1

Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN
(based on Intel PIN) in order to be able to modify the content of some registers at a given PC. For this I just inserted the following callback at line 418 of Tracer.cpp, when the PC is 0x808104f (as a simple test):

if (ceip == 0x808104f) {  
    string* dis = new string(INS_Disassemble(ins));  
    INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)changeReg,  
        IARG_INST_PTR,  
        IARG_CONTEXT,   
        IARG_PTR, dis,   
        IARG_UINT32, INS_Size(ins), IARG_END);  
}

and finally here is my function changeReg():

VOID changeReg (ADDRINT ip, CONTEXT *ctxt, string *disass, INT32 size){  
    UINT32 edx_new_value = 0x00000ccc;  
    UINT32 edx_value;  
    //set the registers  
    PIN_SetContextReg(ctxt, REG_EDX, edx_new_value);  
    edx_value = PIN_GetContextReg(ctxt, REG_EDX);  
    printf("EDX = %08x \n", edx_value);  
}

and when I trace my program with my modified TracerPIN:

root@VirtualBox:/media/shared/E/tracerPin/test/x86#Tracer -o test_modif_register.txt -- ./testapp
[*] Trace file test_modif_register.txt opened for writing...
EDX = 00000ccc
root@VirtualBox:/media/shared/E/tracerPin/test/x86#

According to the printf(), it looks like my register has been correctly modified to 0xccc, however when I checked the .txt trace, the register EDX is still left unmodified (0x0000137), and my modification is never taken into account in the trace... any idea ?: 

[I]      1016       0x8081049    and edx, 0x1fff                        81 e2 ff 1f 00 00
[I]      1017       0x808104f    mov dword ptr [0x8086ae4], 0x4f0       c7 05 e4 6a 08 08 f0 04 00 00
[W]      1017       0x808104f    0x8086ae4 size= 4 value=        0x000004f0  
[I]      1018       0x8081059    mov dword ptr [0x8086ac0], edx         89 15 c0 6a 08 08
[W]      1018       0x8081059    0x8086ac0 size= 4 value=        0x00000137  
[I]      1019       0x808105f    mov dword ptr [0x8086db0], ecx         89 0d b0 6d 08 08
[W]      1019       0x808105f    0x8086db0 size= 4 value=        0xa5879af8
[I]      1020       0x8081065    lea ecx, ptr [edi-0x4]                 8d 4f fc
Improve this question
1

What worked for me was passing a reference to the register to my changeReg() function with IARG_REG_REFERENCE, then changing the value the reference points to.

Improve this answer
3
  • oh thanks manduca, it worked, you are my savior! not sure this was clear in the specifications. – john_antman Mar 29 '18 at 11:30
  • In my understanding your code should have worked. Maybe it would have if you had ended with PIN_ExecuteAt(ctx). I have the feeling the documentation is not very clear and every release has other quirks. Still an awesome tool. – manduca Mar 29 '18 at 11:48
  • yes I also tried this PIN_SaveContext(&snapshot, ctxt) and PIN_ExecuteAt(ctx) as in some examples I found on Github but I ended up with weird behaviours with TracerPIN – john_antman Mar 29 '18 at 12:00
0

Here is my new callback prototype: 

if (ceip == 0x808104f) {  
     string* dis = new string(INS_Disassemble(ins));  
     INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)changeReg,  
     IARG_INST_PTR,  
     IARG_REG_REFERENCE, REG_EDX,      
     IARG_END);  
}

And changeReg() function:

VOID changeReg (ADDRINT ip,  ADDRINT *edx) {   
    *edx = 0x00000ccc;  
    printf("EDX = %08x \n", (UINT32)*edx);   
}
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.