https://github.com/wirepair/idapinlogger

Logs instruction hits to a file which can be fed into IDA Pro to highlight which instructions were called.
https://github.com/wirepair/idapinlogger

Last synced: 3 months ago
JSON representation

Logs instruction hits to a file which can be fed into IDA Pro to highlight which instructions were called.

• Host: GitHub
• URL: https://github.com/wirepair/idapinlogger
• Owner: wirepair
• Created: 2013-02-02T06:53:58.000Z (almost 12 years ago)
• Default Branch: master
• Last Pushed: 2013-07-05T05:38:39.000Z (over 11 years ago)
• Last Synced: 2024-02-12T15:21:08.512Z (9 months ago)
• Language: C++
• Size: 189 KB
• Stars: 41
• Watchers: 7
• Forks: 12
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
IDAPinLogger:

================================

Author: @_wirepair / isaac.dawson{}gmail.com.

Keeps a hit count for every instruction executed in a specified module.

If no module is specified, we use the main executable image.

After the program finishes running, we write the buffer of hits out to a file which

then needs to be imported into IDA Pro using dereko's (?) loadlog.py IDAPython script.

I feel this method is a bit more simpiler then his (and I was having problems with

certain executables). But who knows maybe i'm doing something wrong :).

Update: It is now possible to specify when logging should begin/end by giving an offset

to an instruction where, after it is called logging should start. Also by specifying

an end instruction, logging will stop. This makes it much easier to identify code paths

that are taken after a certain point with in the applications life cycle.

How to build:

-------------------------

Copy this project into your pin source directory:

%pin%\source\tools\IDAPinLogger

Open Visual Studio (2008) and build.

How to run:

-------------------------

Log all hits in nc.exe module:

c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -m nc.exe -- nc.exe -l -v -p 999

or (main exe assumed)

c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -- nc.exe -l -v -p 999

Log all hits in supporting module (note case sensitive!):

c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -m KERNEL32.DLL -- nc.exe -l -v -p 999

Only start logging hits after instruction at base+0x991c is hit, stop logging after base+0x4242 is hit:

c:\pin\pin.exe -t C:\pin\IDAPinLogger.dll -s 0x991c -e 0x4242 -- nc.exe -l -v -p 999