1

please help me with Intel Pin: I print each instruction to the console and I want to insert +++++ after it using Ins_Insertcall:

VOID CpuidCalled(const CONTEXT* ctxt)
{
std::cerr << "+++++" << std::endl;
}

std::cerr << INS_Disassemble(ins) << std::endl;
INS_InsertCall(
ins,
IPOINT_BEFORE, (AFUNPTR)CpuidCalled,
IARG_CONTEXT,
IARG_END
);

Output:

mov esp, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0x10
+++++
+++++
+++++
+++++
+++++
+++++
mov byte ptr [ebp-0x19], al
mov dword ptr [ebp-0x4], 0xfffffffe
mov dword ptr [ebp-0x24], 0x0
call 0x779fdd6d
+++++
+++++
+++++
+++++

why so and how can it be fixed? Thank you

1

that's because you are printing disassembly in instrumentation routine and "+++++" in analysis routine.

PIN has theoretically been divided into two routines:

  1. instrumentation - where you define your instrumentation points - happens when instruction is jitted
  2. analysis - where you execute actual instrumentation code - happens when instruction is executed

Refer following slides for quick overview:

https://www.intel.com/content/dam/develop/external/us/en/documents/cgo2013-256675.pdf

so, what you should do? - depends on your preference - either print both disassembly and "+++++" in analysis routine - i.e. inside function CpuidCalled (which makes more sense), or print both in instrumentation routine (which would not make much sense as you want to observe the executed instructions).

7
  • thanks for the answer, but how to call CpuidCalled a function by analogy with INS_Disassemble(ins)? I need to output: mov esp, esi EAX= ... , IP=...
    – ALex
    Dec 3 '21 at 20:30
  • send it like new string(INS_Disassemble(ins)) as an argument in the instrumentation function
    – R4444
    Dec 3 '21 at 20:37
  • #include "pin.H" #include <iostream> #include <fstream> #include <string> VOID DisplayInstruction(ADDRINT instructionAddress,string assemblyCode){ cout<<std::hex<<instructionAddress<<":"<<std::dec<<assemblyCode<<"\n";} VOID Instruction(INS ins, VOID *v) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)DisplayInstruction, IARG_INST_PTR, IARG_REG_VALUE,new string(INS_Assemble(ins)), IARG_END); } error new string: type specifier required, may be new std:string?
    – ALex
    Dec 3 '21 at 21:21
  • IARG_PTR, new string(INS_Disassemble(ins)),
    – R4444
    Dec 3 '21 at 21:38
  • INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)DisplayInstruction, IARG_INST_PTR, IARG_PTR, new string(INS_Disassemble(ins)), IARG_END);, but error again:type specifier required
    – ALex
    Dec 3 '21 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.