0

I'm trying to learn how to use Intel Pin (Version 3.25) on Windows 11. I am trying to instrument the ETS6 software by the KNX Association. On startup, ETS creates another process by calling CreateProcessW. This child process does all the interesting stuff that I want to track. So according to the Pin documentation, it seems I need to apply the -follow_execv flag to instrument the child.

To test this, I wrote the following pintool called "detect_execv.cpp" and compiled it for x86 architecture (since ETS6 is 32-bit):

#include "pin.H"
#include <iostream>
#include <unistd.h>

FILE* fp;

VOID Finish(INT32 code, VOID* v)
{
    fclose(fp);
}

BOOL FollowChild(CHILD_PROCESS cproc, VOID* user_data)
{
    fprintf(fp, "Before child: %u\n", getpid());
    return TRUE;
}

int main(int argc, char* argv[])
{
    if (PIN_Init(argc, argv))
    {
        printf("PIN_Init failed\n");
        return -1;
    }

    fp = fopen("detect_execv.out", "w");

    PIN_InitSymbols();

    PIN_AddFollowChildProcessFunction(FollowChild, 0);
    PIN_AddFiniFunction(Finish, 0);

    // Never returns
    PIN_StartProgram();

    return 0;
}

If I try to test the pintool using pin -follow_execv -t obj-ia32\detect_execv.dll -- ETS6, it logs a single entry into "detect_execv.out". However, the pintool crashes almost immediately and I get the following error which is logged to "pin.log":

E: [tid:24760] Failure to map DLL C:\pin\pin-3.25-98650-g8f6168173-msvc-windows\source\tools\SimpleExamples\obj-ia32\detect_execv.dll
System error 216 :

If I test the pintool without the -follow_execv flag, then the crash does not happen, but it also does not log anything to "detect_execv.out", which makes me think that the child process was not instrumented.

So, what should I do here if I want to instrument the child process?

Lught
  • 134
  • 6

0 Answers0