/* ===================================================================== */ VOID Instruction(INS ins, VOID *v) { /* if (INS_RegWContain(ins, REG_STACK_PTR)) { if (INS_IsSub(ins)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)StackRegSubBefore, IARG_INST_PTR, IARG_ADDRINT, ins.q(), IARG_REG_VALUE, REG_STACK_PTR, IARG_END); INS_InsertCall(ins, IPOINT_AFTER, (AFUNPTR)StackRegSubAfter, IARG_REG_VALUE, REG_STACK_PTR, IARG_END); } if (INS_Opcode(ins) == XED_ICLASS_ADD) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)StackRegAddBefore, IARG_INST_PTR, IARG_ADDRINT, ins.q(), IARG_REG_VALUE, REG_STACK_PTR, IARG_END); INS_InsertCall(ins, IPOINT_AFTER, (AFUNPTR)StackRegAddAfter, IARG_REG_VALUE, REG_STACK_PTR, IARG_END); } } */ UINT32 memOperands = INS_MemoryOperandCount(ins); // Instrument each memory operand. If the operand is both read and written // it will be processed twice. // Iterating over memory operands ensures that instructions on IA-32 with // two read operands (such as SCAS and CMPS) are correctly handled. for (UINT32 memOp = 0; memOp < memOperands; memOp++) { const UINT32 size = INS_MemoryOperandSize(ins, memOp); // const BOOL single = (size <= 4); if (INS_MemoryOperandIsRead(ins, memOp)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)MemReadBefore, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_ADDRINT, size, IARG_ADDRINT, ins.q(), IARG_REG_VALUE, REG_STACK_PTR, IARG_REG_VALUE, REG_GBP, IARG_BOOL, INS_IsStackRead(ins), IARG_END); } if (INS_MemoryOperandIsWritten(ins, memOp)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)MemWriteBefore, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_ADDRINT, size, IARG_ADDRINT, ins.q(), IARG_REG_VALUE, REG_STACK_PTR, IARG_REG_VALUE, REG_GBP, IARG_BOOL, INS_IsStackWrite(ins), IARG_END); } } }
VOID Instruction(INS ins, VOID * v) { if(INS_IsMemoryWrite(ins)) { INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(CaptureWriteEa), IARG_THREAD_ID, IARG_MEMORYWRITE_EA, IARG_END); if(INS_HasFallThrough(ins)) { INS_InsertPredicatedCall(ins, IPOINT_AFTER, AFUNPTR(EmitWrite), IARG_THREAD_ID, IARG_MEMORYWRITE_SIZE, IARG_END); } if(INS_IsBranchOrCall(ins)) { INS_InsertPredicatedCall(ins, IPOINT_TAKEN_BRANCH, AFUNPTR(EmitWrite), IARG_THREAD_ID, IARG_MEMORYWRITE_SIZE, IARG_END); } } UINT32 memOperands = INS_MemoryOperandCount(ins); int write_operands = 0; for(UINT32 memOp = 0; memOp < memOperands; memOp++) { if(INS_MemoryOperandIsWritten(ins, memOp)) { write_operands++; } } assert(write_operands <= 1); }
// Is called for every instruction and instruments reads and writes VOID Instruction(INS ins, VOID *v) { // Instruments memory accesses using a predicated call, i.e. // the instrumentation is called iff the instruction will actually be executed. // // On the IA-32 and Intel(R) 64 architectures conditional moves and REP // prefixed instructions appear as predicated instructions in Pin. UINT32 memOperands = INS_MemoryOperandCount(ins); // Iterate over each memory operand of the instruction. for (UINT32 memOp = 0; memOp < memOperands; memOp++) { if (INS_MemoryOperandIsRead(ins, memOp)) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)RecordMemRead, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_END); } // Note that in some architectures a single memory operand can be // both read and written (for instance incl (%eax) on IA-32) // In that case we instrument it once for read and once for write. if (INS_MemoryOperandIsWritten(ins, memOp)) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)RecordMemWrite, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_END); } } }
VOID PolymorphicCodeHandlerModule::inspectTrace(TRACE trace){ // set the range of address in which the current trace resides this->trace_head = TRACE_Address(trace); this->trace_tail = trace_head + TRACE_Size(trace); for (BBL bbl = TRACE_BblHead(trace); BBL_Valid(bbl); bbl = BBL_Next(bbl)) { for (INS ins = BBL_InsHead(bbl); INS_Valid(ins); ins = INS_Next(ins)) { // for ech instruction we have to check if it has been overwritten by a previous instruction of the current trace (polimiorfic code detection) INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(checkIfWrittenAddress), IARG_INST_PTR, IARG_CONTEXT, IARG_UINT32, INS_Size(ins), IARG_PTR, this, IARG_END); for (UINT32 op = 0; op<INS_MemoryOperandCount(ins); op++) { if(INS_MemoryOperandIsWritten(ins,op)){ // for each write operation we have to check if the traget address is inside the current trace (attempt to write polimorfic code) INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(polimorficCodeHandler), IARG_INST_PTR, IARG_MEMORYOP_EA, op, IARG_PTR, this, IARG_END); } } } } }
/* Instrumentation of each instruction * that uses a memory operand */ VOID Instruction(INS ins, VOID *v) { trace_enter(); if (!INS_IsStackRead(ins)) { for (UINT32 memopIdx = 0; memopIdx < INS_MemoryOperandCount(ins); memopIdx++) { if (INS_MemoryOperandIsWritten(ins, memopIdx)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR) update_stack_heap_region, IARG_CONST_CONTEXT, IARG_MEMORYOP_EA, memopIdx, IARG_END); UINT32 opIdx = INS_MemoryOperandIndexToOperandIndex(ins, memopIdx); REG base_reg = INS_OperandMemoryBaseReg(ins, opIdx); if (base_reg != REG_INVALID()) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR) check_parameter_out, IARG_REG_VALUE, base_reg, IARG_END); } } } } if (INS_IsCall(ins)) { if (INS_IsDirectCall(ins)) { ADDRINT addr = INS_DirectBranchOrCallTargetAddress(ins); FID fid = fn_lookup_by_address(addr); INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR) fn_call, IARG_CONST_CONTEXT, IARG_UINT32, fid, IARG_END); } else { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR) fn_indirect_call, IARG_CONST_CONTEXT, IARG_BRANCH_TARGET_ADDR, IARG_END); } } if (INS_IsRet(ins)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR) fn_ret, IARG_CONST_CONTEXT, IARG_END); } trace_leave(); }
