Skip to content

Commit 14756cc

Browse files
wirepairwirepair
committed
IDAPinLogger Push
Pushed all code (pintool + idapython scripts)
1 parent 0f3b0ed commit 14756cc

7 files changed

+826
-0
lines changed

‎IDAPinLogger.cpp

+159
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
/*
2+
IDAPinLogger:
3+
Author: @_wirepair / isaac.dawson{}gmail.com.
4+
Keeps a hit count for every instruction executed in a specified module.
5+
If no module is specified, we use the main executable image.
6+
After the program finishes running, we write the buffer of hits out to a file which
7+
then needs to be imported into IDA Pro using dereko's (?) loadlog.py IDAPython sript.
8+
9+
I feel this method is a bit more simpiler then his (and i was having problems with
10+
certain exectuables). But who knows maybe I'm doing something wrong :).
11+
12+
How to build:
13+
Copy this project into your pin source directory:
14+
%pin%\source\tools\IDAPinLogger
15+
Open Visual Studio (2008) and build or run the makefile.
16+
17+
How to run:
18+
Log all hits in nc.exe module:
19+
c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -m nc.exe -- nc.exe -l -v -p 999
20+
or (main exe assumed)
21+
c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -- nc.exe -l -v -p 999
22+
23+
Log all hits in supporting module (note case sensitive!):
24+
c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -m KERNEL32.DLL -- nc.exe -l -v -p 999
25+
*/
26+
#include "pin.H"
27+
#include <iostream>
28+
#include <fstream>
29+
30+
namespace WINDOWS {
31+
#include "Windows.h"
32+
}
33+
/* ================================================================== */
34+
// Global variables
35+
/* ================================================================== */
36+
37+
std::ostream * out = &cerr;
38+
// Module Info
39+
ADDRINT moduleStart = 0;
40+
ADDRINT moduleEnd = 0;
41+
unsigned int moduleSize = 0;
42+
// Hit Count Variables.
43+
FILE *IDAInsLogFile;
44+
WINDOWS::BYTE *logBuffer;
45+
46+
/* ===================================================================== */
47+
// Command line switches
48+
/* ===================================================================== */
49+
KNOB<string> KnobOutputFile(KNOB_MODE_WRITEONCE, "pintool",
50+
"o", "", "specify file name for IDAPinLogger output");
51+
KNOB<string> KnobModuleToLog(KNOB_MODE_WRITEONCE, "pintool",
52+
"m", "", "specify the module to record instruction visits.");
53+
54+
INT32 Usage()
55+
{
56+
cerr << "This tool writes the number of times an instruction is called to a map file " << endl <<
57+
"that can then be fed into IDA Pro to highlight which instructions were executed." << endl << endl;
58+
cerr << KNOB_BASE::StringKnobSummary() << endl;
59+
return -1;
60+
}
61+
62+
/* ===================================================================== */
63+
// Analysis routines
64+
/* ===================================================================== */
65+
VOID IncrementCount(UINT32 eip)
66+
{
67+
unsigned int idx = eip - moduleStart;
68+
// if we get called more than 255 times, well, stop.
69+
if (logBuffer[idx] >= 255)
70+
{
71+
return;
72+
}
73+
logBuffer[idx] += 1;
74+
}
75+
76+
/* ===================================================================== */
77+
// Instrumentation callbacks
78+
/* ===================================================================== */
79+
VOID ImageLoad(IMG img, VOID *v)
80+
{
81+
std::cerr << "Loading " << IMG_Name(img).c_str() << " Start " << hex << IMG_LowAddress(img) << " End " << IMG_HighAddress(img) << endl;
82+
// if no module passed, just use the main executable
83+
string module = KnobModuleToLog.Value();
84+
if (module.empty() && IMG_IsMainExecutable( img ) )
85+
{
86+
module = IMG_Name(img);
87+
}
88+
// keep in mind this is case sensitive...
89+
if (module.empty() || IMG_Name( img ).rfind( module.c_str() ) == string::npos)
90+
{
91+
return;
92+
}
93+
moduleStart = IMG_LowAddress(img);
94+
moduleEnd = IMG_HighAddress(img);
95+
moduleSize = moduleEnd - moduleStart;
96+
std::cerr << "Module size is: " << moduleSize << endl;
97+
logBuffer = (WINDOWS::BYTE *)calloc(moduleSize,sizeof(WINDOWS::BYTE));
98+
if (logBuffer == NULL)
99+
{
100+
std::cerr << "Unable to allocate enough heapspace, how friggen big is this module?" << endl;
101+
return;
102+
}
103+
std::cerr << "Creating hit count for instructions in module: " << IMG_Name(img).c_str() << endl;
104+
105+
}
106+
107+
VOID Instruction(INS ins, VOID *v)
108+
{
109+
ADDRINT loc = INS_Address(ins);
110+
if (loc >= moduleStart && loc <= moduleEnd)
111+
{
112+
INS_InsertCall(ins,
113+
IPOINT_BEFORE,
114+
(AFUNPTR)IncrementCount,
115+
IARG_INST_PTR,
116+
IARG_END);
117+
}
118+
}
119+
120+
121+
VOID Fini(INT32 code, VOID *v)
122+
{
123+
std::cerr << "Writing instruction hits to disk." << endl;
124+
fwrite(logBuffer, sizeof(WINDOWS::BYTE), moduleSize, IDAInsLogFile);
125+
fflush(IDAInsLogFile);
126+
fclose(IDAInsLogFile);
127+
free(logBuffer);
128+
}
129+
130+
int main(int argc, char *argv[])
131+
{
132+
if( PIN_Init(argc,argv) )
133+
{
134+
return Usage();
135+
}
136+
137+
string fileName = KnobOutputFile.Value();
138+
if (!fileName.empty())
139+
{
140+
IDAInsLogFile = fopen(fileName.c_str(), "wb+");
141+
}
142+
else
143+
{
144+
std::cerr << "Need an outfile file dingus." << endl;
145+
return -1;
146+
}
147+
148+
IMG_AddInstrumentFunction(ImageLoad, 0);
149+
INS_AddInstrumentFunction(Instruction, 0);
150+
PIN_AddFiniFunction(Fini, 0);
151+
// Start the program, never returns
152+
PIN_StartProgram();
153+
154+
return 0;
155+
}
156+
157+
/* ===================================================================== */
158+
/* eof */
159+
/* ===================================================================== */

