TraceWeaver.

Overview

TraceWeaver explores how runtime observations can guide reverse engineering without turning incomplete evidence into a behavioral story. It captures bounded events, validates them, and connects them to normalized static-code locations.

This overview is based on the project’s local README. It describes a research system, not a packaged general-purpose release.

Problem and constraints

Runtime addresses depend on where a module is loaded. An observation is only useful in a static analysis tool when its module identity and relative location are preserved. Observations also need to stay distinct from analyst-authored findings and hypotheses.

Architecture

A thin Frida integration observes an authorized target. A versioned collector envelope passes through tw-ingest validation into the backend-independent tw-core trace format. The CLI inspects, replays, correlates, and exports evidence. The Ghidra importer verifies module identity before attaching annotations.

The diagram above shows this documented pipeline. The branches are downstream consumers, not a claim that every runtime event maps successfully.

Key decisions

• Evidence before interpretation. Observed events, deterministic relationships, findings, and hypotheses remain distinct.
• Identity before annotation. SHA-256 module identity and relative virtual addresses support mapping; the importer verifies identity first.
• Replayable traces. Append-only JSONL bundles include manifests, diagnostics, and explicit capture bounds.
• Replaceable integrations. The core evidence model does not depend on Frida or Ghidra.

Implementation

The Rust workspace separates core types, protocol ingestion, and CLI operations. A Python transport bridge connects bounded Frida collection to the ingestion layer. Analysis can operate on existing trace bundles without rerunning a target.

Validation and evidence

The project README documents controlled benign fixtures, portable regression tests, live WSL captures, and isolated Windows fixture runs. It also records hosted analyst acceptance within a specific Ghidra/WSL environment. These are repository-reported validations; this portfolio does not claim independent reproduction or universal platform support.

Limitations

Coverage is bounded to documented profiles and fixtures. Selected-call entry/return linkage does not establish producer/consumer causality. Broader API instrumentation, general memory provenance, and verified static call-chain resolution are not established capabilities.

The system does not automatically label malicious behavior or generate an analyst’s interpretation. Productization and licensing remain unresolved. No public source or demo link is presented until an approved URL is supplied.