intel-pin

intel Pin: analysis routine detects ah register instead of rsp (REG_STACK_PTR)

孤人 提交于 2019-12-02 02:42:31
I asked this question few days ago. I wanted to get the stack allocation size (after the function creation). The answer suggests to do: if((INS_Opcode(ins) == XED_ICLASS_ADD || INS_Opcode(ins) == XED_ICLASS_SUB) && REG(INS_OperandReg(ins, 0)) == REG_STACK_PTR && INS_OperandIsImmediate(ins, 1) Which in theory is correct and does make sense. But, it doesn't work in practice (correct me if I'm wrong here). It works perfectly fine if I remove REG(INS_OperandReg(ins, 0)) == REG_STACK_PTR check. Why? Because pin doesn't detect the REG_STACK_PTR register when REG(INS_OperandReg(ins, 0)) is used to

Errors compiling pin tool with python includes, getting error C2872: 'UINT32' : ambiguous symbol

拥有回忆 提交于 2019-12-01 11:22:15
I'm trying to compile pin tool with Python.h and am getting more then 100 errors about ambiguous symbols. I tried to separate the include to different namespace but it generated many other errors. Same happens when including windows.h . All the errors looks like: D:\proj\Pin\source\include\pin\gen\types_core.TLH(67): error C2872: 'INT32' : ambiguous symbol could be 'C:\Program Files (x86)\Windows Kits\8.0\Include\shared\basetsd.h(72) : int INT32 or D:\proj\pin\Pin\source\include\pin\gen\types_foundation.TLH(88) : LEVEL_BASE::INT32' D:\proj\pin\Pin\source\include\pin\gen\types_core.TLH(81) :

Detecting an illegal instruction opcode on Intel PIN

房东的猫 提交于 2019-12-01 10:13:22
问题 I am writing a Pin tool where I want to detect an instruction with a particular opcode. I have an executable from a sample C program where I am printing hello world. The architecture used is x86_64 and I have the trace of assembly instructions in the program. I am giving this program's assembly instruction trace to the Intel PIN tool, on which I am running the instruction trace and performing operations. My goal here is to detect a particular opcode from my original program. For example I