3

The intel PIN manual (section Memory Reference Trace) says:

We also use INS_InsertPredicatedCall instead of INS_InsertCall to avoid generating references to instructions that are predicated when the predicate is false see here.

_

When the instruction has a predicate and the predicate is false, the analysis function is not called see here.

If I want to analyze all instructions that are actually executed, which of the two shall I pick?

I assume INS_InsertPredicatedCall but I am not sure because I have seen INS_InsertCall more often. But why would somebody use it, i.e., why would somebody want to analyze instructions

that are predicated when the predicate is false

? Maybe a minimal example of how the two functions lead to different results would be helpful here...

2

You are correct, we should use INS_InsertPredicatedCall instead of INS_InsertCall in your case. It is quite intuitive to distinguish one from the other, consider the following code

cond:
  xor eax, eax
  mov edx, 0x1
  cmp word [esp + 0x4], 0x5
  cmovz eax, edx
  ret

whose C code is something likes

int cond(int input)
{
  return input == 0x5 ? 1 : 0;
}

If you use INS_InsertCall to trace executed instructions of cond(input), then for any value of input, you observe always the trace:

xor eax, eax
mov edx, 0x1
cmp word [esp + 0x4], 0x5
cmovz eax, edx
ret

But if you use INS_InsertPredicateCall, then for input != 0x5, you will observe only:

xor eax, eax
mov edx, 0x1
cmp word [esp + 0x4], 0x5
ret

since cmovz is a predicated instruction, it is executed only if ZF = 1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.