### Example TAG File Entries for Indirect Calls

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-local-indirect-branching

Provides concrete examples of how indirect call information is logged in the TAG file. Each line shows the RVA of the call, the instruction, the target VA, and the module base with the target RVA.

```text
24875;[call esi] to: c970c7 [c70000 + 270c7]
2487d;[call esi] to: c79fb0 [c70000 + 9fb0]
24896;[call esi] to: c970c7 [c70000 + 270c7]
2489e;[call esi] to: c79fb0 [c70000 + 9fb0]
```

--------------------------------

### Analyze Tiny Tracer Output Logs

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-shellcodes

Example output logs showing the difference between enabled and disabled shellcode tracing. Lines prefixed with '>' indicate execution occurring within a shellcode.

```text
1000;section: 
1005;->.teddy
6b001;section: .teddy
6b0ed;kernel32.VirtualAlloc
6b11b;kernel32.VirtualAlloc
6b1ad;kernel32.VirtualFree
6b1b8;called: ?? [b337000+0]
> b337000+74;kernel32.GetModuleHandleA
> b337000+8a;kernel32.GetProcAddress
> b337000+9e;kernel32.GetProcAddress
> b337000+c4;kernel32.VirtualAlloc
> b337000+fb;kernel32.VirtualFree
```

```text
1000;section: 
1005;->.teddy
6b001;section: .teddy
6b0ed;kernel32.VirtualAlloc
6b11b;kernel32.VirtualAlloc
6b1ad;kernel32.VirtualFree
6b1b8;called: ?? [b347000+0]
1014;section: 
1014;called: ?? [b33f000+17]
271d6;called: ?? [b454000+6c0]
```

--------------------------------

### Assembly Examples of Indirect Calls

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-local-indirect-branching

Demonstrates two common ways indirect function calls are performed in assembly language. These calls use dynamically retrieved addresses, making them harder to trace than direct calls.

```asm
CALL DWORD PTR [EAX + 8]
```

```asm
CALL EAX
```

--------------------------------

### TinyTracer Exclusion Example

Source: https://github.com/hasherezade/tiny_tracer/wiki/Exclusions-from-tracing

This example demonstrates how to exclude a specific function, `InitializeCriticalSectionEx`, from the `kernelbase` module in TinyTracer's logging. This configuration prevents calls to this function from appearing in the trace log.

```plaintext
kernelbase;InitializeCriticalSectionEx
```

--------------------------------

### Set Function Watch List Parameter (Batch)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-function-input-and-output

Example of how to set the `WATCH_ARGS` variable in a Windows batch script to specify the file containing the list of functions to trace. This file dictates which function parameters will be logged.

```batch
rem WATCH_ARGS - a file with a list of functions which's parameters will be logged
rem The file must be a list of records in a format: [dll_name];[func_name];[parameters_count]
set WATCH_ARGS=%PIN_TOOLS_DIR%\params.txt
```

--------------------------------

### Configure Traced Module for DLL within EXE (Batch)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-DLLs

This batch script configuration allows you to specify which module's API calls should be logged when tracing a process. By default, it traces the main executable (%TARGET_APP%). To trace a specific DLL loaded within the process, modify the TRACED_MODULE variable in run_me.bat. For example, setting it to 'user32.dll' will trace calls made by user32.dll.

```batch
rem TRACED_MODULE - by default it is the main module, but it can be also a DLL within the traced process
set TRACED_MODULE=%TARGET_APP%

```

```batch
rem TRACED_MODULE - by default it is the main module, but it can be also a DLL within the traced process
set TRACED_MODULE=user32.dll

```

--------------------------------

### Compile Tiny Tracer on Linux

Source: https://github.com/hasherezade/tiny_tracer/wiki/Installation

Instructions for building Tiny Tracer on Linux environments. This involves navigating to the PIN directory, verifying the source structure, and executing the build script to generate the necessary .so files.

```bash
cd $HOME/pin
~/pin$ ls
~/pin/source/tools/tiny_tracer$ ls
~/pin/source/tools/tiny_tracer$ ./make_linux.sh
```

--------------------------------

### Configure Tiny Tracer environment paths

Source: https://github.com/hasherezade/tiny_tracer/wiki/Installation

Commands to create symbolic links for the Tiny Tracer runner script and configuration directory, enabling global access from the user's bin directory.

```bash
ln -s $HOME/pin/source/tools/tiny_tracer/install32_64/tiny_runner.sh ~/bin/tiny_runner.sh
ln -s $HOME/pin/source/tools/tiny_tracer/install32_64/ $HOME/Desktop/install32_64
```

--------------------------------

### Execute Tiny Tracer on Linux

Source: https://github.com/hasherezade/tiny_tracer/wiki/Installation

Demonstrates the command-line usage of the tiny_runner.sh script to instrument a target application. The tool outputs a .tag file containing the trace analysis results.

```bash
~/Desktop/pin_tests$ tiny_runner.sh ./demo
```

