0

I am modifying PIN's proccount sample to get the memory access information per function

 VOID Routine(RTN rtn, VOID *v)
{

    // Allocate a counter for this routine
    RTN_COUNT * rc = new RTN_COUNT;
    rc->_name = RTN_Name(rtn);
    rc->_image = StripPath(IMG_Name(SEC_Img(RTN_Sec(rtn))).c_str());
    rc->_address = RTN_Address(rtn);

    rc->_next = RtnList;
    RtnList = rc;

    RTN_Open(rtn);
fprintf(trace,"%s\n",rc->_name.c_str());( writing functio name )
     RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR)docount, IARG_PTR, &(rc->_rtnCount), IARG_END);
       // RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR)RecordMemRead1, &(rc->_name),rc->_address, IARG_END);(this gave an error)
        // For each instruction of the routine
        for (INS ins = RTN_InsHead(rtn); INS_Valid(ins); ins = INS_Next(ins))
        {

        UINT32 memOperands = INS_MemoryOperandCount(ins);
    // Iterate over each memory operand of the instruction.
         for (UINT32 memOp = 0; memOp < memOperands; memOp++)
    {
        if (INS_MemoryOperandIsRead(ins, memOp))
        {
            INS_InsertPredicatedCall(
                ins, IPOINT_BEFORE, (AFUNPTR)RecordMemRead,
                IARG_INST_PTR,
                IARG_MEMORYOP_EA,memOp,IARG_END); (file trace is modified here)

        }
    }
    }

    RTN_Close(rtn);
}

I am getting output like:

dl_find_dso_for_object
__get_cpu_features
__libc_memalign
malloc
calloc
free
realloc
0   0x7fcecff419dd  :R  0x7fced0165e70
0   0x7fcecff419e7  :R  0x7fced0166000
0   0x7fcecff41a57  :R  0x7fced0165e80
0   0x7fcecff41a57  :R  0x7fced0165e90
0   0x7fcecff41a57  :R  0x7fced0165ea0
0   0x7fcecff41a57  :R  0x7fced0165eb0
0   0x7fcecff41a57  :R  0x7fced0165ec0

I need per-function memory list like:

dl_find_dso_for_object
0   0x7fcecff419dd  :R  0x7fced0165e70
    0   0x7fcecff419e7  :R  0x7fced0166000
    0   0x7fcecff41a57  :R  0x7fced0165e80
    0   0x7fcecff41a57  :R  0x7fced0165e90
;;;
malloc
0x7fcecff41a57  :R  0x7fced0165ea0
    0   0x7fcecff41a57  :R  0x7fced0165eb0
    0   0x7fcecff41a57  :R  0x7fced0165ec0

How can I achieve it?

0

You can pass an additional argument to INS_InsertPredicatedCall with the string name and construct a map with function names with (instruction, addr). Parse that map in PIN_AddFiniFunction added callback. Here's a simple example. Implement your mapping in RecordMemRead

map<string, vector<pair<UINT64, UINT64>>> RtnToRead;

VOID RecordMemRead(ADDRINT address, UINT64 memOp, string rname) {
    RtnToRead[rname].pb(mp(address, memOp));
}

VOID Routine(RTN rtn, VOID *v) {

    RTN_Open(rtn);

    string name = RTN_Name(rtn);

    for (INS ins = RTN_InsHead(rtn); INS_Valid(ins); ins = INS_Next(ins)) {

        UINT32 memOperands = INS_MemoryOperandCount(ins);
        for (UINT32 memOp = 0; memOp < memOperands; memOp++) {
            if (INS_MemoryOperandIsRead(ins, memOp)) {
                INS_InsertPredicatedCall(ins, IPOINT_BEFORE,
                                         (AFUNPTR)RecordMemRead, IARG_INST_PTR,
                                         IARG_MEMORYOP_EA, memOp, IARG_PTR,
                                         new string(name), IARG_END);
            }
        }
    }

    RTN_Close(rtn);
}

VOID Fini(INT32 code, VOID *v) {
    for (auto &rtn : RtnToRead) {
        cout << rtn.fs << " :" << endl;
        for (auto &e : rtn.second) {
            cout << "\t" << hex << e.fs << " : " << e.sc << endl;
        }
    }
}

I have added a simple example here

EDIT : I have copied code from the gist which fits your case perfectly.

  • For every instruction it will add the function name to the ouput line. That is redundant. I need function name and starting address in one line and subsequent lines should print for each executed instructiojn in that function - the IP address , memory operation and exeffctive address generated by that instruction till the end of that function. If i could add something to mark the end of each function then it would be more useful to me. – Dileesh Dil Jan 7 at 5:06
  • // Insert a call at the entry point of a routine to increment the call count RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR)docount, IARG_PTR, &(rc->_rtnCount), IARG_END); RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR)RecordMemRead1, IARG_PTR, &(rc->_name), IARG_END); When i added this line is seems ok – Dileesh Dil Jan 7 at 5:42
  • Please read my full answer and change implementation of RecordMemRead as I have suggested or look at the gist I added as a link – sudhackar Jan 7 at 6:26
  • error: ‘auto’ changes meaning in C++11; please remove it [-Werror=c++0x-compat] for (auto &rtn : RtnToRead) { ^ myproccount2.cpp:133:16: error: ISO C++ forbids declaration of ‘rtn’ with no type [-fpermissive] for (auto &rtn : RtnToRead) .. itried adding " -std=c++11 " in the make file dosent helped – Dileesh Dil Jan 7 at 7:57
  • If auto breaks for you See devdocs for map – sudhackar Jan 7 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.