c++ - 使用 Intel PIN 在寻址模式下使用特定寄存器检测 mov dword ptr [rbp - ...] 指令

Question

我想检测像mov dword ptr [rbp-0x28], 0x7 这样的指令(所以，mov dword ptr [rbp-0xxx], xxx 中的所有指令> format)使用Intel PIN(主要是获取阵列写入信息)。在未优化的代码中，这应该让大部分存储到局部变量。

我能做到:

if (INS_Opcode(ins) == XED_ICLASS_MOV)
   instruction detection;

检测mov指令。但是，除此之外，它还会检测其他指令，例如 mov eax, 0x0。我想用 dword ptr 大小指令检测指令。

我查了pin指令检查API和别针 xed-iclass-enum .使用该文档，我尝试了类似的方法:

if ((INS_Opcode(ins) == XED_ICLASS_MOV) && INS_OperandIsMemory(ins, 0))
    instruction detection;

这给了我想要的结果。但也给了我像 mov esi, eax 这样的指令(我不想要)。

我的代码:

#include <fstream>
#include <iostream>
#include "pin.H"
#include <stack>
#include <unordered_map>
// Additional library calls go here

// Stack allocation

struct Node
{
    int value;
};

std::stack<Node> mainStack;

// Ins object mapping

class Insr
{
private:
    INS insobject;

public:
    Insr(INS insob)
    {
        insobject = insob;
    }
    INS get_insobject()
    {
        return insobject;
    }
};

static std::unordered_map<ADDRINT, Insr*> insstack;

// Output file object
ofstream OutFile;

//static uint64_t counter = 0;

std::string rtin = "";
// Make this lock if you want to print from _start
uint32_t key = 0;

void printmaindisas(uint64_t addr, std::string disassins)
{
    std::stringstream tempstream;
    tempstream << std::hex << addr;
    std::string address = tempstream.str();
    // if (addr > 0x700000000000)
    //  return;
    if (addr > 0x700000000000)
        return;
    if (!key)
        return;
    // if (insstack[addr]->get_opcode() == XED_ICLASS_ADD || insstack[addr]->get_opcode()
    //      == XED_ICLASS_SUB)
    INS ins = insstack[addr]->get_insobject();
    if((INS_Opcode(ins) == XED_ICLASS_ADD || INS_Opcode(ins) == XED_ICLASS_SUB)
            &&(INS_OperandIsImmediate(ins, 1)))
    {
      int value = INS_OperandImmediate(ins, 1);
        std::cout << "value: " << value << '\n';
        Node node{value};
        mainStack.push(node);
        std::cout << "stack top: " << mainStack.top().value << '\n';
    }
    if ((INS_Opcode(ins) == XED_ICLASS_MOV) && INS_OperandIsMemory(ins, 0))
    {
            std::cout << "yes!" << '\n';
    }


    std::cout<<address<<"\t"<<disassins<<std::endl;
}

void mutex_lock()
{
key = 0;
std::cout<<"out\n";
}
void mutex_unlock()
{
    key = 1;
    std::cout<<"in\n";
}

void Instruction(INS ins, VOID *v)
{

    insstack.insert(std::make_pair(INS_Address(ins), new Insr(ins)));
    INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)printmaindisas, IARG_ADDRINT, INS_Address(ins),
    IARG_PTR, new string(INS_Disassemble(ins)), IARG_END);
}

void Routine(RTN rtn, VOID *V)
{
    if (RTN_Name(rtn) == "main")
    {
        //std::cout<<"Loading: "<<RTN_Name(rtn) << endl;
        RTN_Open(rtn);
        RTN_InsertCall(rtn, IPOINT_BEFORE, (AFUNPTR)mutex_unlock, IARG_END);
        RTN_InsertCall(rtn, IPOINT_AFTER, (AFUNPTR)mutex_lock, IARG_END);
        RTN_Close(rtn);
    }
}

KNOB<string> KnobOutputFile(KNOB_MODE_WRITEONCE, "pintool", "o", "mytool.out", "specify output file name");
/*
VOID Fini(INT32 code, VOID *v)
{
    // Write to a file since cout and cerr maybe closed by the application
    OutFile.setf(ios::showbase);
    OutFile << "Count " << count << endl;
    OutFile.close();
}
*/

int32_t Usage()
{
  cerr << "This is my custom tool" << endl;
  cerr << endl << KNOB_BASE::StringKnobSummary() << endl;
  return -1;
}

int main(int argc, char * argv[])
{
  // It must be called for image instrumentation
  // Initialize the symbol table
  PIN_InitSymbols();
  // Initialize pin
    // PIN_Init must be called before PIN_StartProgram
    // as mentioned in the documentation
  if (PIN_Init(argc, argv)) return Usage();

