{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/hasherezade/tiny_tracer/wiki/Installation/bfcee7fad835f06437b3a6c2410cc38d276b855b",
    "https://github.com/hasherezade/tiny_tracer/wiki/The-INI-file/e48e12d46454008e8d2a1b55a247329c554cc4b7",
    "https://github.com/hasherezade/tiny_tracer/wiki/Using-the-TAGs-with-disassemblers-and-debuggers/215f7cae78a12ffdc1f646000e216fdb517658cd",
    "https://github.com/hasherezade/tiny_tracer/wiki/Tracing-shellcodes/4f8169a1a84f11f773b148f65913fdc486e5c1b9",
    "https://github.com/hasherezade/tiny_tracer/blob/99618fc0569a4a06b7955e507e1707792ad1bef5/install32_64/README.md",
    "https://github.com/hasherezade/tiny_tracer/tree/99618fc0569a4a06b7955e507e1707792ad1bef5/install32_64",
    "https://github.com/hasherezade/tiny_tracer/blob/99618fc0569a4a06b7955e507e1707792ad1bef5/LICENSE.txt",
    "https://github.com/hasherezade/tiny_tracer/releases/tag/4.0"
  ],
  "category": "dynamic-analysis",
  "description_en": "Intel Pin tool by hasherezade that traces a 32- or 64-bit program while it runs on Windows or Linux, logging API calls (with arguments and return values for watched functions), chosen local and statically linked functions, inline system calls, RDTSC, CPUID and INT instructions, and transitions between sections of the traced module, which helps find the original entry point of a packed module. It can follow code the module unpacks into new memory, disassemble selected ranges and, on Windows, flag the anti-debug and anti-VM checks a sample performs. Each run writes a .tag file of RVA;event lines that PE-bear reads natively and that the wiki shows loading into IDA Pro, Binary Ninja, x64dbg, Ghidra and Cutter to annotate code.",
  "description_zh": "hasherezade 开发的 Intel Pin 插桩工具，在 Windows 或 Linux 上跟踪运行中的 32 位或 64 位程序，记录 API 调用（对监视的函数还会记录参数和返回值）、指定的本地函数和静态链接库函数、内联系统调用、RDTSC、CPUID 和 INT 指令，以及被跟踪模块各节区之间的跳转，有助于找到加壳模块的原始入口点。它可以继续跟踪模块解包到新内存中的代码，对选定范围进行反汇编，并可在 Windows 上标记样本执行的反调试和反虚拟机检查。每次运行都会生成由“RVA;事件”行组成的 .tag 文件，PE-bear 可直接读取，Wiki 还演示了将其导入 IDA Pro、Binary Ninja、x64dbg、Ghidra 和 Cutter 以标注代码。",
  "entry_url": "https://awesomerea.org/resources/tiny-tracer/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/tiny-tracer/",
  "evidence_url": "https://github.com/hasherezade/tiny_tracer/blob/99618fc0569a4a06b7955e507e1707792ad1bef5/README.md",
  "group": "tools",
  "id": "tiny-tracer",
  "json_url": "https://awesomerea.org/resources/tiny-tracer/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/tiny-tracer/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/tiny-tracer/index.md",
  "name": "Tiny Tracer",
  "name_zh": "Tiny Tracer API 调用跟踪工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Release at review: 4.0, published 2026-05-28 and refactored for Intel Pin 4.x; the reviewed master commit is two commits ahead of it. Releases contain source only, because, as the release notes and installation guide explain, Pin's license does not allow distributing compiled Pin tools. Users download Pin themselves and build the tool inside Pin's source/tools tree; the README names Pin 4.2 as the version tested, Pin before 4.0 needs a pre-4.0 release with the legacy build, and Windows versions older than 8 also need the legacy build.",
    "Windows builds use MSYS2 make with clang-cl, with Visual Studio 2019 or later optional as an editor; Linux builds use g++ and make. Both scripts produce 32- and 64-bit builds in install32_64, which holds run_me.bat with context-menu .reg files, pin_attach.bat for attaching to a running process, tiny_runner.sh for Linux, and the TinyTracer.ini, params.txt and excluded.txt settings. The README says kernel debugging must be disabled for Pin to work.",
    "install32_64 also commits the author's prebuilt Windows helpers dll_load32.exe, dll_load64.exe, kdb_check.exe, pe_check.exe and syscall_extract.exe, whose sources are in the separate hasherezade/pe_utils repository; the README notes that Windows Defender sometimes flags kdb_check.exe, a known false positive. The anti-debug and anti-VM modes are Windows-only, and the deep anti-debug mode is documented as prone to false positives. The analyst supplies the program to trace, which executes natively under Pin.",
    "GPL-2.0 in LICENSE.txt; Intel Pin keeps its own license. Traces cover only code that executes during the run."
  ],
  "requirements_zh": [
    "审阅时的版本为 4.0，发布于 2026-05-28，已针对 Intel Pin 4.x 重构；所审阅的 master 提交比该版本多两个提交。发布版本只提供源码，因为发布说明和安装指南指出，Pin 的许可不允许分发编译好的 Pin 工具。使用者需自行下载 Pin，并在 Pin 的 source/tools 目录下构建本工具；README 称已测试的版本为 Pin 4.2，Pin 4.0 以前的版本需使用 4.0 之前的发布版本及其旧版构建方式，Windows 8 以前的系统同样需要旧版构建。",
    "Windows 构建使用 MSYS2 的 make 和 clang-cl，Visual Studio 2019 及以上版本可选用作编辑器；Linux 构建使用 g++ 和 make。两种构建脚本都会在 install32_64 中生成 32 位和 64 位版本，该目录还包含配合右键菜单 .reg 文件使用的 run_me.bat、用于附加到运行中进程的 pin_attach.bat、Linux 上使用的 tiny_runner.sh，以及 TinyTracer.ini、params.txt 和 excluded.txt 配置文件。README 指出必须禁用内核调试，Pin 才能正常工作。",
    "install32_64 中还提交了作者预编译的 Windows 辅助程序 dll_load32.exe、dll_load64.exe、kdb_check.exe、pe_check.exe 和 syscall_extract.exe，其源码位于独立的 hasherezade/pe_utils 仓库；README 提到 Windows Defender 有时会将 kdb_check.exe 误报为恶意软件，这是已知的误报。反调试与反虚拟机模式仅支持 Windows，文档称深度反调试模式可能产生误报。被跟踪的程序由分析人员自行提供，并在 Pin 下原生执行。",
    "LICENSE.txt 采用 GPL-2.0；Intel Pin 沿用其自身许可。跟踪结果只覆盖本次运行中实际执行的代码。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/hasherezade/tiny_tracer",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}