VOID Instruction(INS ins, VOID *v) { UINT32 memOperands = INS_MemoryOperandCount(ins); for (UINT32 memOp = 0; memOp < memOperands; memOp++) { if (INS_MemoryOperandIsWritten(ins, memOp)) { INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)RecordMemWrite, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_END); } } }
//-------------------------------------------------------------------------- static VOID trace_cb(TRACE trace, VOID *v) { // Visit every basic block in the trace for ( BBL bbl = TRACE_BblHead(trace); BBL_Valid(bbl); bbl = BBL_Next(bbl) ) { for( INS ins = BBL_InsHead(bbl); INS_Valid(ins); ins=INS_Next(ins) ) { ADDRINT ea = INS_Address(ins); if ( !valid_ea(ea) ) continue; if ( was_writen(ea) ) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)check_unpacked_cb, IARG_INST_PTR, IARG_CONST_CONTEXT, IARG_THREAD_ID, IARG_END); } // Instruments memory accesses using a predicated call, i.e. // the instrumentation is called iff the instruction will actually be executed. // // The IA-64 architecture has explicitly predicated instructions. // On the IA-32 and Intel(R) 64 architectures conditional moves and REP // prefixed instructions appear as predicated instructions in Pin. UINT32 mem_operands = INS_MemoryOperandCount(ins); // Iterate over each memory operand of the instruction. for ( UINT32 mem_op = 0; mem_op < mem_operands; mem_op++ ) { // Note that in some architectures a single memory operand can be // both read and written (for instance incl (%eax) on IA-32) // In that case we instrument it once for read and once for write. if ( INS_MemoryOperandIsWritten(ins, mem_op) ) { INS_InsertIfPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)valid_ea, IARG_MEMORYOP_EA, mem_op, IARG_END); INS_InsertThenPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)record_mem_write_cb, IARG_INST_PTR, IARG_MEMORYOP_EA, mem_op, IARG_END); } } } } }
void processMemoryWriteInstruction(INS ins, const char* imageName) { UINT32 memoryOperandCount = INS_MemoryOperandCount(ins); for (UINT32 i = 0; i < memoryOperandCount; ++i) { if (INS_MemoryOperandIsWritten(ins, i) && INS_OperandIsMemory(ins, i)) { INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR) Write, IARG_THREAD_ID, IARG_MEMORYOP_EA, i, IARG_REG_VALUE, REG_STACK_PTR, //pass current stack ptr IARG_PTR, imageName, IARG_INST_PTR, IARG_MEMORYWRITE_SIZE, IARG_CALL_ORDER, CALL_ORDER_FIRST + 30, IARG_END); } } }
static VOID instrument_instruction(INS ins, VOID *v) { UINT32 memops = INS_MemoryOperandCount(ins); for (UINT32 memop = 0; memop < memops; memop++) { if (INS_MemoryOperandIsRead(ins, memop)) { INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)rec_memread, IARG_INST_PTR, IARG_MEMORYOP_EA, memop, IARG_END); } if (INS_MemoryOperandIsWritten(ins, memop)) { INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)rec_memwrite, IARG_INST_PTR, IARG_MEMORYOP_EA, memop, IARG_END); } } }
VOID insInstruction(INS ins, VOID *v) { UINT32 memOperands = INS_MemoryOperandCount(ins); for (UINT32 i = 0; i < memOperands; i++) { if (!INS_MemoryOperandIsWritten(ins, i)) continue; INS_InsertFillBufferPredicated( ins, IPOINT_BEFORE, buf, IARG_INST_PTR, offsetof(struct record, pc), IARG_MEMORYOP_EA, i, offsetof(struct record, ea), IARG_END); } }
VOID Instruction(INS ins, VOID *v) { if (INS_OperandCount(ins) > 1 && INS_MemoryOperandIsRead(ins, 0) && INS_OperandIsReg(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)ReadMem, IARG_ADDRINT, INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_UINT32, INS_OperandCount(ins), IARG_UINT32, INS_OperandReg(ins, 0), IARG_MEMORYOP_EA, 0, IARG_REG_VALUE, REG_STACK_PTR, IARG_END); } else if (INS_OperandCount(ins) > 1 && INS_MemoryOperandIsWritten(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)WriteMem, IARG_ADDRINT, INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_UINT32, INS_OperandCount(ins), IARG_UINT32, INS_OperandReg(ins, 1), IARG_MEMORYOP_EA, 0, IARG_REG_VALUE, REG_STACK_PTR, IARG_END); } else if (INS_OperandCount(ins) > 1 && INS_OperandIsReg(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)spreadRegTaint, IARG_ADDRINT, INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_UINT32, INS_OperandCount(ins), IARG_UINT32, INS_RegR(ins, 0), IARG_UINT32, INS_RegW(ins, 0), IARG_END); } if (INS_OperandCount(ins) > 1 && INS_OperandIsReg(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)followData, IARG_ADDRINT, INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_UINT32, INS_RegR(ins, 0), IARG_END); } }
VOID Instruction(INS ins, VOID *v) { if (INS_MemoryOperandIsRead(ins, 0) && INS_OperandIsReg(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)ReadMem, IARG_ADDRINT, INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_MEMORYOP_EA, 0, IARG_END); } else if (INS_MemoryOperandIsWritten(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)WriteMem, IARG_ADDRINT, INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_MEMORYOP_EA, 0, IARG_END); } }
