A Trace Explorer for Reverse Engineers

Last update: Jan 2, 2023

Overview

Tenet - A Trace Explorer for Reverse Engineers

Overview

Tenet is an IDA Pro plugin for exploring execution traces. The goal of this plugin is to provide more natural, human controls for navigating execution traces against a given binary. The basis of this work stems from the desire to research new or innovative methods to examine and distill complex execution patterns in software.

For more context about this project, please read the blogpost about its initial release.

Special thanks to QIRA / geohot et al. for the inspiration.

Releases

v0.1 -- Initial release

Installation

Tenet is a cross-platform (Windows, macOS, Linux) Python 3 plugin. It takes zero third party dependencies, making the code both portable and easy to install.

From your disassembler's python console, run the following command to find its plugin directory:
- IDA Pro: import idaapi, os; os.path.join(idaapi.get_user_idadir(), "plugins")
Copy the contents of this repository's /plugins/ folder to the listed directory.
Restart your disassembler.

This plugin is only supported for IDA 7.5 and newer.

Usage

Once properly installed, there will be a new menu entry available in the disassembler. This can be used to load externally-collected execution traces into Tenet.

As this is the initial release, Tenet only accepts simple human-readable text traces. Please refer to the tracing readme in this repository for additional information on the trace format, limitations, and reference tracers.

Bidirectional Exploration

While using Tenet, the plugin will 'paint' trails to indicate the flow of execution forwards (blue) and backwards (red) from your present position in the active execution trace.

To step forwards or backwards through time, you simply scroll while hovering over the timeline on the right side of the disassembler. To step over function calls, hold SHIFT while scrolling.

Trace Timeline

The trace timeline will be docked on the right side of the disassembler. This widget is used to visualize different types of events along the trace timeline and perform basic navigation as described above.

By clicking and dragging across the timeline, it is possible to zoom in on a specific section of the execution trace. This action can be repeated any number of times to reach the desired granularity.

Execution Breakpoints

Clicking the instruction pointer in the registers window will highlight it in red, revealing all the locations the instruction was executed across the trace timeline.

To jump between executions, scroll up or down while hovering the highlighted instruction pointer.

Additionally, you can right click in the disassembly listing and select one of the navigation-based menu entries to quickly seek to the execution of an instruction of interest.

IDA's native F2 hotkey can also be used to set breakpoints on arbitrary instructions.

Memory Breakpoints

By clicking a byte in either the stack or memory views, you will instantly see all reads/writes to that address visualized across the trace timeline. Yellow indicates a memory read, blue indicates a memory write.

Memory breakpoints can be navigated using the same technique described for execution breakpoints. Click a byte, and scroll while hovering the selected byte to seek the trace to each of its accesses.

Right clicking a byte of interest will give you options to seek between memory read / write / access if there is a specific navigation action that you have in mind.

To navigate the memory view to an arbitrary address, click onto the memory view and hit G to enter either an address or database symbol to seek the view to.

Region Breakpoints

A rather experimental feature is setting access breakpoints for a region of memory. This is possible by highlighting a block of memory, and selecting the Find accesses action from the right click menu.

As with normal memory breakpoints, hovering the region and scrolling can used to traverse between the accesses made to the selected region of memory.

Register Seeking

In reverse engineering, it's pretty common to encounter situations where you ask yourself "Which instruction set this register to its current value?"

Using Tenet, you can seek backwards to that instruction in a single click.

Seeking backwards is by far the most common direction to navigate across register changes... but for dexterity you can also seek forward to the next register assignment using the blue arrow on the right of the register.

Timestamp Shell

A simple 'shell' is provided to navigate to specific timestamps in the trace. Pasting (or typing...) a timestamp into the shell with or without commas will suffice.

Using an exclamation point, you can also seek a specified 'percentage' into the trace. Entering !100 will seek to the final instruction in the trace, where !50 will seek approximately 50% of the way through the trace.

Themes

Tenet ships with two default themes -- a 'light' theme, and a 'dark' one. Depending on the colors currently used by your disassembler, Tenet will attempt to select the theme that seems most appropriate.

The theme files are stored as simple JSON on disk and are highly configurable. If you are not happy with the default themes or colors, you can create your own themes and simply drop them in the user theme directory.

Tenet will remember your theme preference for future loads and uses.

FAQ

Q: How do I record an execution trace using Tenet?

A: Tenet is a trace reader, not a trace recorder. You will have to use dynamic binary instrumentation frameworks (or other related technologies) to generate a compatible execution trace. Please refer to the tracing readme for more information on existing tracers, or how to implement your own.

