I've discovered recently PIN which allows to dynamically instrument the binary code while still making the program believe it is running unmodified.
Even more recently, I've heared about Dyninst and DynamoRIO. Do you know some other tools like this? And more importantly, do you know the difference between those? What are their strenghs and their weaknesses for the topic of reverse engineering and binary code analysis?
More specifically, the properties I'm interested in are:
- Open source licence
- Operating system portability (Linux, Windows, Mac, ...)
- Hardware architecture portability (x86 (32 and 64 bits), ARM, ...)
- Run the program unnoticeably, especially when the programs perform some tricks like executable code generation / modification, instruction overlap, memory image checksum, etc.
- Hard to detect (how about a program reading
/proc/self/mapsor trying to
mmapall the memory pages that should be free or even reading hardware instruction counters?)
But of course, other usual properties are also very welcome, like low overhead and ease of use.