// Is called for every instruction and instruments reads and writes VOID Instruction(INS ins, VOID *v) { // Instruments memory accesses using a predicated call, i.e. // the instrumentation is called iff the instruction will actually be executed. // // On the IA-32 and Intel(R) 64 architectures conditional moves and REP // prefixed instructions appear as predicated instructions in Pin. UINT32 memOperands = INS_MemoryOperandCount(ins); // Iterate over each memory operand of the instruction. for (UINT32 memOp = 0; memOp < memOperands; memOp++) { /*if (INS_MemoryOperandIsRead(ins, memOp)) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)RecordMemRead, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_END); }*/ // Note that in some architectures a single memory operand can be // both read and written (for instance incl (%eax) on IA-32) // In that case we instrument it once for read and once for write. if (INS_MemoryOperandIsWritten(ins, memOp)) { xed_decoded_inst_t* xedd = INS_XedDec(ins); xed_syntax_enum_t syntax = XED_SYNTAX_INTEL; // XED_SYNTAX_ATT, XED_SYNTAX_XED const UINT32 BUFLEN = 100; //char buffer[BUFLEN]; ADDRINT addr = INS_Address(ins); BOOL ok = xed_format(syntax, xedd, writeInstruction, BUFLEN, static_cast<UINT64>(addr)); if (ok){ } INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)RecordMemWrite, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_END); } } }
VOID Routine(RTN rtn, VOID *v) { std::string name = PIN_UndecorateSymbolName(RTN_Name(rtn).c_str(), UNDECORATION_NAME_ONLY); std::vector<std::string>::iterator it; for (it = userFuncs.begin(); it != userFuncs.end(); ++it) { std::string userFunc = *it; if (name.find(userFunc) == std::string::npos) continue; RTN_Open(rtn); // For each instruction of the routine for (INS ins = RTN_InsHead(rtn); INS_Valid(ins); ins = INS_Next(ins)) { UINT32 memOperands = INS_MemoryOperandCount(ins); // Iterate over each memory operand of the instruction. for (UINT32 memOp = 0; memOp < memOperands; memOp++) { if (INS_IsStackRead(ins) || INS_IsStackWrite(ins)) break; if (INS_MemoryOperandIsRead(ins, memOp)) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)RecordMemRead, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_THREAD_ID, IARG_END); } if (INS_MemoryOperandIsWritten(ins, memOp)) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)RecordMemWrite, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_THREAD_ID, IARG_END); } } } RTN_Close(rtn); } }
VOID CheckMagicValue(INS ins, VOID *v) { UINT32 memOperands = INS_MemoryOperandCount(ins); for (UINT32 memOp = 0; memOp < memOperands; memOp++) { if (INS_MemoryOperandIsRead(ins, memOp)) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)CheckMagicOnRead, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_END ); } if (INS_MemoryOperandIsWritten(ins, memOp)) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)CheckMagicOnWrite, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_END ); } } }
VOID Instruction(INS ins, VOID *v) { if (INS_OperandCount(ins) > 1 && INS_MemoryOperandIsRead(ins, 0) && INS_OperandIsReg(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)ReadMem, IARG_PTR, ins, IARG_MEMORYOP_EA, 0, IARG_END); } else if (INS_OperandCount(ins) > 1 && INS_MemoryOperandIsWritten(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)WriteMem, IARG_PTR, ins, IARG_MEMORYOP_EA, 0, IARG_END); } else if (INS_OperandCount(ins) > 1 && INS_OperandIsReg(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)spreadRegTaint, IARG_PTR, ins, IARG_END); } }
VOID Instruction(INS ins, VOID *v) { PIN_LockClient(); IMG img = IMG_FindByAddress(INS_Address(ins)); PIN_UnlockClient(); if (IMG_Valid(img) && IMG_IsMainExecutable(img)){ if (INS_IsCall(ins)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)PrologueAnalysis, IARG_ADDRINT, INS_Address(ins), IARG_ADDRINT, INS_NextAddress(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_END); } else if (INS_IsRet(ins)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)EpilogueAnalysis, IARG_ADDRINT, INS_Address(ins), IARG_ADDRINT, INS_NextAddress(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_END); } else if (INS_OperandCount(ins) > 1 && INS_MemoryOperandIsWritten(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)WriteMem, IARG_ADDRINT, INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_UINT32, INS_OperandCount(ins), IARG_UINT32, INS_OperandReg(ins, 1), IARG_MEMORYOP_EA, 0, IARG_END); } /* Value Set Analysis */ if (INS_Opcode(ins) == XED_ICLASS_MOV && INS_RegR(ins, 0) == REG_RBP && INS_RegR(ins, 1) == REG_INVALID() && INS_IsMemoryWrite(ins)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)ValueSetAnalysis, IARG_ADDRINT, INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_REG_VALUE, REG_RSP, IARG_REG_VALUE, REG_RBP, IARG_MEMORYOP_EA, 0, IARG_END); } /* Analyzes stack overflow */ if (INS_MemoryOperandIsWritten(ins, 0)){ INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)WriteMemAnalysis, IARG_ADDRINT, INS_Address(ins), IARG_PTR, new string(INS_Disassemble(ins)), IARG_MEMORYOP_EA, 0, IARG_END); } /* Timer Handler - And instruction counter */ INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)timerHandler, IARG_ADDRINT, INS_Address(INS_Prev(ins)), IARG_ADDRINT, INS_Address(ins), IARG_ADDRINT, INS_Address(INS_Next(ins)), IARG_PTR, new string(INS_Disassemble(ins)), IARG_END); } }