Q: What trace architectures does Tenet support loading?

A: Only x86 and AMD64, but the codebase is almost entirely architecture agnostic.

Q: How big of a trace file can Tenet load / navigate?

A: Tenet's trace reader is pure python, it was written as an MVP. There is no guarantee that traces which exceed 10 million instructions will be reasonable to navigate until a native backend replaces it.

Q: I loaded an execution trace, now there is a '.tt' file. What is it?

A: When Tenet loads a given text trace, it will parse, index, and compress the trace into a more performant format. On subsequent loads, Tenet will attempt to load the '.tt' file which should load in fraction of the time that it would take to load the original text trace.

Q: The plugin crashed / threw an error / is showing bad trace information, what should I do?

A: If you encounter an issue or inaccuracy that can be reproduced, please file an issue against this repository and upload a sample trace + executable.

Q: Memory in my trace is changing, but there are no writes to the region. Is this a bug!?

A: Your log file may not have captured all memory writes. For example, usermode DBI generally do not get a memory callback for external writes to process memory. This is most common when reading from a file, or from socket -- it is the kernel that writes memory into your designated usermode buffer, making the event invisible to traditional instrumentation.
- Microsoft TTD generally exhibits the same behavior, it's tricky to solve without modeling syscalls.

Q: Will this be ported to Binary Ninja / Ghidra / ... ?

A: Possibly, but not anytime soon (unless there is significant incentive). As a research oriented project, the driving motivation is on developing novel strategies to organize and explore program execution -- not porting them.

Q: My organization would like to support this project, how can we help?

A: Without funding, the time I can devote to this project is limited. If your organization is excited by the ideas put forth here and capable of providing capital to sponsor dedicated R&D, please contact us.

Future Work

Time and ~~motivation~~ funding permitting, future work may include:

Filtering / coagulating library calls from traces
Pointer analysis (e.g. annotations) for the register / stack views
Native TraceFile & TraceReader implementations (e.g. bigger and faster traces)
Navigation history + bookmarks view (maybe 2-in-1?)
Richer trace informatics, more aggressive indexing of relevant events (e.g. function calls)
Trace cartography, improved summarization and representation of trace geography
Make the 'cpu architecture' selection/detection slightly less hardcoded
More out-of-the-box tracing bridges, DynamoRIO, TTD, RR, QEMU, Bochs, ...
Support for Hex-Rays / decompiled views (besides basic view sync)
Improved workflow for automatically loading or iterating on traces
Differential analysis, high level 'trace diffing'
Better navigation and breakdown of threads, quantum's
Better support for navigating 'multi module' traces (e.g. full system traces)
Binary Ninja support
... ?

I welcome external contributions, issues, and feature requests. Please make any pull requests to the develop branch of this repository if you would like them to be considered for a future release.

Authors

Markus Gaasedelen (@gaasedelen)

Comments

pintenet segfaults without the -w option

test program

~/tenet/tracers/pin$ cat test.c
#include <stdio.h>

int main() { printf("hello\n"); }

~/tenet/tracers/pin$ gcc -g -o test test.c -Wall -Werror -Wextra

~/tenet/tracers/pin$ ./test
hello

crash

~/tenet/tracers/pin$ /home/test/pin/pin-3.19-98425-gd666b2bee-gcc-linux/pin -t obj-intel64/pintenet.so
   -o moo -- "./test"
Loaded image: 0x563463397000:0x563463399157 -> test
Loaded image: 0x7f01cbc50000:0x7f01cbc7bccb -> ld-linux-x86-64.so.2
Loaded image: 0x7ffce369a000:0x7ffce369aec7 -> [vdso]
Loaded image: 0x7f01b7200000:0x7f01b73f14d7 -> libc.so.6
C: [tid:38587] Tool (or Pin) caused signal 11 at PC 0x7f01c998d65d
Segmentation fault (core dumped)

no crash

~/tenet/tracers/pin$ /home/test/pin/pin-3.19-98425-gd666b2bee-gcc-linux/pin -t obj-intel64/pintenet.so   -w "test" -o moo -- "./test"
White-listing image: test
Loaded image: 0x55d75fe6f000:0x55d75fe71157 -> test
Loaded image: 0x7f78b5d1e000:0x7f78b5d49ccb -> ld-linux-x86-64.so.2
Loaded image: 0x7ffca6a61000:0x7ffca6a61ec7 -> [vdso]
Loaded image: 0x7f78a13c1000:0x7f78a15b24d7 -> libc.so.6
hello

