std::vector<TTDCallEvent> GetTTDCallsForSymbols(const std::string& symbols, uint64_t startReturnAddress = 0, uint64_t endReturnAddress = 0);
 		std::vector<TTDEvent> GetTTDEvents(TTDEventType eventType);
+		std::vector<TTDEvent> GetAllTTDEvents();
 		TTDPosition GetCurrentTTDPosition();
 		bool SetTTDPosition(const TTDPosition& position);
 

api/debuggercontroller.cpp

@@ -1133,6 +1133,75 @@ std::vector<TTDEvent> DebuggerController::GetTTDEvents(TTDEventType eventType)
 }
 
 
+std::vector<TTDEvent> DebuggerController::GetAllTTDEvents()
+{
+	std::vector<TTDEvent> result;
+	
+	size_t count = 0;
+	BNDebuggerTTDEvent* events = BNDebuggerGetAllTTDEvents(m_object, &count);
+	
+	if (events && count > 0)
+	{
+		result.reserve(count);
+		for (size_t i = 0; i < count; i++)
+		{
+			TTDEvent event;
+			event.type = static_cast<TTDEventType>(events[i].type);
+			event.position.sequence = events[i].position.sequence;
+			event.position.step = events[i].position.step;
+			
+			// Copy optional module details
+			if (events[i].module)
+			{
+				TTDModule module;
+				module.name = events[i].module->name ? std::string(events[i].module->name) : "";
+				module.address = events[i].module->address;
+				module.size = events[i].module->size;
+				module.checksum = events[i].module->checksum;
+				module.timestamp = events[i].module->timestamp;
+				event.module = module;
+			}
+			
+			// Copy optional thread details
+			if (events[i].thread)
+			{
+				TTDThread thread;
+				thread.uniqueId = events[i].thread->uniqueId;
+				thread.id = events[i].thread->id;
+				thread.lifetimeStart.sequence = events[i].thread->lifetimeStart.sequence;
+				thread.lifetimeStart.step = events[i].thread->lifetimeStart.step;
+				thread.lifetimeEnd.sequence = events[i].thread->lifetimeEnd.sequence;
+				thread.lifetimeEnd.step = events[i].thread->lifetimeEnd.step;
+				thread.activeTimeStart.sequence = events[i].thread->activeTimeStart.sequence;
+				thread.activeTimeStart.step = events[i].thread->activeTimeStart.step;
+				thread.activeTimeEnd.sequence = events[i].thread->activeTimeEnd.sequence;
+				thread.activeTimeEnd.step = events[i].thread->activeTimeEnd.step;
+				event.thread = thread;
+			}
+			
+			// Copy optional exception details
+			if (events[i].exception)
+			{
+				TTDException exception;
+				exception.type = static_cast<TTDExceptionType>(events[i].exception->type);
+				exception.programCounter = events[i].exception->programCounter;
+				exception.code = events[i].exception->code;
+				exception.flags = events[i].exception->flags;
+				exception.recordAddress = events[i].exception->recordAddress;
+				exception.position.sequence = events[i].exception->position.sequence;
+				exception.position.step = events[i].exception->position.step;
+				event.exception = exception;
+			}
+			
+			result.push_back(event);
+		}
+		BNDebuggerFreeTTDEvents(events, count);
+	}
+	
+	return result;
+}
+
+
 bool DebuggerController::IsInstructionExecuted(uint64_t address)
 {
 	return BNDebuggerIsInstructionExecuted(m_object, address);

api/ffi.h

@@ -618,6 +618,7 @@ extern "C"
 		const char* symbols, uint64_t startReturnAddress, uint64_t endReturnAddress, size_t* count);
 	DEBUGGER_FFI_API BNDebuggerTTDEvent* BNDebuggerGetTTDEvents(BNDebuggerController* controller,
 		BNDebuggerTTDEventType eventType, size_t* count);
+	DEBUGGER_FFI_API BNDebuggerTTDEvent* BNDebuggerGetAllTTDEvents(BNDebuggerController* controller, size_t* count);
 	DEBUGGER_FFI_API BNDebuggerTTDPosition BNDebuggerGetCurrentTTDPosition(BNDebuggerController* controller);
 	DEBUGGER_FFI_API bool BNDebuggerSetTTDPosition(BNDebuggerController* controller, BNDebuggerTTDPosition position);
 	DEBUGGER_FFI_API void BNDebuggerFreeTTDMemoryEvents(BNDebuggerTTDMemoryEvent* events, size_t count);

api/python/debuggercontroller.py

@@ -2344,6 +2344,85 @@ def get_ttd_events(self, event_type: int) -> List[TTDEvent]:
         dbgcore.BNDebuggerFreeTTDEvents(events, count.value)
         return result
 
