I want to trace all instructions with pintool. Strange behaviour

Question

Look at this very basic c program:

int main()
{
    for (int i=0;i<0x42;i++)
    {
        asm("nop");
        asm("nop");
    }
    return 0x42;
}

I have compiled it without any optimisations.

You can see this with radare2:

|       ,=< 0x00001130      eb06           jmp 0x1138
|       |   ; JMP XREF from 0x0000113c (main)
|      .--> 0x00001132      90             nop
|      :|   0x00001133      90             nop
|      :|   0x00001134      8345fc01       add dword [local_4h], 1
|      :|   ; JMP XREF from 0x00001130 (main)
|      :`-> 0x00001138      837dfc41       cmp dword [local_4h], 0x41  ; [0x41:4]=0x4000000 ; 'A'
|      `==< 0x0000113c      7ef4           jle 0x1132

The 2 nops instructions will be runned 0x42 times.

What i want to do is to understand how i can log all program instructions with pin tool.

I have wrote a very basic tool for pin:

#include "pin.H"
#include <stdio.h>

VOID callback_instruction(INS ins, VOID *v)
{
    printf("%lx\t%s\n", INS_Address(ins),INS_Disassemble(ins).c_str());
}

int main(int argc, char *argv[])
{
    if (PIN_Init(argc,argv))
    {
        printf("Erreur\n");
        return 0;
    }

    INS_AddInstrumentFunction(callback_instruction, 0);
    PIN_StartProgram();

    return 0;
}

There is something i do not understand. callback_instruction should be called before each instructions. So i should see 0x42*2 times the nop instruction. Or i can see it only twice times.

I do not understand why pintool just disassemble my program instead of running it instruction by instruction...

Answer 1

I think you might have confused INS_AddInstrumentFunction with a tracing callback. In your case the callback supplied to INS_AddInstrumentFunction is callback_instruction. Pin calls callback_instruction every time a new instruction is encountered, not on every execution of an instruction.

This is probably not what you want to achieve. Here's the code that suits your case. You need to register a callback which is executed on every execution.

#include "pin.H"
#include <stdio.h>

VOID dump_nop(UINT64 insAddr, std::string insDis) {
  printf("%lx\t%s\n", insAddr, insDis.c_str());
}

VOID callback_instruction(INS ins, VOID *v) {

  if (INS_IsNop(ins)) {
    INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)dump_nop, IARG_ADDRINT,
                   INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)),
                   IARG_END);
  }
}

int main(int argc, char *argv[]) {
  if (PIN_Init(argc, argv)) {
    printf("Erreur\n");
    return 0;
  }

  INS_AddInstrumentFunction(callback_instruction, 0);
  PIN_StartProgram();

  return 0;
}