We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [instrumentation]

Instrumentation is the process of injecting probe functions into a code (executable, source code, ...) for measurement purposes. It is extensively used for *profiling* or *dynamic-analysis* by tools like Valgrind, MAQAO, DynInst, and many others.

Filter by
Sorted by
Tagged with
5
votes
2answers
206 views

Trace Method Calls in .NET/C# Binary

I have a heavily obfuscated Windows service binary. Fields, types and methods are renamed. While it is possible to decompile the binary using dnSpy, it is still very cumbersome to identify important/...
1
vote
0answers
75 views

Static binary instrumentation

I am working on a class project. I need to find out static features of a program (without executing it). Backward branches (loops) Conditional branches (potential threads with load imbalance) ...
1
vote
0answers
392 views

Tracing calls, rets and instructions with Intel Pin

I am writing a Pin tool with the following functionality: It has to record instructions with arguments. (works well) It has to record memory access operations associated with instructions. (works ...
1
vote
0answers
32 views

Instrumentation fail when app use far jump 0x33 crash

Do you known any dbi tool that support instrumentation of application that use far jump 0x33? P.S. pin, dymanoRIO don't support far jump 0x33.
1
vote
0answers
88 views

Is Dynamic Binary Instrumentation legal in UK/EU for malware analysis?

I am doing a university project about performing malware analysis on binary files. The end goal would be to analyze real world executables(Microsoft Office installation file for example). If I use DBI,...
2
votes
1answer
85 views

Detect interesting testcases

Suppose I have a ton of test cases and my target is closed-source. Well, I need to know which test cases discover new path in the execution of my target and which are duplicated. I know I have to use ...
1
vote
2answers
261 views

Intel PIN (TracerPIN): adding modification of registers

Basically I just would like to modify the following code: https://github.com/SideChannelMarvels/Tracer/tree/master/TracerPIN (based on Intel PIN) in order to be able to modify the content of some ...
3
votes
3answers
200 views

Running just one function from an compiled executable or shared object?

Radare lets me view the assembly and pseudo-C code of a function. Can I run those instructions though outside of the process? Perhaps setting the register myself? If so, how would I go about doing ...
2
votes
1answer
820 views

How to use Frida on a Java application ? (non Android application)

I am trying to use Frida on a Java application which is obfuscated with ZKM (Zelix KlassMaster). When I attach to the process, it seems the JVM is not loaded: [Local::PID::23585]-> Java.available ...
1
vote
0answers
1k views

Attaching to Dalvik static function using Frida in order to disable emulator detection

I have a re-occuring issue with Frida (I'm using Frida and Frida-Server for Android x86_64 ver.: 10.6.11), where I try to hook a function and override its functionality, but for some reason I get ...
2
votes
1answer
121 views

Dumpout Process Memory Layout During Loading Time

I am working on a project where I need to use LD_PRELOAD to load some libraries into the memory space. It's like: LD_PRELOAD="./libapp.so" ./my_app Due to certain reasons (I am actually working on ...
3
votes
1answer
3k views

Are there any static binary rewriting tools?

My goal is to modify some instructions and make some instrumentation in ELF executables or libraries(For example, modifying all memory writes instructions). Since there're so many instructions, I want ...
0
votes
2answers
225 views

How to perform memory address translation on x86 instructions?

I have a mechanism that maps memory addresses to other memory addresses, e.g.: { 0x10000 -> 0xA0000 0x20000 -> 0x99000000 0x340000 -> 0x50000000 ; Stack in this example } Some example ...
3
votes
1answer
775 views

Intel PIN: InsertPredicatedCall and INS_InsertCall

The intel PIN manual (section Memory Reference Trace) says: We also use INS_InsertPredicatedCall instead of INS_InsertCall to avoid generating references to instructions that are predicated when ...
0
votes
1answer
203 views

Is it possible to programmatically determine if a crash resulted from a buffer overflow?

