AwesomeREA.org

Tool

Tiny Tracer

Intel Pin tool by hasherezade that traces a 32- or 64-bit program while it runs on Windows or Linux, logging API calls (with arguments and return values for watched functions), chosen local and statically linked functions, inline system calls, RDTSC, CPUID and INT instructions, and transitions between sections of the traced module, which helps find the original entry point of a packed module. It can follow code the module unpacks into new memory, disassemble selected ranges and, on Windows, flag the anti-debug and anti-VM checks a sample performs. Each run writes a .tag file of RVA;event lines that PE-bear reads natively and that the wiki shows loading into IDA Pro, Binary Ninja, x64dbg, Ghidra and Cutter to annotate code.

Requirements & limits

  • Release at review: 4.0, published 2026-05-28 and refactored for Intel Pin 4.x; the reviewed master commit is two commits ahead of it. Releases contain source only, because, as the release notes and installation guide explain, Pin's license does not allow distributing compiled Pin tools. Users download Pin themselves and build the tool inside Pin's source/tools tree; the README names Pin 4.2 as the version tested, Pin before 4.0 needs a pre-4.0 release with the legacy build, and Windows versions older than 8 also need the legacy build.
  • Windows builds use MSYS2 make with clang-cl, with Visual Studio 2019 or later optional as an editor; Linux builds use g++ and make. Both scripts produce 32- and 64-bit builds in install32_64, which holds run_me.bat with context-menu .reg files, pin_attach.bat for attaching to a running process, tiny_runner.sh for Linux, and the TinyTracer.ini, params.txt and excluded.txt settings. The README says kernel debugging must be disabled for Pin to work.
  • install32_64 also commits the author's prebuilt Windows helpers dll_load32.exe, dll_load64.exe, kdb_check.exe, pe_check.exe and syscall_extract.exe, whose sources are in the separate hasherezade/pe_utils repository; the README notes that Windows Defender sometimes flags kdb_check.exe, a known false positive. The anti-debug and anti-VM modes are Windows-only, and the deep anti-debug mode is documented as prone to false positives. The analyst supplies the program to trace, which executes natively under Pin.
  • GPL-2.0 in LICENSE.txt; Intel Pin keeps its own license. Traces cover only code that executes during the run. No REA connection is established, and nothing was built or traced for this review.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · hasherezade/tiny_tracer · Revision 99618fc
  2. https://github.com/hasherezade/tiny_tracer/wiki/Installation/bfcee7fad835f06437b3a6c2410cc38d276b855b
  3. https://github.com/hasherezade/tiny_tracer/wiki/The-INI-file/e48e12d46454008e8d2a1b55a247329c554cc4b7
  4. https://github.com/hasherezade/tiny_tracer/wiki/Using-the-TAGs-with-disassemblers-and-debuggers/215f7cae78a12ffdc1f646000e216fdb517658cd
  5. https://github.com/hasherezade/tiny_tracer/wiki/Tracing-shellcodes/4f8169a1a84f11f773b148f65913fdc486e5c1b9
  6. install32_64/README.md GitHub · hasherezade/tiny_tracer · Revision 99618fc
  7. install32_64 GitHub · hasherezade/tiny_tracer · Revision 99618fc
  8. LICENSE.txt GitHub · hasherezade/tiny_tracer · Revision 99618fc
  9. https://github.com/hasherezade/tiny_tracer/releases/tag/4.0

More in Native binaries

All 94 entries in Native binaries