Malware analysis, sandbox work
Live detonation
Run an unknown binary under observation, then confinement, without losing the live view. Denials surface the instant they happen.
# retrace-profile capture -o p.json -- ./sample # observe
# retrace-profile jail p.json -o jail.json # emit policy
# retrace run --config jail.json -- ./sample # confine
With RETRACE_OTLP_ENDPOINT set, every retrace.jail.denied event streams to your collector while the detonation runs (v2.36+).
Cookbook 34 — profile and jail →Supply chain, compliance
Continuous audit
Grade a binary's claims against kernel-layer truth and against its packaging manifest's declared set. Violations are headline output, not log spam.
# strace -f -e trace=file ./tool 2> truth.json # kernel truth
# retrace-profile --libc t.json --kernel k.json # grade: libc_only / kernel_only
# retrace-profile --libc t.json --inside declared.json # confinement check
Converters exist for strace, dtrace, truss, ktrace, procmon, and raw ETW — five platforms of ground truth in one shape.
docs/reports.md — output shapes →QA, security engineering
Fuzz campaigns
Deterministic failure injection plus corpus management: clusters, one reproducer per cluster, a minimized corpus, and a drift oracle for behavior the baseline never saw.
# retrace fuzz malloc --rate 0.2 --seed 42 -- ./target in.xml
# retrace-fuzz-report --config fuzz.json --seeds corpus/ -o report.json -- ./target
# retrace-fuzz-report --baseline good.json ... # drift oracle
Reports export over OTLP: crash clusters as log records, iteration/crash counters as metrics (--endpoint).
Cookbook 35 — dictionary fuzzing →SRE, detection engineering
OTLP observability
One env variable turns the traced process into an OpenTelemetry emitter: spans per call, security events, timing metrics — into any otelcol/Tempo/Jaeger stack.
# RETRACE_OTLP_ENDPOINT=http://collector:4318 retrace trace '*' -- ./svc
# retrace-profile export p.json --endpoint http://collector:4318
# retrace-fuzz-report ... --endpoint http://collector:4318
Attribute schema is documented and stable (retrace.func, retrace.jail.*, retrace.fuzz.*, retrace.risk.*) — dashboards can be shared.
Cookbook 36 — live OTLP stream →Container/packaging security
VFS escape hunting
Does the packaged app stay inside its declared world? Trace every path touch, normalize NT forms, diff against the escape set.
# retrace trace fopen,open,mkdir --log run.json -- ./app
# retrace-correlate --libc run.json # normalized path truth
# retrace-profile --libc run.json --inside declared.json
Works on Flatpak/Snap manifests too: flatpak2inside and snap2inside convert personal-files plugs to declared sets.
Example: escape-hunting →Deployment, blue teams
Zero-trust hardening
Turn a known-good run into the strictest config that still works: allow-list the observed paths, deny the classes you never granted, redirect reads to decoys.
# retrace-profile harden p.json -o strict.json
# retrace run --config strict.json -- ./tool # deny-by-default
# decoy_dir in the sandbox action # deception mode
Fail-closed by design: an unreachable supervisor never relaxes a jail — and the same declared-set now compiles into kernel enforcement (landlock/seccomp, Seatbelt, AppContainer) with a signed audit trail.
About the supervisor arc →Debugging, CI archaeology
Time-travel replay
A recorded session replays with identical calls and mutations — the 3am failure reproduces on a laptop at 9am, deterministically.
# retrace run --config session.json --record r.json -- ./flaky
# retrace replay r.json
Seeds are first-class (RETRACE_FUZZ_SEED / fuzz_seed param): randomness is a dial, not a hazard.
Cookbook — replay debugging →Windows IR, software inventory
Windows, including static CRT
One injectable retrace.dll for MSVC and MinGW targets; /MT binaries that carry their own CRT are observed and jailed through the ntdll layer.
# retrace-win-run --dll retrace.dll -- target.exe
# retrace-profile capture -o p.json -- target.exe
ETW capture (etw-capture.ps1 → etw2retrace) provides the kernel truth on Windows; procmon CSV is equally first-class.
Docs — platforms →