search

hasherezade / tiny_tracer

A Pin Tool for tracing API calls etc
1.25k stars 138 forks source link

Is there a way to track created processes? #11

Open Ou7law007 opened 2 years ago

Ou7law007 commented 2 years ago

My sample calls CreateProcessInternalW to create a new process, is there a way track it without attaching a debugger or hooking the function?

hasherezade commented 2 years ago

Sorry but currently TinyTracer does not provide following children processes. However, as far as I know Pin gives such option, so I will check if I can add it.

Ou7law007 commented 2 years ago

Thank you. I was able to run the child process on its own but it requires specific arguments. Is there a way to maybe pass arguments to tiny tracer?

hasherezade commented 2 years ago

I was able to run the child process on its own but it requires specific arguments. Is there a way to maybe pass arguments to tiny tracer?

Yes. You just need to add the parameter in the run_me.bat, just after the "%TARGET_APP%" https://github.com/hasherezade/tiny_tracer/blob/a38128de2aba8996ce84cc394370ded5987700bb/install32_64/run_me.bat#L79

Ou7law007 commented 2 years ago

Awesome. Thank you