generated trace

~/tenet/tracers/pin$ head moo.0.log  -n3
rdi=0x7f78b5d4d190,rsi=0x7f78b5d4d730,rsp=0x7ffca6a1d700,rdx=0x7f78b5d2fd50,rcx=0x7ffca6a1d718,rax=0x1c,r8=0x7f78a1573700,r9=0x9,r11=0x7f78a15738f0,r12=0x55d75fe70060,r13=0x7ffca6a1d700,rip=0x55d75fe70060,mr=0x7ffca6a1d6f8:3af1d1b5787f0000,mw=0x7f78b5d4d4ac:1c
rip=0x55d75fe70064
rip=0x55d75fe70066

not enough information

opened by nkaretnikov 4

Tenet cannot follow the trace if the traced imagebase does not match the database

Hello, thanks for the amazing work😊

I use pintenet to generate trace.log for calc.exe, but the trace.log looks like can't work. I did the following:

ps: windows 10 + IDA 7.5 + pin 3.18 1、download pin and pintenet.dll/pintenet64.dll; 2、in a CMD execute: pin\pin.exe -t pintenet.dll -w calc.exe -o "calc" -- "C:\Users\ml\Desktop\software\pin\calc.exe" After successful execution, nothing is displayed on the CMD 3、a file named calc.0.log generated,the size of it is 988k 4、load the calc.0.log in IDA, The interface looks like this：

when I scroll while hovering over the timeline on the right side of the disassembler， The code doesn't move forward or backward with it.

I did the same thing for BoomBox.exe, and it's trace file is available. so I thought maybe there was something wrong with the trace files for calc.exe.
enhancement

opened by NarutoGit 4

error loading trace file

when loading trace file it shows this error:

[TENET] Traceback (most recent call last):
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\context.py", line 270, in interactive_load_trace
    self.load_trace(filepath)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\context.py", line 177, in load_trace
    self.trace.attach_reader(self.reader)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\ui\trace_view.py", line 715, in attach_reader
    self.view.attach_reader(reader)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\ui\trace_view.py", line 621, in attach_reader
    self.trace_global.attach_reader(reader)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\ui\trace_view.py", line 126, in attach_reader
    self.set_zoom(0, reader.trace.length)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\ui\trace_view.py", line 264, in set_zoom
    self.refresh()
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\ui\trace_view.py", line 155, in refresh
    self._draw_trace()
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\ui\trace_view.py", line 334, in _draw_trace
    self._draw_cursor(painter)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\ui\trace_view.py", line 379, in _draw_cursor
    cursor_y = int(relative_idx / self.density) + BORDER_SIZE
ZeroDivisionError: float division by zero

