7 votes
Accepted

Why are PUSHF and POPF so slow?

Clever (some would say incomprehensible) misuse of x86 features could do this for you. The loop instruction will decrement the ecx register, jump if it's nonzero, and not modify flags. You can use ...
user avatar
6 votes
Accepted

Are there any static binary rewriting tools?

I just extracted the following list during my research of this paper: "Reassembleable Disassembling" Shuai Wang, Pei Wang, and Dinghao Wu, The Pennsylvania State University The following list ...
user avatar
  • 1,227
5 votes

Trace Method Calls in .NET/C# Binary

that instrumentation is not easily possible because of JIT compilation of IL instructions. Well it's actually the opposite. Tracing methods is quite easy - it would be difficult if we would like to ...
user avatar
4 votes
Accepted

Where can I learn about code instrumentation?

Before jumping straight to interesting articles and sources I'll start by defining the key words, just in case. Static analysis : consists in analyzing the target binary file without executing it. ...
user avatar
  • 2,603
4 votes
Accepted

Determining the number of instructions executed by a driver

I'd recommend using Bochs. It'll allow you to write code to count the number of instructions (and/or number of different instructions) executed between a SYSCALL/SYSRET, SYSENTER/SYSEXIT, etc.
user avatar
3 votes
Accepted

Intel PIN: InsertPredicatedCall and INS_InsertCall

You are correct, we should use INS_InsertPredicatedCall instead of INS_InsertCall in your case. It is quite intuitive to distinguish one from the other, consider the following code cond: xor eax, ...
user avatar
3 votes

Is it possible to programmatically determine if a crash resulted from a buffer overflow?

it is not clear if you are using windbg and you have a bunch of .dmp files that you want to auto analyze for access-violation if that is the case you could check this out original contents of ...
user avatar
  • 14.8k
3 votes

Running just one function from an compiled executable or shared object?

I think you are looking for ESIL which allow you to emulate code Specifically aei to initialize the VM and aeip to set the pc to curseek. You can list registers using aer and set them with aer eax=1 ...
user avatar
3 votes
Accepted

Binary Instrumentation of malware binaries?

Yes, your Pintool written in C/C++ works fine for binaries (of x86 or x86-64 instruction set) generated from compilers of other languages. You can see this quotes in the file README of any Pin ...
user avatar
3 votes

Configure and execute Intel's PIN Tool

The fastest and less cumbersome way I know is to make a copy of MyPinTool directory (under <pin dir>\source\tools\ and overwrite the file MyPinTool.cpp with your own code. Open the MyPinTool....
user avatar
3 votes

Why are PUSHF and POPF so slow?

If you look at lib/Target/X86/X86InstrInfo.cpp in the LLVM source code you can see that they prefer the LAHF and SAHF instructions to PUSHF and POPF for speed reasons. These instructions don't deal ...
user avatar
  • 2,134
3 votes

Dynamic instrumentation tools

frida is cross-platform (OS X, Windows, Linux, iOS, Android) and also supports multiple architecture. The main functionality is running some javascript code every time a function is called or when ...
user avatar
  • 340
3 votes
Accepted

Strange behavior in the reverse execution of traces

When dealing with multi-threaded program, you may end up getting instructions from different threads. You can for example check the current thread ID to make sure you're getting what you need. Even ...
user avatar
  • 34.6k
3 votes

Trace Method Calls in .NET/C# Binary

You can use de4dot (https://github.com/0xd4d/de4dot) to deobfuscate the binary. Static analysis of dotnet binaries can be done easily by using de4dot and then using ILSpy to create a visual studio ...
user avatar
2 votes
Accepted

IPs shown by the strace.so pintool

On modern Linux systems, a syscall stub (vdso) is used to invoke the actual syscall. This is done so that the application binary does not need to know anything about the host CPU, and what mechanism ...
user avatar
  • 2,279
2 votes
Accepted

Tracing int 0x80 instructions using PIN

PIN_AddSyscallEntryFunction Why not just use PIN_AddSyscallEntryFunction? This is an ABI-agnostic way of doing things, that lets you use PIN_GetSyscallArgument and related functions rather than ...
user avatar
  • 2,279
2 votes

Saving program execution state for fuzzing

CreateToolhelp32Snapshot() would help for creating a snapshot of program state, especially fuzzing a la this paper Also, Peter Van Eeckhoutte covered what you're attempting to do in (in-memory ...
user avatar
2 votes

Instrumenting syscall by static binary rewriting

PIN_AddSyscallEntryFunction and PIN_AddSyscallExitFunction should do the trick. Link to the Documentation. Snippet using theses APIs : (credits to Jurriaan Bremer) #include <stdio.h> #include "...
user avatar
  • 578
2 votes

Why are PUSHF and POPF so slow?

Posting a 2nd answer for a different method, combining cmov to avoid a skip-1-instruction branch with @Ian Cook's nice lahf/sahf. push %ecx movl index, %ecx push %eax ...
user avatar
2 votes

Running just one function from an compiled executable or shared object?

As you correctly mentioned, this is a pseudo C code which output a C-like code. This code can't be compiled since it's not a valid C code. This output can be shown using the pdc command. radare2 ...
user avatar
  • 8,579
1 vote

Detect interesting testcases

If you want to discover new test cases (or check that a test case is valuable) on a binary, the good way to go is to use tools such as KLEE (see this small tutorial). The point is too use symbolic ...
user avatar
  • 18k
1 vote
Accepted

Intel PIN (TracerPIN): adding modification of registers

What worked for me was passing a reference to the register to my changeReg() function with IARG_REG_REFERENCE, then changing the value the reference points to.
user avatar
  • 341
1 vote

Running just one function from an compiled executable or shared object?

A few of other approaches could be: Using IDA's AppCall functionality. It isn't all too known a feature (and it should be!) but IDA makes an effort letting you use functions inside the binary in ...
user avatar
  • 11.3k
1 vote
Accepted

How to use Frida on a Java application ? (non Android application)

To my best knowledge, Frida has no support for non-android java applications. For desktop java applications you are better of using Java agents or the lower level JVM-TI interface. There's also the ...
user avatar
  • 5,850
1 vote
Accepted

Dumpout Process Memory Layout During Loading Time

I think that one option could be to use ptrace, for example you can use _dl_open() instead of LD_PRELOAD. Look at this example: http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx ...
user avatar
1 vote

How to perform memory address translation on x86 instructions?

If you have control over the original memory, and performance is not a concern, you can install an exception handler, and then mark the entire original memory region as "not accessible". For each ...
user avatar
  • 4,511
1 vote

Configure and execute Intel's PIN Tool

Carlos's answer is more of a workaround, but it's so much spot on. Getting all the right knobs right is an insane job. And even more so with version 3 that switched away from whatever native runtime ...
user avatar
  • 111
1 vote

Configure and execute Intel's PIN Tool

I was able to find a blog which helped me configure Visual Studio 10 to develop my own tools. Here is the link to blog . The steps mentioned are generalized. But one thing I observed was that few ...
user avatar
  • 141
1 vote

Insert a function call in an ELF executable

It seems that you're trying to run some code in the context of the binary before anything meaningful happens. You should read some resources about ELF infection, for example on vxheavens or here. ...
user avatar
  • 2,486
1 vote

Why are PUSHF and POPF so slow?

What if you have index count downward, and unconditionally mask it to handle wraparound, instead of a conditional? Hmm, AND sets all the flags, including OF (which isn't saved/restored with lahf/safh)...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible