IPTAnalyzer is a tool that can expedite exploit and malware analysis using Intel Process Trace trace files. It wraps Python around libipt library and uses multiprocessing to generate basic block caches to expedite post-mortem analysis.
| Name | Description |
|---|---|
| iptdecoder | libipt wrapper class |
| pyipt | python wrapper upon iptdecoder and libipt |
| iptanalyzer | python library to decode ipt using libipt and process dump image extraction |
| tools | various tools based upon iptanalyzer |
- Install pykd, capstone, windbgtool
pip install pykd
pip install capstone
pip install git+https://github.com/ohjeongwook/windbgtool
- Install WinDbg from Windows SDK
PyKD sometimes suffers from WinDbg DLL compability issues. Please run script from fix_windbg_files.py when you find the issue affecting PyKD loading.
For a good example, please read my article Using Intel PT for Vulnerability Triaging with IPTAnalyzer