5 votes
Accepted

Intel PIN: How to access the INS object from inside an analysis function?

You may note that printip is a function pointer, it is lazily called internally by Pin; moreover ins is an automatic variable (it is passed into Instruction from the stack). Consequently, passing &...
Ta Thanh Dinh's user avatar
4 votes
Accepted

I want to trace all instructions with pintool. Strange behaviour

I think you might have confused INS_AddInstrumentFunction with a tracing callback. In your case the callback supplied to INS_AddInstrumentFunction is callback_instruction. Pin calls ...
sudhackar's user avatar
  • 2,659
3 votes

pintool add metadata like radare2

Sure, it’s possible but you’ll have to implement the logic for it yourself: check the instruction type/operands, fetch the referred memory, try to detect if it looks like a string and so on. For ...
Igor Skochinsky's user avatar
  • 36.6k
3 votes
Accepted

Intel PIN: InsertPredicatedCall and INS_InsertCall

You are correct, we should use INS_InsertPredicatedCall instead of INS_InsertCall in your case. It is quite intuitive to distinguish one from the other, consider the following code cond: xor eax, ...
Ta Thanh Dinh's user avatar
3 votes

Configure and execute Intel's PIN Tool

The fastest and less cumbersome way I know is to make a copy of MyPinTool directory (under <pin dir>\source\tools\ and overwrite the file MyPinTool.cpp with your own code. Open the MyPinTool....
Carlos Garcia's user avatar
2 votes
Accepted

How to get the runtime memory region information when instrumenting using Pin?

As you're saying you're using ELF code, i assume you're running under Linux, or another unix-y system. And proc/self/maps (you don't have to getpid() and use /proc/XXX/maps, really) hints at Linux as ...
Guntram Blohm's user avatar
2 votes
Accepted

What is the difference between binary instrumentation and software breakpoints?

Intel Pintool is not a JIT compiler. The explanation you quote just uses an analogy to JIT compilation, as there are logical similarities. IMHO this is not a well thought out analogy, and should be ...
NirIzr's user avatar
  • 11.8k
2 votes

how to bypass the instruction for antiDBI

This is the "Heaven's Gate" technique for switching from 32-bit to 64-bit code. You'll need an updated version of Pin to proceed.
peter ferrie's user avatar
  • 4,709
1 vote

In Pintool, How to find the name of an routine's caller?

In instruction instrumentation function, you can check if the instruction is indeed a call instruction. Something like - if (INS_IsCall(ins)) { if (INS_IsDirectCall(ins)) { Then ...
R4444's user avatar
  • 1,807
1 vote

How to know each register value instruction by instruction in a binary using radare2?

As i commented use visual mode to see all registers radare2 file.exe ood vv f7 / s EDIT that is not a realistic expectation are you going to keep on single stepping for eternity ? what are you ...
blabb's user avatar
  • 16.4k
1 vote

IntelPin, Ins_Insertcall?

that's because you are printing disassembly in instrumentation routine and "+++++" in analysis routine. PIN has theoretically been divided into two routines: instrumentation - where you ...
R4444's user avatar
  • 1,807
1 vote

Instrument memory accesses of python scripts

Using pin -t <pintool> -- python <python_script.py> is nearly equivalent to compiling your code using Pyinstaller and then running it using pin. Pyinstaller bundles python runtime and your ...
R4444's user avatar
  • 1,807
1 vote

Does pintool work with virtual/symbolic CPU

I am looking for Dynamic Symbolic Execution tools Probably nitpicking, but as your question is about PIN, this tool falls under the DBI (Dynamic Binary Instrumentation) tool category, it has nothing ...
Neitsa's user avatar
  • 412
1 vote

Intel PIN: How to log the value of the fs and gs registers at every instruction?

const CONTEXT *ctx; (from the arguments of LogRegWrite...) PIN_REGISTER regval; PIN_GetContextRegval(ctx, REG_SEG_GS, reinterpret_cast<UINT8*>(&regval)); PIN_GetContextRegval(ctx, REG_SEG_FS,...
慕冬亮's user avatar
  • 121
1 vote

Intel PIN: How to access the INS object from inside an analysis function?

typedef class INDEX<6> INS; is defined in types_core.TLH (types not type). The following code works for me to disassamble at analysis time. void disasmIns(ADDRINT tid, ADDRINT insarg) { INS ins;...
Heiner Litz's user avatar
1 vote

Configure and execute Intel's PIN Tool

I was able to find a blog which helped me configure Visual Studio 10 to develop my own tools. Here is the link to blog . The steps mentioned are generalized. But one thing I observed was that few ...
Anurag's user avatar
  • 151
1 vote
Accepted

Intel Pin memory operations tracking

So, finally I came up with the solution that works how I want and results seem to be valid according to this reference of instruction tables fprintf(trace,"\n[%s]\n",(INS_Disassemble(ins))....
aGGeRReS's user avatar
  • 124
1 vote
Accepted

Detect deadloop in PinTool

Open debugger and attach to the pin executable to check if the dead loop is in the pin itself. This is highly unlikely and the most probable cause is the tool you've written. Do the same for the ...
PhoeniX's user avatar
  • 3,052
1 vote

Configure and execute Intel's PIN Tool

Carlos's answer is more of a workaround, but it's so much spot on. Getting all the right knobs right is an insane job. And even more so with version 3 that switched away from whatever native runtime ...
mirh's user avatar
  • 117

Only top scored, non community-wiki answers of a minimum length are eligible