Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
tiny_tracer — Intel Pin-based tracer for API calls, syscalls, and instructions with anti-debug evasion, used for malware analysis and reverse engineering of packed binaries. | Kitploit
Tools/GitHubGitHub/hasherezade/tiny_tracer
Dynamic Analysis (Sandboxing)Reverse EngineeringMalware AnalysisBinary AnalysisAPI Security
GitHubhasherezade/tiny_tracer

tiny_tracer

Intel Pin-based tracer for API calls, syscalls, and instructions with anti-debug evasion, used for malware analysis and reverse engineering of packed binaries.

View Repository
1.7k1682 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

tiny_tracer

Codacy Badge Commit activity Last Commit Build status

GitHub release GitHub release date

A Pin Tool for tracing:

  • API calls, including input and output of selected functions
  • defined local functions, and functions from statically linked libraries
  • selected instructions: RDTSC, CPUID, INT
  • inline system calls, including parameters of selected syscalls
  • transition between sections of the traced module (helpful in finding OEP of the packed module)
  • executed instructions in defined code fragments

Evades some of the known anti-debug and anti-VM techniques

Generates a report in a .tag format (which can be loaded into other analysis tools):

root@kitploit:~
RVA;traced event

i.e.

root@kitploit:~
345c2;section: .text
58069;called: C:\Windows\SysWOW64\kernel32.dll.IsProcessorFeaturePresent
3976d;called: C:\Windows\SysWOW64\kernel32.dll.LoadLibraryExW
3983c;called: C:\Windows\SysWOW64\kernel32.dll.GetProcAddress
3999d;called: C:\Windows\SysWOW64\KernelBase.dll.InitializeCriticalSectionEx
398ac;called: C:\Windows\SysWOW64\KernelBase.dll.FlsAlloc
3995d;called: C:\Windows\SysWOW64\KernelBase.dll.FlsSetValue
49275;called: C:\Windows\SysWOW64\kernel32.dll.LoadLibraryExW
4934b;called: C:\Windows\SysWOW64\kernel32.dll.GetProcAddress
...

🚧 How to build

It was tested with Intel Pin 4.2.

You can build it on Windows or on Linux. Detailed descriptions available here.

If you have any problems with building the project on Windows, you can use the test builds from the AppVeyor server. Select the platform, and then 'Artifacts'. Check the 'Console' output to see what version of Pin is required to use them. Then, follow the installation instructions.

⚙ Usage

📖 Details about the usage you will find on the project's Wiki.

🛠 Helpers

For automatic generation of params.txt for API arguments tracing, try IAT-Tracer by YoavLevi

WARNINGS

  • In order for Pin to work correctly, Kernel Debugging must be DISABLED.
  • In install32_64 you can find a utility that checks if Kernel Debugger is disabled (kdb_check.exe, source), and it is used by the Tiny Tracer's .bat scripts. This utility sometimes gets flagged as a malware by Windows Defender (it is a known false positive). If you encounter this issue, you may need to exclude the installation directory from Windows Defender scans.
  • Since the version 3.20 Pin has dropped a support for old versions of Windows. If you need to use the tool on Windows < 8, follow the Legacy Build.

🤔 Questions? Ideas? Join Discussions!

Download Tool