Questions tagged [pintool]
Pin is a dynamic binary instrumentation framework developed by Intel, which can hook and run arbitrary code into running processes, and is pluggable with user-written addons called Pintools. Pin targets the most well-know Intel architectures such as ia32 and amd64.
39
questions
0
votes
0
answers
69
views
Intel Pin Tool : Memory Trace of a function and all the functions called by it
I want a memory (read) trace of a function and all the functions called by the function I wish to trace.
This is the code I wrote.
#include "pin.H"
#include <cstdint>
#include <...
2
votes
1
answer
77
views
In Pintool, How to find the name of an routine's caller?
I want to trace the mutex variables in my rust program(e.g. which mutex called lock() and unlock() methods). And I think there're static methods.
- 21
2
votes
0
answers
89
views
Intel Pintools: How to count the number of static and basic blocks?
I am using Intel Pintool BBLs to count the total number of static and dynamic basic blocks.
The below is the distinguish between static vs dynamic basic blocks (bbls):
A dynamic basic block is ...
- 41
2
votes
0
answers
210
views
PinTools Multi-threaded example (inscount_Tls.cpp): only one thread outputs
I am studying PinTools multithread example inscount_tls.cpp. When I change the number of thread to 3, only 1 thread outputs the result. Is anyone familiar with Intel Pintools instruments that can give ...
- 41
1
vote
1
answer
57
views
How to know each register value instruction by instruction in a binary using radare2?
As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to ...
- 39
0
votes
0
answers
151
views
Heavens gate code
Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you.
I use Intel Pin
push cs
push 0xa02829
jmp far ...
- 21
1
vote
1
answer
67
views
how to bypass the instruction for antiDBI
This instruction stops the execution of the pin code jmp far 0x161061d, 0x33 ? how to get around this?
- 21
1
vote
1
answer
195
views
IntelPin, Ins_Insertcall?
please help me with Intel Pin:
I print each instruction to the console and I want to insert +++++ after it using Ins_Insertcall:
VOID CpuidCalled(const CONTEXT* ctxt)
{
std::cerr << "+++++&...
- 21
0
votes
1
answer
344
views
PIN tool doesn't write to stdout or sterr on windows
I'm writing a pin tool (Windows, x64, PIN 3.18), and it starts like this:
int main(int argc, char *argv[]) {
std::cerr << "Initializing..." << std::endl;
This is how I'm ...
-1
votes
1
answer
253
views
Instrument memory accesses of python scripts
My research requires processing memory traces of applications. For C/C++ programs, this is easy using Intel's PIN library. However, as suggested here https://stackoverflow.com/questions/51835532/use-...
0
votes
0
answers
121
views
Pin DBI tool - Create executable
I'm starting to learn Intel's Pin framework and I can't figure out if it's possible to create an executable.
I mean, rather than creating a module and forcing people to download Pin + the module, is ...
- 1
0
votes
0
answers
69
views
Windows pintool mismatch between call/ret instructions
So i've been trying to write a pintool that monitors call/ret instructions but i've noticed that threre was a significant inconsistency between the two. For example ret instructions without previous ...
- 53
1
vote
0
answers
54
views
Obtaining a relation between reads and writes with Pin
I'll be honest, Pin is confounding my intuition. Let's say, for the sake of argument, I have a line
a = b + c
and I wish to then store the addresses of b and c as a's dependencies, say, in a map,
...
- 11
0
votes
0
answers
129
views
Intel Pin assertion failed: RTN_Valid(x)
I am working on modifying my Intel Pin based tool. As before I am using VS2015 on Windows 10. Previously, I have been testing a tool on the same system where I build it and it worked just fine. The ...
- 124
1
vote
0
answers
3k
views
Tracing calls, rets and instructions with Intel Pin
I am writing a Pin tool with the following functionality:
It has to record instructions with arguments. (works well)
It has to record memory access operations associated with instructions. (works ...
- 124
0
votes
1
answer
1k
views
how to get per-function memory accesses using PIN tool
I am modifying PIN's proccount sample to get the memory access information per function
VOID Routine(RTN rtn, VOID *v)
{
// Allocate a counter for this routine
RTN_COUNT * rc = new ...
1
vote
0
answers
42
views
Instrumentation fail when app use far jump 0x33 crash
Do you known any dbi tool that support instrumentation of application that use far jump 0x33?
P.S. pin, dymanoRIO don't support far jump 0x33.
- 11
2
votes
1
answer
47
views
pintool add metadata like radare2
Look at this very basic C program:
#include <stdio.h>
int main()
{
printf("Hello world\n");
return 0;
}
Now look at this very basic pintool:
#include "pin.H"
#include <stdio.h>
...
- 797
2
votes
1
answer
2k
views
I want to trace all instructions with pintool. Strange behaviour
Look at this very basic c program:
int main()
{
for (int i=0;i<0x42;i++)
{
asm("nop");
asm("nop");
}
return 0x42;
}
I have compiled it without any optimisations.
...
- 797
1
vote
0
answers
105
views
Getting REWARDS pintool to work with ELF [closed]
I am trying to run a pintool I downloaded from this link:
https://www.cs.purdue.edu/homes/kim1051/
The associated paper is here:
https://www.utdallas.edu/~zxl111930/file/Rewards_NDSS10.pdf
The tool ...
