static VOID ImageLoad(IMG img, VOID *v) { static UINT32 mallocCount = 0; PROTO protoMalloc = PROTO_Allocate(PIN_PARG(void *), CALLINGSTD_DEFAULT, "malloc", PIN_PARG(size_t), PIN_PARG_END()); RTN rtnMalloc = RTN_FindByName(img, "malloc"); if (RTN_Valid(rtnMalloc)) { TraceFile << "probing malloc #" << mallocCount << " in " << IMG_Name(img) << std::endl; RTN_ReplaceSignatureProbed(rtnMalloc, AFUNPTR(MallocProbe), IARG_PROTOTYPE, protoMalloc, IARG_ORIG_FUNCPTR, IARG_UINT32, static_cast<UINT32>(mallocCount), IARG_FUNCARG_ENTRYPOINT_VALUE, 0, #if defined(TARGET_IPF) IARG_REG_VALUE, REG_TP, #else IARG_ADDRINT, static_cast<ADDRINT>(0), #endif IARG_END); mallocCount++; } PROTO_Free(protoMalloc); static UINT32 freeCount = 0; PROTO protoFree = PROTO_Allocate(PIN_PARG(void), CALLINGSTD_DEFAULT, "free", PIN_PARG(void *), PIN_PARG_END()); RTN freeRtn = RTN_FindByName(img, "free"); if (RTN_Valid(freeRtn)) { TraceFile << "probing free #" << freeCount << " in " << IMG_Name(img) << std::endl; RTN_ReplaceSignatureProbed(freeRtn, AFUNPTR(FreeProbe), IARG_PROTOTYPE, protoFree, IARG_ORIG_FUNCPTR, IARG_UINT32, static_cast<UINT32>(freeCount), IARG_FUNCARG_ENTRYPOINT_VALUE, 0, #if defined(TARGET_IPF) IARG_REG_VALUE, REG_TP, #else IARG_ADDRINT, static_cast<ADDRINT>(0), #endif IARG_END); freeCount++; } PROTO_Free(protoFree); }
static VOID on_module_loading(IMG img, VOID *data) { if (IMG_IsMainExecutable(img)) { RTN routine = RTN_FindByName(img, "foo1"); if (RTN_Valid(routine) && RTN_IsSafeForProbedReplacement(routine)) { PROTO foo1_proto = PROTO_Allocate( PIN_PARG(void), CALLINGSTD_DEFAULT, "foo1", PIN_PARG_END() ); AFUNPTR foo1_ptr = RTN_ReplaceSignatureProbed(routine, (AFUNPTR)foo1_rep, IARG_PROTOTYPE, foo1_proto, IARG_ORIG_FUNCPTR, IARG_END); ASSERTX(foo1_ptr != 0); } routine = RTN_FindByName(img, "foo2"); if (RTN_Valid(routine) && RTN_IsSafeForProbedInsertion(routine)) { PROTO foo2_proto = PROTO_Allocate( PIN_PARG(void), CALLINGSTD_DEFAULT, "foo2", PIN_PARG_END() ); RTN_InsertCallProbed(routine, IPOINT_BEFORE, AFUNPTR( foo2_before ), IARG_PROTOTYPE, foo2_proto, IARG_END); RTN_InsertCallProbed(routine, IPOINT_AFTER, AFUNPTR( foo2_after ), IARG_PROTOTYPE, foo2_proto, IARG_END); }
inline static AFUNPTR execute (const Routine & rtn, const Prototype & prototype, CALLINGSTD_TYPE callstd_type) { return RTN_ReplaceSignatureProbed (rtn, AFUNPTR (REPLACEMENT::execute), IARG_PROTOTYPE, (PROTO)prototype, IARG_END); }
void DoReplacementFunc( IMG img, char * funcName) { RTN rtnToReplace; printf ("Image %s\n", IMG_Name(img).c_str()); for (SEC sec = IMG_SecHead(img); SEC_Valid(sec); sec = SEC_Next(sec)) { for (RTN rtn = SEC_RtnHead(sec); RTN_Valid(rtn); rtn = RTN_Next(rtn)) { printf (" Rtn: %s %s\n", RTN_Name(rtn).c_str(), funcName); if (strstr( RTN_Name(rtn).c_str(), funcName)) { //printf (" found\n"); foundFunc = true; rtnToReplace = rtn; break; } } if (foundFunc) { break; } } if (!foundFunc) { return; } printf ( "Found %s %x\n", funcName, RTN_Address(rtnToReplace)); // commented out so that absence of pdb file will not cause failure if (RTN_IsSafeForProbedReplacement(rtnToReplace)) { printf ( "RTN_ReplaceSignatureProbed on %s\n", funcName); foundFunc = true; PROTO protoOfStdCallFunction1ToBeReplacedByPin = PROTO_Allocate( PIN_PARG(void *), CALLINGSTD_STDCALL, "protoOfStdCallFunction1ToBeReplacedByPin", PIN_PARG(char), PIN_PARG(int), PIN_PARG(char), PIN_PARG(int), PIN_PARG_END() ); RTN_ReplaceSignatureProbed(rtnToReplace, AFUNPTR(ReplacementFunc), IARG_PROTOTYPE, protoOfStdCallFunction1ToBeReplacedByPin, IARG_ORIG_FUNCPTR, IARG_FUNCARG_ENTRYPOINT_VALUE, 0, IARG_FUNCARG_ENTRYPOINT_VALUE, 1, IARG_FUNCARG_ENTRYPOINT_VALUE, 2, IARG_FUNCARG_ENTRYPOINT_VALUE, 3, IARG_END); PROTO_Free( protoOfStdCallFunction1ToBeReplacedByPin ); } }
