Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wrote this small pintool that tries to record the number of int 0x80 instructions executed. I did this roughly as follows :-

xed_iclass_enum_t iclass = static_cast<xed_iclass_enum_t>(INS_Opcode(ins));

I then compare iclass against XED_ICLASS_INT and print out the EIP if found. I'm doing this on a statically compiled test binary that :-

1. Prints hello world
2. Makes a call to mprotect

However, the number of int 0x80 instructions encountered is just one. Is there something obvious I'm doing wrong? I tried using XED_ICLASS_SYSCALL too but that did not help.

share|improve this question
up vote 3 down vote accepted


Why not just use PIN_AddSyscallEntryFunction? This is an ABI-agnostic way of doing things, that lets you use PIN_GetSyscallArgument and related functions rather than manually inspecting the stack and register context.


You could also use INS_IsInterrupt at instrumentation time to gather the information at analysis time. Note that this won't catch any systemm calls made via the syscall or sysenter instructions.


As a simple example, if you look at the file inscount0.cpp that comes with Pin, if you add the following check, you'll only instrument syscalls.


In inscount0.cpp, change the routines as shown below. The module will now count the number of int instructions executed, rather than the total number of instructions executed.

VOID Instruction(INS ins, VOID *v)
        INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)docount, IARG_END);

Now all syscall instructions will be counted. You can use the standard INS_InsertCall arguments to inspect the stack or register context.


Add this function before main

void OnSyscall(THREADID threadIndex, CONTEXT *ctxt, SYSCALL_STANDARD std, VOID *v)
    printf("Made syscall #%i\n", PIN_GetSyscallNumber(ctxt, std));

and add this line to main before PIN_StartProgram.

PIN_AddSyscallEntryFunction(OnSyscall, 0);
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.