1

I am quite new to reverse engineering (but have some experience with OllyDbg). What I want to do, is to attach to Windows executable file or library (mostly PE32, but x64 would be a great benefit) and record how it interacts with virtual memory in order to do some self-study and experiments. E.g. I want to have timestamp,operation type(read,write,allocate etc.), address, amount of data transfered records for some period of program's runtime. My first thought was to use breakpoints in OllyDbg, where you can set breakpoint on the memory range and operation type. But this will cause execution to stop every time, so gathering of the data will take a lot of time. Also I need to know memory ranges, but if program will try to write into unallocated memory for some reason - I'll lose this data. Also I found that Intel Pin can do something similar to what I want, but as I understood it can't record the timestamp of memory operation.

So my questions is: Is there any tool that can fit my requests? If not - which tools can be modified in some feasible time? In the worst case I would be satisfied with something that can track amount of read(or write, or allocation - all separately) operations per millisecond (or other significantly small time period).

Thank you.

Improve this question
2
  • IDA Pro's tracing might help.
    – Vitaly Osipov
    Commented Mar 3, 2016 at 20:36
  • I have tried freeware version - no timestamps there. And I prefer command-line interface to be available in order to automate the process.
    – aGGeRReS
    Commented Mar 3, 2016 at 21:14

1 Answer 1

Reset to default
1

As you noted, PIN would likely be the best option for this. Since PIN allows you to register user-defined callbacks for events, you could indeed record timestamps via your callback functions.

You may also want to check out tracectory, which parses OllyDbg run traces. It might not do exactly what you want, but it's open source, and you could probably get your desired output with a few simple modifications.

tracectory

You could also hack up QEMU or Bochs for your needs, but I wouldn't recommend it as these are rather "heavyweight" options, especially since you're interested in monitoring only a single process.

Improve this answer
6
  • Thanks for advices. Do you know if I can find somewhere PIN usage examples? I found pintrace on the pintool website, but I didn't get how it works since in my opinion there is too few code for that functionality. I was thinking about QEMU, but didn't found anything about desired functionality: what should I search for?
    – aGGeRReS
    Commented Mar 3, 2016 at 15:27
  • When you download PIN, the ZIP contains several examples in \extras\xed-ia32\examples. You can also Google for example PIN code, which yields links such as github.com/jbremer/readb4write.
    – Jason Geffner
    Commented Mar 3, 2016 at 15:34
  • So far I can see, that tracectory will not produce any timestamps, since there is no such in OllyDbg run trace.
    – aGGeRReS
    Commented Mar 3, 2016 at 16:24
  • Good point. If you absolutely need timestamps then PIN would be the best option.
    – Jason Geffner
    Commented Mar 3, 2016 at 16:44
  • I tried to compile Intel Pin examples with no success (Error 1 error C1083: Cannot open include file: 'memory': No such file or directory c:\program files (x86)\microsoft visual studio 10.0\vc\include\vector) The problem described here: (stackoverflow.com/questions/35795143/…). Does anybody have experience with that?
    – aGGeRReS
    Commented Mar 4, 2016 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.