search

gaasedelen / tenet

A Trace Explorer for Reverse Engineers
MIT License
1.33k stars 130 forks source link

Ability to apply diffs (memory, registers) from tenet context to the main state #16

Open 1ndahous3 opened 2 years ago

1ndahous3 commented 2 years ago

I have a full memory dump (generated by WinDbg), and a tenet trace file (generated by wtf fuzzer), that contains trace from start point to BSOD (nt!KeBugCheck2).

image

I see that tenet context is a fully separate - it has its own windows for registers, memory, stack, etc...

It would be useful to apply the diff (to the main state) from the start of the trace to the selected tracepoint. This way I could generate a new memory dump (via '!dump' command in the Windbg shell in IDA console) directly from the nt!KeBugCheck2 state or whatever.