Exception in ida_kernwin.UI_Hooks dispatcher function: SWIG director method error. Error detected when calling 'UI_Hooks.get_lines_rendering_info'
Traceback (most recent call last):
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 397, in _render_lines
    self._highlight_disassesmbly(lines_out, widget, lines_in)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 449, in _highlight_disassesmbly
    if address == ctx.reader.ip:
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 79, in ip
    return self.get_register(self.arch.IP)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1462, in get_register
    return self.get_registers([reg_name], idx)[reg_name]
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1519, in get_registers
    output_registers[self.arch.IP] = self.trace.get_ip(idx)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 590, in get_ip
    raise ValueError("Invalid IDX")
ValueError: Invalid IDX
Exception in ida_kernwin.UI_Hooks dispatcher function: SWIG director method error. Error detected when calling 'UI_Hooks.get_lines_rendering_info'
Traceback (most recent call last):
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 397, in _render_lines
    self._highlight_disassesmbly(lines_out, widget, lines_in)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 449, in _highlight_disassesmbly
    if address == ctx.reader.ip:
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 79, in ip
    return self.get_register(self.arch.IP)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1462, in get_register
    return self.get_registers([reg_name], idx)[reg_name]
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1519, in get_registers
    output_registers[self.arch.IP] = self.trace.get_ip(idx)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 590, in get_ip
    raise ValueError("Invalid IDX")
ValueError: Invalid IDX
Rebasing program to 0x56646000...
Exception in ida_kernwin.UI_Hooks dispatcher function: SWIG director method error. Error detected when calling 'UI_Hooks.get_lines_rendering_info'
Traceback (most recent call last):
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 397, in _render_lines
    self._highlight_disassesmbly(lines_out, widget, lines_in)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 449, in _highlight_disassesmbly
    if address == ctx.reader.ip:
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 79, in ip
    return self.get_register(self.arch.IP)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1462, in get_register
    return self.get_registers([reg_name], idx)[reg_name]
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1519, in get_registers
    output_registers[self.arch.IP] = self.trace.get_ip(idx)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 590, in get_ip
    raise ValueError("Invalid IDX")
ValueError: Invalid IDX
Exception in ida_kernwin.UI_Hooks dispatcher function: SWIG director method error. Error detected when calling 'UI_Hooks.get_lines_rendering_info'
Traceback (most recent call last):
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 397, in _render_lines
    self._highlight_disassesmbly(lines_out, widget, lines_in)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 449, in _highlight_disassesmbly
    if address == ctx.reader.ip:
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 79, in ip
    return self.get_register(self.arch.IP)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1462, in get_register
    return self.get_registers([reg_name], idx)[reg_name]
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1519, in get_registers
    output_registers[self.arch.IP] = self.trace.get_ip(idx)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 590, in get_ip
    raise ValueError("Invalid IDX")
ValueError: Invalid IDX
Exception in ida_kernwin.UI_Hooks dispatcher function: SWIG director method error. Error detected when calling 'UI_Hooks.get_lines_rendering_info'
Traceback (most recent call last):
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 397, in _render_lines
    self._highlight_disassesmbly(lines_out, widget, lines_in)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 449, in _highlight_disassesmbly
    if address == ctx.reader.ip:
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 79, in ip
    return self.get_register(self.arch.IP)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1462, in get_register
    return self.get_registers([reg_name], idx)[reg_name]
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1519, in get_registers
    output_registers[self.arch.IP] = self.trace.get_ip(idx)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 590, in get_ip
    raise ValueError("Invalid IDX")
ValueError: Invalid IDX
Exception in ida_kernwin.UI_Hooks dispatcher function: SWIG director method error. Error detected when calling 'UI_Hooks.get_lines_rendering_info'
Traceback (most recent call last):
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 397, in _render_lines
    self._highlight_disassesmbly(lines_out, widget, lines_in)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 449, in _highlight_disassesmbly
    if address == ctx.reader.ip:
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 79, in ip
    return self.get_register(self.arch.IP)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1462, in get_register
    return self.get_registers([reg_name], idx)[reg_name]
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1519, in get_registers
    output_registers[self.arch.IP] = self.trace.get_ip(idx)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 590, in get_ip
    raise ValueError("Invalid IDX")
ValueError: Invalid IDX
[TENET] Failed to load trace...
[TENET] Traceback (most recent call last):
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\context.py", line 270, in interactive_load_trace
    self.load_trace(filepath)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\context.py", line 159, in load_trace
    self.reader = TraceReader(filepath, self.arch, disassembler[self])
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 59, in __init__
    self.trace = TraceFile(filepath, architecture)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 294, in __init__
    self._load_trace()
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 459, in _load_trace
    self._load_packed_trace(self.packed_filepath)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 470, in _load_packed_trace
    self._load_segments(zip_archive)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 533, in _load_segments
    segment.from_file(f)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 946, in from_file
    self.load(f)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 1196, in load
    ip_itemsize = info.ip_length // info.ip_num
ZeroDivisionError: integer division or modulo by zero

Exception in ida_kernwin.UI_Hooks dispatcher function: SWIG director method error. Error detected when calling 'UI_Hooks.get_lines_rendering_info'
Traceback (most recent call last):
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 397, in _render_lines
    self._highlight_disassesmbly(lines_out, widget, lines_in)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\integration\ida_integration.py", line 449, in _highlight_disassesmbly
    if address == ctx.reader.ip:
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 79, in ip
    return self.get_register(self.arch.IP)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1462, in get_register
    return self.get_registers([reg_name], idx)[reg_name]
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\reader.py", line 1519, in get_registers
    output_registers[self.arch.IP] = self.trace.get_ip(idx)
  File "C:/Users/alex/AppData/Roaming/Hex-Rays/IDA Pro/plugins\tenet\trace\file.py", line 590, in get_ip
    raise ValueError("Invalid IDX")
ValueError: Invalid IDX

not enough information

opened by zixcoolx 3

Does not detect changes in trace file

Say you create a trace file trace.txt and save it on your desktop. When you load the trace into Tenet for the first time, it will generate a trace.tt file in the same directory. If you now change trace.txt and reload it, nothing will change inside Tenet, because it will just load the old trace.tt file instead. To solve this, you need to either delete trace.tt or save the new version of the trace under a different file name.
bug

opened by ViRb3 2

Tenet does not load when using Python 3.9, 'NameError: name 'QtCore' is not defined'

