Tool
Tenet
IDA Pro plugin for exploring execution traces of a binary: it loads an externally recorded trace and lets the analyst step forwards and backwards through time while the disassembly shows the execution flow in both directions. Execution, memory and region breakpoints mark every execution of an instruction or every read and write of an address or range along a trace timeline, register seeking jumps to the instruction that set a register's value, and a timestamp shell seeks to a position or percentage of the trace.
- Targets
- Binary
- Category
- Debugging and dynamic analysis
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: IDA Pro 7.5 or newer on Windows, macOS or Linux; Tenet is a pure Python 3 plugin with no third-party dependencies, installed by copying the repository's plugins folder into IDA's user plugin directory. Release at review: v0.2.0, published 2021-09-14, whose tag is the reviewed master commit.
- Limits: Tenet only reads traces in its own text format, which records general-purpose register changes and memory reads and writes; a separate tracer must record them, and the repository's Intel Pin tracer for Windows and Linux user-mode programs and its QEMU tracer are marked experimental.
- Limits: It loads only x86 and AMD64 traces, and its pure-Python reader gives no guarantee that traces of more than 10 million instructions stay reasonable to navigate.
- License: MIT per LICENSE.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · gaasedelen/tenet · Revision 62c0bec
- tracers/README.md GitHub · gaasedelen/tenet · Revision 62c0bec
- LICENSE GitHub · gaasedelen/tenet · Revision 62c0bec
- https://github.com/gaasedelen/tenet/releases/tag/v0.2.0
More in Native binaries
- findcrypt-yara · Tool
- deREferencing · Tool
- HexRays Toolbox · Tool
- Virtuailor · Tool
- xAnalyzer · Tool
- Voltron · Tool