Docs · chapter 6

Analysis tools

Updated 14 November 2026 · version 0.17

In short: ProtoInsight index compiles a capture into a bundle; then each call asks one question and gets a JSON answer. The same tools are what an agent uses; by hand they are free on your machine.

Compile, then ask

.\ProtoInsight.exe index app.proto.cap                 # app.proto.bundle, beside it
.\ProtoInsight.exe app.proto.bundle overview            # what the trace holds, start here
.\ProtoInsight.exe app.proto.bundle io                  # what the program read, wrote, sent
.\ProtoInsight.exe app.proto.bundle find '{"q":"CreateFileW"}'
.\ProtoInsight.exe app.proto.bundle state '{"at":5000}'

Compiling reads the capture and never changes it; it takes about half a minute per gigabyte. The first call starts a daemon that keeps the bundle open, so the next ones answer in milliseconds.

Quotes in Windows PowerShell 5

The PowerShell that comes with Windows drops the double quotes inside an argument. There, write them '{\"q\":\"CreateFileW\"}'; PowerShell 7.3 and later, and cmd.exe, take the JSON as written.

Functions need your account

Instruction-level answers (states, flows, strings, searches, calls into Windows) work offline. The function structure (which blocks form which function, what to call them) is worked out with our server: set PROTOVISION_TOKEN to your account token and it is unlocked, free. Without it, a function-level question says the structure is locked.

The tools

One question each. The answer says what it covered and what it left out.

Tool	Answers
`overview`	The trace's fixed facts: threads, modules, how many functions, loops and blocks; the words the other tools accept. First.
`list`	Functions, loops or blocks with their measures, filtered and sorted: the hot ones, the big ones, the ones run once.
`get`	The full record of one or several objects: measures, names, notes, pseudocode; with include, their callers, callees and calls into Windows.
`code`	Disassembly or raw bytes, at an object or an address.
`state`	Registers and memory at an instant; which thread ran it; every thread of the run.
`flow`	Where a value came from (back) or where it went (forward): one path.
`taint`	What computed this, what it affects, what changed in memory between two instants.
`strings`	The text the program built or read in memory (ASCII and UTF-16), with where and when.
`find`	One question q: a function name (the calls made under that name), a constant, a register value, a memory address, bytes, an opcode.
`compare`	Registers (and memory) at 2 to 16 instants, each diffed against the first.
`watch`	Every write into a memory range, oldest first: who filled a buffer, when a variable changed.
`io`	Inputs and outputs: the program's calls into Windows for files, network, registry, processes, console, crypto and time, grouped by kind, with counts and instants.
`symbols`	The nearest symbol of an address, a module's symbols, or a PDB to use for a module.
`export`	Writes another tool's whole answer to a file, for answers too long to read in one go.

An agent also has the tools that write its work into the session: names and labels (tag, note), the question tree (session), the report (report) and several calls at once (batch). Agents and prompts.

Instants and ids

Written	Means
`5000`	An instant: the 5000th instruction of the whole run, all threads interleaved in time.
`fn:0x7ff6a1b21000`	A function, by its entry address. Also bb: (a block) and loop: (a loop, by its header).
`run:fn:0x…#3`	The fourth execution of a function, with its own arguments and instants.

Debugging

Agents and prompts