In PIN's documentation it says this about
PIN_SafeCopy is used to copy the specified number of bytes from a source memory region to a destination memory region. This function guarantees safe return to the caller even if the source or destination regions are inaccessible (entirely or partially). Use of this function also guarantees that the tool reads or writes the values used by the application. For example, on Windows, Pin replaces certain TEB fields when running a tool's analysis code. If the tool accessed these fields directly, it would see the modified values rather than the original ones. Using PIN_SafeCopy() allows the tool to read or write the application's values for these fields.
I'm trying to get the stack base of the current thread. Normally I would get it like this (if going directly through
mov eax, FS:[0x04]. Since I'm getting the old stack, and not the "new" one maintained by PIN (if I compare the
REG_ESP from PIN with the current
ESP they show different stacks) I tried to first get the linear address of the TEB with
mov eax, FS:[0x18] and then use
PIN_SafeCopy to read from this address + 0x04. However I only get 0x00000000. Any idea how I can do this? Also I suppose this makes it risky to use the Win API if it reads from such stale sources of data?