  // Open the output file to write
  OutFile.open(KnobOutputFile.Value().c_str());

  // Set instruction format as intel
    // Not needed because my machine is intel
  PIN_SetSyntaxIntel();

  RTN_AddInstrumentFunction(Routine, 0);

  // Add an isntruction instrumentation
  INS_AddInstrumentFunction(Instruction, 0);


  //PIN_AddFiniFunction(Fini, 0);

  // Start the program here
  PIN_StartProgram();

  return 0;

}

我得到的输出:

in
40051e  push rbp
value: -128
stack top: -128
40051f  mov rbp, rsp
400522  add rsp, 0xffffffffffffff80
yes!
400526  mov dword ptr [rbp-0x28], 0x7
yes!
40052d  mov dword ptr [rbp-0x64], 0x9
400534  mov eax, 0x0
400539  call 0x4004e6
4004e6  push rbp
value: 64
stack top: 64
4004e7  mov rbp, rsp
4004ea  sub rsp, 0x40
yes!
4004ee  mov dword ptr [rbp-0xc], 0x4
4004f5  lea rax, ptr [rbp-0xc]
yes!
4004f9  mov qword ptr [rbp-0x8], rax
4004fd  mov rax, qword ptr [rbp-0x8]
400501  mov eax, dword ptr [rax]
yes!
400503  mov esi, eax
400505  mov edi, 0x4005d0
40050a  mov eax, 0x0
40050f  call 0x4003f0
4003f0  jmp qword ptr [rip+0x200c22]
4003f6  push 0x0
4003fb  jmp 0x4003e0
4003e0  push qword ptr [rip+0x200c22]
4003e6  jmp qword ptr [rip+0x200c24]
4
yes!
400514  mov dword ptr [rbp-0x3c], 0x3
40051b  nop
40051c  leave 
40051d  ret 
40053e  mov eax, 0x0
400543  leave 
out

这样做是否正确(没有任何误报)？

Answer 1

如果您想接受以下所有说明:

mov [rbp + disp], reg/imm
mov [rbp*scale + disp], reg/imm
mov [reg + rbp*scale], reg/imm
mov [rbp + reg*scale + disp], reg/imm

那么您需要执行以下检查:

if (INS_Opcode(ins) == XED_ICLASS_MOV &&              // Check that the instruction is MOV.
    INS_OperandIsMemory(ins, 0) &&                    // Check that the destination operand is a memory operand.
    INS_OperandWidth(ins, 0) == 32 &&                 // Check that the size of the operand is 32 bits.
    (INS_OperandMemoryBaseReg(ins, 0) == REG_EBP || 
     INS_OperandMemoryIndexReg(ins, 0) == REG_EBP))  // Check that the base or index register is RBP.
{
    ...
}

请注意，这些检查接受带位移(包括零位移)的 MOV 指令和不带位移的 MOV 指令(在语义上等同于零位移，但编码不同)。

我假设您希望接受 RBP 作为基址寄存器或索引寄存器(可能具有大于 1 的比例)。请注意，在 RBP 用作基址寄存器的情况下，指令的编码将始终包含位移。请参阅:Why are rbp and rsp called general purpose registers? .

如果您想接受以下所有使用 RBP 作为基址寄存器的指令:

mov [rbp + disp], reg/imm
mov [rbp + reg*scale + disp], reg/imm

那么您需要执行以下检查:

if (INS_Opcode(ins) == XED_ICLASS_MOV &&              // Check that the instruction is MOV.
    INS_OperandIsMemory(ins, 0) &&                    // Check that the destination operand is a memory operand.
    INS_OperandWidth(ins, 0) == 32 &&                 // Check that the size of the operand is 32 bits.
    INS_OperandMemoryBaseReg(ins, 0) == REG_EBP)      // Check that the base is RBP.
{
    ...
}

如果您只想接受以下指令:

mov [rbp + disp], reg/imm

那么您需要执行以下检查:

if (INS_Opcode(ins) == XED_ICLASS_MOV &&                 // Check that the instruction is MOV.
    INS_OperandIsMemory(ins, 0) &&                       // Check that the destination operand is a memory operand.
    INS_OperandWidth(ins, 0) == 32 &&                    // Check that the size of the operand is 32 bits.
    INS_OperandMemoryBaseReg(ins, 0) == REG_EBP &&       // Check that the base is RBP.
    INS_OperandMemoryIndexReg(ins, 0) == REG_INVALID())  // Check that there is no index register.
{
    ...
}

如果要检查位移是否为负数，请使用以下检查:

INS_OperandMemoryDisplacement(ins, 0) < 0

请注意，INS_OperandMemoryDisplacement 不区分没有位移的内存操作数和位移为零的内存操作数。如果没有位移，它只返回零。如果要确定指令编码是否实际包含位移字段，则应改用 XED API。