Intel PIN (TracerPIN): adding modification of registers

Question

Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN
(based on Intel PIN) in order to be able to modify the content of some registers at a given PC. For this I just inserted the following callback at line 418 of Tracer.cpp, when the PC is 0x808104f (as a simple test):

if (ceip == 0x808104f) {  
    string* dis = new string(INS_Disassemble(ins));  
    INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)changeReg,  
        IARG_INST_PTR,  
        IARG_CONTEXT,   
        IARG_PTR, dis,   
        IARG_UINT32, INS_Size(ins), IARG_END);  
}

and finally here is my function changeReg():

VOID changeReg (ADDRINT ip, CONTEXT *ctxt, string *disass, INT32 size){  
    UINT32 edx_new_value = 0x00000ccc;  
    UINT32 edx_value;  
    //set the registers  
    PIN_SetContextReg(ctxt, REG_EDX, edx_new_value);  
    edx_value = PIN_GetContextReg(ctxt, REG_EDX);  
    printf("EDX = %08x \n", edx_value);  
}

and when I trace my program with my modified TracerPIN:

root@VirtualBox:/media/shared/E/tracerPin/test/x86#Tracer -o test_modif_register.txt -- ./testapp
[*] Trace file test_modif_register.txt opened for writing...
EDX = 00000ccc
root@VirtualBox:/media/shared/E/tracerPin/test/x86#

According to the printf(), it looks like my register has been correctly modified to 0xccc, however when I checked the .txt trace, the register EDX is still left unmodified (0x0000137), and my modification is never taken into account in the trace... any idea ?:

[I]      1016       0x8081049    and edx, 0x1fff                        81 e2 ff 1f 00 00
[I]      1017       0x808104f    mov dword ptr [0x8086ae4], 0x4f0       c7 05 e4 6a 08 08 f0 04 00 00
[W]      1017       0x808104f    0x8086ae4 size= 4 value=        0x000004f0  
[I]      1018       0x8081059    mov dword ptr [0x8086ac0], edx         89 15 c0 6a 08 08
[W]      1018       0x8081059    0x8086ac0 size= 4 value=        0x00000137  
[I]      1019       0x808105f    mov dword ptr [0x8086db0], ecx         89 0d b0 6d 08 08
[W]      1019       0x808105f    0x8086db0 size= 4 value=        0xa5879af8
[I]      1020       0x8081065    lea ecx, ptr [edi-0x4]                 8d 4f fc

Answer 1

What worked for me was passing a reference to the register to my changeReg() function with IARG_REG_REFERENCE, then changing the value the reference points to.

Answer 2

Here is my new callback prototype:

if (ceip == 0x808104f) {  
     string* dis = new string(INS_Disassemble(ins));  
     INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)changeReg,  
     IARG_INST_PTR,  
     IARG_REG_REFERENCE, REG_EDX,      
     IARG_END);  
}

And changeReg() function:

VOID changeReg (ADDRINT ip,  ADDRINT *edx) {   
    *edx = 0x00000ccc;  
    printf("EDX = %08x \n", (UINT32)*edx);   
}