2

I have a library DLL which I'm trying to analyze, and I have a basic understanding of its function and behavior (and can modify some input to affect how long certain operations will take to execute/how often it will execute), but I'm not sure where exactly in the DLL the functions which I know exist are located, and finding them by following program flow manually in a disassembler is non-trivial. It would be very helpful to be able to have some sort of "flame-graph" code coverage tool which would show me how many times a given line of assembly has been executed. I don't need function calls or anything like that, just the raw number of executions per line (or CPU time per line) from some kind of sampling.

Additionally, as a library DLL, it has to be called from another process, and in this case must be called by a very specific program.

Is this possible with a DLL that doesn't have any debugging symbols attached? Or am I asking for a holy grail?

Thanks!

1
  • Hi and welcome to RE.SE. Coverage is typically measured on instrumented binaries. But an emulator (e.g. Unicorn Engine) or symbolic execution via Angr could work here. The more difficult part is that this all happens from another process. Code lifting may be a better approach then, provided the DLL doesn't implement any protection methods or checks its integrity (e.g. code-signing). And yet another approach could be a combination of the above with a DLL placement attack and a proxy DLL you offer which provides the same exports but forwards them to the real DLL. Question is a bit vague.
    – 0xC0000022L
    Nov 18 at 10:37

1 Answer 1

1

not sure what you are looking for
if you want to concentrate on one single line of assembly
you can employ a skip number of passes with a high count

for example with windbg you could do bp ntdll!memcmp 5000 and hit g to run the binary

which would either break if it has been hit 0x5000 times or

will show how many times it has been hit if you display the status of break point with bl

see a demo below

C:\WINDOWS\system32>cdb cdb

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
irrelevent output snipped setting a breakpoint as above
0:000> bp ntdll!memcmp 5000
0:000> g
again irrelevent output snipped 
ntdll!NtTerminateProcess+0x14:
00007ffe`5f94d644 c3              ret

the process has finished running but no break 
so memcmp must have been hit a few times but less than the 
threshold of 0x5000 hits
lets check how many times it has been hit      

0:000> bl
 0 e 00007ffe`5f940100     4f45 (5000)  0:**** ntdll!memcmp  <<<<<<<<< 
memcmp a single assembly line has been hit **(0x500- 0x4f45)** about 186 
times between start and end of process 
0:000>

breaking on the last but one hit on memcmp

0:000> bp ntdll!memcmp 0xba
0:000> g
Breakpoint 0 hit
ntdll!memcmp:
00007ffe`5f940100 482bd1          sub     rdx,rcx
0:000> bl
 0 e 00007ffe`5f940100     0001 (00ba)  0:**** ntdll!memcmp  < on hit left to reach threahhold
0:000>

or you can count like this employing a script

0:000> r $t1=0
0:000> bp ntdll!memcmp "r $t1=@$t1+1;?@$t1;gc"
0:000> g
Evaluate expression: 1 = 00000000`00000001
Evaluate expression: 2 = 00000000`00000002
Evaluate expression: 3 = 00000000`00000003
Evaluate expression: 4 = 00000000`00000004
Evaluate expression: 5 = 00000000`00000005

sniped irrelevent output

ModLoad: 00007ffe`5e230000 00007ffe`5e2dd000   C:\WINDOWS\System32\shcore.dll
Evaluate expression: 182 = 00000000`000000b6
Evaluate expression: 183 = 00000000`000000b7
Evaluate expression: 184 = 00000000`000000b8
Evaluate expression: 185 = 00000000`000000b9
Evaluate expression: 186 = 00000000`000000ba
Evaluate expression: 187 = 00000000`000000bb

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Failed to open \\.\com1
Kernel debugger failed initialization, Win32 error 0n2
    "The system cannot find the file specified."
Debuggee initialization failed, Win32 error 0n2
The system cannot find the file specified.
ntdll!NtTerminateProcess+0x14:
00007ffe`5f94d644 c3              ret
0:000>

btw fwiw the old ollydbg32 bit debugger had a feature called hittrace that could count how many times each line was executed not sure if either ollydbg64 or its 64bit competitor x64dbg implements such feature

1
  • "ollydbg32 bit debugger had a feature called hittrace that could count how many times each line was executed" - that sounds like what I'm looking for. I'll look more into it- I found something called Cryptoshark github.com/frida/cryptoshark which may have the functionality I'm looking for. It seems a bit abandoned, though. Nov 19 at 1:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.