1

I am using the Intel PIN tool to emulate some new instructions and check the corresponding results. For this purpose I am using illegal opcodes of x86_64 to represent my instructions. For example- opcodes 0x16, 0x17 are illegal in x86_64. which represent my instruction opcodes. I am using a C program to generate an executable and then pass it to the Pintool. A C program I am using is this - 

#include <stdio.h>

int main()
{
    asm(".byte 0x16");
    asm(".byte 0x17");
    return 0;
}

So if we see the instruction trace 0x16 and 0x17 will appear as bad instructions and if we try to run the executable we get -

Illegal instruction (core dumped)

which is expected as 0x16, 0x17 are illegal in x86_64 and hence the executable should not pass. I am using this executable as input to my Pintool, which examines the instruction trace and hence will encounter 0x16 and 0x17 in the trace.

The Pintool I am using is this -

#include "pin.H"
#include <iostream>
#include <fstream>
#include <cstdint>

UINT64 icount = 0;

using namespace std;

KNOB<string> KnobOutputFile(KNOB_MODE_WRITEONCE, "pintool", "o", "test.out","This pin tool simulates ULI");

FILE * op;
//====================================================================
// Analysis Routines
//====================================================================

VOID simulate_ins(VOID *ip, UINT32 size) { 
    fprintf(op,"Wrong instruction encountered here\n");
    // Do something based on the instruction
}

//====================================================================
// Instrumentation Routines
//====================================================================

VOID Instruction(INS ins, void *v) {

    UINT8 opcodeBytes[15];
    UINT64 fetched = PIN_SafeCopy(&opcodeBytes[0],(void *)INS_Address(ins),INS_Size(ins));

    if (fetched != INS_Size(ins))
        fprintf(op,"\nBad\n");

    else {

        if(opcodeBytes[0]==0x16 || opcodeBytes[0]==0x17) {
            INS_InsertCall( ins, IPOINT_BEFORE, (AFUNPTR)simulate_ins, IARG_INST_PTR, IARG_UINT64, INS_Size(ins) , IARG_END);
            INS_Delete(ins);
        }

}

VOID Fini(INT32 code, VOID *v) {
    //Display some end result
}

INT32 Usage() {
    PIN_ERROR("This Pintool failed\n" + KNOB_BASE::StringKnobSummary() + "\n");
    return -1;
}

int main(int argc, char *argv[]) 
{

    op = fopen("test.out", "w");

    if (PIN_Init(argc, argv)) 
        return Usage();

    PIN_InitSymbols();

    PIN_AddInternalExceptionHandler(ExceptionHandler,NULL);
    INS_AddInstrumentFunction(Instruction, 0);
    PIN_AddFiniFunction(Fini, 0);
    PIN_StartProgram();

    return 0;
}

So I am extracting my assembly opcodes and if the first byte is 0x16 or 0x17 I am sending the instruction to my analysis routine and then deleting the instruction. But however when I run this Pintool on the executable I still get the Illegal instruction (core dumped) error and my code fails to run. My understanding is that the Instrumentation routine is called every time a new instruction is encountered in the trace and the analysis routine is called before the instruction is executed. Here I am checking for the opcode and based on the result I am sending the code to the analysis routine and deleting the instruction. I will be simulating my new instruction in the analysis routine so, I just need to delete the old instruction and let the program proceed futher and make sure it dosen't give the illegal instruction error again.

Anywhere I am doing something wrong?

Rohit Poduri
  • 99
  • 2
  • 9
  • I'm having difficulty finding a reference for this, so I can't write an answer, but I'm pretty sure that PIN doesn't support illegal instructions. When I did this in the past, instead of an illegal instruction, I used something like `mov cr0, rax` which is a legal instruction that could never be used in user mode. – prl Oct 08 '17 at 07:29
  • @prl I am not trying to use any illegal instruction here. Pin allows instruction modification so I put a check for an illegal instruction, then delete it and then do whatever i have to do. – Rohit Poduri Oct 08 '17 at 07:55
  • This is the same issue (and solution) as described (and explained) [here](https://stackoverflow.com/questions/46640202/modify-application-instruction-in-pin) – Heyji Oct 12 '17 at 07:37
  • Possible duplicate of [Modify application instruction in PIN](https://stackoverflow.com/questions/46640202/modify-application-instruction-in-pin) – Heyji Oct 12 '17 at 07:44

0 Answers0