c++binaryintel-pin

PIN: identify MOV and indirect memory operand


For a program analysis tool, I need to identify all types of MOV operations (Register->Register, Memory->Register, Register->Memory). I was able to identify Memory->Register, but failed for the other ones.

Another problem are indirect memory operands. I need to identify them somehow. I understand that PIN is able to check whether we have a memory read/memory write. But indirect memory accesses are e.g. MOV eax [ebx], aren't they? How can I handle them? I need the content of ebx in this example.

Cheers


Solution

  • Use INS_OperandMemoryBaseReg etc. I hope you are familiar with the complex way in which memory operands can be addressed on x86. If not, read the Intel manuals first or for a quick summary read for example this. You can get the other parts of something like [eax+ebx*2+25] with INS_OperandMemoryIndexReg, INS_OperandMemoryScale, INS_OperandMemoryDisplacement etc.

    The code in movRMHandler() from http://devilheart.googlecode.com/svn-history/r80/trunk/devilheart/project_pin/devilheart/ins_handler.cpp should get you started.