# Debugger: Threads and Traces

In general, a thread refers to a unit of concurrent execution within a target. Typically, each thread carries its own execution context, so this window provides a means of navigating those contexts. Furthermore, this window provides a means of navigating and managing open traces, much like the static listing provides a means of navigating open programs. The window also plots a timeline showing thread lifespans, and displays a caret which can be used to navigate the current point in time. This window, the Stack window, and the Dynamic Listing window provide a complete trace navigation system.

## Trace Tabs

The trace tab bar is displayed when at least one trace is open. It displays the name of each open trace in a button, where the "current" or "focused" trace is selected. Clicking a tab will select its trace and focus the tool onto it. A trace associated with a live target has a red "recording" icon at its left. If that icon is not present, or has disappeared, the trace is dead or terminated. A "dead" trace can still be manipulated and marked up, but it will not record any new target information.

In most cases, a trace is ephemeral, but occasionally, interesting behavior is observed that is difficult to store as static mark-up. When a trace is no longer needed, it can be closed by right-clicking the tab and selecting "Close Trace." Warning: closing a trace that has not been saved cannot be undone. If you accumulate many unwanted traces, use one of the "Close Others," "Close Dead," or "Close All" actions from the pop-up menu.

## Navigating Threads

Selecting a thread in the table will navigate to (or "activate" or "focus") that thread. Windows which are sensitive to the current thread will update. Notably, the Registers window will display the activated thread's register values. Listing windows with configured location tracking will re-compute that location with the thread's context and navigate to it. The thread timeline plots all recorded threads. Threads which are alive will appear to extend "to the end of time." The threads table displays more detailed information in the following columns:

- Name - the name of the thread given by the debugger. Often, this is just an index or unique id assigned to the thread. This field can be modified, but it has no effect on the target.
- Created - the snapshot when this thread was first observed. If the thread's creation was observed, then it is its creation time.
- Destroyed - if destroyed, the snapshot when this thread was last observed. If the thread's destruction was observed, then it is its destruction time.
- State - the thread's current state. For a dead trace, this is either ALIVE or TERMINATED, and depends solely on whether or not a destruction time was recorded. For a live trace, this may also take RUNNING, STOPPED, or UNKNOWN, depending on what is reported by the debugger. The state always reflects the present, or latest known, state.
- Comment - a user-modifiable comment about the thread.
- Plot - a graphical representation of the thread's lifespan. Unlike other column headers, clicking and dragging in this one will navigate through time. To rearrange this column, hold SHIFT while dragging.

## Navigating Time

The user can navigate through time within the current trace by using the caret in the plot column header. There are also actions for "stepping the trace" forward and backward. See the Time window for a way to display and navigate to specific events in the trace's timeline. Note that stepping away from the present will prevent most windows from interacting with the live target. While some components and scripts may interact with the target and record things "into the present," such updates may not appear on screen until the user steps back to the present. Stepping the trace does not affect the target, except that viewing the present requires querying the live target, which can perturb its state.

### Step Trace Snap Backward

This action is available when there exists a snapshot previous to the current. It steps the trace backward to the previous snapshot, causing most windows to display the recorded data from the new point in time.

### Step Trace Snap Forward

This action is available when there exists a snapshot ahead of the current. It steps the trace forward to the next snapshot, causing most windows to display the recorded data from the new point in time.

### Step Trace Tick Backward

This action is available when the current point in time includes emulated steps. It steps the trace backward to the previous tick.

### Step Trace Tick Forward

This action is available when a thread is selected. It steps the current thread forward to the next tick, using emulation. Note that emulation does not affect the target. Furthermore, emulation may halt early if it encounters certain instructions or causes an exception.

### Seek Trace to Present

This toggle is always available and is enabled by default. When first enabled, if the current trace is live, it immediately steps the trace to the present. Furthermore, as long as it is enabled and the current trace is live, whenever the recorder steps forward, the tool steps with it. In most cases, this option should remain on, otherwise stepping the target will not cause any windows to update. Toggling it off then on is a quick way to return to the present after browsing the past.

## Other Actions

### Synchronize Trace and Target Focus

This toggle is always available and is enabled by default. While enabled, any changes in navigation coordinates are translated, to the extent possible, and sent to the connected debugger. This may, for example, issue `thread` and/or `frame` commands to GDB so that commands typed into its CLI will refer to the same thread and frame as is focused in Ghidra. Conversely, any debugger events which indicate a change in focus are translated, to the extent possible, into navigation coordinates and activated in Ghidra. For example, if the user issues a `frame` command to the CLI of a GDB connection, then Ghidra will navigate to that same frame.