This project replaces syscall numbers & arguments in Tinytracer's .tag output w/ their actual Nt function declarations for better readability.
Do note that some functions declarations are not included, so some arguments will not be processed
The function declarations I use in this project are obtained from CAPE Sandbox and NtInternals. In the case of conflicting declarations for the same function, CAPE's declaration will be prioritized since it references MSDN (which is the official documentation site).
usage: TinyProcessor.py [-h] -file <filename>
options:
-h, --help show this help message and exit
-file <filename> Takes in a .tag file generated by Tinytracer
- Remove memory addresses [--remove-addr, -r]
- Add argument direction & type [--verbose, -v]
- Add symbols for normal API calls by scraping
hooks.c - Add support for Linux syscalls
- Wrap files using Pyinstaller