Ptrwatch is a Linux CLI tool designed for real-time observation of pointer chains.
Observe pointer chains in real time.
Ptrwatch is useful for security professionals and developers who need to monitor and analyze pointer chains in processes for potential vulnerabilities or malicious activity. It can be employed during forensic investigations or system monitoring to gain insights into memory usage and pointer manipulation.
Ensure that you have the required dependencies installed, including libpwu and the ncurses development library, before building ptrwatch.
$ git clone https://github.com/vykt/ptrwatch
$ cd ptrscan && ./buildgen.sh
$ cd build && make watch
$ cd .. && sudo ./install.shptrwatch example_proc
Watches pointer chains of the process named 'example_proc' using the default configuration.
ptrwatch -c new_config.cfg 1234
Watches pointer chains of the process with PID 1234 using 'new_config.cfg' as the configuration file.