Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

I wrote this small pintool that tries to record the number of int 0x80 instructions executed. I did this roughly as follows :-

xed_iclass_enum_t iclass = static_cast<xed_iclass_enum_t>(INS_Opcode(ins));

I then compare iclass against XED_ICLASS_INT and print out the EIP if found. I'm doing this on a statically compiled test binary that :-

1. Prints hello world
2. Makes a call to mprotect

However, the number of int 0x80 instructions encountered is just one. Is there something obvious I'm doing wrong? I tried using XED_ICLASS_SYSCALL too but that did not help.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

PIN_AddSyscallEntryFunction

Why not just use PIN_AddSyscallEntryFunction? This is an ABI-agnostic way of doing things, that lets you use PIN_GetSyscallArgument and related functions rather than manually inspecting the stack and register context.

INS_IsInterrupt

You could also use INS_IsInterrupt at instrumentation time to gather the information at analysis time. Note that this won't catch any systemm calls made via the syscall or sysenter instructions.

Examples

As a simple example, if you look at the file inscount0.cpp that comes with Pin, if you add the following check, you'll only instrument syscalls.

INS_IsInterrupt

In inscount0.cpp, change the routines as shown below. The module will now count the number of int instructions executed, rather than the total number of instructions executed.

VOID Instruction(INS ins, VOID *v)
{
    if(INS_IsSyscall(ins))
    {
        INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)docount, IARG_END);
    }
}

Now all syscall instructions will be counted. You can use the standard INS_InsertCall arguments to inspect the stack or register context.

PIN_AddSyscallEntryFunction

Add this function before main

void OnSyscall(THREADID threadIndex, CONTEXT *ctxt, SYSCALL_STANDARD std, VOID *v)
{
    printf("Made syscall #%i\n", PIN_GetSyscallNumber(ctxt, std));
}

and add this line to main before PIN_StartProgram.

PIN_AddSyscallEntryFunction(OnSyscall, 0);
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.