+    def get_all_ttd_events(self) -> List[TTDEvent]:
+        """
+        Get all TTD events from the trace.
+
+        This method is only available when debugging with TTD (Time Travel Debugging).
+        Use the is_ttd property to check if TTD is available before calling this method.
+
+        :return: list of all TTDEvent objects in the trace
+        :rtype: List[TTDEvent]
+        """
+        if self.handle is None:
+            return []
+
+        count = ctypes.c_size_t()
+        events = dbgcore.BNDebuggerGetAllTTDEvents(self.handle, ctypes.byref(count))
+
+        result = []
+        if not events or count.value == 0:
+            return result
+
+        for i in range(count.value):
+            event = events[i]
+            
+            position = TTDPosition(event.position.sequence, event.position.step)
+            
+            # Convert optional module details
+            module = None
+            if event.module:
+                module = TTDModule(
+                    name=event.module.contents.name if event.module.contents.name else "",
+                    address=event.module.contents.address,
+                    size=event.module.contents.size,
+                    checksum=event.module.contents.checksum,
+                    timestamp=event.module.contents.timestamp
+                )
+            
+            # Convert optional thread details
+            thread = None
+            if event.thread:
+                lifetime_start = TTDPosition(event.thread.contents.lifetimeStart.sequence, event.thread.contents.lifetimeStart.step)
+                lifetime_end = TTDPosition(event.thread.contents.lifetimeEnd.sequence, event.thread.contents.lifetimeEnd.step)
+                active_time_start = TTDPosition(event.thread.contents.activeTimeStart.sequence, event.thread.contents.activeTimeStart.step)
+                active_time_end = TTDPosition(event.thread.contents.activeTimeEnd.sequence, event.thread.contents.activeTimeEnd.step)
+                
+                thread = TTDThread(
+                    unique_id=event.thread.contents.uniqueId,
+                    id=event.thread.contents.id,
+                    lifetime_start=lifetime_start,
+                    lifetime_end=lifetime_end,
+                    active_time_start=active_time_start,
+                    active_time_end=active_time_end
+                )
+            
+            # Convert optional exception details
+            exception = None
+            if event.exception:
+                exception_position = TTDPosition(event.exception.contents.position.sequence, event.exception.contents.position.step)
+                
+                exception = TTDException(
+                    type=event.exception.contents.type,
+                    program_counter=event.exception.contents.programCounter,
+                    code=event.exception.contents.code,
+                    flags=event.exception.contents.flags,
+                    record_address=event.exception.contents.recordAddress,
+                    position=exception_position
+                )
+
+            ttd_event = TTDEvent(
+                type=event.type,
+                position=position,
+                module=module,
+                thread=thread,
+                exception=exception
+            )
+            result.append(ttd_event)
+
+        dbgcore.BNDebuggerFreeTTDEvents(events, count.value)
+        return result
+
     def __del__(self):
         if dbgcore is not None:
             dbgcore.BNDebuggerFreeController(self.handle)

core/adapters/dbgengttdadapter.cpp

@@ -11,6 +11,7 @@ using namespace std;
 DbgEngTTDAdapter::DbgEngTTDAdapter(BinaryView* data) : DbgEngAdapter(data)
 {
     m_usePDBFileName = false;
+	m_eventsCached = false;
 	GenerateDefaultAdapterSettings(data);
 }
 
