-
Notifications
You must be signed in to change notification settings - Fork 0
/
Tracer.cpp
71 lines (58 loc) · 2.18 KB
/
Tracer.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
/*
* A pin tool to record all instructions in a binary execution.
*
*/
#include <stdio.h>
#include <pin.H>
#include <map>
#include <iostream>
using namespace std;
const char *tracefile = "instrace.txt";
std::map<ADDRINT, string> opcmap;
FILE *fp;
void getctx(ADDRINT addr, CONTEXT *fromctx, ADDRINT raddr, ADDRINT waddr)
{
fprintf(fp, "%x;%s;%x,%x,%x,%x,%x,%x,%x,%x,%x,%x,\n", addr, opcmap[addr].c_str(),
PIN_GetContextReg(fromctx, REG_EAX),
PIN_GetContextReg(fromctx, REG_EBX),
PIN_GetContextReg(fromctx, REG_ECX),
PIN_GetContextReg(fromctx, REG_EDX),
PIN_GetContextReg(fromctx, REG_ESI),
PIN_GetContextReg(fromctx, REG_EDI),
PIN_GetContextReg(fromctx, REG_ESP),
PIN_GetContextReg(fromctx, REG_EBP),
raddr, waddr);
}
static void instruction(INS ins, void *v)
{
ADDRINT addr = INS_Address(ins);
if (opcmap.find(addr) == opcmap.end()) {
opcmap.insert(std::pair<ADDRINT, string>(addr, INS_Disassemble(ins)));
}
if (INS_IsMemoryRead(ins) && INS_IsMemoryWrite(ins)) {
INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)getctx, IARG_INST_PTR, IARG_CONST_CONTEXT, IARG_MEMORYREAD_EA, IARG_MEMORYWRITE_EA, IARG_END);
} else if (INS_IsMemoryRead(ins)) {
INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)getctx, IARG_INST_PTR, IARG_CONST_CONTEXT, IARG_MEMORYREAD_EA, IARG_ADDRINT, 0, IARG_END);
} else if (INS_IsMemoryWrite(ins)) {
INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)getctx, IARG_INST_PTR, IARG_CONST_CONTEXT, IARG_ADDRINT, 0, IARG_MEMORYWRITE_EA, IARG_END);
} else {
INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)getctx, IARG_INST_PTR, IARG_CONST_CONTEXT, IARG_ADDRINT, 0, IARG_ADDRINT, 0, IARG_END);
}
}
static void on_fini(INT32 code, void *v)
{
fclose(fp);
}
int main(int argc, char *argv[])
{
if (PIN_Init(argc, argv)) {
fprintf(stderr, "command line error\n");
return 1;
}
fp = fopen(tracefile, "w");
PIN_InitSymbols();
PIN_AddFiniFunction(on_fini, 0);
INS_AddInstrumentFunction(instruction, NULL);
PIN_StartProgram(); // Never returns
return 0;
}