Is there a way to track created processes?

[Ou7law007]

My sample calls CreateProcessInternalW to create a new process, is there a way track it without attaching a debugger or hooking the function?

[hasherezade]

Sorry but currently TinyTracer does not provide following children processes. However, as far as I know Pin gives such option, so I will check if I can add it.

[Ou7law007]

Thank you.
I was able to run the child process on its own but it requires specific arguments. Is there a way to maybe pass arguments to tiny tracer?

[hasherezade]

I was able to run the child process on its own but it requires specific arguments. Is there a way to maybe pass arguments to tiny tracer?

Yes. You just need to add the parameter in the run_me.bat, just after the "%TARGET_APP%"

tiny_tracer/install32_64/run_me.bat

Line 79 in a38128d

set EXE_CMD=%PIN_DIR%\pin.exe -t %PINTOOL% -m "%TRACED_MODULE%" -o %TAG_FILE% -s %SETTINGS_FILE% -b "%WATCH_BEFORE%" -- "%TARGET_APP%"

[Ou7law007]

Awesome. Thank you

[cecio]

hey @hasherezade , hope you are fine!

I made a small modification to add the possibility (controlled by an option in .INI file) to follow subprocesses.
If you are interested, I can open a pull request, so we can discuss the implementation and any rework you may think it's needed.
Thanks!

[hasherezade]

hi @cecio ! Sure, I am interested, let's discuss it further! Feel free to open a pull request, or a thread in https://github.com/hasherezade/tiny_tracer/discussions.