How does pin and pintool control a program?
Pin and the Pintool control a program starting with the very first instruction. For executables compiled with shared libraries this implies that the execution of the dynamic loader and all shared libraries will be visible to the Pintool. When writing tools, it is more important to tune the analysis code than the instrumentation code.
How to detect deadloop in pintool-reverse engineering stack?
Do the same for the pintool. Pintool is in the target process. So attache debugger to it. The debugger should show you where the problem is. Once the area identified, you can open the tool in IDA to do further inspection or “connect” your source to debugger.
Which is the best way to think about pin?
The best way to think about Pin is as a “just in time” (JIT) compiler. The input to this compiler is not bytecode, however, but a regular executable. Pin intercepts the execution of the first instruction of the executable and generates (“compiles”) new code for the straight line code sequence starting at this instruction.
What happens if an instruction is never excuted in pin?
Pin instruments all instructions that are actually excuted. It does not matter in what section they reside. Although there are some exceptions for conditional branches, generally speaking, if an instruction is never executed then it will not be instrumented. Pintools Conceptually, instrumentation consists of two components:
Where does a pin start in a trace?
Pin guarantees that a trace is only entered at the top, but it may contain multiple exits. If a branch joins the middle of a trace, Pin constructs a new trace that begins with the branch target. Pin breaks the trace into basic blocks, BBLs. A BBL is a single entrance, single exit sequence of instructions.
What do you need to know about pin?
Pin allows a tool to insert arbitrary code (written in C or C++) in arbitrary places in the executable. The code is added dynamically while the executable is running. This also makes it possible to attach Pin to an already running process.