void PINshield::avoidEvasion(INS ins){ ADDRINT curEip = INS_Address(ins); ProcInfo *pInfo = ProcInfo::getInstance(); Config *config = Config::getInstance(); FilterHandler *filterHandler = FilterHandler::getInstance(); //Filter instructions inside a known library (only graphic dll) if(filterHandler->isFilteredLibraryInstruction(curEip)){ return; } // Pattern matching in order to avoid the dead path of obsidium if(strcmp( (INS_Disassemble(ins).c_str() ),"xor eax, dword ptr [edx+ecx*8+0x4]") == 0){ MYTEST("Obsidium_evasion"); REGSET regsIn; REGSET_AddAll(regsIn); REGSET regsOut; REGSET_AddAll(regsOut); if(INS_HasFallThrough(ins)){ INS_InsertCall(ins,IPOINT_AFTER,(AFUNPTR)KillObsidiumDeadPath, IARG_PARTIAL_CONTEXT, ®sIn, ®sOut,IARG_END); } } // 1 - single instruction detection if(config->ANTIEVASION_MODE_INS_PATCHING && this->evasionPatcher.patchDispatcher(ins, curEip)){ return; } // 2 - memory read // Checking if there is a read at addresses that the application shouldn't be aware of if(config->ANTIEVASION_MODE_SREAD){ for (UINT32 op = 0; op<INS_MemoryOperandCount(ins); op++) { if (INS_MemoryOperandIsRead(ins,op)) { //if first read initialize the FakeReadHandler if(firstRead == 0){ fakeMemH.initFakeMemory(); firstRead=1; } REG scratchReg = GetScratchReg(op); INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(handleRead), IARG_INST_PTR, IARG_MEMORYOP_EA, op, IARG_PTR, &fakeMemH, IARG_RETURN_REGS, scratchReg, IARG_END); INS_RewriteMemoryOperand(ins, op, scratchReg); } } } //3. memory write filter if(config->ANTIEVASION_MODE_SWRITE){ for (UINT32 op = 0; op<INS_MemoryOperandCount(ins); op++) { if(INS_MemoryOperandIsWritten(ins,op) && INS_IsMov(ins)){ REG writeReg = GetScratchReg(op); INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(handleWrite), IARG_INST_PTR, IARG_MEMORYOP_EA, op, IARG_PTR, &fakeWriteH, IARG_RETURN_REGS, writeReg, // this is an output param IARG_END); INS_RewriteMemoryOperand(ins, op, writeReg); } } } }
VOID Instruction(INS ins, void * v) { UINT32 memOperands = INS_MemoryOperandCount(ins); // Instrument each memory operand. If the operand is both read and written // it will be processed twice. // Iterating over memory operands ensures that instructions on IA-32 with // two read operands (such as SCAS and CMPS) are correctly handled. for (UINT32 memOp = 0; memOp < memOperands; memOp++) { const UINT32 size = INS_MemoryOperandSize(ins, memOp); const BOOL single = (size <= 4); if (INS_MemoryOperandIsRead(ins, memOp)) { if( KnobTrackLoads ) { // map sparse INS addresses to dense IDs const ADDRINT iaddr = INS_Address(ins); const UINT32 instId = profile.Map(iaddr); if( single ) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR) LoadSingle, IARG_MEMORYOP_EA, memOp, IARG_UINT32, instId, IARG_END); } else { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR) LoadMulti, IARG_MEMORYOP_EA, memOp, IARG_UINT32, size, IARG_UINT32, instId, IARG_END); } } else { if( single ) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR) LoadSingleFast, IARG_MEMORYOP_EA, memOp, IARG_END); } else { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR) LoadMultiFast, IARG_MEMORYOP_EA, memOp, IARG_UINT32, size, IARG_END); } } } if (INS_MemoryOperandIsWritten(ins, memOp)) { if( KnobTrackStores ) { const ADDRINT iaddr = INS_Address(ins); const UINT32 instId = profile.Map(iaddr); if( single ) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR) StoreSingle, IARG_MEMORYOP_EA, memOp, IARG_UINT32, instId, IARG_END); } else { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR) StoreMulti, IARG_MEMORYOP_EA,memOp, IARG_UINT32, size, IARG_UINT32, instId, IARG_END); } } else { if( single ) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR) StoreSingleFast, IARG_MEMORYOP_EA, memOp, IARG_END); } else { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR) StoreMultiFast, IARG_MEMORYOP_EA, memOp, IARG_UINT32, size, IARG_END); } } } } }
// This function is called before every instruction is executed VOID instrument_routine(RTN rtn, void *ip) { string name = RTN_Name(rtn); if(name == "ivan") { RTN_Open(rtn); for (INS ins = RTN_InsHead(rtn); INS_Valid(ins); ins = INS_Next(ins)) { int opCount = INS_OperandCount(ins); int opcode = INS_Opcode(ins); if(INS_IsMemoryRead(ins)) { for(int i = 0; i< opCount; i++) { if(INS_MemoryOperandIsRead(ins,i)) { /* INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)RecordMemRead,IARG_PTR,ins, IARG_INST_PTR, IARG_MEMORYOP_EA, i, IARG_END); */ cout<<"opcode:"<<INS_Opcode(ins)<<", mnemonic: "<<INS_Mnemonic(ins)<<endl; if(INS_Opcode(ins)!= XED_ICLASS_RET_NEAR) { REG scratchReg = GetScratchReg(i); INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(GetMemAddress), IARG_MEMORYOP_EA, i, IARG_RETURN_REGS, scratchReg, IARG_END); INS_RewriteMemoryOperand(ins, i, scratchReg); } } } } if(INS_IsMemoryWrite(ins)) { for(int i = 0; i< opCount; i++) { /* if(INS_OperandIsImmediate(ins,i)) { cout<<"immediate "<<INS_OperandImmediate(ins,i)<<endl; } */ if(INS_MemoryOperandIsWritten(ins,i) && INS_HasFallThrough(ins)) { /* INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)RecordMemWrite, IARG_INST_PTR, IARG_MEMORYOP_EA, i, IARG_END); INS_InsertCall( ins, IPOINT_AFTER, (AFUNPTR)RecordMemWrite, IARG_INST_PTR, IARG_MEMORYOP_EA, i, IARG_END); */ if(opcode != XED_ICLASS_PUSH) { REG scratchReg = GetScratchReg(i); INS_InsertCall(ins, IPOINT_BEFORE, AFUNPTR(GetMemAddress), IARG_MEMORYOP_EA, i, IARG_RETURN_REGS, scratchReg, IARG_END); INS_RewriteMemoryOperand(ins, i, scratchReg); } } } } } RTN_Close(rtn); } }
