hasherezade/tiny_tracer

Health v2 · maintenance only

Adoption not part of the score

1692 stars · 169 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Pin Tool built on Intel Pin for dynamic binary instrumentation that traces API calls, syscalls, selected instructions, and section transitions in executables. It generates .tag reports that can be loaded into disassemblers and debuggers, and evades some known anti-debug and anti-VM techniques.

Use cases

• trace API calls made by a Windows executable
• analyze malware behavior in a sandbox
• find the OEP of a packed binary
• log syscall parameters during dynamic analysis
• trace function inputs and outputs of selected APIs
• detect anti-debug and anti-VM tricks in a sample
• export trace results into IDA or other analysis tools

When to choose

• you need lightweight API/syscall tracing of a Windows PE binary
• you are doing malware analysis and want to bypass common anti-analysis checks
• you want trace output importable into disassemblers like IDA

When to avoid

• you need a full debugger with interactive stepping
• you target platforms other than Windows PE binaries
• you cannot use Intel Pin as the instrumentation backend

Facets

cli-tool · maturity active

reverse-engineering tracing security developer-tools reverse-engineering security developer-tools windows cli intel-pin dynamic-binary-instrumentation malware-analysis api-tracing anti-debug-evasion linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="hasherezade/tiny_tracer")