Hot answers tagged

5 votes
Accepted

Intel PIN: How to access the INS object from inside an analysis function?

You may note that printip is a function pointer, it is lazily called internally by Pin; moreover ins is an automatic variable (it is passed into Instruction from the stack). Consequently, passing &...
user avatar
4 votes

How to read and analyze Intel PIN trace

This list of hexadecimal numbers represent the addresses of each instruction followed by the software you are looking at. Pin is a tool that will allow you to collect traces of a software by ...
user avatar
  • 18k
4 votes
Accepted

I want to trace all instructions with pintool. Strange behaviour

I think you might have confused INS_AddInstrumentFunction with a tracing callback. In your case the callback supplied to INS_AddInstrumentFunction is callback_instruction. Pin calls ...
user avatar
  • 2,345
3 votes

pintool add metadata like radare2

Sure, it’s possible but you’ll have to implement the logic for it yourself: check the instruction type/operands, fetch the referred memory, try to detect if it looks like a string and so on. For ...
user avatar
  • 34.6k
3 votes
Accepted

Intel PIN: InsertPredicatedCall and INS_InsertCall

You are correct, we should use INS_InsertPredicatedCall instead of INS_InsertCall in your case. It is quite intuitive to distinguish one from the other, consider the following code cond: xor eax, ...
user avatar
3 votes
Accepted

Binary Instrumentation of malware binaries?

Yes, your Pintool written in C/C++ works fine for binaries (of x86 or x86-64 instruction set) generated from compilers of other languages. You can see this quotes in the file README of any Pin ...
user avatar
3 votes
Accepted

Launch pintool expecting user input from Powershell

in powershell use -NoNewWindow Switch if you do not want the new process to be started in a popup window Start-process -FilePath ".\XXXXXXX" -ArgumentList "xxxx yyy ddd" -NoNewWindow btw i read your ...
user avatar
  • 14.8k
3 votes

Configure and execute Intel's PIN Tool

The fastest and less cumbersome way I know is to make a copy of MyPinTool directory (under <pin dir>\source\tools\ and overwrite the file MyPinTool.cpp with your own code. Open the MyPinTool....
user avatar
3 votes

NTAPI calls made by VirtualAlloc

NtProtectVirutalMemory is not a part of VirtualAlloc call it is a part of VirtualProtect call you can verify your pintool trace with this windbg conditional breakpoint on any executable that ...
user avatar
  • 14.8k
2 votes
Accepted

pintool to intercept writes and VirtualProtect

Pintools on Windows can also aid you in instrumenting system calls. Also, if its discovered that the cpu supports sysenter/syscall, those are used in place of int 2e. However, this has no bearing on ...
user avatar
  • 251
2 votes
Accepted

What is the difference between binary instrumentation and software breakpoints?

Intel Pintool is not a JIT compiler. The explanation you quote just uses an analogy to JIT compilation, as there are logical similarities. IMHO this is not a well thought out analogy, and should be ...
user avatar
  • 11.3k
2 votes
Accepted

How to get the runtime memory region information when instrumenting using Pin?

As you're saying you're using ELF code, i assume you're running under Linux, or another unix-y system. And proc/self/maps (you don't have to getpid() and use /proc/XXX/maps, really) hints at Linux as ...
user avatar
2 votes

how to bypass the instruction for antiDBI

This is the "Heaven's Gate" technique for switching from 32-bit to 64-bit code. You'll need an updated version of Pin to proceed.
user avatar
  • 4,511
1 vote

IntelPin, Ins_Insertcall?

that's because you are printing disassembly in instrumentation routine and "+++++" in analysis routine. PIN has theoretically been divided into two routines: instrumentation - where you ...
user avatar
  • 1,427
1 vote

Instrument memory accesses of python scripts

Using pin -t <pintool> -- python <python_script.py> is nearly equivalent to compiling your code using Pyinstaller and then running it using pin. Pyinstaller bundles python runtime and your ...
user avatar
  • 1,427
1 vote

Intel PIN: How to access the INS object from inside an analysis function?

typedef class INDEX<6> INS; is defined in types_core.TLH (types not type). The following code works for me to disassamble at analysis time. void disasmIns(ADDRINT tid, ADDRINT insarg) { INS ins;...
user avatar
1 vote

Does pintool work with virtual/symbolic CPU

I am looking for Dynamic Symbolic Execution tools Probably nitpicking, but as your question is about PIN, this tool falls under the DBI (Dynamic Binary Instrumentation) tool category, it has nothing ...
user avatar
  • 402
1 vote

Intel PIN: How to log the value of the fs and gs registers at every instruction?

const CONTEXT *ctx; (from the arguments of LogRegWrite...) PIN_REGISTER regval; PIN_GetContextRegval(ctx, REG_SEG_GS, reinterpret_cast<UINT8*>(&regval)); PIN_GetContextRegval(ctx, REG_SEG_FS,...
user avatar
  • 121
1 vote
Accepted

Intel Pin memory operations tracking

So, finally I came up with the solution that works how I want and results seem to be valid according to this reference of instruction tables fprintf(trace,"\n[%s]\n",(INS_Disassemble(ins))....
user avatar
  • 124
1 vote
Accepted

Detect deadloop in PinTool

Open debugger and attach to the pin executable to check if the dead loop is in the pin itself. This is highly unlikely and the most probable cause is the tool you've written. Do the same for the ...
user avatar
  • 2,832
1 vote

Configure and execute Intel's PIN Tool

Carlos's answer is more of a workaround, but it's so much spot on. Getting all the right knobs right is an insane job. And even more so with version 3 that switched away from whatever native runtime ...
user avatar
  • 111
1 vote

Configure and execute Intel's PIN Tool

I was able to find a blog which helped me configure Visual Studio 10 to develop my own tools. Here is the link to blog . The steps mentioned are generalized. But one thing I observed was that few ...
user avatar
  • 141
1 vote

How can I remove a bbl instrumentation call at a specific address in PIN?

PIN does not provide a direct API to remove a basic block instrumentation call on a particular address.What you could do is keep track of basic blocks which have been executed at least once. You ...
user avatar
  • 5,850
1 vote
Accepted

PinTool catches instrumented application exceptions

Use PIN_AddContextChangeFunction, and from callback (CONTEXT_CHANGE_CALLBACK) you may see exception
user avatar
  • 34

Only top scored, non community-wiki answers of a minimum length are eligible