Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pintool]

Pin is a dynamic binary instrumentation framework developed by Intel, which can hook and run arbitrary code into running processes, and is pluggable with user-written addons called Pintools. Pin targets the most well-know Intel architectures such as ia32 and amd64.

1
vote
0answers
89 views

Tracing calls, rets and instructions with Intel Pin

I am writing a Pin tool with the following functionality: It has to record instructions with arguments. (works well) It has to record memory access operations associated with instructions. (works ...
0
votes
1answer
92 views

how to get per-function memory accesses using PIN tool

I am modifying PIN's proccount sample to get the memory access information per function VOID Routine(RTN rtn, VOID *v) { // Allocate a counter for this routine RTN_COUNT * rc = new ...
1
vote
0answers
25 views

Instrumentation fail when app use far jump 0x33 crash

Do you known any dbi tool that support instrumentation of application that use far jump 0x33? P.S. pin, dymanoRIO don't support far jump 0x33.
2
votes
1answer
34 views

pintool add metadata like radare2

Look at this very basic C program: #include <stdio.h> int main() { printf("Hello world\n"); return 0; } Now look at this very basic pintool: #include "pin.H" #include <stdio.h> ...
2
votes
1answer
144 views

I want to trace all instructions with pintool. Strange behaviour

Look at this very basic c program: int main() { for (int i=0;i<0x42;i++) { asm("nop"); asm("nop"); } return 0x42; } I have compiled it without any optimisations. ...
1
vote
0answers
66 views

Getting REWARDS pintool to work with ELF [closed]

I am trying to run a pintool I downloaded from this link: https://www.cs.purdue.edu/homes/kim1051/ The associated paper is here: https://www.utdallas.edu/~zxl111930/file/Rewards_NDSS10.pdf The tool ...
2
votes
1answer
212 views

What is the difference between binary instrumentation and software breakpoints?

Don't be confused by a title of a question. Here is an explanation. Let's take Intel Pin. They claim that The best way to think about Pin is as a "just in time" (JIT) compiler. The input to ...
1
vote
0answers
194 views

Get instruction bytes in JIT mode, Intel Pin

I have an INS object in the instrumentation function, and I wish to get the actual bytes used to code this instruction. Looking at the INS functions, the closest I found was a function to disassemble ...
0
votes
1answer
225 views

Does pintool work with virtual/symbolic CPU

I am working on debugging tools detection. What i am looking for is a tool than can log EACH cpu instruction which is run by CPU. I am looking for Dynamic Symbolic Execution tools. The code is not ...
1
vote
1answer
846 views

Intel PIN: How to log the value of the fs and gs registers at every instruction?

I modified the pinatrace pintool example and managed to log all values of the "regular" registers: VOID Instruction(INS ins, VOID *v) { ... // Instrument REGISTER writes using a predicated call, i....
1
vote
0answers
134 views

How do I access the TEB in PIN?

In PIN's documentation it says this about PIN_SafeCopy: PIN_SafeCopy is used to copy the specified number of bytes from a source memory region to a destination memory region. This function ...
0
votes
1answer
110 views

How the same executable runs on different OS and hardware types?

I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
1
vote
1answer
640 views

How to get the runtime memory region information when instrumenting using Pin?

I am using Pin for some execution monitoring tasks towards x64 ELF binary code. During the monitoring, for any memory write/read operation of the original code, I would like to record it as long as ...
5
votes
2answers
1k views

Intel PIN: How to access the INS object from inside an analysis function?

A typical PIN code snippet looks like this (taken from the official manual): // This function is called before every instruction is executed // and prints the IP VOID printip(VOID *ip) { fprintf(...
4
votes
1answer
590 views

Intel PIN: InsertPredicatedCall and INS_InsertCall

The intel PIN manual (section Memory Reference Trace) says: We also use INS_InsertPredicatedCall instead of INS_InsertCall to avoid generating references to instructions that are predicated when ...
2
votes
2answers
1k views

Intel Pin memory operations tracking

I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify ...
3
votes
2answers
319 views

Detect deadloop in PinTool

I am writing a PinTool, which can manipulate certain register/memory value. However, after manipulation, one challenge I am facing now, is the deadloop. In particular, due to the frequent ...
0
votes
2answers
922 views

Configure and execute Intel's PIN Tool

I am trying to develop a Pintool on Windows. But so far I have been unable to configure or execute PIN. I have Microsoft Visual Studio 10.0 installed on my system. I have also downloaded and unzipped ...
1
vote
1answer
401 views

Binary Instrumentation of malware binaries?

I am developing a dynamic instrumentation tool using Intel PIN to analyze malware binaries in windows. From what I have learned so far is that I am able to use the tool with programs I write using C/C+...
3
votes
1answer
114 views

Launch pintool expecting user input from Powershell

I'm trying to bruteforce a password in a 32bit Windows application (this is challenge 9 of http://www.flare-on.com/files/2015_FLAREOn_Challenges.zip), using the inscount0 pintool (https://software....
2
votes
1answer
968 views

How to read and analyze Intel PIN trace

Recently I have collected several PIN traces but all of them are in a format like below : 0x2af1510676b0 0x2af1510676b3 0x2af15106b010 0x2af15106b011 0x2af15106b014 0x2af15106b016 0x2af15106b018 ...
1
vote
1answer
506 views

How can I remove a bbl instrumentation call at a specific address in PIN?

I have created a pintool that outputs in a json file all the basic blocks executed by a program. The problem is that the instrumented program runs slow so I am trying to optimize my pintool. I was ...
0
votes
1answer
201 views

PinTool catches instrumented application exceptions

How can I catch the exceptions generated by an instrumented application in Intel PIN? I know about PIN_AddInternalExceptionHandler. This is not what I mean, this catches exceptions generated by the ...
3
votes
1answer
2k views

NTAPI calls made by VirtualAlloc

I wrote a Pintool that intercepts system calls based on their system call number. I'm currently on a windows 7 machine and I'm using the system calls listed here as a reference. I'm tracing a hello ...
1
vote
1answer
359 views

pintool to intercept writes and VirtualProtect

On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of EAX to see which system call is being invoked(and mprotect and writes ...