5
votes
Accepted
Intel PIN: How to access the INS object from inside an analysis function?
You may note that printip is a function pointer, it is lazily called internally by Pin; moreover ins is an automatic variable (it is passed into Instruction from the stack). Consequently, passing &...
- 1,370
4
votes
How to read and analyze Intel PIN trace
This list of hexadecimal numbers represent the addresses of each instruction followed by the software you are looking at.
Pin is a tool that will allow you to collect traces of a software by ...
- 18k
4
votes
Accepted
I want to trace all instructions with pintool. Strange behaviour
I think you might have confused INS_AddInstrumentFunction with a tracing callback. In your case the callback supplied to INS_AddInstrumentFunction is callback_instruction. Pin calls ...
- 2,345
3
votes
pintool add metadata like radare2
Sure, it’s possible but you’ll have to implement the logic for it yourself: check the instruction type/operands, fetch the referred memory, try to detect if it looks like a string and so on. For ...
- 34.6k
3
votes
Accepted
Intel PIN: InsertPredicatedCall and INS_InsertCall
You are correct, we should use INS_InsertPredicatedCall instead of INS_InsertCall in your case. It is quite intuitive to distinguish one from the other, consider the following code
cond:
xor eax, ...
- 1,370
3
votes
Accepted
Binary Instrumentation of malware binaries?
Yes, your Pintool written in C/C++ works fine for binaries (of x86 or x86-64 instruction set) generated from compilers of other languages. You can see this quotes in the file README of any Pin ...
- 1,370
3
votes
Accepted
Launch pintool expecting user input from Powershell
in powershell use -NoNewWindow Switch if you do not want the new process to be started in a popup window
Start-process -FilePath ".\XXXXXXX" -ArgumentList "xxxx yyy ddd" -NoNewWindow
btw i read your ...
- 14.8k
3
votes
Configure and execute Intel's PIN Tool
The fastest and less cumbersome way I know is to make a copy of MyPinTool directory (under <pin dir>\source\tools\ and overwrite the file MyPinTool.cpp with your own code.
Open the MyPinTool....
- 991
3
votes
NTAPI calls made by VirtualAlloc
NtProtectVirutalMemory is not a part of VirtualAlloc call it is a part of VirtualProtect call
you can verify your pintool trace with this windbg conditional breakpoint on any executable that ...
- 14.8k
2
votes
Accepted
pintool to intercept writes and VirtualProtect
Pintools on Windows can also aid you in instrumenting system calls. Also, if its discovered that the cpu supports sysenter/syscall, those are used in place of int 2e. However, this has no bearing on ...
- 251
2
votes
Accepted
What is the difference between binary instrumentation and software breakpoints?
Intel Pintool is not a JIT compiler. The explanation you quote just uses an analogy to JIT compilation, as there are logical similarities. IMHO this is not a well thought out analogy, and should be ...
- 11.3k
2
votes
Accepted
How to get the runtime memory region information when instrumenting using Pin?
As you're saying you're using ELF code, i assume you're running under Linux, or another unix-y system. And proc/self/maps (you don't have to getpid() and use /proc/XXX/maps, really) hints at Linux as ...
- 12.6k
2
votes
how to bypass the instruction for antiDBI
This is the "Heaven's Gate" technique for switching from 32-bit to 64-bit code. You'll need an updated version of Pin to proceed.
- 4,511
1
vote
IntelPin, Ins_Insertcall?
that's because you are printing disassembly in instrumentation routine and "+++++" in analysis routine.
PIN has theoretically been divided into two routines:
instrumentation - where you ...
- 1,427
1
vote
Instrument memory accesses of python scripts
Using pin -t <pintool> -- python <python_script.py> is nearly equivalent to compiling your code using Pyinstaller and then running it using pin. Pyinstaller bundles python runtime and your ...
- 1,427
1
vote
Intel PIN: How to access the INS object from inside an analysis function?
typedef class INDEX<6> INS; is defined in types_core.TLH (types not type). The following code works for me to disassamble at analysis time.
void disasmIns(ADDRINT tid, ADDRINT insarg)
{
INS ins;...
- 11
1
vote
Does pintool work with virtual/symbolic CPU
I am looking for Dynamic Symbolic Execution tools
Probably nitpicking, but as your question is about PIN, this tool falls under the DBI (Dynamic Binary Instrumentation) tool category, it has nothing ...
- 402
1
vote
Intel PIN: How to log the value of the fs and gs registers at every instruction?
const CONTEXT *ctx; (from the arguments of LogRegWrite...)
PIN_REGISTER regval;
PIN_GetContextRegval(ctx, REG_SEG_GS, reinterpret_cast<UINT8*>(®val));
PIN_GetContextRegval(ctx, REG_SEG_FS,...
- 121
1
vote
Accepted
Intel Pin memory operations tracking
So, finally I came up with the solution that works how I want and results seem to be valid according to this reference of instruction tables
fprintf(trace,"\n[%s]\n",(INS_Disassemble(ins))....
- 124
1
vote
Accepted
Detect deadloop in PinTool
Open debugger and attach to the pin executable to check if the dead loop is in the pin itself. This is highly unlikely and the most probable cause is the tool you've written.
Do the same for the ...
- 2,832
1
vote
Configure and execute Intel's PIN Tool
Carlos's answer is more of a workaround, but it's so much spot on. Getting all the right knobs right is an insane job. And even more so with version 3 that switched away from whatever native runtime ...
- 111
1
vote
Configure and execute Intel's PIN Tool
I was able to find a blog which helped me configure Visual Studio 10 to develop my own tools. Here is the link to blog . The steps mentioned are generalized. But one thing I observed was that few ...
- 141
1
vote
How can I remove a bbl instrumentation call at a specific address in PIN?
PIN does not provide a direct API to remove a basic block instrumentation call on a particular address.What you could do is keep track of basic blocks which have been executed at least once.
You ...
- 5,850
1
vote
Accepted
PinTool catches instrumented application exceptions
Use PIN_AddContextChangeFunction, and from callback (CONTEXT_CHANGE_CALLBACK) you may see exception
- 34
Only top scored, non community-wiki answers of a minimum length are eligible