Skip to content

ohjeongwook/iptanalyzer

master
Switch branches/tags
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
src
 
 
 
 
 
 
 
 

IPTAnalyzer

IPTAnalyzer is a tool that can expedite exploit and malware analysis using Intel Process Trace trace files. It wraps Python around libipt library and uses multiprocessing to generate basic block caches to expedite post-mortem analysis.


Tools

Name Description
iptdecoder libipt wrapper class
pyipt python wrapper upon iptdecoder and libipt
iptanalyzer python library to decode ipt using libipt and process dump image extraction
tools various tools based upon iptanalyzer

Package dependencies

  • Install pykd, capstone, windbgtool
pip install pykd
pip install capstone
pip install git+https://github.com/ohjeongwook/windbgtool

Fix Windbg DLL Compatibility Issues

PyKD sometimes suffers from WinDbg DLL compability issues. Please run script from fix_windbg_files.py when you find the issue affecting PyKD loading.


Usage

For a good example, please read my article Using Intel PT for Vulnerability Triaging with IPTAnalyzer

About

Intel PT log analyzer With Parallel Processing And Basic Block Offset Caching Support

Resources

Stars

Watchers

Forks

Packages

No packages published