--------------------------------

### Configure Syscall Parameter Tracing (Text)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-syscalls

To trace parameters of specific syscalls, create a list in 'params.txt'. Each line should specify the syscall by name or ID and its parameter count. The format is '<SYSCALL>;[syscall number];[params_count]' or 'module;FunctionName;[params_count]'.

```text
<SYSCALL>;0x36;4
<SYSCALL>;0x20;2
```

```text
ntdll;NtSetInformationThread;4
<SYSCALL>;0x19;4
```

```text
<SYSCALL>;0x28;10
ntdll;NtCreateSection;7
```

--------------------------------

### Configure EXE_ARGS in run_me.bat

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-an-EXE-with-commandline-arguments

This snippet demonstrates how to define command line arguments for Tiny Tracer. By setting the EXE_ARGS variable in the run_me.bat file, users can pass specific parameters to every executable traced during the session.

```batch
rem The arguments that you want to pass to the run executable
set EXE_ARGS="Test123"
```

--------------------------------

### Attach to running process with pin_attach.bat

Source: https://github.com/hasherezade/tiny_tracer/wiki/Installation

Demonstrates how to attach the Tiny Tracer tool to an already running process using the provided Windows batch script. It requires the path to the target module and the process ID (PID) as arguments.

```cmd
C:\pin\source\tools\tiny_tracer\install32_64>pin_attach.bat "C:\Users\tester\Desktop\test_app.exe" 8924
```

--------------------------------

### Configure Functions to Watch (Windows/Linux)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-function-input-and-output

Defines the format for specifying functions to be traced by Tiny Tracer. This list is saved to a file and provided as a parameter to the PIN Tool. It includes the module name, function name, and the count of arguments.

```text
[module_name];[func_name];[args_count]
```

```text
Kernel32;LoadLibraryW;1
kernel32;LoadLibraryA;1
KERNEL32;GetProcAddress;2
```

```text
libc.so;_IO_puts;1
```

--------------------------------

### Set Configuration Path via Environment Variables

Source: https://github.com/hasherezade/tiny_tracer/wiki/The-INI-file

To use a custom configuration file, update the SETTINGS_FILE environment variable in the respective runner script for your operating system.

```bat
rem The ini file specifying the settings of the tracer
set SETTINGS_FILE=%PIN_TOOLS_DIR%\TinyTracer.ini
```

```bash
SETTINGS_FILE=$PIN_CONFIGS_DIR"/TinyTracer.ini"
```

--------------------------------

### TinyTracer Log Before Exclusion

Source: https://github.com/hasherezade/tiny_tracer/wiki/Exclusions-from-tracing

This is a sample trace log from TinyTracer before any exclusions are applied. It shows various API calls, including `kernel32.LoadLibraryExW` and `kernelbase.FlsAlloc`, along with detailed parameter information for `GetProcAddress`.

```plaintext
7f56c;section: [.text]
7f5a4;CPUID:0
7f602;CPUID:1
7f69d;CPUID:7
82c4c;kernel32.LoadLibraryExW
82ce3;kernel32.GetProcAddress
GetProcAddress:
	Arg[0] = ptr 0x00007ff81b340000 -> {MZ\x90\x00\x03\x00\x00\x00}
	Arg[1] = ptr 0x00007ff621e5a5d8 -> "InitializeCriticalSectionEx"

82c4c;kernel32.LoadLibraryExW
82ce3;kernel32.GetProcAddress
GetProcAddress:
	Arg[0] = ptr 0x00007ff81b340000 -> {MZ\x90\x00\x03\x00\x00\x00}
	Arg[1] = ptr 0x00007ff621e5a5a0 -> "FlsAlloc"

82da7;kernelbase.FlsAlloc
[...]
```

--------------------------------

### Enable Return Value Tracking (INI)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-function-input-and-output

Configuration setting in the INI file to enable logging of the values returned by traced functions. When set to `True`, Tiny Tracer will capture and display the return value of each function call.

```ini
LOG_RETURN_VALUE=True
```

--------------------------------

### Enable/Disable Syscall Tracing (INI)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-syscalls

Configure syscall tracing by setting the TRACE_SYSCALL option in the TinyTracer.ini file. Set to 'True' to enable and 'False' to disable.

```ini
TRACE_SYSCALL=True
```

```ini
TRACE_SYSCALL=False
```

--------------------------------

### Generate Syscalls Table (Batch)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-syscalls

This batch script checks for the existence of a syscalls table and, if not found, executes 'syscall_extract.exe' to generate one for the current Windows version. This tool helps map syscall IDs to function names for more readable output.

```bat
if NOT exist %SYSCALLS_TABLE% (
	if exist %PIN_TOOLS_DIR%\syscall_extract.exe (
		%PIN_TOOLS_DIR%\syscall_extract.exe %SYSCALLS_TABLE%
	)
)
```

--------------------------------

### Assembly with Resolved Indirect Call Target

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-local-indirect-branching

Illustrates how an indirect call appears in assembly after the TAG file has been processed by a disassembler. The 'to:' annotation clearly shows the resolved target address, making it easier to follow the execution flow.

```asm
CALL DWORD PTR [EAX + 4] ;to: c79fb0 [c70000 + 9fb0]
```