‎IDAPinLogger.sln

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 10.00
3+
# Visual Studio 2008
4+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "IDAPinLogger", "IDAPinLogger.vcproj", "{639EF517-FCFC-408E-9500-71F0DC0458DB}"
5+
EndProject
6+
Global
7+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
8+
Debug|Win32 = Debug|Win32
9+
Debug|x64 = Debug|x64
10+
Release|Win32 = Release|Win32
11+
Release|x64 = Release|x64
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{639EF517-FCFC-408E-9500-71F0DC0458DB}.Debug|Win32.ActiveCfg = Debug|Win32
15+
{639EF517-FCFC-408E-9500-71F0DC0458DB}.Debug|Win32.Build.0 = Debug|Win32
16+
{639EF517-FCFC-408E-9500-71F0DC0458DB}.Debug|x64.ActiveCfg = Debug|x64
17+
{639EF517-FCFC-408E-9500-71F0DC0458DB}.Debug|x64.Build.0 = Debug|x64
18+
{639EF517-FCFC-408E-9500-71F0DC0458DB}.Release|Win32.ActiveCfg = Release|Win32
19+
{639EF517-FCFC-408E-9500-71F0DC0458DB}.Release|Win32.Build.0 = Release|Win32
20+
{639EF517-FCFC-408E-9500-71F0DC0458DB}.Release|x64.ActiveCfg = Release|x64
21+
{639EF517-FCFC-408E-9500-71F0DC0458DB}.Release|x64.Build.0 = Release|x64
22+
EndGlobalSection
23+
GlobalSection(SolutionProperties) = preSolution
24+
HideSolutionNode = FALSE
25+
EndGlobalSection
26+
EndGlobal

0 commit comments

Comments
 (0)