/* Trace instrumentation */ static void TRACE_Instrumentation(TRACE trace, VOID *v) { for (BBL bbl = TRACE_BblHead(trace); BBL_Valid(bbl); bbl = BBL_Next(bbl)) { for (INS ins = BBL_InsHead(bbl); INS_Valid(ins); ins = INS_Next(ins)) { /* Check if the analysis me be unlocked */ tracer::pintool::checkUnlockAnalysis(INS_Address(ins)); if (!tracer::pintool::analysisTrigger.getState()) /* Analysis locked */ continue; if (tracer::pintool::instructionBlacklisted(INS_Address(ins)) == true || tracer::pintool::instructionWhitelisted(INS_Address(ins)) == false) /* Insruction blacklisted */ continue; /* Prepare the Triton's instruction */ triton::arch::Instruction* tritonInst = new triton::arch::Instruction(); /* Save memory read1 informations */ if (INS_IsMemoryRead(ins)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)saveMemoryAccess, IARG_PTR, tritonInst, IARG_MEMORYREAD_EA, IARG_MEMORYREAD_SIZE, IARG_END); } /* Save memory read2 informations */ if (INS_HasMemoryRead2(ins)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)saveMemoryAccess, IARG_PTR, tritonInst, IARG_MEMORYREAD2_EA, IARG_MEMORYREAD_SIZE, IARG_END); } /* Callback before */ INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)callbackBefore, IARG_PTR, tritonInst, IARG_INST_PTR, IARG_UINT32, INS_Size(ins), IARG_CONTEXT, IARG_THREAD_ID, IARG_END); /* Callback after */ /* Syscall after context must be catcher with INSERT_POINT.SYSCALL_EXIT */ if (INS_IsSyscall(ins) == false) { IPOINT where = IPOINT_AFTER; if (INS_HasFallThrough(ins) == false) where = IPOINT_TAKEN_BRANCH; INS_InsertCall(ins, where, (AFUNPTR)callbackAfter, IARG_PTR, tritonInst, IARG_CONTEXT, IARG_THREAD_ID, IARG_END); } /* I/O memory monitoring for snapshot */ if (INS_OperandCount(ins) > 1 && INS_MemoryOperandIsWritten(ins, 0)) { INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)callbackSnapshot, IARG_MEMORYOP_EA, 0, IARG_UINT32, INS_MemoryWriteSize(ins), IARG_END); } } } }
VOID Instruction(INS ins, VOID *v){ /** * INS_InsertCall(INS ins, IPOINT action, AFUNPTR funptr, ...) * * insert a call to 'docount' relative to instruction 'ins' * * ins: instruction to instrument * action: specifies before/after, etc. IPOINT_BEFORE is always valid for all instructions. * funptr: insert a call to funptr. * ...: list of arguments to pass funptr, terminated with IARG_END */ //INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)stat_ins, IARG_END); InsCount ++; //string ins_cat = CATEGORY_StringShort(INS_Category(ins)); int num_ops = INS_OperandCount(ins); //total #operands int memOperands = INS_MemoryOperandCount(ins); //#mem_operands string op_string = ""; //string to record all operands stringstream sstm; //string stream int num_mems = 0; for(int ii=0; ii<num_ops; ii++){ //iterate each operand if(INS_OperandIsImmediate(ins, ii)){ //immediate auto value = INS_OperandImmediate(ins, ii); sstm.str(""); //empty sstm << "$" << value; op_string += " " + sstm.str(); } else if(INS_OperandIsReg(ins, ii)){ //register auto reg = REG_StringShort(INS_OperandReg(ins, ii)); sstm.str(""); sstm << "%" << reg; op_string += " " + sstm.str(); } else if(INS_OperandIsMemory(ins, ii) && memOperands>0){ //memory string mem_type = "memXX"; if(INS_MemoryOperandIsRead(ins, num_mems)) { mem_type = "memR"; } else if(INS_MemoryOperandIsWritten(ins, num_mems)) { mem_type = "memW"; } if(INS_MemoryOperandIsRead(ins, num_mems) && INS_MemoryOperandIsWritten(ins, num_mems)) { mem_type = "memRW"; } ++ num_mems; op_string += " " + mem_type; //true if this operand is a memory reference, //Note: this does not include LEA operands. } else if(INS_OperandIsMemory(ins, ii) && memOperands==0){ //NOP assert(INS_IsNop(ins)); } else { //TRUE if memory operand uses predefined base register and this register can not be changed //Example: movs ds:(esi), es:(edi) There are two fixed operands string other_type = ""; if(INS_OperandIsFixedMemop(ins, ii)) other_type = "FM"; //true if this operand is a displacement (e.g. branch offset) else if(INS_OperandIsBranchDisplacement(ins, ii)) other_type = "BD"; //true if this operand is implied by the opcode (e.g. the stack write in a push instruction) else if(INS_OperandIsImplicit(ins, ii)) other_type = "IM"; else { assert(INS_IsLea(ins)); other_type = "lea"; } op_string += " " + other_type; } } assert(num_mems == memOperands); assert(num_ops <= 6); //record ins INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)record_ins, IARG_THREAD_ID, IARG_UINT32, INS_Opcode(ins), IARG_UINT32, num_ops, IARG_PTR, new string(op_string), IARG_END); if (INS_IsXchg(ins) && INS_OperandReg(ins, 0)==REG_BX && INS_OperandReg(ins, 1)==REG_BX) { //INS_InsertPredictedCall() is used to call analysis functions. //This API function prevents pollution of the memory analysis by calling an analysis function only if a particular //instruction is actualy executed, i.e., only if the instruction is executed. INS_InsertPredicatedCall(ins, IPOINT_BEFORE, (AFUNPTR)handleHook, IARG_THREAD_ID, IARG_REG_VALUE, REG_GAX, #ifdef TARGET_IA32 IARG_REG_VALUE, REG_GDX, #else IARG_REG_VALUE, REG_GBX, #endif IARG_REG_VALUE, REG_GCX, IARG_END); } }