My System Version：Win10 20H2

My IDA Version: IDA Pro 7.5 sp3 My Python version:Python 3.9.0 The errors I encountered:

***********\IDA Pro 7.5 SP3\plugins\tenet_plugin.py: name 'QtCore' is not defined
Traceback (most recent call last):
  File "***********\IDA Pro 7.5 SP3\python\3\ida_idaapi.py", line 616, in IDAPython_ExecScript
    exec(code, g)
  File "***********/Tools/IDA Pro 7.5 SP3/plugins/tenet_plugin.py", line 1, in <module>
    from tenet.util.log import logging_started, start_logging
  File "***********/IDA Pro 7.5 SP3/plugins\tenet\util\log.py", line 6, in <module>
    from ..integration.api import disassembler
  File "***********/IDA Pro 7.5 SP3/plugins\tenet\integration\api\__init__.py", line 18, in <module>
    from .ida_api import IDACoreAPI, IDAContextAPI, DockableWindow
  File "***********/IDA Pro 7.5 SP3/plugins\tenet\integration\api\ida_api.py", line 538, in <module>
    class IDADockSizeHack(QtCore.QObject):
NameError: name 'QtCore' is not defined

No new options appear in the menu, how do I fix it

opened by Mofisto 2

PyQt5 float fixes (TypeError: setSpacing(self, int): argument 1 has unexpected type 'float')

Some minor fixes for Qt where it now requires floats to be truncated for some of its parameters.

iff --git a/plugins/tenet/util/qt/waitbox.py b/plugins/tenet/util/qt/waitbox.py
index c0b05f9..434a35b 100644
--- a/plugins/tenet/util/qt/waitbox.py
+++ b/plugins/tenet/util/qt/waitbox.py
@@ -86,17 +86,17 @@ class WaitBox(QtWidgets.QDialog):
             self._abort_button.clicked.connect(self._abort)
             v_layout.addWidget(self._abort_button)
 
-        v_layout.setSpacing(self._dpi_scale*3)
+        v_layout.setSpacing(int(self._dpi_scale*3))
         v_layout.setContentsMargins(
-            self._dpi_scale*5,
-            self._dpi_scale,
-            self._dpi_scale*5,
-            self._dpi_scale
+            int(self._dpi_scale*5),
+            int(self._dpi_scale),
+            int(self._dpi_scale*5),
+            int(self._dpi_scale)
         )
 
         # scale widget dimensions based on DPI
         height = self._dpi_scale * 15
-        self.setMinimumHeight(height)
+        self.setMinimumHeight(int(height))
 
         # compute the dialog layout
         self.setLayout(v_layout)

That's for this exception:

Traceback (most recent call last):
  File "/home/$USER/idapro-8.0/python/3/ida_idaapi.py", line 580, in IDAPython_ExecScript
    exec(code, g)
  File "/home/$USER/.idapro/plugins/tenet_plugin.py", line 1, in <module>
    from tenet.util.log import logging_started, start_logging
  File "/home/$USER/.idapro/plugins/tenet/util/log.py", line 6, in <module>
    from ..integration.api import disassembler
  File "/home/$USER/.idapro/plugins/tenet/integration/api/__init__.py", line 19, in <module>
    disassembler = IDACoreAPI()
  File "/home/$USER/.idapro/plugins/tenet/integration/api/ida_api.py", line 74, in __init__
    super(IDACoreAPI, self).__init__()
  File "/home/$USER/.idapro/plugins/tenet/integration/api/api.py", line 47, in __init__
    self._waitbox = WaitBox("Please wait...")
  File "/home/$USER/.idapro/plugins/tenet/util/qt/waitbox.py", line 27, in __init__
    self._ui_init()
  File "/home/$USER/.idapro/plugins/tenet/util/qt/waitbox.py", line 71, in _ui_init
    self._ui_layout()
  File "/home/$USER/.idapro/plugins/tenet/util/qt/waitbox.py", line 89, in _ui_layout
    v_layout.setSpacing(self._dpi_scale*3)
TypeError: setSpacing(self, int): argument 1 has unexpected type 'float'

opened by arizvisa 1

pintenet now working

Pintenet does not seem to work on Windows 11. It starts the progam and tthen nothing happens. A look at the task manager shows that nothing is happening even though the programs are all there in the task manager. Something seems to be preventing the trace.

