How to find RTN by name in pintool?

Question

I use RTN_FindByName() to search for a specific RTN, but it didn't work with me, moreover i try to force the compiler to not inline the RTN, but still not working,
test code:

void __attribute__ ((noinline)) MyFunInApp() 
{
  printf(" function inside application environmental \n");
}

code in pintool:

VOID ImageLoad(IMG img, VOID *v)
 {
   RTN MyRtn = RTN_FindByName(img,"MyFunInApp");
   if (RTN_Valid(MyRtn))
    {
      cout<< "Found RTN"<< endl;
    }
    else
    {
      cout<< "Not Found RTN"<< endl;
    }
}

How can i fix that, or do that by another way ?

Compiler: gcc version 4.8
C++ Language
O.S : Ubuntu 14.04 LTS, 64-bit
Output (of test code) :
Not Found RTN
Not Found RTN
Not Found RTN

You need to provide more details. What compiler are you using? Which operating system? Include the full output of your program. — nitzanms, Aug 09 '15 at 19:59
@nitzanms , Yes, and i test it, and i test the function name by ( objdump ) , and i foud the compiler add some characters to my function name !!! ( _Z10MyFunInAppv ), so i think i should search function name by another way, is that ok? — Mos Moh, Aug 11 '15 at 12:43

nitzanms · Accepted Answer · 2016-01-07T16:15:50.503

2

What you're seeing (the function name wrapped with characters) is called function name decoration/mangling. It's the way that C++ implements overloading natively. Unfortunately mangling isn't standardized and every compiler does it differently.

You can either look for the mangled name, or alternatively iterate over the rtns in an image (you can see samples in the kit on how to do this) and use Pin's PIN_UndecorateSymbolName API to get the clean function name. Just remember that due to mangling you may get more than one such symbol.

edited Jan 07 '16 at 16:15

answered Aug 11 '15 at 13:08

nitzanms

1,786
12
35

Thanks, i got it, but why in the output (of test code) ( Not Found RTN ) repeated three times, is it normal ? – Mos Moh Aug 11 '15 at 13:36
Note that you run this code for every image load. Usually there will be several images loaded with the application, for example, the C runtime. – nitzanms Aug 11 '15 at 13:50
BTW if you found my answer solved your problem, consider accepting it - this will give you a reputation boost as well, which is always nice. Look for the gray "V" on the left. – nitzanms Aug 11 '15 at 13:51
1

Thanks, this is the first time i know it, ( about accepting the answer ), thank you again. – Mos Moh Aug 11 '15 at 15:39

How to find RTN by name in pintool?

1 Answers1