pintool
memory break_inline
sonysame
2018. 10. 17. 16:02
#include "pin.H" #include <iostream> #define PAGE_GUARD 0x100 VOID change_eax(ADDRINT insAddr, CONTEXT *ctx, ADDRINT * memory_protection_constant, ADDRINT * pEAX) { if ((*memory_protection_constant)&PAGE_GUARD) { *pEAX = 0; } } VOID ImageLoad(IMG img, VOID *v) { RTN print_rtn = RTN_FindByName(img, "VirtualProtect"); if (RTN_Valid(print_rtn)) { RTN_Open(print_rtn); RTN_InsertCall(print_rtn, IPOINT_AFTER, (AFUNPTR)change_eax, IARG_ADDRINT, "change_eax", IARG_CONTEXT, IARG_FUNCARG_ENTRYPOINT_REFERENCE, 2, IARG_REG_REFERENCE, REG_EAX, IARG_END); RTN_Close(print_rtn); } } int main(INT32 argc, CHAR *argv[]) { PIN_InitSymbols(); if (PIN_Init(argc, argv)) return -1; IMG_AddInstrumentFunction(ImageLoad, 0); PIN_StartProgram(); return 0; }