1

I am developing a dynamic instrumentation tool using Intel PIN to analyze malware binaries in windows. From what I have learned so far is that I am able to use the tool with programs I write using C/C++.

My question is that, will the tool developed using PIN and C/C++, work fine for binaries developed in other languages? Or are there any special care I needed to be taken to analyze binaries developed in other languages?

  • You can use dynamic instrumentation on any process that runs on the system. Scripting languages such as python does not run natively. The python VM executes python bytecode. So if you plan to instrument python programs, you are actually instrumenting the python VM and not your code. – 0xec Oct 9 '15 at 8:17
  • Will processor size matter? For example if I am generating tool dll in 64bit system, it'll instrument only 64bit application or will work for both?? – Anurag Nov 17 '15 at 8:07
  • Architecture of tool and application must match. A 64 bit tool can only instrument 64 bit applications. See here for more details. – 0xec Nov 17 '15 at 9:02
  • does that means if I am developing any tool for malwares, I need to develop separate tools for both 32 and 64bits?? – Anurag Nov 17 '15 at 18:22
  • Definitely so. For malware reversing with pin tools you can refer to these for some idea 1, 2 – 0xec Nov 17 '15 at 19:18
3

Yes, your Pintool written in C/C++ works fine for binaries (of x86 or x86-64 instruction set) generated from compilers of other languages. You can see this quotes in the file README of any Pin distribution

... the [instrumented] application can use any compiler.

Personally, I have used Pin to instrument binaries compiled by OCaml compiler (so the source code is OCaml).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.