opened by dhucul 1

Pin tool consistently crashes on the first instruction (32bit, Linux)

I got the intel pin tool you provided but after I compile it in Linux, and I try to run it, pin -t pintenet.so -w a.out -- ./a.out

it gives me

White-listing image: a.out

Loaded image: 0x56605000:0x5660572f -> a.out

Loaded image: 0xf7f0a000:0xf7f2f4e3 -> ld-linux.so.2

Loaded image: 0xf7f09000:0xf7f09c0f -> [vdso]

Loaded image: 0xed317000:0xed4f2a1f -> libc.so.6

C: Tool (or Pin) caused signal 11 at PC 0xf6dd0a8d

Segmentation fault (core dumped)

bug

opened by zixcoolx 1

can not load tenet

:\Users\test\AppData\Roaming\Hex-Rays\IDA Pro\plugins\tenet_plugin.py: name 'QtCore' is not defined Traceback (most recent call last): File "C:\Program Files\IDA Pro 7.5 SP3\python\3\ida_idaapi.py", line 616, in IDAPython_ExecScript exec(code, g) File "C:/Users/test/AppData/Roaming/Hex-Rays/IDA Pro/plugins/tenet_plugin.py", line 1, in from tenet.util.log import logging_started, start_logging File "C:/Program Files/IDA Pro 7.5 SP3/plugins\tenet\util\log.py", line 6, in from ..integration.api import disassembler File "C:/Program Files/IDA Pro 7.5 SP3/plugins\tenet\integration\api_init_.py", line 18, in from .ida_api import IDACoreAPI, IDAContextAPI, DockableWindow File "C:/Program Files/IDA Pro 7.5 SP3/plugins\tenet\integration\api\ida_api.py", line 538, in class IDADockSizeHack(QtCore.QObject): NameError: name 'QtCore' is not defined

opened by tmtt66 0
Binja Support
Hi,

I've started porting Tenet for Binja. I used a decent chunk of code from your lighthouse plugin, and added the other necessary backend/gui portions for everything else.

I've made changes that no longer make the plugin a generic plugin.

Changes to the docks

Binja doesn't look as clean with DockableWidgets, so I implemented them in the different UI areas

SidebarWidget (Registers)

SidebarWidget (Stack)

GlobalArea (Memory)

These changes make it so within each file, I instantiate a different object than the generic DockableWindow object IDA uses. This can be fixed by just moving the instantiation to the *api.py files I believe

Pyside6

I think Binja only supports Pyside6, there were various places where I have to update the names of static members that had changed from either Pyside2 or Pyside5 (Not sure which)

Example: I had to change event.pos() to event.position() in context.py wheelEvent

There's also stuff that needs cleaned up and unused code removed, but the plugin is in a working state for Binja and every feature mentioned in the readme is functioning. It should probably be placed onto it's own branch for the work that still needs done for making it generic and cleaning up.
opened by EtchProject 0
convert float to int as expected by Qt API functions

Tenet is suffering the same issues than lighthouse previously: https://github.com/gaasedelen/lighthouse/commit/6e1dcb8d40dd28c3717d82ad957ba48cef10a3ab

This pull request, replicates the fixes to Tenet.

opened by RobinDavid 1
Ability to apply diffs (memory, registers) from tenet context to the main state

I have a full memory dump (generated by WinDbg), and a tenet trace file (generated by wtf fuzzer), that contains trace from start point to BSOD (nt!KeBugCheck2).

I see that tenet context is a fully separate - it has its own windows for registers, memory, stack, etc...

It would be useful to apply the diff (to the main state) from the start of the trace to the selected tracepoint. This way I could generate a new memory dump (via '!dump' command in the Windbg shell in IDA console) directly from the nt!KeBugCheck2 state or whatever.

opened by 1ndahous3 0

Support wow64 traces?

Hello, thanks for the awesome project!

I'm attempting to fuzz a wow64 application with wtf - my traces end up 64bit but tenet on ida with a 32bit binary is able to load only 32bit traces. It would be nice if tenet was able to load these as well.

I guess another option would be for wtf to support 32bit trace output? That would leave out some steps that happen in 64bit land tho.

I'm currently using a hacky script to convert the 64bit trace to 32. It simply drops anything 64bit related and converts r[xx] to e[xx]. Seems to somewhat work in most cases. Adding it below if anyone needs it.

