0

How can I measure the number of instructions a Windows (or Linux or XNU) kernel driver/module executed after, say, an IOCTL or a SYSCALL? My only ideas are the following:

  • Using WinDBG or remote GDB, debug the whole operating system, put breakpoints in each basic block/function/instruction of the driver or step-trace inside it. Very slow and likely going to cause problems due to the large number of breakpoints to be added.
  • From user-land, use instructions like RDTSC to try to "measure" the number of (non different) instructions executed by checking the times it took to execute it. Likely going to give "false" results for many reasons (i.e., the very same call to a syscall or ioctl can take different times for many different reasons).

Any idea or option in any of the mentioned kernels to determine the number of instructions and, preferably, the number of different instructions executed?

Improve this question
1
  • if you haven't yet done give wt (watch and trace ) command a spin in windbg it does this counting stuff in the statistics it provides at the end of tracing a complete function may be you can leverage it with a custom windbg extension – blabb Sep 30 '14 at 7:07
4

I'd recommend using Bochs. It'll allow you to write code to count the number of instructions (and/or number of different instructions) executed between a SYSCALL/SYSRET, SYSENTER/SYSEXIT, etc.

Improve this answer
1
  • 1
    Yes, I think it's the best one can one as of today. Slow as hell, but probed to work. Thanks! – joxeankoret Oct 9 '14 at 7:41
-2

You can also give a try to pin. There is even an example in the documentation explaining exactly what you want to do.

Improve this answer
1
  • Sure, tell me how to use Intel PIN, which is a completely user-land toolkit, in Kernel. – joxeankoret Oct 5 '14 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.