How do you efficiently record EIP of a target continuously?

Question

Platform: Windows 7 64bit, target 32bit.

I have had an idea of using data mining techniques (maybe even some primitive machine learning) on EIP data, so as to be able to correlate with something later. Just the EIP because everything else needed could later be pulled from the target process anyway as leisure (aside from stack or dynamic memory).

I plan to use PCA or perhaps even a SOM for clustering.

So the actual question: Is there a way to attach to a process in such a way as to be able to continuously dump EIP to file while at the same time having the least possible effect on target's performance?

Thank you.

Answer 1

I would go for Dynamic Binary Instrumentation (DBI). Logging rIP is a standard application for DBI.

On windows there are at least 3 well known DBI frameworks:

• Intel PIN
• DynamoRIO
• DynInst

Logging rIP for each instruction can affect target performance (I haven't precise numbers but that's probably something around a 20% to 50% slowdown). Maybe you could trace basic blocks, rather than each instruction, to reduce performance penalty.

Intel PIN has at least a buffered recording so you can trace each instruction, log it's program counter in a buffer and dump the buffer when it's full so your logger is not I/O bound (everything is handled by PIN).

Finally, another way would be to use a debugger (some have tracing capabilities, like ollyDBG) or program your own and raise the TF (Trap Flag) for each instruction - so you can log each executed instruction - but this will probably have a big impact on the target's performance and could be problematic for a multi-threaded application (DBI frameworks handle multi-threading well).

Answer 2

To add to the above from @Neitsa, there is a great post by Axel "0vercl0k" Souchet:

Some Thoughts About Code-coverage Measurement With Pin

about using PIN for basic blocks logging with all the way explained from idea to the development POC based on PIN framework.

You can definitely use the provided code there and adjust it to log all the instructions for your needs. Probably even the basic blocks logging could serve your needs in the begging.