4

I've discovered recently PIN which allows to dynamically instrument the binary code while still making the program believe it is running unmodified.

Even more recently, I've heared about Dyninst and DynamoRIO. Do you know some other tools like this? And more importantly, do you know the difference between those? What are their strenghs and their weaknesses for the topic of reverse engineering and binary code analysis?

More specifically, the properties I'm interested in are:

  • Open source licence
  • Operating system portability (Linux, Windows, Mac, ...)
  • Hardware architecture portability (x86 (32 and 64 bits), ARM, ...)
  • Run the program unnoticeably, especially when the programs perform some tricks like executable code generation / modification, instruction overlap, memory image checksum, etc.
  • Hard to detect (how about a program reading /proc/self/maps or trying to mmap all the memory pages that should be free or even reading hardware instruction counters?)

But of course, other usual properties are also very welcome, like low overhead and ease of use.

3

frida is cross-platform (OS X, Windows, Linux, iOS, Android) and also supports multiple architecture.

The main functionality is running some javascript code every time a function is called or when returning from a function.

  • I may have some doubts about the performance if the user code is in javascript. – Celelibi Apr 8 '15 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.