--------------------------------

### TAG File Format for Indirect Calls

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-local-indirect-branching

Specifies the format of the TAG file when indirect calls are logged by Tiny Tracer. This format includes the RVA of the indirect call, the instruction, and the resolved virtual address (VA) of the called function, along with its module base and RVA.

```text
<RVA>;[<instruction>] to: <VA of the called function> [<Module Load Base> + <RVA of the called function>]
```

--------------------------------

### TinyTracer Exclusion List Syntax

Source: https://github.com/hasherezade/tiny_tracer/wiki/Exclusions-from-tracing

This section details the syntax for the `excluded.txt` file used by TinyTracer. It explains how to exclude an entire module by its name or specific functions within a module using a module;function format.

```plaintext
[module_name]
[module_name];[func_name]
```

--------------------------------

### Configure Shellcode Tracing in TinyTracer.ini

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-shellcodes

The FOLLOW_SHELLCODES parameter controls the depth of shellcode tracing. Values range from 0 (disabled) to 3 (trace all shellcodes).

```ini
FOLLOW_SHELLCODES=1
```

```ini
FOLLOW_SHELLCODES=3
```

--------------------------------

### Configure DLL Exports for Tracing (Batch)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-DLLs

This batch script configuration allows you to specify which exports (functions) of a DLL should be called and traced when the DLL is loaded by Tiny Tracer. It modifies the DLL_EXPORTS variable in run_me.bat. Ensure to revert changes after use.

```batch
rem The exports that you want to call from a dll, in format: [name1];[name2] or [#ordinal1];[#ordinal2]
set DLL_EXPORTS=""

```

```batch
rem The exports that you want to call from a dll, in format: [name1];[name2] or [#ordinal1];[#ordinal2]
set DLL_EXPORTS="ServiceMain"

```

--------------------------------

### Configure Excluded Functions File Path (Windows Batch)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Exclusions-from-tracing

This batch script snippet shows how to define the path to the excluded functions text file. The `EXCLUDED_FUNC` variable is set to point to the `excluded.txt` file, which can be customized.

```batch
rem List of functions that will be excluded from logging
set EXCLUDED_FUNC=%PIN_TOOLS_DIR%\excluded.txt
```

--------------------------------

### Enable Argument Modification Tracking (INI)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Tracing-function-input-and-output

Configuration setting in the INI file to enable tracking of changes made to function arguments during execution. When set to `True`, Tiny Tracer will log modifications to arguments.

```ini
FOLLOW_ARGS_RETURN=True
```

--------------------------------

### Configure TinyTracer via INI file

Source: https://github.com/hasherezade/tiny_tracer/wiki/The-INI-file

The TinyTracer.ini file controls the core functionality of the tracer. It supports various boolean and integer flags to toggle features like syscall tracing, shellcode following, and anti-debugging mechanisms.

```ini
ENABLE_SHORT_LOGGING=True
USE_DEBUG_SYMBOLS=False
FOLLOW_SHELLCODES=1
FOLLOW_CHILDPROCESSES=False
TRACE_RDTSC=False
TRACE_INT=False
TRACE_SYSCALL=True
LOG_SECTIONS_TRANSITIONS=True
LOG_SHELLCODES_TRANSITIONS=True
LOG_INDIRECT_CALLS=False
HEXDUMP_SIZE=8
HOOK_SLEEP=False
SLEEP_TIME=10
STOP_OFFSET_TIME=30
DISASM_CTX=False
DISASM_DEPTH=3
ANTIDEBUG=0
ANTIVM=0
EMULATE_HYPERV=False
EMULATE_SINGLE_STEP=True
LOG_RETURN_VALUE=False
FOLLOW_ARGS_RETURN=False
PARSE_EXPORTS=False
VOLUME_ID=0
```

--------------------------------

### Configure Excluded Functions File Path (Linux Shell)

Source: https://github.com/hasherezade/tiny_tracer/wiki/Exclusions-from-tracing

This shell script snippet demonstrates how to set the path for the excluded functions file on Linux systems. The `EXCLUDED_FUNC` variable is assigned the path to `excluded.txt`, allowing for customization.

```shell
# List of functions that will be excluded from logging
EXCLUDED_FUNC="${PIN_TOOLS_DIR}/excluded.txt"
```

--------------------------------

### Configure Volume Serial Number Spoofing

Source: https://github.com/hasherezade/tiny_tracer/wiki/The-INI-file

Sets a custom VolumeSerialNumber for Windows API calls like GetVolumeInformation. This is useful for bypassing malware checks that rely on specific disk volume identifiers.

```ini
VOLUME_ID=0x12345678
```

--------------------------------

### TinyTracer Log After Excluding GetProcAddress

Source: https://github.com/hasherezade/tiny_tracer/wiki/Exclusions-from-tracing

This trace log demonstrates the effect of excluding `GetProcAddress` from the `kernel32` module. The entries related to `GetProcAddress` calls are no longer present in the log, resulting in a cleaner output.

```plaintext
7f56c;section: [.text]
7f5a4;CPUID:0
7f602;CPUID:1
7f69d;CPUID:7
82c4c;kernel32.LoadLibraryExW
82c4c;kernel32.LoadLibraryExW
82da7;kernelbase.FlsAlloc
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.