Pin is a dynamic binary instrumentation framework for the IA-32 and x86-64 instruction-set architectures that enables the creation of dynamic program analysis tools.
The tools created using Pin, called Pintools, can be used to perform program analysis on user space applications in Linux and Windows. As a dynamic binary instrumentation tool, instrumentation is performed at run time on the compiled binary files. Thus, it requires no recompiling of source code and can support instrumenting programs that dynamically generate code.
Installation and compilation of a project
The below sections explain how to install pin and create a pintool (inscount0) based on the MyPinTool template and the cpp source code from.
Installation, configuration and compilation
- Install Microsoft Visual Studio 2010.
- Get pin (VC10) for Windows and copy all files to C:\pin:
- Open in Visual Studio and expand the Source Files section.
- Edit the file and replace its content with the source code of
- Ensure you set Release as Solution Configuration option:
- Right click on MyPinTool and select Properties
- Go to > and add the following paths:
- Now you should be able to compile your project. Right click on MyPinTool and select Build. The output should be as follows and you should have a file in
------ Build started: Project: MyPinTool, Configuration: Release Win32 ------ MyPinTool.cpp Creating library C:\pin\source\tools\MyPinTool\Release\MyPinTool.lib and object C:\pin\source\tools\MyPinTool\Release\MyPinTool.exp MyPinTool.vcxproj -> C:\pin\source\tools\MyPinTool\Release\MyPinTool.dll ========== Build: 1 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========
Proof of Concept
Now suppose we have an executable that prompts for a password and we know the check is performed letter by letter. We can obviously guess that the number of instructions won't be the same if the probed letter is correct or incorrect. Here is how we can use the dll (renamed to) we have compiled with :
Providing an incorrect letter shows that the number of instructions is:
C:\pin>pin.exe -t inscount0.dll -- \_malware\you_are_very_good_at_this.exe I have evolved since the first challenge. You have not. Bring it. Enter the password> a.......... You are failure C:\pin>more inscount.out Count 32894 C:\pin>pin.exe -t inscount0.dll -- \_malware\you_are_very_good_at_this.exe I have evolved since the first challenge. You have not. Bring it. Enter the password> b.......... You are failure C:\pin>more inscount.out Count 32894
But if the correct letter is provided, the number of instructions is not the same:
C:\pin>pin.exe -t inscount0.dll -- \_malware\you_are_very_good_at_this.exe I have evolved since the first challenge. You have not. Bring it. Enter the password> I.......... You are failure C:\pin>more inscount.out Count 32856
We can obviously automate this technique to brute force the password.
$ wget http://software.intel.com/sites/landingpage/pintool/downloads/pin-3.0-76991-gcc-linux.tar.gz $ tar xzvf pin-3.0-76991-gcc-linux.tar.gz $ cd source/tools/ManualExamples/
To build all examples in a directory:
$ cd source/tools/ManualExamples $ make all
To build and run a specific example (e.g., inscount0):
$ cd source/tools/ManualExamples $ make dir inscount0.test
To build a specific example without running it (e.g., inscount0):
$ cd source/tools/ManualExamples $ make dir obj-intel64/inscount0.so
This applies to the Intel(R) 64 architecture. For the IA-32 architecture, use "obj-ia32" instead of "obj-intel64":
$ cd source/tools/ManualExamples $ make dir obj-ia32/inscount0.so
To compile for a 32bit architecture, use the following instead:
$ make obj-ia32/inscount0.so TARGET=ia32