Skip to content
Tenet Documentation

Getting started

The path

Section titled “The path”
  1. Install Tenet on an Apple Silicon Mac.
  2. Record a trace with QBDITrace or a compatible collector.
  3. Open it in Tenet and wait for the first index build.
  4. Understand core concepts — instruction IDs, time-aware state, analysis passes.
  5. Explore the execution — navigate, inspect, set breakpoints, follow calls.

Trace requirements

Section titled “Trace requirements”

Tenet accepts format version 4 or newer. The trace should include register diffs and embedded code for the richest analysis. PC-delta (v5) and FPR (v7) recordings require Tenet rather than the legacy trace_decode utility.

What success looks like

Section titled “What success looks like”

The instruction timeline opens, register values change as you navigate, and default structure passes identify executed functions and cross-references. From there, run targeted analysis passes to follow data flow, recognize algorithms, or inspect platform API calls.