I have an INS object in the instrumentation function, and I wish to get the actual bytes used to code this instruction. Looking at the INS functions, the closest I found was a function to disassemble it (show the assembly code), where I'm seeking for the actual bytes.

Assistance is highly appreciated.

  • You can use INS_Address and INS_Size together. – 0xec Jan 8 '17 at 10:41
  • @ExtremeCoders: I did not mean the size, but rather the actual bytes used for coding it. (I also edited the question to make it clear) – Jaaz Jan 8 '17 at 11:12
  • I meant to read the instruction bytes from memory by using the address and size. – 0xec Jan 8 '17 at 17:32
  • @ExtremeCoders: Well, this is embarrassing. The bigger lesson I learned here is that a pintool can directly access the memory region of the binary it runs. Thank you! – Jaaz Jan 8 '17 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.