// ------------------------------------------------------------- // Instruction instrumentation function // ------------------------------------------------------------- // Is called for every instruction and instruments reads and writes VOID Instruction(INS ins) { // Instruments memory accesses using a predicated call, i.e. // the instrumentation is called iff the instruction will actually be executed. // // The IA-64 architecture has explicitly predicated instructions. // On the IA-32 and Intel(R) 64 architectures conditional moves and REP // prefixed instructions appear as predicated instructions in Pin. UINT32 memOperands = INS_MemoryOperandCount(ins); // Iterate over each memory operand of the instruction. for (UINT32 memOp = 0; memOp < memOperands; memOp++) { if (INS_MemoryOperandIsRead(ins, memOp)) { #if DEBUG_INS printf("-- Instrumenting read operation at instruction address %X\n", INS_Address(ins)); #endif if (gSetup.memBuf) { // if using memory operations buffering, bypass user-defined callbacks INS_InsertFillBufferPredicated(ins, IPOINT_BEFORE, buf_id, IARG_MEMORYOP_EA, memOp, offsetof(STool_TMemRec, addr), IARG_BOOL, FALSE, offsetof(STool_TMemRec, isWrite), IARG_END); } else if (gSetup.memRead) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)A_MemRead, IARG_FAST_ANALYSIS_CALL, IARG_THREAD_ID, IARG_MEMORYOP_EA, memOp, IARG_END); } } // Note that in some architectures a single memory operand can be // both read and written (for instance incl (%eax) on IA-32) // In that case we instrument it once for read and once for write. if (INS_MemoryOperandIsWritten(ins, memOp)) { #if DEBUG_INS printf("-- Instrumenting write operation at instruction address %X\n", INS_Address(ins)); #endif if (gSetup.memBuf) { // if using memory operations buffering, bypass user-defined callbacks INS_InsertFillBufferPredicated(ins, IPOINT_BEFORE, buf_id, IARG_MEMORYOP_EA, memOp, offsetof(STool_TMemRec, addr), IARG_BOOL, TRUE, offsetof(STool_TMemRec, isWrite), IARG_END); } else if (gSetup.memWrite) { INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)A_MemWrite, IARG_FAST_ANALYSIS_CALL, IARG_THREAD_ID, IARG_MEMORYOP_EA, memOp, IARG_END); } } } }
// Returns a pointer to an IRBuilder object. // It is up to the user to delete it when times come. IRBuilder *createIRBuilder(INS ins) { uint64 address = INS_Address(ins); std::string disas = INS_Disassemble(ins); INT32 opcode = INS_Opcode(ins); IRBuilder *ir = nullptr; switch (opcode) { case XED_ICLASS_ADC: ir = new AdcIRBuilder(address, disas); break; case XED_ICLASS_ADD: ir = new AddIRBuilder(address, disas); break; case XED_ICLASS_AND: ir = new AndIRBuilder(address, disas); break; case XED_ICLASS_ANDNPD: ir = new AndnpdIRBuilder(address, disas); break; case XED_ICLASS_ANDNPS: ir = new AndnpsIRBuilder(address, disas); break; case XED_ICLASS_ANDPD: ir = new AndpdIRBuilder(address, disas); break; case XED_ICLASS_ANDPS: ir = new AndpsIRBuilder(address, disas); break; case XED_ICLASS_BSWAP: ir = new BswapIRBuilder(address, disas); break; case XED_ICLASS_CALL_FAR: case XED_ICLASS_CALL_NEAR: ir = new CallIRBuilder(address, disas); break; case XED_ICLASS_CBW: ir = new CbwIRBuilder(address, disas); break; case XED_ICLASS_CDQE: ir = new CdqeIRBuilder(address, disas); break; case XED_ICLASS_CLC: ir = new ClcIRBuilder(address, disas); break; case XED_ICLASS_CLD: ir = new CldIRBuilder(address, disas); break; case XED_ICLASS_CMC: ir = new CmcIRBuilder(address, disas); break; case XED_ICLASS_CMOVB: ir = new CmovbIRBuilder(address, disas); break; case XED_ICLASS_CMOVBE: ir = new CmovbeIRBuilder(address, disas); break; case XED_ICLASS_CMOVL: ir = new CmovlIRBuilder(address, disas); break; case XED_ICLASS_CMOVLE: ir = new CmovleIRBuilder(address, disas); break; case XED_ICLASS_CMOVNB: ir = new CmovnbIRBuilder(address, disas); break; case XED_ICLASS_CMOVNBE: ir = new CmovnbeIRBuilder(address, disas); break; case XED_ICLASS_CMOVNL: ir = new CmovnlIRBuilder(address, disas); break; case XED_ICLASS_CMOVNLE: ir = new CmovnleIRBuilder(address, disas); break; case XED_ICLASS_CMOVNO: ir = new CmovnoIRBuilder(address, disas); break; case XED_ICLASS_CMOVNP: ir = new CmovnpIRBuilder(address, disas); break; case XED_ICLASS_CMOVNS: ir = new CmovnsIRBuilder(address, disas); break; case XED_ICLASS_CMOVNZ: ir = new CmovnzIRBuilder(address, disas); break; case XED_ICLASS_CMOVO: ir = new CmovoIRBuilder(address, disas); break; case XED_ICLASS_CMOVP: ir = new CmovpIRBuilder(address, disas); break; case XED_ICLASS_CMOVS: ir = new CmovsIRBuilder(address, disas); break; case XED_ICLASS_CMOVZ: ir = new CmovzIRBuilder(address, disas); break; case XED_ICLASS_CMP: ir = new CmpIRBuilder(address, disas); break; case XED_ICLASS_CQO: ir = new CqoIRBuilder(address, disas); break; case XED_ICLASS_CWDE: ir = new CwdeIRBuilder(address, disas); break; case XED_ICLASS_DEC: ir = new DecIRBuilder(address, disas); break; case XED_ICLASS_DIV: ir = new DivIRBuilder(address, disas); break; case XED_ICLASS_IDIV: ir = new IdivIRBuilder(address, disas); break; case XED_ICLASS_IMUL: ir = new ImulIRBuilder(address, disas); break; case XED_ICLASS_INC: ir = new IncIRBuilder(address, disas); break; case XED_ICLASS_JB: ir = new JbIRBuilder(address, disas); break; case XED_ICLASS_JBE: ir = new JbIRBuilder(address, disas); break; case