<?php

$infile = $argv[1];
$out = [];

foreach (file($infile, 6) as $line)
{
    $items = [];
    foreach (explode(',', $line) as $item)
    {
        if (preg_match('#0x[\da-f]{9}#', $item)) // drop anything that looks 64bit
            continue;
        
        list($key, $value) = explode('=', $item);
        
        if (preg_match('#r\d+#', $key)) // drop r8-r15
            continue;
        
        if (preg_match('#r\w\w#', $key)) // rxx -> exx
            $item = 'e'.substr($key,1).'='.$value;
        
        $items[] = $item;
    }
    
    $out[] = implode(',', $items);
}

file_put_contents($infile.'.wow64', implode("\n", array_filter($out)));

opened by tostercx 0

Releases(v0.2.0)

v0.2.0(Sep 14, 2021)

Release Notes: What's New in Tenet v0.2

Additional Downloads

pintenet-v0.2-98437.zip - Windows pintool binaries compiled for Pin 3.20 (Kit 98437)
pintenet-v0.2-98425.zip - Windows pintool binaries compiled for Pin 3.19 (Kit 98425)

v0.2 -- CHANGELOG

+ Features
|- Overhauled Tenet's breakpoint / selection / navigation model to be more explicit
|- Tenet will now attempt to automatically resolve ASLR mappings with basic trace analysis
|- Added a cell-based drawing mode that is used when zoomed in far enough on the tracebars
|- Added !last command to the 'timestamp shell' to jump to the last 'navigable' trace address
|- What The Fuzz (https://github.com/0vercl0k/wtf) added native support for Tenet traces

+ Minor Changes
|- Tracebars now draw 'un-navigable' regions of the trace grey (such as library/external calls)
|- Tenet will now stay on the last 'navigable' mapped address when stepping through unmapped regions
|- Improved the selection behavior and interaction with 'zooming' on tracebars
|- Improved the selection behavior in the memory dump view (stack still needs work...)
|- Both 'code' and 'memory' breakpoints can be active at the same time now, not just one
|- Added more fine-grained right-click controls for interacting with 'region' breakpoints
|- Added various right-click 'Clear ... breakpoints' to the mem, trace, and reg views
|- Highlighting and double clicking a region of memory will now set a region access breakpoint
|- Double clicking 'empty' space in the mem / reg views can be used to automatically clear breakpoints
|- Updated theme subsystem and colors a little bit to be more consistent
|- A little bit of code and comment cleanup, but not a lot

+ Bugfixes
|- Tenet now ensures a selected text trace will be parsed if a packed trace does not actually match it
|- A bug could cause Tenet to show wrong register values towards the end of a trace segment
|- Step-over / reverse step-over could fail near the start/end of the trace
|- Fixed a bug that could cause the sample pin tracer to crash from uninitialized memory
|- mrexodia fixed a bug that could cause the pin tracer to crash on the fxsave instruction
|- Fixed / eliminated several misc UI / selection bugs through simple refactoring

Source code(tar.gz)
Source code(zip)
pintenet-v0.2-98425.zip(1.87 MB)
pintenet-v0.2-98437.zip(1.88 MB)

v0.1.0(Apr 20, 2021)
Release Notes: Tenet: A Trace Explorer for Reverse Engineers

Additional Downloads

pintenet-v0.1-98332.zip - Windows pintool binaries compiled for Pin 3.18 (Kit 98332)

Source code(tar.gz)
Source code(zip)
pintenet-v0.1-98332.zip(1.85 MB)

Owner

turning over rocks and finding nothing is still progress.

GitHub

Simple Python API for the Ergo Platform Explorer

Ergo is a "Resilient Platform for Contractual Money." It is designed to be a platform for applications with the main focus to provide an efficient, se

7 Jul 6, 2021

Some scripts for the Reverse engineered (old) api of CafeBazaar

bazz Note: This project is done and published only for educational purposes. Some scripts for the Reverse engineered (old) API of CafeBazaar. Be aware

35 Dec 25, 2022

A python script to simplify recompiling, signing and installing reverse engineered android apps.

urszi.py A python script to simplify the Uninstall Recompile Sign Zipalign Install cycle when reverse engineering Android applications. It checks if d

4 Jun 24, 2022

This tool helps you to reverse any regex and gives you the opposite/allowed Letters,numerics and symbols.