@@ -173,6 +174,9 @@ bool DbgEngTTDAdapter::Start()
 void DbgEngTTDAdapter::Reset()
 {
 	m_aboutToBeKilled = false;
+	
+	// Clear TTD events cache when resetting
+	ClearTTDEventsCache();
 
 	if (!this->m_dbgengInitialized)
 		return;
@@ -1354,18 +1358,48 @@ std::vector<TTDEvent> DbgEngTTDAdapter::GetTTDEvents(TTDEventType eventType)
 {
 	std::vector<TTDEvent> events;
 
-	if (!QueryEventsForType(eventType, events))
+	// Cache all events if not already cached
+	if (!m_eventsCached)
 	{
-		LogError("Failed to query TTD events for type %d", eventType);
-		return events;
+		if (!QueryAllTTDEvents())
+		{
+			LogError("Failed to query all TTD events");
+			return events;
+		}
+	}
+	
+	// Filter cached events by type
+	for (const auto& event : m_cachedEvents)
+	{
+		if (event.type == eventType)
+		{
+			events.push_back(event);
+		}
 	}
 
-	LogInfo("Successfully retrieved %zu TTD events", events.size());
+	LogInfo("Successfully retrieved %zu TTD events of type %d from cache", events.size(), eventType);
 	return events;
 }
 
 
-bool DbgEngTTDAdapter::QueryEventsForType(TTDEventType eventType, std::vector<TTDEvent>& events)
+std::vector<TTDEvent> DbgEngTTDAdapter::GetAllTTDEvents()
+{
+	// Cache all events if not already cached
+	if (!m_eventsCached)
+	{
+		if (!QueryAllTTDEvents())
+		{
+			LogError("Failed to query all TTD events");
+			return {};
+		}
+	}
+	
+	LogInfo("Successfully retrieved %zu total TTD events from cache", m_cachedEvents.size());
+	return m_cachedEvents;
+}
+
+
+bool DbgEngTTDAdapter::QueryAllTTDEvents()
 {
 	if (!m_debugHost || !m_hostEvaluator)
 	{
@@ -1375,45 +1409,28 @@ bool DbgEngTTDAdapter::QueryEventsForType(TTDEventType eventType, std::vector<TT
 
 	try
 	{
-		// Build the TTD.Events query expression based on event type
-		std::string expression = GetEventTypeExpression(eventType);
+		// Build the TTD.Events query expression to get all events (using curprocess instead of cursession)
+		std::string expression = "@$curprocess.TTD.Events";
 
 		LogInfo("Executing TTD events query: %s", expression.c_str());
 
-		return ParseTTDEventObjects(expression, eventType, events);
+		m_cachedEvents.clear();
+		if (ParseTTDEventObjects(expression, m_cachedEvents))
+		{
+			m_eventsCached = true;
+			return true;
+		}
+		return false;
 	}
 	catch (const std::exception& e)
 	{
-		LogError("Exception in QueryEventsForType: %s", e.what());
+		LogError("Exception in QueryAllTTDEvents: %s", e.what());
 		return false;
 	}
 }
 
 
-std::string DbgEngTTDAdapter::GetEventTypeExpression(TTDEventType eventType)
-{
-	std::string baseExpression = "@$cursession.TTD.Events";
-	
-	switch (eventType)
-	{
-		case TTDEventThreadCreated:
-			return baseExpression + ".Where(e => e.Type == \"ThreadCreated\")";
-		case TTDEventThreadTerminated:
-			return baseExpression + ".Where(e => e.Type == \"ThreadTerminated\")";
-		case TTDEventModuleLoaded:
-			return baseExpression + ".Where(e => e.Type == \"ModuleLoaded\")";
-		case TTDEventModuleUnloaded:
-			return baseExpression + ".Where(e => e.Type == \"ModuleUnloaded\")";
-		case TTDEventException:
-			return baseExpression + ".Where(e => e.Type == \"Exception\")";
-		default:
-			LogError("Unknown TTD event type: %d", eventType);
-			return baseExpression;
-	}
-}
-
-
-bool DbgEngTTDAdapter::ParseTTDEventObjects(const std::string& expression, TTDEventType eventType, std::vector<TTDEvent>& events)
+bool DbgEngTTDAdapter::ParseTTDEventObjects(const std::string& expression, std::vector<TTDEvent>& events)
 {
 	try
 	{
@@ -1490,6 +1507,33 @@ bool DbgEngTTDAdapter::ParseTTDEventObjects(const std::string& expression, TTDEv
 				break;
 			}
 