XED_ICLASS_JL: ir = new JlIRBuilder(address, disas); break; case XED_ICLASS_JLE: ir = new JleIRBuilder(address, disas); break; case XED_ICLASS_JMP: ir = new JmpIRBuilder(address, disas); break; case XED_ICLASS_JNB: ir = new JnbIRBuilder(address, disas); break; case XED_ICLASS_JNBE: ir = new JnbeIRBuilder(address, disas); break; case XED_ICLASS_JNL: ir = new JnlIRBuilder(address, disas); break; case XED_ICLASS_JNLE: ir = new JnleIRBuilder(address, disas); break; case XED_ICLASS_JNO: ir = new JnoIRBuilder(address, disas); break; case XED_ICLASS_JNP: ir = new JnpIRBuilder(address, disas); break; case XED_ICLASS_JNS: ir = new JnsIRBuilder(address, disas); break; case XED_ICLASS_JNZ: ir = new JnzIRBuilder(address, disas); break; case XED_ICLASS_JO: ir = new JoIRBuilder(address, disas); break; case XED_ICLASS_JP: ir = new JpIRBuilder(address, disas); break; case XED_ICLASS_JS: ir = new JsIRBuilder(address, disas); break; case XED_ICLASS_JZ: ir = new JzIRBuilder(address, disas); break; case XED_ICLASS_LEA: ir = new LeaIRBuilder(address, disas); break; case XED_ICLASS_LEAVE: ir = new LeaveIRBuilder(address, disas); break; case XED_ICLASS_MOV: ir = new MovIRBuilder(address, disas); break; case XED_ICLASS_MOVAPD: ir = new MovapdIRBuilder(address, disas); break; case XED_ICLASS_MOVAPS: ir = new MovapsIRBuilder(address, disas); break; case XED_ICLASS_MOVDQA: ir = new MovdqaIRBuilder(address, disas); break; case XED_ICLASS_MOVDQU: ir = new MovdquIRBuilder(address, disas); break; case XED_ICLASS_MOVHLPS: ir = new MovhlpsIRBuilder(address, disas); break; case XED_ICLASS_MOVHPD: ir = new MovhpdIRBuilder(address, disas); break; case XED_ICLASS_MOVHPS: ir = new MovhpsIRBuilder(address, disas); break; case XED_ICLASS_MOVLHPS: ir = new MovlhpsIRBuilder(address, disas); break; case XED_ICLASS_MOVLPD: ir = new MovlpdIRBuilder(address, disas); break; case XED_ICLASS_MOVLPS: ir = new MovlpsIRBuilder(address, disas); break; case XED_ICLASS_MOVSX: case XED_ICLASS_MOVSXD: ir = new MovsxIRBuilder(address, disas); break; case XED_ICLASS_MOVZX: ir = new MovzxIRBuilder(address, disas); break; case XED_ICLASS_MUL: ir = new MulIRBuilder(address, disas); break; case XED_ICLASS_NEG: ir = new NegIRBuilder(address, disas); break; case XED_ICLASS_NOT: ir = new NotIRBuilder(address, disas); break; case XED_ICLASS_OR: ir = new OrIRBuilder(address, disas); break; case XED_ICLASS_ORPD: ir = new OrpdIRBuilder(address, disas); break; case XED_ICLASS_ORPS: ir = new OrpsIRBuilder(address, disas); break; case XED_ICLASS_POP: ir = new PopIRBuilder(address, disas); break; case XED_ICLASS_PUSH: ir = new PushIRBuilder(address, disas); break; case XED_ICLASS_RET_FAR: case XED_ICLASS_RET_NEAR: ir = new RetIRBuilder(address, disas); break; case XED_ICLASS_ROL: ir = new RolIRBuilder(address, disas); break; case XED_ICLASS_ROR: ir = new RorIRBuilder(address, disas); break; case XED_ICLASS_SAR: ir = new SarIRBuilder(address, disas); break; case XED_ICLASS_SBB: ir = new SbbIRBuilder(address, disas); break; case XED_ICLASS_SETB: ir = new SetbIRBuilder(address, disas); break; case XED_ICLASS_SETBE: ir = new SetbeIRBuilder(address, disas); break; case XED_ICLASS_SETL: ir = new SetlIRBuilder(address, disas); break; case XED_ICLASS_SETLE: ir = new SetleIRBuilder(address, disas); break; case XED_ICLASS_SETNB: ir = new SetnbIRBuilder(address, disas); break; case XED_ICLASS_SETNBE: ir = new SetnbeIRBuilder(address, disas); break; case XED_ICLASS_SETNL: ir = new SetnlIRBuilder(address, disas); break; case XED_ICLASS_SETNLE: ir = new SetnleIRBuilder(address, disas); break; case XED_ICLASS_SETNO: ir = new SetnoIRBuilder(address, disas); break; case XED_ICLASS_SETNP: ir = new SetnpIRBuilder(address, disas); break; case XED_ICLASS_SETNS: ir = new SetnsIRBuilder(address, disas); break; case XED_ICLASS_SETNZ: ir = new SetnzIRBuilder(address, disas); break; case XED_ICLASS_SETO: ir = new SetoIRBuilder(address, disas); break; case XED_ICLASS_SETP: ir = new SetpIRBuilder(address, disas); break; case XED_ICLASS_SETS: ir = new SetsIRBuilder(address, disas); break; case XED_ICLASS_SETZ: ir = new SetzIRBuilder(address, disas); break; case XED_ICLASS_SHL: // XED_ICLASS_SAL is also a SHL ir = new ShlIRBuilder(address, disas); break; case XED_ICLASS_SHR: ir = new ShrIRBuilder(address, disas); break; case XED_ICLASS_STC: ir = new StcIRBuilder(address, disas); break; case XED_ICLASS_STD: ir = new StdIRBuilder(address, disas); break; case XED_ICLASS_SUB: ir = new SubIRBuilder(address, disas); break; case XED_ICLASS_TEST: ir = new TestIRBuilder(address, disas); break; case XED_ICLASS_XADD: ir = new XaddIRBuilder(address, disas); break; case XED_ICLASS_XCHG: ir = new XchgIRBuilder(address, disas); break; case XED_ICLASS_XOR: ir = new XorIRBuilder(address, disas); break; case XED_ICLASS_XORPD: ir = new XorpdIRBuilder(address, disas); break; case XED_ICLASS_XORPS: ir = new XorpsIRBuilder(address, disas); break; default: ir = new NullIRBuilder(address, disas); break; } // Populate the operands const uint32 n = INS_OperandCount(ins); for (uint32 i = 0; i < n; ++i) { IRBuilderOperand::operand_t type; uint32 size = 0; uint64 val = 0; //Effective address = Displacement + BaseReg + IndexReg * Scale uint64 displacement = 0; uint64 baseReg = ID_INVALID; uint64 indexReg = ID_INVALID; uint64 memoryScale = 0; /* Special case */ if (INS_IsDirectBranchOrCall(ins)){ ir->addOperand(TritonOperand(IRBuilderOperand::IMM, INS_DirectBranchOrCallTargetAddress(ins), 0)); if (INS_MemoryOperandIsWritten(ins, 0)) ir->addOperand(TritonOperand(IRBuilderOperand::MEM_W, 0, INS_MemoryWriteSize(ins))); break; } /* Immediate */ if (INS_OperandIsImmediate(ins, i)) { type = IRBuilderOperand::IMM; val = INS_OperandImmediate(ins, i); } /* Register */ else if (INS_OperandIsReg(ins, i)) { type = IRBuilderOperand::REG; REG reg = INS_OperandReg(ins, i); val = PINConverter::convertDBIReg2TritonReg(reg); // store the register ID. if (REG_valid(reg)) { // check needed because instructions like "xgetbv 0" make // REG_Size crash. size = REG_Size(reg); } } /* Memory */ else if (INS_MemoryOperandCount(ins) > 0) { /* Memory read */ if (INS_MemoryOperandIsRead(ins, 0)) { type = IRBuilderOperand::MEM_R; size = INS_MemoryReadSize(ins); } /* Memory write */ else { type = IRBuilderOperand::MEM_W; size = INS_MemoryWriteSize(ins); } } /* load effective address instruction */ else if (INS_OperandIsAddressGenerator(ins, i)) { REG reg; type = IRBuilderOperand::LEA; displacement = INS_OperandMemoryDisplacement(ins, i); memoryScale = INS_OperandMemoryScale(ins, i); reg = INS_OperandMemoryBaseReg(ins, i); if (REG_valid(reg)) baseReg = PINConverter::convertDBIReg2TritonReg(reg); reg = INS_OperandMemoryIndexReg(ins, i); if (REG_valid(reg)) indexReg = PINConverter::convertDBIReg2TritonReg(reg); } /* Undefined */ else { // std::cout << "[DEBUG] Unknown kind of operand: " << INS_Disassemble(ins) << std::endl; continue; } ir->addOperand(TritonOperand(type, val, size, displacement, baseReg, indexReg, memoryScale)); } // Setup the opcode in the IRbuilder ir->setOpcode(opcode); ir->setOpcodeCategory(INS_Category(ins)); ir->setNextAddress(INS_NextAddress(ins)); return ir; }
// Is called for every instruction and instruments reads and writes VOID Instruction(INS ins, VOID *v) { if(fixed_pim_flag) { fixed_pim_count++; return; } UINT32 memOperands = INS_MemoryOperandCount(ins); if(gen_pim_flag) { if(memOperands != 0) gen_pim_mem_ref++; else gen_pim_comp_ref++; return; } if(memOperands != 0) reg_mem_ref++; else reg_comp_ref++; return; #if 0 UINT32 memOperands = INS_MemoryOperandCount(ins); RTN rtn = INS_Rtn(ins); if ( RTN_Valid(rtn) && fixed_pim_flag) { FixPimCount(); //INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)FixPimCount, IARG_END); // icount++;//++insNoRtnDiscoveredCount; //INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)InsNativeCount, IARG_END); } else if ( RTN_IsDynamic(rtn) && gen_pim_flag) { for (UINT32 memOp = 0; memOp < memOperands; memOp++) { if ((INS_MemoryOperandIsRead(ins, memOp) || INS_MemoryOperandIsWritten(ins, memOp)) ) { /* INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)GenPimMemCount, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_END);*/ GenPimMemCount(); //INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)GenPimMemCount, IARG_END); } else { GenPimCoRef(); //INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)GenPimCoRef, IARG_END); } } } else { for (UINT32 memOp = 0; memOp < memOperands; memOp++) { if (INS_MemoryOperandIsRead(ins, memOp) || INS_MemoryOperandIsWritten(ins, memOp)) { /*INS_InsertPredicatedCall( ins, IPOINT_BEFORE, (AFUNPTR)RegMemRef, IARG_INST_PTR, IARG_MEMORYOP_EA, memOp, IARG_END);*/ RegMemRef(); //INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)RegMemRef, IARG_END); } else { RegCoRef(); // INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)RegCoRef, IARG_END); } } } INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)docount, IARG_END); INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)FixPimCount, IARG_END); INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)GenPimMemCount, IARG_END); INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)GenPimCoRef, IARG_END); INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)RegMemRef, IARG_END); INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)RegCoRef, IARG_END); #endif }
// Pin calls this function every time a new instruction is encountered VOID Instruction(INS ins, VOID *v) { string *disptr = new string(INS_Disassemble(ins)); // reads if (INS_IsMemoryRead(ins)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)readMemoryFunc, IARG_FAST_ANALYSIS_CALL, IARG_MEMORYREAD_EA, IARG_MEMORYREAD_PTR, IARG_THREAD_ID, IARG_PTR, disptr, IARG_INST_PTR, IARG_END); } // writes if (INS_IsMemoryWrite(ins)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)writeMemoryFunc, IARG_FAST_ANALYSIS_CALL, IARG_THREAD_ID, IARG_MEMORYWRITE_EA, IARG_MEMORYWRITE_PTR , IARG_INST_PTR, IARG_PTR, disptr, IARG_END); } UINT32 memOperands = INS_MemoryOperandCount(ins); if (!INS_IsVgather(ins) && memOperands) { // OPs for (UINT32 memOp = 0; memOp < memOperands; memOp++) { if (INS_MemoryOperandIsRead(ins, memOp) || INS_MemoryOperandIsWritten(ins, memOp)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)opMemoryFunc, IARG_FAST_ANALYSIS_CALL, IARG_MEMORYOP_EA, memOp, IARG_MEMORYOP_PTR, memOp, IARG_INST_PTR , IARG_PTR, disptr, IARG_END); } } } // READ2 if (INS_HasMemoryRead2(ins)) { INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)read2MemoryFunc, IARG_FAST_ANALYSIS_CALL, IARG_MEMORYREAD_EA, IARG_MEMORYREAD_PTR, IARG_MEMORYREAD2_EA, IARG_MEMORYREAD2_PTR, IARG_THREAD_ID, IARG_PTR, disptr, IARG_CONTEXT, IARG_INST_PTR, IARG_END); } }