trace-ui

Trace UI is a high-performance ARM64 execution trace visualization and analysis tool built with Tauri 2 and React. It is designed for security researchers to handle massive traces (tens of millions to hundreds of millions of lines) with smooth browsing and low memory overhead.

Key capabilities include:

• Large-scale Trace Browsing: Uses virtual scrolling and mmap zero-copy for constant memory usage and fast loading.
• Reverse Taint Analysis: Tracks data dependencies from registers or memory addresses.
• Cryptographic Algorithm Identification: Automatically scans for 28 different magic number patterns (e.g., AES, SHA, MD5).
• Function & Call Tree Analysis: Automatically builds call trees from BL/BLR/RET instructions.
• String Extraction: Extracts runtime strings from memory writes for searching and XRef analysis.
• AI Integration: Built-in MCP (Model Context Protocol) Server allows AI tools like Claude Code and Cursor to perform trace analysis directly.

Trace UI is a desktop application built with React 19, TypeScript, and Vite, using Tauri 2 for the backend. The project is organized as a Rust workspace with four primary crates:

• trace-parser: Handles trace log parsing for unidbg and GumTrace formats with automatic detection.
• trace-core: The central analysis engine providing indexing, taint slicing, call trees, memory tracking, register checkpoints, string extraction, and password algorithm scanning.
• trace-mcp: The MCP (Model Context Protocol) layer that exposes trace-core capabilities via 10 MCP tools, supporting both HTTP/SSE and Stdio transports.
• trace-cli: A standalone MCP Server entry point designed for direct integration with AI clients via Stdio.

Performance Model: The backend uses mmap for zero-copy trace file mapping. It performs a single scan to generate dependency graphs, call trees, memory access indices, and register checkpoints, which are then persisted using bincode for fast subsequent loads.

Trace UI includes a built-in Model Context Protocol (MCP) Server that exposes the trace analysis engine to AI tools (like Claude Code or Claude Desktop). This allows you to use natural language to perform complex reverse engineering tasks instead of manual GUI interaction.

Core Capabilities

• Automated Tool Chaining: AI can autonomously call multiple tools (e.g., opening a trace, searching for strings, performing taint analysis, and querying call trees) to complete a high-level goal.
• Natural Language Interaction: You can describe analysis intents in plain language (e.g., "Find all functions that call JNI functions").
• Batch Processing: AI can analyze multiple trace files and summarize differences.
• Deterministic Data: The data returned by the MCP tools (search results, taint analysis, call trees, memory content) is identical to what you see in the GUI.

Important Limitation

While the data is deterministic and accurate, the AI's reasoning and interpretation (e.g., "This function is performing AES key expansion") is an inference and may be incorrect, especially in complex ARM64 calculation chains or algorithm identification. Always use AI conclusions as a reference and verify with your own expertise.

Use these prompt patterns to automate common reverse engineering tasks using the MCP server.

Full Automated Analysis

Goal: Quickly understand a new trace file. Prompt:

打开 /path/to/trace.log，对这个 trace 做一次全面分析：
1. 基本信息：总行数、格式
2. 函数调用概览：有哪些函数被调用，调用次数最多的是哪些
3. 密码算法扫描：是否检测到已知算法
4. 字符串提取：有哪些有意义的运行时字符串（过滤掉太短的）
5. 基于以上信息，给出你的分析建议：哪些函数值得深入分析，可能的加密/签名逻辑在哪里

Tracking Encryption/Signature Data Flow

Goal: Trace input/output data flow for known crypto operations. Prompt:

打开 /path/to/trace.log，帮我分析加密流程：
1. 先扫描密码算法常量，看看 trace 中用了什么加密算法
2. 根据扫描到的算法匹配位置，找到这些指令所在的函数（通过调用树定位）
3. 对该函数入口处的输入寄存器（通常是 X0-X3）做污点分析，追踪数据来源
4. 分析加密输入是如何被计算出来的

Analyzing Strings and Network Requests

Goal: Find sensitive strings like URLs, tokens, or keys. Prompt:

打开 /path/to/trace.log，帮我分析字符串：
1. 提取所有运行时字符串，搜索包含 "http" "token" "key" "sign" 的字符串
2. 对找到的敏感字符串，用 search_instructions 搜索其地址附近的指令，找出是哪些指令在读写这些字符串
3. 对最关键的字符串（比如包含 URL 或 token 的），追踪其写入位置的数据来源

Understanding Unknown Function Logic

Goal: Deconstruct a specific function's behavior. Prompt:

打开 /path/to/trace.log，我需要分析一个函数：
1. 查看函数列表，找到地址为 0x12345 的函数（或搜索包含某特征的函数）
2. 获取这个函数的详细信息，包括入口参数和返回值
3. 对函数返回值（通常是 X0）做污点分析，追踪数据依赖
4. 查看函数内部调用了哪些子函数

The tool extracts runtime-generated strings from memory write operations by tracking incremental memory images.

How to Trigger String Scanning

• Manual: Use the menu Analysis → Scan Strings.
• Automatic: In Settings → Preferences → Analysis, enable Scan strings during index build.

Strings Panel Features

Strings are viewed in a dedicated tab (alongside Memory and Registers) and can be floated as an independent window. The panel includes:

• Search Box: Real-time filtering of string content.
• Min Length Slider: Filter noise by setting a minimum byte length (2-20 bytes).
• Columns: Seq, Address, Content, Enc (ASCII/UTF-8), Len, and XRefs (Cross-references).

String Actions (Right-click)

• View Detail: Opens a window with Hex and Text views (Hex view supports byte selection/copying).
• View in Memory: Jumps to the Memory panel at the string's address.
• Show XRefs: Opens a window listing all instructions that read this string; clicking an entry jumps to that trace line.
• Copy String / Copy Address: Copies the content or address to the clipboard.

Taint Analysis allows you to specify one or more registers or memory addresses as 'taint sources' and automatically traces the backward data dependency chain to identify all instructions affecting those values.

Taint Button States

• Gray (Default): No analysis active. Click to open the Taint Configuration dialog.
• Green: A register is selected. Click to immediately start analysis using the selected register and current line number.
• Orange (Active): Analysis is running. Click to access the menu with these options:
  • Tainted Only: Filter view to show only relevant instructions.
  • Show All (Dimmed): Show all instructions but dim non-tainted ones.
  • Go to Source: Navigate to the origin of the taint.
  • Re-configure: Open configuration settings.
  • Clear: Stop analysis.

Viewing Modes

• Filter Mode: Only displays rows related to the taint, significantly reducing view clutter.
• Highlight Mode: Displays all rows, but highlights tainted rows with color.

Configuration Options

In the Taint Configuration dialog, you can toggle the Dependencies option to control whether the tool tracks only data dependencies or both data and control dependencies (e.g., tracking dependencies propagated through conditional branches).