5
You may note that printip is a function pointer, it is lazily called internally by Pin; moreover ins is an automatic variable (it is passed into Instruction from the stack). Consequently, passing &ins into printip (through IARG_PTR), then using it will lead to segmentation faults.
Pin declares INS by specializing the class template INDEX, as you can ...
4
This list of hexadecimal numbers represent the addresses of each instruction followed by the software you are looking at.
Pin is a tool that will allow you to collect traces of a software by dynamically instrumenting the code of it. What you collected here is the lowest level of information that you can get out of Pin, but you can ask for more by using the ...
4
I think you might have confused INS_AddInstrumentFunction with a tracing callback. In your case the callback supplied to INS_AddInstrumentFunction is callback_instruction. Pin calls callback_instruction every time a new instruction is encountered, not on every execution of an instruction.
This is probably not what you want to achieve. Here's the code that ...
3
Sure, it’s possible but you’ll have to implement the logic for it yourself: check the instruction type/operands, fetch the referred memory, try to detect if it looks like a string and so on. For function names, you'll need to parse the symbol table of the binary.
There is no ready to use pintool that does this (AFAIK).
3
You are correct, we should use INS_InsertPredicatedCall instead of INS_InsertCall in your case. It is quite intuitive to distinguish one from the other, consider the following code
cond:
xor eax, eax
mov edx, 0x1
cmp word [esp + 0x4], 0x5
cmovz eax, edx
ret
whose C code is something likes
int cond(int input)
{
return input == 0x5 ? 1 : 0;
}
...
3
Yes, your Pintool written in C/C++ works fine for binaries (of x86 or x86-64 instruction set) generated from compilers of other languages. You can see this quotes in the file README of any Pin distribution
... the [instrumented] application can use any compiler.
Personally, I have used Pin to instrument binaries compiled by OCaml compiler (so the source ...
3
in powershell use -NoNewWindow Switch if you do not want the new process to be started in a popup window
Start-process -FilePath ".\XXXXXXX" -ArgumentList "xxxx yyy ddd" -NoNewWindow
btw i read your solution and it seems the challenge doesnt check just one character and proceeds to terminate itself on failure of first it seems to check all of the 41 ...
3
The fastest and less cumbersome way I know is to make a copy of MyPinTool directory (under <pin dir>\source\tools\ and overwrite the file MyPinTool.cpp with your own code.
Open the MyPinTool.sln in Visual Studio and build your target. After that you can rename the DLL to whatever you want.
It is not an elegant solution but it gets the job done. In ...
3
NtProtectVirutalMemory is not a part of VirtualAlloc call it is a part of VirtualProtect call
you can verify your pintool trace with this windbg conditional breakpoint on any executable that allocates memory
0:000> bl
0 e 7c809af1 0001 (0001) 0:**** kernel32!VirtualAlloc "bp /1 @$ra \"g\";wt"
0:000> $$ break on valloc set a one time condtional ...
2
Pintools on Windows can also aid you in instrumenting system calls. Also, if its discovered that the cpu supports sysenter/syscall, those are used in place of int 2e. However, this has no bearing on whether or not instrumentation can take place.
To answer your second question, yes, NtReadFile, NtWriteFile and NtDeviceIoControlFile are the *nix equivalent of ...
2
Intel Pintool is not a JIT compiler. The explanation you quote just uses an analogy to JIT compilation, as there are logical similarities. IMHO this is not a well thought out analogy, and should be taken very lightly.
I'll explain the three concepts in detail:
JIT Compilation
Indeed, the concept of JIT compilation is not really relevant to the question, but ...
2
As you're saying you're using ELF code, i assume you're running under Linux, or another unix-y system. And proc/self/maps (you don't have to getpid() and use /proc/XXX/maps, really) hints at Linux as well.
One problem i see is the definition of heap - what about memory mapped regions, do they count as "heap" or not? Linux malloc uses mmap in some cases ...
1
Using pin -t <pintool> -- python <python_script.py> is nearly equivalent to compiling your code using Pyinstaller and then running it using pin. Pyinstaller bundles python runtime and your script together, so that user don't have to install python on their end.
Check pyinstrument - it is a python profiling project, it provides you stack track by ...
1
I am looking for Dynamic Symbolic Execution tools
Probably nitpicking, but as your question is about PIN, this tool falls under the DBI (Dynamic Binary Instrumentation) tool category, it has nothing to do with symbolic execution.
Does it work with a symbolic CPU ?
No, you need a binary to be instrumented, be it a PE (Windows) or ELF (linux).
Or is it ...
1
const CONTEXT *ctx; (from the arguments of LogRegWrite...)
PIN_REGISTER regval;
PIN_GetContextRegval(ctx, REG_SEG_GS, reinterpret_cast<UINT8*>(®val));
PIN_GetContextRegval(ctx, REG_SEG_FS, reinterpret_cast<UINT8*>(®val));
PIN_GetContextRegval(ctx, REG_SEG_GS_BASE, reinterpret_cast<UINT8*>(®val));
PIN_GetContextRegval(...
1
So, finally I came up with the solution that works how I want and results seem to be valid according to this reference of instruction tables
fprintf(trace,"\n[%s]\n",(INS_Disassemble(ins)).c_str()); //(INS_Disassemble(ins)).c_str()
fflush(trace);
for (UINT32 memOp = 0; memOp < memOperands; memOp++)
{
if (INS_MemoryOperandIsRead(ins, ...
1
Open debugger and attach to the pin executable to check if the dead loop is in the pin itself. This is highly unlikely and the most probable cause is the tool you've written.
Do the same for the pintool. Pintool is in the target process. So attache debugger to it.
The debugger should show you where the problem is. Once the area identified, you can open the ...
1
Carlos's answer is more of a workaround, but it's so much spot on. Getting all the right knobs right is an insane job. And even more so with version 3 that switched away from whatever native runtime the OS may have, and started to use their own.
After half a day reversing the examples, I could come up with this (I'm assuming a 64 bit Windows target, but it ...
1
I was able to find a blog which helped me configure Visual Studio 10 to develop my own tools. Here is the link to blog . The steps mentioned are generalized. But one thing I observed was that few directory names were different in my Pin installation. So please keep in mind to update those names. For some weird reasons I had to add "\LIBPATH:(path to ...
1
PIN does not provide a direct API to remove a basic block instrumentation call on a particular address.What you could do is keep track of basic blocks which have been executed at least once.
You would insert instrumentation calls only for those basic blocks which have not been executed previously.
Here is a crude example based on the official ...
1
Use PIN_AddContextChangeFunction, and from callback (CONTEXT_CHANGE_CALLBACK) you may see exception
Only top voted, non community-wiki answers of a minimum length are eligible