Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/wirepair/idapinlogger
Logs instruction hits to a file which can be fed into IDA Pro to highlight which instructions were called.
https://github.com/wirepair/idapinlogger
Last synced: 3 months ago
JSON representation
Logs instruction hits to a file which can be fed into IDA Pro to highlight which instructions were called.
- Host: GitHub
- URL: https://github.com/wirepair/idapinlogger
- Owner: wirepair
- Created: 2013-02-02T06:53:58.000Z (almost 12 years ago)
- Default Branch: master
- Last Pushed: 2013-07-05T05:38:39.000Z (over 11 years ago)
- Last Synced: 2024-02-12T15:21:08.512Z (9 months ago)
- Language: C++
- Size: 189 KB
- Stars: 41
- Watchers: 7
- Forks: 12
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
IDAPinLogger:
================================Author: @_wirepair / isaac.dawson{}gmail.com.
Keeps a hit count for every instruction executed in a specified module.
If no module is specified, we use the main executable image.
After the program finishes running, we write the buffer of hits out to a file which
then needs to be imported into IDA Pro using dereko's (?) loadlog.py IDAPython script.I feel this method is a bit more simpiler then his (and I was having problems with
certain executables). But who knows maybe i'm doing something wrong :).Update: It is now possible to specify when logging should begin/end by giving an offset
to an instruction where, after it is called logging should start. Also by specifying
an end instruction, logging will stop. This makes it much easier to identify code paths
that are taken after a certain point with in the applications life cycle.How to build:
-------------------------Copy this project into your pin source directory:
%pin%\source\tools\IDAPinLogger
Open Visual Studio (2008) and build.How to run:
-------------------------Log all hits in nc.exe module:
c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -m nc.exe -- nc.exe -l -v -p 999
or (main exe assumed)
c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -- nc.exe -l -v -p 999
Log all hits in supporting module (note case sensitive!):
c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -m KERNEL32.DLL -- nc.exe -l -v -p 999
Only start logging hits after instruction at base+0x991c is hit, stop logging after base+0x4242 is hit:
c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -s 0x991c -e 0x4242 -- nc.exe -l -v -p 999