how to get per-function memory accesses using PIN tool

Question

I am modifying PIN's proccount sample to get the memory access information per function

 VOID Routine(RTN rtn, VOID *v)
{

    // Allocate a counter for this routine
    RTN_COUNT * rc = new RTN_COUNT;
    rc->_name = RTN_Name(rtn);
    rc->_image = StripPath(IMG_Name(SEC_Img(RTN_Sec(rtn))).c_str());
    rc->_address = RTN_Address(rtn);

    rc->_next = RtnList;
    RtnList = rc;

    RTN_Open(rtn);
fprintf(trace,"%s\n",rc->_name.c_str());( writing functio name )
     RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR)docount, IARG_PTR, &(rc->_rtnCount), IARG_END);
       // RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR)RecordMemRead1, &(rc->_name),rc->_address, IARG_END);(this gave an error)
        // For each instruction of the routine
        for (INS ins = RTN_InsHead(rtn); INS_Valid(ins); ins = INS_Next(ins))
        {

        UINT32 memOperands = INS_MemoryOperandCount(ins);
    // Iterate over each memory operand of the instruction.
         for (UINT32 memOp = 0; memOp < memOperands; memOp++)
    {
        if (INS_MemoryOperandIsRead(ins, memOp))
        {
            INS_InsertPredicatedCall(
                ins, IPOINT_BEFORE, (AFUNPTR)RecordMemRead,
                IARG_INST_PTR,
                IARG_MEMORYOP_EA,memOp,IARG_END); (file trace is modified here)

        }
    }
    }

    RTN_Close(rtn);
}

I am getting output like:

dl_find_dso_for_object
__get_cpu_features
__libc_memalign
malloc
calloc
free
realloc
0   0x7fcecff419dd  :R  0x7fced0165e70
0   0x7fcecff419e7  :R  0x7fced0166000
0   0x7fcecff41a57  :R  0x7fced0165e80
0   0x7fcecff41a57  :R  0x7fced0165e90
0   0x7fcecff41a57  :R  0x7fced0165ea0
0   0x7fcecff41a57  :R  0x7fced0165eb0
0   0x7fcecff41a57  :R  0x7fced0165ec0

I need per-function memory list like:

dl_find_dso_for_object
0   0x7fcecff419dd  :R  0x7fced0165e70
    0   0x7fcecff419e7  :R  0x7fced0166000
    0   0x7fcecff41a57  :R  0x7fced0165e80
    0   0x7fcecff41a57  :R  0x7fced0165e90
;;;
malloc
0x7fcecff41a57  :R  0x7fced0165ea0
    0   0x7fcecff41a57  :R  0x7fced0165eb0
    0   0x7fcecff41a57  :R  0x7fced0165ec0

How can I achieve it?

Answer 1

You can pass an additional argument to INS_InsertPredicatedCall with the string name and construct a map with function names with (instruction, addr). Parse that map in PIN_AddFiniFunction added callback. Here's a simple example. Implement your mapping in RecordMemRead

map<string, vector<pair<UINT64, UINT64>>> RtnToRead;

VOID RecordMemRead(ADDRINT address, UINT64 memOp, string rname) {
    RtnToRead[rname].pb(mp(address, memOp));
}

VOID Routine(RTN rtn, VOID *v) {

    RTN_Open(rtn);

    string name = RTN_Name(rtn);

    for (INS ins = RTN_InsHead(rtn); INS_Valid(ins); ins = INS_Next(ins)) {

        UINT32 memOperands = INS_MemoryOperandCount(ins);
        for (UINT32 memOp = 0; memOp < memOperands; memOp++) {
            if (INS_MemoryOperandIsRead(ins, memOp)) {
                INS_InsertPredicatedCall(ins, IPOINT_BEFORE,
                                         (AFUNPTR)RecordMemRead, IARG_INST_PTR,
                                         IARG_MEMORYOP_EA, memOp, IARG_PTR,
                                         new string(name), IARG_END);
            }
        }
    }

    RTN_Close(rtn);
}

VOID Fini(INT32 code, VOID *v) {
    for (auto &rtn : RtnToRead) {
        cout << rtn.fs << " :" << endl;
        for (auto &e : rtn.second) {
            cout << "\t" << hex << e.fs << " : " << e.sc << endl;
        }
    }
}

I have added a simple example here

EDIT : I have copied code from the gist which fits your case perfectly.