1

I am developing a dynamic instrumentation tool using Intel PIN to analyze malware binaries in windows. From what I have learned so far is that I am able to use the tool with programs I write using C/C++.

My question is that, will the tool developed using PIN and C/C++, work fine for binaries developed in other languages? Or are there any special care I needed to be taken to analyze binaries developed in other languages?

Improve this question
5
  • You can use dynamic instrumentation on any process that runs on the system. Scripting languages such as python does not run natively. The python VM executes python bytecode. So if you plan to instrument python programs, you are actually instrumenting the python VM and not your code.
    – 0xec
    Oct 9, 2015 at 8:17
  • Will processor size matter? For example if I am generating tool dll in 64bit system, it'll instrument only 64bit application or will work for both??
    – Anurag
    Nov 17, 2015 at 8:07
  • Architecture of tool and application must match. A 64 bit tool can only instrument 64 bit applications. See here for more details.
    – 0xec
    Nov 17, 2015 at 9:02
  • does that means if I am developing any tool for malwares, I need to develop separate tools for both 32 and 64bits??
    – Anurag
    Nov 17, 2015 at 18:22
  • Definitely so. For malware reversing with pin tools you can refer to these for some idea 1, 2
    – 0xec
    Nov 17, 2015 at 19:18

1 Answer 1

Reset to default
3

Yes, your Pintool written in C/C++ works fine for binaries (of x86 or x86-64 instruction set) generated from compilers of other languages. You can see this quotes in the file README of any Pin distribution

... the [instrumented] application can use any compiler.

Personally, I have used Pin to instrument binaries compiled by OCaml compiler (so the source code is OCaml).

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.