2

Look at this very basic C program:

#include <stdio.h>
int main()
{
    printf("Hello world\n");
    return 0;
}

Now look at this very basic pintool:

#include "pin.H"
#include <stdio.h>

VOID callback_instruction(INS ins, VOID *v)
{
    printf("%lx\t%s\n", INS_Address(ins),INS_Disassemble(ins).c_str());
}

int main(int argc, char *argv[])
{
    if (PIN_Init(argc,argv))
    {
        printf("Erreur\n");
        return 0;
    }

    INS_AddInstrumentFunction(callback_instruction, 0);
    PIN_StartProgram();

    return 0;
}

Here is what is printed by this pintool:

....
55ef42b84139    lea rdi, ptr [rip+0xec4]
55ef42b84140    call 0x55ef42b84030
...

Here is what i get in radare2:

|           0x00001135      55             push rbp
|           0x00001136      4889e5         mov rbp, rsp
|           0x00001139      488d3dc40e00.  lea rdi, str.Hello_world    ; 0x2004 ; "Hello world"
|           0x00001140      e8ebfeffff     call sym.imp.puts           ; int puts(const char *s)
|           0x00001145      b800000000     mov eax, 0
|           0x0000114a      5d             pop rbp
\           0x0000114b      c3             ret

As you can see, radare2 is able to display in comments the value of the strings (Hello world) and the imported function names (puts). My question is: Is it possible to do the same thing with pintool ?

Thanks

1 Answer 1

3

Sure, it’s possible but you’ll have to implement the logic for it yourself: check the instruction type/operands, fetch the referred memory, try to detect if it looks like a string and so on. For function names, you'll need to parse the symbol table of the binary.

There is no ready to use pintool that does this (AFAIK).

5
  • Okay for the strings, but how can i do for the functions names ?
    – Bob5421
    Sep 12, 2018 at 8:10
  • 2
    @Bob5421: parse the symbol table
    – Igor Skochinsky
    Sep 12, 2018 at 9:23
  • do you have any samples ? I have tried to read memory from pintool c function callback
    – Bob5421
    Sep 12, 2018 at 10:04
  • Nope, maybe ask on SO since it’s an sw dev question.
    – Igor Skochinsky
    Sep 12, 2018 at 10:12
  • 1
    for functions RTN_FindNameByAddress is a good option. Also check source/tools/SimpleExamples in your pin directory for API examples.
    – sudhackar
    Sep 12, 2018 at 10:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.