Regex-Reverser This tool helps you to reverse any regex and gives you the opposite/allowed Letters,numerics and symbols. Screenshots Usage/Examples py

0 Jun 2, 2022

Minitel 5 somewhat reverse-engineered

Minitel 5 The Minitel was a french dumb terminal with an embedded modem which had its Golden Age before the rise of Internet. Typically cubic, with an

10 Dec 28, 2022

Reverse the infix string. Note that while reversing the string you must interchange left and right parentheses

Reverse the infix string. Note that while reversing the string you must interchange left and right parentheses. Obtain the postfix expression of the infix expression Step 1.Reverse the postfix expression to get the prefix expression

1 Jan 4, 2022

Program to send ROM files to Turbo Everdrive; reverse-engineered and designed to be platform-independent

PCE_TurboEverdrive_USB What is this "TurboEverdrive USB" thing ? For those who have a TurboEverdrive v2.x from krikzz.com, there was originally an opt

10 Sep 18, 2022

Small-File-Explorer - I coded a small file explorer with several options

Petit explorateur de fichier / Small file explorer Pour la première option (création de répertoire) / For the first option (creation of a directory) e

1 Jan 3, 2022

A Python Bytecode Disassembler helping reverse engineers in dissecting Python binaries

A Python Bytecode Disassembler helping reverse engineers in dissecting Python binaries by disassembling and analyzing the compiled python byte-code(.pyc) files across all python versions (including Python 3.10.*)

95 Dec 26, 2022

An advanced multi-threaded, multi-client python reverse shell for hacking linux systems. There's still more work to do so feel free to help out with the development. Disclaimer: This reverse shell should only be used in the lawful, remote administration of authorized systems. Accessing a computer network without authorization or permission is illegal.

PwnLnX An advanced multi-threaded, multi-client python reverse shell for hacking linux systems. There's still more work to do so feel free to help out

212 Dec 24, 2022

Trace any Python program, anywhere!

lptrace lptrace is strace for Python programs. It lets you see in real-time what functions a Python program is running. It's particularly useful to de

687 Nov 20, 2022

printstack is a Python package that adds stack trace links to the builtin print function, so that editors such as PyCharm can link you to the source of the print call.

printstack is a Python package that adds stack trace links to the builtin print function, so that editors such as PyCharm can link to the source of the print call.

101 Aug 26, 2022

A Trace Explorer for Reverse Engineers

Related tags

Overview

Tenet - A Trace Explorer for Reverse Engineers

Overview

Releases

Installation

Usage

Bidirectional Exploration

Trace Timeline

Execution Breakpoints

Memory Breakpoints

Region Breakpoints

Register Seeking

Timestamp Shell

Themes

FAQ

Q: How do I record an execution trace using Tenet?

Q: What trace architectures does Tenet support loading?

Q: How big of a trace file can Tenet load / navigate?

Q: I loaded an execution trace, now there is a '.tt' file. What is it?

Q: The plugin crashed / threw an error / is showing bad trace information, what should I do?

Q: Memory in my trace is changing, but there are no writes to the region. Is this a bug!?

Q: Will this be ported to Binary Ninja / Ghidra / ... ?

Q: My organization would like to support this project, how can we help?

Future Work

Authors

Comments

test program

crash

no crash

generated trace

I've made changes that no longer make the plugin a generic plugin.

Releases(v0.2.0)

v0.2.0(Sep 14, 2021)

v0.1.0(Apr 20, 2021)

Owner

Simple Python API for the Ergo Platform Explorer

Some scripts for the Reverse engineered (old) api of CafeBazaar

A python script to simplify recompiling, signing and installing reverse engineered android apps.

This tool helps you to reverse any regex and gives you the opposite/allowed Letters,numerics and symbols.

Minitel 5 somewhat reverse-engineered

Reverse the infix string. Note that while reversing the string you must interchange left and right parentheses

Program to send ROM files to Turbo Everdrive; reverse-engineered and designed to be platform-independent

Small-File-Explorer - I coded a small file explorer with several options

A Python Bytecode Disassembler helping reverse engineers in dissecting Python binaries

Trace any Python program, anywhere!

printstack is a Python package that adds stack trace links to the builtin print function, so that editors such as PyCharm can link you to the source of the print call.

A listener for RF >= 4.0 that prints a Stack Trace to console to faster find the code section where the failure appears.

Fully asynchronous trace.moe API wrapper

VizTracer is a low-overhead logging/debugging/profiling tool that can trace and visualize your python code execution.

Library for Memory Trace Statistics in Python

nettrace is a powerful tool to trace network packet and diagnose network problem inside kernel.

Space-event-trace - Tracing service for spaceteam events

Trace all method entries and exits, the exit also prints the return value, if it is of basic type

An interactive explorer for single-cell transcriptomics data