StartApiTrace
Prepare an API call trace session by enumerating matching module imports and setting silent breakpoints, without running the debuggee; use RunApiTrace to collect calls.
Instructions
Set up (but do not yet run) an API call trace session.
Enumerates imports matching filter_json in modules_json and sets
silent+continue-on-hit breakpoints on each target. Use RunApiTrace to
drive the debuggee and collect calls.
Args:
modules_json: JSON array of module names (e.g. ["kernel32.dll","ws2_32.dll"]).
Empty → typical OS modules (kernel32/user32/advapi32/ws2_32/wininet/ntdll).
filter_json: JSON array of substrings to match module!func.
Empty → DEFAULT_API_FILTERS (file I/O, memory, process, net, crypto, etc.)
custom_targets_json: Strict JSON array of explicit loaded-module
targets. Each item selects exactly one symbol, RVA, or address.
kind="import-resolver" records custom/hash resolver returns as
exact PE exports using supplied resolver argument metadata.
arg_count: Number of args to sample per call (default 4, max 8).
label: Optional session label.
max_targets: Max number of BPs to actually set (default 200). If the
filter matches more, returns an error listing counts per module so
the caller can narrow the filter.
subscribe_modules: Periodically discover matching exports in modules
that load after the trace starts.
discover_dynamic_resolvers: Add a bounded owned breakpoint for a
matching function pointer returned by GetProcAddress.
native_return_hooks: Let the native breakpoint callback install and
remove return hooks. Python remains a fail-safe if native
scheduling is unavailable or rejects a hook.
Returns summary: {ok, traceId, targetCount, modules, filters, warnings}.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | ||
| arg_count | No | ||
| filter_json | No | ||
| max_targets | No | ||
| modules_json | No | ||
| caller_filter | No | ||
| max_out_bytes | No | ||
| capture_returns | No | ||
| capture_callstack | No | ||
| subscribe_modules | No | ||
| decode_string_args | No | ||
| custom_targets_json | No | ||
| native_return_hooks | No | ||
| max_callstack_frames | No | ||
| collapse_nested_families | No | ||
| discover_dynamic_resolvers | No |