Python_Pin icon indicating copy to clipboard operation
Python_Pin copied to clipboard

INS_InsertCall for Reads

Open KevinCooper opened this issue 10 years ago • 3 comments

student@ubuntu:~/Desktop/pin_dir/source/tools/Python_Pin$ sudo bash ../../../pin.sh -t obj-intel64/Python_Pin.so -m examples/uaf_finder.py -- /bin/cat ../../../../input.txt

E:INS.cpp:131: Cannot use IARG_MEMORYWRITE_EA for ins without memory write ( 20 0x00007f37d87cba8f mov rax, qword ptr [rip+0x21e3da])

It seems that line 130 in INS.cpp only account for using the INS_InsertCall with a write operation, when the documentation shows that it can be used with reads as well.\

Thanks for all your work.

KevinCooper avatar Jan 19 '15 03:01 KevinCooper

I pushed a commit to fix that little bug. If you check out line 33 in INS.cpp you can see how we check for memory being written and you can add a similar check for memory being read as well and then you can add some things to the dictionary to expose the functionality that your interested in. Im going to close this issue for now but if you have other questions or need an example please feel free to ask.

blankwall avatar Jan 19 '15 03:01 blankwall

I am able to set things like registers being read/write. However, is there some way to expose the ins_object to be included in the python dictionary as well?

INS.cpp:5, so that in the calling function I could run things like

def readMem(everything):
    reg_r = pin.INS_OperandReg(args['ins_obj'], 1);
....
def instr(ins_addr):
   if(pin.INS_MemoryOperandIsRead(ins_addr, 0) and pin.INS_OperandIsReg(ins_addr, 0)):
      pin.INS_InsertCall(pin.IPOINT_BEFORE, ins_addr, readMem)
....
pin.INS_AddInstrumentFunction(instr)

For your situational awareness, I am trying to recreate Taint Anaylsis with PIN in python.

KevinCooper avatar Jan 19 '15 20:01 KevinCooper

Im at work atm but will look into it tonight. @ancat is working on the z3 importing stuff today as well expect updates soon. If we can get that blog post working I think it will be a cool demo showing off some of what python_pin can do.

blankwall avatar Jan 19 '15 20:01 blankwall