2

Recently I have collected several PIN traces but all of them are in a format like below :

0x2af1510676b0
0x2af1510676b3
0x2af15106b010
0x2af15106b011
0x2af15106b014
0x2af15106b016
0x2af15106b018
0x2af15106b01a
0x2af15106b01c
0x2af15106b01d
0x2af15106b020
0x2af15106b024
0x2af15106b026
0x2af15106b02a

I want to see the assembly instruction related to these traces (equivalent instructions) and perform some analysis but I do not know how to do that? How can I see these traces in a readable format that I can analyze ?

Improve this question
2
  • What does the series of numbers represent? Are those instruction addresses ?
    – 0xec
    Jun 15, 2015 at 9:45
  • I am not sure but it seems they are instruction addresses.
    – user2942756
    Jun 15, 2015 at 11:34

1 Answer 1

Reset to default
4

This list of hexadecimal numbers represent the addresses of each instruction followed by the software you are looking at.

Pin is a tool that will allow you to collect traces of a software by dynamically instrumenting the code of it. What you collected here is the lowest level of information that you can get out of Pin, but you can ask for more by using the proper Pintool (or writing one by yourself).

Look in the directory source/tools, you will find various plugins that you can use with Pin and extract usefull information. For example, you may want to know: the address of each instruction (you already have that), the decoded instruction that is executed and the opcode of the instruction. All this can be asked to Pin and collected as a trace.

In the directory source/tools/SimpleExamples, you will find simple examples to start with and to understand how to use Pin. Try to look also to a few tutorial that you may find on Internet.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.