MyPinTool的基本框架

MyPinTool

MyPinTool中,其入口点为Ptrace_DllMainCRTStartup函数,但是其也有个main函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
int main(int argc, char *argv[])
{
if( PIN_Init(argc,argv) )
{ // 初始化运行库,当错误或者使用-h参数时,打印帮助信息
return Usage();
}

// 根据命令行初始化fileName,为 -o 参数指定的输出文件
string fileName = KnobOutputFile.Value();

if (!fileName.empty()) { out = new std::ofstream(fileName.c_str());}

// -count 参数所设置的值,默认为1的时候会注册下面三个插桩函数
if (KnobCount)
{
// 注册执行trace命令时所执行的函数
TRACE_AddInstrumentFunction(Trace, 0);

// 注册每个线程启动时的所执行的函数
PIN_AddThreadStartFunction(ThreadStart, 0);

// 注册程序退出时所执行的函数
PIN_AddFiniFunction(Fini, 0);
}

cerr << "===============================================" << endl;
cerr << "This application is instrumented by MyPinTool" << endl;
if (!KnobOutputFile.Value().empty())
{
cerr << "See file " << KnobOutputFile.Value() << " for analysis results" << endl;
}
cerr << "===============================================" << endl;

// 启动程序,该函数不会返回
PIN_StartProgram();

return 0;
}

帮助信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
Pin tools switches

-count [default 1]
count instructions, basic blocks and threads in the application
-logfile [default pintool.log]
The log file path and file name
-o [default ]
specify file name for MyPinTool output
-symbol_path [default ]
List of paths separated with semicolons that is searched for symbol
and line information
-unique_logfile [default 0]
The log file names will contain the pid

Symbols controls

-ignore_debug_info [default 0]
Ignore debug info for the image. Symbols are taken from the symbol
tables.
-reduce_rtn_size_mode [default auto]
Mode for RTN size reduction: delete trailing instructions after RET if
there is no jump to the rtn part after the RET. Possible modes are:
auto/never/always
-short_name [default 0]
Use the shortest name for the RTN. Names with version substrings are
preferred over the same name without the substring.
-support_jit_api [default 0]
Enables the Jitted Functions Support
-unrestricted_rtn_size [default 0]
Use the unrestricted RTN size. When set the RTN size defined by the
distance between RTN start to the beginning of next RTN.

Statistic switches

-profile [default 0]
print amount of memory dynamically allocated but not yet freed by the
tool
-statistic [default 0]
print general statistics

General switches (available in pin and tool)

-h [default 0]
Print help message (same as -help)
-help [default 0]
Print help message
-ifeellucky [default 0]
skip warning message for unsupported platforms and convert some errors
to warnings
-slow_asserts [default 0]
Perform expensive sanity checks

插桩方式

Pin提供以下几种插桩方式

插桩粒度 API 执行时机
指令级插桩 instruction INS_AddInstrumentFunction 执行一条新指令
轨迹级插桩 trace TRACE_AddInstrumentFunction 执行一个新trace
镜像级插桩 image IMG_AddInstrumentFunction 加载新镜像时
函数级插桩 routine RTN_AddInstrumentFunction 执行一个新函数时
  • 指令级插桩
    • 对于动态生成的代码也能对其动态插桩
  • 轨迹级插桩
    • 相当于基本块级的插桩,会在基本块的入口处调用,若其中执行动态生成了新的基本块(新的轨迹),也能对新的轨迹进行动态插桩
  • 镜像级插桩
    • 依赖符号信息,需要在调用PIN_Init前调用Pin_InitSymbols对程序进行符号分析
  • 函数级插桩
    • 依赖符号信息,需要在调用PIN_Init前调用Pin_InitSymbols对程序进行符号分析

官方示例

在官方的MyPinTool示例中,注册了三个插桩函数,其中该示例的主要功能在**轨迹级插桩**

Trace

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
VOID CountBbl(UINT32 numInstInBbl)
{
bblCount++;
insCount += numInstInBbl;
}

VOID Trace(TRACE trace, VOID *v)
{
// 遍历每一个基本块
for (BBL bbl = TRACE_BblHead(trace); BBL_Valid(bbl); bbl = BBL_Next(bbl))
{
// 在基本块执行之前插入CountBbl()函数,并传递当前基本块的指令个数
BBL_InsertCall(bbl, IPOINT_BEFORE, (AFUNPTR)CountBbl, IARG_UINT32, BBL_NumIns(bbl), IARG_END);
}
}
打赏
  • 版权声明: 本博客所有文章除特别声明外,著作权归作者所有。转载请注明出处!
  • Copyrights © 2021 lzeroyuee
  • 访问人数: | 浏览次数:

请我喝杯咖啡吧~

支付宝
微信