+			// Parse event type from the event object first
+			TTDEventType eventType = TTDEventThreadCreated; // default
+			
+			ComPtr<IModelObject> typeObj;
+			if (SUCCEEDED(eventObject->GetKeyValue(L"Type", &typeObj, nullptr)))
+			{
+				VARIANT vtType;
+				VariantInit(&vtType);
+				if (SUCCEEDED(typeObj->GetIntrinsicValueAs(VT_BSTR, &vtType)))
+				{
+					_bstr_t bstr(vtType.bstrVal);
+					std::string typeStr = std::string(bstr);
+					
+					if (typeStr == "ThreadCreated")
+						eventType = TTDEventThreadCreated;
+					else if (typeStr == "ThreadTerminated")
+						eventType = TTDEventThreadTerminated;
+					else if (typeStr == "ModuleLoaded")
+						eventType = TTDEventModuleLoaded;
+					else if (typeStr == "ModuleUnloaded")
+						eventType = TTDEventModuleUnloaded;
+					else if (typeStr == "Exception")
+						eventType = TTDEventException;
+				}
+				VariantClear(&vtType);
+			}
+			
 			TTDEvent event(eventType);
 
 			// Parse Position
@@ -1838,6 +1882,13 @@ void DbgEngTTDAdapter::ParseTTDPosition(IModelObject* positionObj, TTDPosition&
 }
 
 
+void DbgEngTTDAdapter::ClearTTDEventsCache()
+{
+	m_cachedEvents.clear();
+	m_eventsCached = false;
+}
+
+
 void BinaryNinjaDebugger::InitDbgEngTTDAdapterType()
 {
     static DbgEngTTDAdapterType localType;

core/adapters/dbgengttdadapter.h

@@ -56,6 +56,7 @@ namespace BinaryNinjaDebugger {
 
     	// TTD Events Analysis Methods
     	std::vector<TTDEvent> GetTTDEvents(TTDEventType eventType) override;
+    	std::vector<TTDEvent> GetAllTTDEvents() override;
 
     	void GenerateDefaultAdapterSettings(BinaryView* data);
     	Ref<Settings> GetAdapterSettings() override;
@@ -69,13 +70,19 @@ namespace BinaryNinjaDebugger {
 		bool ParseTTDCallObjects(const std::string& expression, std::vector<TTDCallEvent>& events);
 
 		// Helper methods for TTD events analysis
-		bool QueryEventsForType(TTDEventType eventType, std::vector<TTDEvent>& events);
-		bool ParseTTDEventObjects(const std::string& expression, TTDEventType eventType, std::vector<TTDEvent>& events);
-		std::string GetEventTypeExpression(TTDEventType eventType);
+		bool QueryAllTTDEvents();
+		bool ParseTTDEventObjects(const std::string& expression, std::vector<TTDEvent>& events);
 		void ParseThreadDetails(IModelObject* eventObject, TTDEvent& event);
 		void ParseModuleDetails(IModelObject* eventObject, TTDEvent& event);
 		void ParseExceptionDetails(IModelObject* eventObject, TTDEvent& event);
 		void ParseTTDPosition(IModelObject* positionObj, TTDPosition& position);
+		
+		// TTD Events cache
+		std::vector<TTDEvent> m_cachedEvents;
+		bool m_eventsCached;
+		
+		// Method to clear TTD events cache
+		void ClearTTDEventsCache();
 
 		// Data model helper methods
 		std::string EvaluateDataModelExpression(const std::string& expression);

core/debugadapter.cpp

@@ -200,6 +200,13 @@ std::vector<TTDEvent> DebugAdapter::GetTTDEvents(TTDEventType eventType)
 }
 
 
+std::vector<TTDEvent> DebugAdapter::GetAllTTDEvents()
+{
+	// Default implementation returns empty results for adapters that don't support TTD
+	return {};
+}
+
+
 TTDPosition DebugAdapter::GetCurrentTTDPosition()
 {
 	// Default implementation returns an empty position for adapters that don't support TTD