Documentation
Tenet connects focused on-device capture with reproducible offline analysis. Choose the path that matches your current goal.
Start here
Section titled “Start here”- Install Tenet
- Record a trace with QBDITrace or a compatible collector
- Open it and verify the session
Explore an execution
Section titled “Explore an execution”Navigate the timeline, inspect registers and memory at any moment, set breakpoints on a static history, and follow dynamic calls and returns. Available in Desktop GUI and TUI.
Analyze a trace
Section titled “Analyze a trace”- Recover program structure — functions, CFG, XRefs, loops
- Trace data flow — forward and backward taint, critical path
- Inspect memory and strings — snapshots, search, entropy, YARA
- Recognize algorithms — patterns, constants, loop semantics
- Platform semantics — ObjC, syscalls, C API intercepts
- Trace tools — fold, diff, profile
- Virtual machine analysis — handler identification and dispatch recovery
Automate an investigation
Section titled “Automate an investigation”Use the CLI for batch jobs, JSON-RPC for programmatic access, MCP for LLM integration, or WebSocket for real-time streaming.
Reference
Section titled “Reference”- Pass catalog — every analysis pass, its CLI flag and dependencies
- Compatibility and limits — what each capability requires and how it degrades
- Trace format — binary format specification for custom collectors
Tenet Desktop analyzes trace files locally. The documentation website never receives your trace data.