IPTAnalyzer

IPTAnalyzer is a tool that can expedite exploit and malware analysis using Intel Process Trace trace files. It wraps Python around libipt library and uses multiprocessing to generate basic block caches to expedite post-mortem analysis.

Tools

Name | Description :--- | :---------- iptdecoder | libipt wrapper class pyipt | python wrapper upon iptdecoder and libipt iptanalyzer | python library to decode ipt using libipt and process dump image extraction tools | various tools based upon iptanalyzer

Package dependencies

• Install pykd, capstone, windbgtool

pip install pykd
pip install capstone
pip install git+https://github.com/ohjeongwook/windbgtool

• Install WinDbg from Windows SDK

Fix Windbg DLL Compatibility Issues

PyKD sometimes suffers from WinDbg DLL compability issues. Please run script from fix_windbg_files.py when you find the issue affecting PyKD loading.

Usage

For a good example, please read my article Using Intel PT for Vulnerability Triaging with IPTAnalyzer