# Tiny Tracer | A Pin Tool For Tracing API Calls Etc

**URL:** <https://onehack.st/t/tiny-tracer-a-pin-tool-for-tracing-api-calls-etc/255154>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, hacking\
**Created:** [September 5, 2023, 10:17pm UTC](https://onehack.st/t/tiny-tracer-a-pin-tool-for-tracing-api-calls-etc/255154 "2023-09-05T22:17:24Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid)\
**Post date:** [September 5, 2023, 10:17pm UTC](https://onehack.st/t/tiny-tracer-a-pin-tool-for-tracing-api-calls-etc/255154/1 "2023-09-05T22:17:24Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/1/6/160558b037b80c0f1bb12d10df6c61397c2e4342.png)

# Tiny\_tracer

[![Codacy Badge](https://camo.githubusercontent.com/dafac35185fcd7b709d97697308788401bae1e0110070bddf9257f000a6157f0/68747470733a2f2f6170702e636f646163792e636f6d2f70726f6a6563742f62616467652f47726164652f6639383831383062666234643435656262653437363462646531303538633266)](https://app.codacy.com/gh/hasherezade/tiny_tracer/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade) [![Commit activity](https://camo.githubusercontent.com/559f2cf7469d77120acff375a46b9f3dd8c30b0702dda4819eadd6641ccd8dfb/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f636f6d6d69742d61637469766974792f6d2f686173686572657a6164652f74696e795f747261636572)](https://github.com/hasherezade/tiny_tracer/commits) [![Last Commit](https://camo.githubusercontent.com/fb265af9e04109ff0e3456ec3eebd555742323c60e86bd652984d8a7a89cc3ee/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6173742d636f6d6d69742f686173686572657a6164652f74696e795f7472616365722f6d6173746572)](https://github.com/hasherezade/tiny_tracer/commits)

[![GitHub release](https://camo.githubusercontent.com/3265e2063ce5dd7b51d2066d074e78ac5883694aa7644da91ffe75c02e565f69/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f686173686572657a6164652f74696e795f7472616365722e737667)](https://github.com/hasherezade/tiny_tracer/releases) [![GitHub release date](https://camo.githubusercontent.com/9a56c111460892cdfcf712f4e790e4f32f0d3b400810d6a82460856a7676b0d3/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652d646174652f686173686572657a6164652f74696e795f7472616365723f636f6c6f723d626c7565)](https://github.com/hasherezade/tiny_tracer/releases)

A Pin Tool for tracing:

- API calls, including [parameters of selected functions](https://github.com/hasherezade/tiny_tracer/wiki/Tracing-parameters-of-functions)
- selected instructions: [RDTSC](https://c9x.me/x86/html/file_module_x86_id_278.html), [CPUID](https://c9x.me/x86/html/file_module_x86_id_45.html), [INT](https://c9x.me/x86/html/file_module_x86_id_142.html)
- [inline system calls, including parameters of selected syscalls](https://github.com/hasherezade/tiny_tracer/wiki/Tracing-syscalls)
- transition between sections of the traced module (helpful in finding OEP of the packed module)

Bypasses the anti-tracing check based on RDTSC.

Generates a report in a `.tag` format (which can be [loaded into other analysis tools](https://github.com/hasherezade/tiny_tracer/wiki/Using-the-TAGs-with-disassemblers-and-debuggers)):

`RVA;traced event`

i.e.

```auto
345c2;section: .text
58069;called: C:\Windows\SysWOW64\kernel32.dll.IsProcessorFeaturePresent
3976d;called: C:\Windows\SysWOW64\kernel32.dll.LoadLibraryExW
3983c;called: C:\Windows\SysWOW64\kernel32.dll.GetProcAddress
3999d;called: C:\Windows\SysWOW64\KernelBase.dll.InitializeCriticalSectionEx
398ac;called: C:\Windows\SysWOW64\KernelBase.dll.FlsAlloc
3995d;called: C:\Windows\SysWOW64\KernelBase.dll.FlsSetValue
49275;called: C:\Windows\SysWOW64\kernel32.dll.LoadLibraryExW
4934b;called: C:\Windows\SysWOW64\kernel32.dll.GetProcAddress
...

```

## 🚧 How to build

### On Windows

To compile the prepared project you need to use [Visual Studio \>= 2012](https://visualstudio.microsoft.com/downloads/). It was tested with [Intel Pin 3.28](https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads).  
Clone this repo into `\source\tools` that is inside your Pin root directory. Open the project in Visual Studio and build. Detailed description available [here](https://github.com/hasherezade/tiny_tracer/wiki/Installation#on-windows).  
To build with Intel Pin \< 3.26 on Windows, use the appropriate legacy Visual Studio project.

### On Linux

For now the support for Linux is experimental. Yet it is possible to build and use Tiny Tracer on Linux as well. Please refer [tiny\_runner.sh](https://github.com/hasherezade/tiny_tracer/blob/master/install32_64/tiny_runner.sh) for more information. Detailed description available [here](https://github.com/hasherezade/tiny_tracer/wiki/Installation#on-linux).

## ⚙ Usage

📖 Details about the usage you will find on [the project’s Wiki](https://github.com/hasherezade/tiny_tracer/wiki).

## WARNINGS

- In order for Pin to work correctly, Kernel Debugging must be **DISABLED**.
- In [`install32_64`](https://github.com/hasherezade/tiny_tracer/tree/master/install32_64) you can find a utility that checks if Kernel Debugger is disabled (`kdb_check.exe`, [source](https://github.com/hasherezade/pe_utils/tree/master/kdb_check)), and it is used by the Tiny Tracer’s `.bat` scripts. This utilty sometimes gets flagged as a malware by Windows Defender (it is a known false positive). If you encounter this issue, you may need to [exclude](https://support.microsoft.com/en-us/windows/add-an-exclusion-to-windows-security-811816c0-4dfd-af4a-47e4-c301afe13b26) the installation directory from Windows Defender scans.
- Since the version 3.20 Pin has dropped a support for **old versions of Windows**. If you need to use the tool on Windows \< 8, try to compile it with Pin 3.19.

* * *

🤔 Questions? Ideas? Join [Discussions](https://github.com/hasherezade/tiny_tracer/discussions)!

## GitHub:

> **[GitHub - hasherezade/tiny\_tracer: A Pin Tool for tracing API calls etc](https://github.com/hasherezade/tiny_tracer)**
>
> A Pin Tool for tracing API calls etc