static VOID on_module_loading(IMG img, VOID *data) { RTN routine = RTN_FindByName(img, "pthread_exit"); if (RTN_Valid(routine)) { PROTO pte_proto = PROTO_Allocate( PIN_PARG(int), CALLINGSTD_DEFAULT, "pthread_exit", PIN_PARG(void *), PIN_PARG_END() ); AFUNPTR orig_pte = RTN_ReplaceSignatureProbed(routine, (AFUNPTR)pthread_exit_rep, IARG_PROTOTYPE, pte_proto, IARG_ORIG_FUNCPTR, IARG_FUNCARG_ENTRYPOINT_VALUE, 0, IARG_END); ASSERTX(orig_pte != 0); } }
/* ===================================================================== */ VOID ImageLoad(IMG img, VOID *v) { if (!IMG_IsMainExecutable(img)) { return; } const char * name = "check_sp_value"; RTN rtn = RTN_FindByName(img, name); if (RTN_Valid(rtn)) { PROTO proto = PROTO_Allocate(PIN_PARG(int), CALLINGSTD_DEFAULT, name, PIN_PARG(void*), PIN_PARG_END() ); if ( ! PIN_IsProbeMode() ) { RTN_ReplaceSignature( rtn, AFUNPTR(check_sp_value), IARG_PROTOTYPE, proto, IARG_FUNCARG_ENTRYPOINT_VALUE, 0, IARG_REG_VALUE, REG_STACK_PTR, IARG_REG_VALUE, REG_ESP, IARG_REG_VALUE, REG_SP, IARG_END); } else if (RTN_IsSafeForProbedReplacement(rtn)) { RTN_ReplaceSignatureProbed( rtn, AFUNPTR(check_sp_value), IARG_PROTOTYPE, proto, IARG_FUNCARG_ENTRYPOINT_VALUE, 0, IARG_REG_VALUE, REG_STACK_PTR, IARG_REG_VALUE, REG_ESP, IARG_REG_VALUE, REG_SP, IARG_END); } PROTO_Free( proto); } }
void InsertProbe( IMG img, char * funcName) { /* printf ("Image %s\n", IMG_Name(img).c_str()); for (SEC sec = IMG_SecHead(img); SEC_Valid(sec); sec = SEC_Next(sec)) { for (RTN rtn = SEC_RtnHead(sec); RTN_Valid(rtn); rtn = RTN_Next(rtn)) { printf (" Rtn: %s %s\n", RTN_Name(rtn).c_str(), funcName); if (strstr( RTN_Name(rtn).c_str(), funcName)) { printf (" found\n"); } } } */ RTN allocRtn = RTN_FindByName(img, funcName); if (RTN_Valid(allocRtn) && RTN_IsSafeForProbedReplacement(allocRtn)) { fprintf (fp, "RTN_ReplaceSignatureProbed on %s\n", funcName); PROTO protoHeapAlloc = PROTO_Allocate( PIN_PARG(void *), CALLINGSTD_STDCALL, "protoHeapAlloc", PIN_PARG(WINDOWS::HANDLE), PIN_PARG(WINDOWS::DWORD),PIN_PARG(WINDOWS::DWORD), PIN_PARG_END() ); RTN_ReplaceSignatureProbed(allocRtn, AFUNPTR(ReplacementFunc), IARG_PROTOTYPE, protoHeapAlloc, IARG_ORIG_FUNCPTR, IARG_FUNCARG_ENTRYPOINT_VALUE, 0, IARG_FUNCARG_ENTRYPOINT_VALUE, 1, IARG_FUNCARG_ENTRYPOINT_VALUE, 2, IARG_CONTEXT, IARG_RETURN_IP, IARG_END); PROTO_Free( protoHeapAlloc ); }
static VOID on_module_loading(IMG img, VOID *data) { if (IMG_IsMainExecutable(img)) { RTN routine = RTN_FindByName(img, "foo"); if (!RTN_Valid(routine)) { routine = RTN_FindByName(img, "_foo"); } if (RTN_Valid(routine)) { PROTO foo_proto = PROTO_Allocate( PIN_PARG(int), CALLINGSTD_DEFAULT, "foo", PIN_PARG_END() ); AFUNPTR foo_ptr = RTN_ReplaceSignatureProbed(routine, (AFUNPTR)foo_rep, IARG_PROTOTYPE, foo_proto, IARG_ORIG_FUNCPTR, IARG_RETURN_IP, IARG_END); ASSERTX(foo_ptr != 0); } } }