In PIN's documentation it says this about PIN_SafeCopy:

PIN_SafeCopy is used to copy the specified number of bytes from a source memory region to a destination memory region. This function guarantees safe return to the caller even if the source or destination regions are inaccessible (entirely or partially). Use of this function also guarantees that the tool reads or writes the values used by the application. For example, on Windows, Pin replaces certain TEB fields when running a tool's analysis code. If the tool accessed these fields directly, it would see the modified values rather than the original ones. Using PIN_SafeCopy() allows the tool to read or write the application's values for these fields.

I'm trying to get the stack base of the current thread. Normally I would get it like this (if going directly through FS): mov eax, FS:[0x04]. Since I'm getting the old stack, and not the "new" one maintained by PIN (if I compare the REG_ESP from PIN with the current ESP they show different stacks) I tried to first get the linear address of the TEB with mov eax, FS:[0x18] and then use PIN_SafeCopy to read from this address + 0x04. However I only get 0x00000000. Any idea how I can do this? Also I suppose this makes it risky to use the Win API if it reads from such stale sources of data?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.