3

I am writing a PinTool, which can manipulate certain register/memory value. However, after manipulation, one challenge I am facing now, is the deadloop.

In particular, due to the frequent manipulation of certain register value, it is indeed common to create deadloop in the execution trace. I am thinking to detect such case, and terminate the execution.

So here is my question, what is a good practice to detect a deadloop in a PinTool? I can come up with some naive solutions, say, record the executed instructions, and if certain instruction has been executed for a large amount of times, just terminate the execution.

Could anyone help me on this issue? Thank you.

1
  1. Open debugger and attach to the pin executable to check if the dead loop is in the pin itself. This is highly unlikely and the most probable cause is the tool you've written.

  2. Do the same for the pintool. Pintool is in the target process. So attache debugger to it.

The debugger should show you where the problem is. Once the area identified, you can open the tool in IDA to do further inspection or "connect" your source to debugger.

Another way, is to log every Trace or basic block that is executing - check in the examples. This log should also show you the problematic area.

0

I assume by deadloop you mean infinite loop.

Generally, the loop should have one or more exit condition. The exit condition has one of the control-transfer instructions (jz, jg, ja...) that keeps the loop going. So it's enough to log the control-transfer instructions.

Logging the instructions can be expensive, and you may need to narrow the algorithm to specific thread and module.

You may also want to consider to diagnose the infinite loops to know more about the cause before implementing algorithm to detect it.

  • I think that by dead loop he meant dead loop code which isn't executed after registry manipulation. – yaspr Dec 28 '16 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.