Exact-match record lookup
grep can locate a PC, opcode, address, or string. It does not reconstruct the complete register file at an instruction or resolve writes by address range and time.
DYNAMIC TRACE ANALYSIS
Instruction trace analysisat billion-instruction scale.
Tenet indexes instruction-level execution traces for random-access state reconstruction and offline analysis. Inspect registers and memory at any recorded instruction, recover executed control flow, and run data-flow, algorithm, and platform analyses.
Random-access statePersistent trace indexComposable analysis passes
0x10083A274bl0x100815d20
0x100815D20stpx29, x30, [sp, #-0x20]!
0x100815D24movx29, sp
0x100815D28eorx8, x0, x1
REGISTER DIFF
x80x0000000102a00x9e3779b97f4a
sp0x000000016f300x000000016f10
ANALYSIS SIGNAL
ARX patterndetected · confidence 0.94
Backward slice127 instructions · x0 source
TRACE INDEXING / STATE RECONSTRUCTION
A trace records transitions, not queryable state
Text search locates individual records. Register state, overlapping memory writes, executed control flow, and value provenance require reconstruction across the instruction timeline.
Repeated scans do not scale
Replaying from the beginning for every query makes random navigation expensive. Running each analysis as a separate full scan multiplies IO and decoding cost.
Persistent indexes and point-in-time queries
Tenet indexes instruction offsets, anchors, register writes, memory history, and code. The same data model supports interactive navigation and deterministic analysis passes.
QUERY MODEL / 查询模型
Queries return instruction IDs, runtime PCs, register values, time-specific memory contents, write history, and call context. Analysis results retain references to the records that produced them.
ANALYSIS CAPABILITIES
Instruction, state, control-flow, and data-flow analysis
Analysis passes share the indexed trace, reconstructed state, and common scan infrastructure.
Point-in-time state reconstruction
Reconstruct the register file and time-specific memory contents from ANCHOR records, diffs, reads, and writes.
Executed control-flow recovery
Recover functions, XRefs, CFGs, calls, returns, loops, and observed execution counts.
Register and memory provenance
Find register definitions, memory write history, forward propagation, backward dependencies, and critical paths.
Algorithm and pattern analysis
Analyze constants, instruction patterns, loop behavior, call graphs, and data-flow structure.
Platform API correlation
Correlate ObjC messages, C APIs, JNI calls, syscalls, and cryptographic operations with traced instructions.
Trace-backed analysis results
Pass outputs include inst_id, runtime PC, memory access, call-site, and source annotations where applicable.
PERFORMANCE / BILLION-INSTRUCTION TRACES
Storage, indexing, and memory behavior at trace scale
Tenet supports traces containing up to billions of executed instructions without loading the complete trace into memory. Persistent indexes move repeated analysis cost out of subsequent sessions.
Memory-mapped IO and Block compression
TraceReader uses mmap for zero-copy access. Indexed zstd blocks keep rich register, memory, and code evidence compact while preserving random block reads.
Persistent RocksDB index
RocksDB separates offsets, anchors, register writes, memory history, and code into dedicated column families. First-open work becomes a durable index; later sessions avoid rebuilding it.
Adaptive register checkpoints
ANCHOR + diff avoids full snapshots per instruction. Adaptive checkpoints target a practical memory budget while keeping random state queries to a short replay window.
Scan Fusion
Compatible collectors share one sequential trace traversal instead of making every pass rescan billions of records. TBB schedules independent pass dependencies in parallel.
Compact pass-result cache
Full-scan analyses serialize compact binary results into RocksDB. Repeated GUI, CLI, RPC, or MCP queries can reuse prior work instead of recomputing it.
On-demand semantic analysis
Fast native indexes handle navigation and structure globally; expensive semantic engines such as Triton are applied to focused ranges where precision justifies the cost.
Processing time, index size, and peak memory depend on record density, enabled fields, compression ratio, selected passes, and hardware. Tenet does not require the complete trace to reside in RAM.
WORKFLOW / CAPTURE → INDEX → ANALYZE → EXPORT
Capture once, reuse the indexed trace
The local index is shared by interactive interfaces, batch commands, and service APIs. Pass results can be cached in the same database.
Record instruction execution
Use the official QBDITrace on iOS or Android, or produce the same binary contract with a compatible collector such as Frida Stalker.
→
Reconstruct execution
Build persistent indexes for instruction offsets, anchors, register writes, memory history, code, functions, and XRefs.
→
Run analysis passes
Run deterministic passes for CFG, taint, memory search, algorithm recognition, platform APIs, Trace Diff, and VM analysis.
→
Inspect or export results
Use the GUI or TUI interactively, export reports from the CLI, or retrieve structured results through RPC and MCP.
ANALYSIS TASKS
Common trace-analysis workloads
These analyses operate on recorded instruction order, reconstructed state, memory history, and observed control flow.
Signature and encryption routines
Identify constants, round loops, ARX/SPN/Feistel semantics, and the call context surrounding a signature or encryption routine.
Source-to-sink tracing
Follow an input through register and memory transformations to an API call, buffer, branch, or return value.
Backward provenance
Start from a suspicious output and recover the contributing instructions, last writers, constants, calls, and source annotations.
Platform boundary correlation
Connect ObjC messages, JNI or C API intercepts, syscalls, and crypto operations back to low-level execution.
VM protection analysis
Use static hints plus dynamic CFG, loop, taint, and data-flow evidence to study dispatchers, handlers, and virtual state.
Trace comparison
Compare inputs, environments, or patched builds; locate the first control-flow, register, or memory divergence.
Analysis interfaces
GUI / TUI provide interactive navigation. CLI / RPC support batch processing and integration. MCP / WebSocket expose indexed trace data and pass results to automation tools, including LLM clients.
GET STARTED
Open a trace and begin analysis
Follow the quick start to record a trace, build its local index, and inspect the first instruction range.