Determining the number of instructions executed by a driver

Question

How can I measure the number of instructions a Windows (or Linux or XNU) kernel driver/module executed after, say, an IOCTL or a SYSCALL? My only ideas are the following:

• Using WinDBG or remote GDB, debug the whole operating system, put breakpoints in each basic block/function/instruction of the driver or step-trace inside it. Very slow and likely going to cause problems due to the large number of breakpoints to be added.
• From user-land, use instructions like RDTSC to try to "measure" the number of (non different) instructions executed by checking the times it took to execute it. Likely going to give "false" results for many reasons (i.e., the very same call to a syscall or ioctl can take different times for many different reasons).

Any idea or option in any of the mentioned kernels to determine the number of instructions and, preferably, the number of different instructions executed?

Answer 1

I'd recommend using Bochs. It'll allow you to write code to count the number of instructions (and/or number of different instructions) executed between a SYSCALL/SYSRET, SYSENTER/SYSEXIT, etc.

Answer 2

You can also give a try to pin. There is even an example in the documentation explaining exactly what you want to do.