Crash analysis: Given a large set of crashes, all resulting from access violations, is it possible to (with or without access to symbols and source code) programmatically determine whether the ...
0
votes
2answers
1k views

Configure and execute Intel's PIN Tool

I am trying to develop a Pintool on Windows. But so far I have been unable to configure or execute PIN. I have Microsoft Visual Studio 10.0 installed on my system. I have also downloaded and unzipped ...
1
vote
1answer
429 views

Binary Instrumentation of malware binaries?

I am developing a dynamic instrumentation tool using Intel PIN to analyze malware binaries in windows. From what I have learned so far is that I am able to use the tool with programs I write using C/C+...
2
votes
1answer
868 views

Insert a function call in an ELF executable

I want to patch an ELF executable to insert a function call (the function s2e_rawmon_loadmodule and its dependencies are to be linked statically, preferably) at the beginning. This answer seems to ...
0
votes
1answer
307 views

Instrumenting syscall by static binary rewriting

(The problem is updated... as the investigation goes deep) My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not ...
4
votes
4answers
1k views

Why are PUSHF and POPF so slow?

the experiment is on 32-bit x86 Linux. I am doing some static binary instrumentation work, and basically I am trying to insert some instructions below to the beginning of every basic block. BB23 : ...
9
votes
1answer
250 views

Saving program execution state for fuzzing

Suppose I have a program that has two functions, functionA and functionB called sequentially. functionA requires a significant amount of processing in order to execute, and in the course of the ...
1
vote
1answer
604 views

How can I remove a bbl instrumentation call at a specific address in PIN?

I have created a pintool that outputs in a json file all the basic blocks executed by a program. The problem is that the instrumented program runs slow so I am trying to optimize my pintool. I was ...
4
votes
1answer
970 views

Dynamic instrumentation tools

I've discovered recently PIN which allows to dynamically instrument the binary code while still making the program believe it is running unmodified. Even more recently, I've heared about Dyninst and ...
1
vote
1answer
236 views

Where can I learn about code instrumentation?

Currently I am learning about profiling parallel programs. All the profilers heavily use all kinds of instrumentations but this topic is not well explained. Do you know any good sources from which I ...
0
votes
2answers
250 views

Determining the number of instructions executed by a driver

How can I measure the number of instructions a Windows (or Linux or XNU) kernel driver/module executed after, say, an IOCTL or a SYSCALL? My only ideas are the following: Using WinDBG or remote GDB, ...
1
vote
1answer
150 views

IPs shown by the strace.so pintool

I have a statically compiled test binary compiled as :- $ cat > test.c #include<stdio.h> int main() { printf("adsf"); mprotect(0x8048000, 0x100, 0x7); } $ gcc -o test test.c -static I use ...
2
votes
1answer
476 views

Tracing int 0x80 instructions using PIN

I wrote this small pintool that tries to record the number of int 0x80 instructions executed. I did this roughly as follows :- xed_iclass_enum_t iclass = static_cast<xed_iclass_enum_t>(...
0
votes
0answers
117 views

Set up an interrupt handler at kernel mode

I'm looking for something (a tool?) that can help me achieve my current goal: write a driver that can momentously interrupt the execution of the operating system (Linux, in my case), let me be able to ...
2
votes
1answer
114 views

Strange behavior in the reverse execution of traces

In fuzzing applications with Pin (the Pintool source code is hosted here, I am sorry for the self-advertisement), I get a very bizarre situation in tracing executed instructions, the following trace: ...
3
votes
1answer
772 views

Forcing a call to an object instance method

I've instrumented an application using Frida.RE. I can hook the constructor of a C++ class of my interest, let's call this MyClass::MyClass(). I want to call the non-static MyClass::SomeMethod() on ...
3
votes
1answer
293 views

Weird instructions

In fuzzing (with Pintool) to get examining execution traces of the program, here it is wget. I get some weird instructions, following is a piece extracted from a (very long) trace: RIP register ...
5
votes
1answer
630 views

Dalvik Byte code instrumentation framwork for dynamic data dependency analysis

I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
10
votes
1answer
1k views

Kernel level Dynamic Binary Instrumentation

Is there anything like PIN or DynamoRIO to instrument at Kernel level? The platforms I'm more interested on are Windows and OSX.