pintool add metadata like radare2

Question

Look at this very basic C program:

#include <stdio.h>
int main()
{
    printf("Hello world\n");
    return 0;
}

Now look at this very basic pintool:

#include "pin.H"
#include <stdio.h>

VOID callback_instruction(INS ins, VOID *v)
{
    printf("%lx\t%s\n", INS_Address(ins),INS_Disassemble(ins).c_str());
}

int main(int argc, char *argv[])
{
    if (PIN_Init(argc,argv))
    {
        printf("Erreur\n");
        return 0;
    }

    INS_AddInstrumentFunction(callback_instruction, 0);
    PIN_StartProgram();

    return 0;
}

Here is what is printed by this pintool:

....
55ef42b84139    lea rdi, ptr [rip+0xec4]
55ef42b84140    call 0x55ef42b84030
...

Here is what i get in radare2:

|           0x00001135      55             push rbp
|           0x00001136      4889e5         mov rbp, rsp
|           0x00001139      488d3dc40e00.  lea rdi, str.Hello_world    ; 0x2004 ; "Hello world"
|           0x00001140      e8ebfeffff     call sym.imp.puts           ; int puts(const char *s)
|           0x00001145      b800000000     mov eax, 0
|           0x0000114a      5d             pop rbp
\           0x0000114b      c3             ret

As you can see, radare2 is able to display in comments the value of the strings (Hello world) and the imported function names (puts). My question is: Is it possible to do the same thing with pintool ?

Thanks

Answer 1

Sure, it’s possible but you’ll have to implement the logic for it yourself: check the instruction type/operands, fetch the referred memory, try to detect if it looks like a string and so on. For function names, you'll need to parse the symbol table of the binary.

There is no ready to use pintool that does this (AFAIK).