Skip to content

CaYaTrace 0.5.0 — request contents, and a sweep for leftovers

Choose a tag to compare

@CaYatur CaYatur released this 13 Aug 13:50
· 7 commits to main since this release

Two things the tool had the data for and would not show.

The contents of GET and POST requests

The requests table listed a method, a URL and a size. The headers and the body were in the session all along — written there by the proxy — with nothing in the view able to reach them, so a POST that uploaded 45 bytes was a row saying 45 bytes.

A row now opens to show every header it carried and a button for the body. Both travel with an exported report, so this works in a report you send to somebody else.

A sweep for what a program left behind

This is why removal was skipping things, and why loosening the filters was never going to fix it.

The plan is built from the recording: every item in it is something the tool watched being created. That is the right foundation and it cannot be the whole answer — a program installed before the recording started, or a component dropped by an installer that ran outside the traced scope, was never observed, so no filter setting could ever include it. The observation does not exist.

The sweep asks the opposite question: what on this machine is named after it. Four depths, because how hard to look is your choice and each one matches more loosely:

Depth Looks at
None only what was recorded, as before
Safe directories and registry keys carrying the name
Moderate also uninstall entries, services, App Paths, startup values, scheduled tasks — matched on the names a person recognises, not the GUID the key is filed under
Advanced also registry values anywhere under the software hives whose data points at it. Slow, bounded, and it says when it stopped early

Nothing in it deletes. It produces candidates carrying the reason each one matched, every one still passes the safety policy, and you approve the plan. A sweep that matched too widely is a list to uncheck rather than damage — that is the only arrangement in which an aggressive search is safe to offer.

The terms it searched for are shown, so an unexpected match is explainable. A name with nothing distinctive left after the common words are stripped produces no sweep at all rather than a sweep of the whole machine.

A refused item stays in the plan, marked

It used to be dropped. Comparing the plan against what was still on the machine, you had no way to tell something the tool had not found from something it had decided not to touch — a gap to report versus a judgement to argue with, both arriving as silence. The runner still refuses it; this changes what the plan says, not what it does.

Download

CaYaTrace.exe — one file, no installer, no runtime to install. Right-click → Run as administrator for kernel tracing.

SHA-256  01BE9CFC2B7978F6680FE67A7F820A29A9CADD49133F384CEB6B8C10A18A88C8

Authorized use only. Recorded sessions can contain credentials, tokens, cookies and personal data — see SECURITY.md.