- 11
2
votes
1
answer
737
views
What is the difference between binary instrumentation and software breakpoints?
Don't be confused by a title of a question. Here is an explanation.
Let's take Intel Pin. They claim that
The best way to think about Pin is as a "just in time" (JIT) compiler.
The input to ...
- 124
1
vote
0
answers
356
views
Get instruction bytes in JIT mode, Intel Pin
I have an INS object in the instrumentation function, and I wish to get the actual bytes used to code this instruction. Looking at the INS functions, the closest I found was a function to disassemble ...
- 11
0
votes
1
answer
426
views
Does pintool work with virtual/symbolic CPU
I am working on debugging tools detection.
What i am looking for is a tool than can log EACH cpu instruction which is run by CPU.
I am looking for Dynamic Symbolic Execution tools. The code is not ...
- 797
1
vote
1
answer
2k
views
Intel PIN: How to log the value of the fs and gs registers at every instruction?
I modified the pinatrace pintool example and managed to log all values of the "regular" registers:
VOID Instruction(INS ins, VOID *v)
{
...
// Instrument REGISTER writes using a predicated ...
- 1,560
1
vote
0
answers
204
views
How do I access the TEB in PIN?
In PIN's documentation it says this about PIN_SafeCopy:
PIN_SafeCopy is used to copy the specified number of bytes from a
source memory region to a destination memory region. This function
...
- 121
0
votes
1
answer
139
views
How the same executable runs on different OS and hardware types?
I was playing around with Intel Pin and OllyDbg. And now I came up with the next question. Imagine we have PE32 executable that are able to run on both Windows 7 and Windows 10 (or any other versions ...
- 124
1
vote
1
answer
1k
views
How to get the runtime memory region information when instrumenting using Pin?
I am using Pin for some execution monitoring tasks towards x64 ELF binary code.
During the monitoring, for any memory write/read operation of the original code, I would like to record it as long as ...
- 2,485
6
votes
2
answers
4k
views
Intel PIN: How to access the INS object from inside an analysis function?
A typical PIN code snippet looks like this (taken from the official manual):
// This function is called before every instruction is executed
// and prints the IP
VOID printip(VOID *ip) { fprintf(...
- 1,560
4
votes
1
answer
2k
views
Intel PIN: InsertPredicatedCall and INS_InsertCall
The intel PIN manual (section Memory Reference Trace) says:
We also use INS_InsertPredicatedCall instead of INS_InsertCall to
avoid generating references to instructions that are predicated when
...
- 1,560
3
votes
2
answers
3k
views
Intel Pin memory operations tracking
I am using Intel Pin in order trace memory activity of an executable on Windows. What I have found, that most of the memory operands (Read or Write) operates with 2 or 4 bytes. So I decided to modify ...
- 124
3
votes
2
answers
392
views
Detect deadloop in PinTool
I am writing a PinTool, which can manipulate certain register/memory value. However, after manipulation, one challenge I am facing now, is the deadloop.
In particular, due to the frequent ...
- 2,485
2
votes
3
answers
3k
views
Configure and execute Intel's PIN Tool
I am trying to develop a Pintool on Windows. But so far I have been unable to configure or execute PIN. I have Microsoft Visual Studio 10.0 installed on my system. I have also downloaded and unzipped ...
- 151
1
vote
1
answer
516
views
Binary Instrumentation of malware binaries?
I am developing a dynamic instrumentation tool using Intel PIN to analyze malware binaries in windows. From what I have learned so far is that I am able to use the tool with programs I write using C/C+...
- 151
3
votes
1
answer
165
views
Launch pintool expecting user input from Powershell
I'm trying to bruteforce a password in a 32bit Windows application (this is challenge 9 of http://www.flare-on.com/files/2015_FLAREOn_Challenges.zip), using the inscount0 pintool (https://software....
- 109
2
votes
1
answer
2k
views
How to read and analyze Intel PIN trace
Recently I have collected several PIN traces but all of them are in a format like below :
0x2af1510676b0
0x2af1510676b3
0x2af15106b010
0x2af15106b011
0x2af15106b014
0x2af15106b016
0x2af15106b018
...
- 171
1
vote
1
answer
905
views
How can I remove a bbl instrumentation call at a specific address in PIN?
I have created a pintool that outputs in a json file all the basic blocks executed by a program. The problem is that the instrumented program runs slow so I am trying to optimize my pintool.
I was ...
2
votes
1
answer
389
views
PinTool catches instrumented application exceptions
How can I catch the exceptions generated by an instrumented application in Intel PIN?
I know about PIN_AddInternalExceptionHandler. This is not what I mean, this catches exceptions generated by the ...
- 1,041
3
votes
1
answer
4k
views
NTAPI calls made by VirtualAlloc
I wrote a Pintool that intercepts system calls based on their system call number. I'm currently on a windows 7 machine and I'm using the system calls listed here as a reference.
I'm tracing a hello ...
user1743
1
vote
1
answer
545
views
pintool to intercept writes and VirtualProtect
On Linux the strace.so pintool gives a good overview on how system calls are intercepted in PIN. One could monitor the value of EAX to see which system call is being invoked(and mprotect and writes ...
user1743