Why not just use
PIN_AddSyscallEntryFunction? This is an ABI-agnostic way of doing things, that lets you use
PIN_GetSyscallArgument and related functions rather than manually inspecting the stack and register context.
You could also use
INS_IsInterrupt at instrumentation time to gather the information at analysis time. Note that this won't catch any systemm calls made via the
As a simple example, if you look at the file
inscount0.cpp that comes with Pin, if you add the following check, you'll only instrument syscalls.
inscount0.cpp, change the routines as shown below. The module will now count the number of
int instructions executed, rather than the total number of instructions executed.
VOID Instruction(INS ins, VOID *v)
INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)docount, IARG_END);
Now all syscall instructions will be counted. You can use the standard
INS_InsertCall arguments to inspect the stack or register context.
Add this function before
void OnSyscall(THREADID threadIndex, CONTEXT *ctxt, SYSCALL_STANDARD std, VOID *v)
printf("Made syscall #%i\n", PIN_GetSyscallNumber(ctxt, std));
and add this line to