Example tools:
Detecting the Loading and Unloading of Images (Image Instrumentation)
Iteration idioms:
// Visit every loaded image for( IMG img= APP_ImgHead(); IMG_Valid(img); img = IMG_Next(img) )
typedef VOID(*) LEVEL_PINCLIENT::IMAGECALLBACK(IMG, VOID *) |
Type of function to be called when an image is loaded
enum LEVEL_CORE::IMG_TYPE |
IMG LEVEL_PINCLIENT::APP_ImgHead | ( | ) |
IMG LEVEL_PINCLIENT::APP_ImgTail | ( | ) |
PIN_CALLBACK LEVEL_PINCLIENT::IMG_AddInstrumentFunction | ( | IMAGECALLBACK | fun, | |
VOID * | v | |||
) |
Use this to register a call back to catch the loading of an image
fun | Instrumentation function for images, it is passed an image and v | |
v | the value of to pass to fun when an image is loaded |
PIN_CALLBACK LEVEL_PINCLIENT::IMG_AddUnloadFunction | ( | IMAGECALLBACK | fun, | |
VOID * | v | |||
) |
Register fun as a call back to be used when an image is unloaded. This is not an instrumentation function--it doesn't make sense to instrument a function when it removed from memory.
fun | passed an image and v when an image is unloaded | |
v | the value to pass to fun when an image is unloaded |
VOID LEVEL_PINCLIENT::IMG_Close | ( | IMG | img | ) |
Close the open image.
[in] | img | The IMG that was previously opened. |
ADDRINT LEVEL_PINCLIENT::IMG_Entry | ( | IMG | img | ) |
IMG LEVEL_PINCLIENT::IMG_FindByAddress | ( | ADDRINT | address | ) |
Find image by address. For each image, check if the address is within the mapped memory region of one of its segments.
IMG LEVEL_PINCLIENT::IMG_FindImgById | ( | UINT32 | id | ) |
Find image by Id
ADDRINT LEVEL_PINCLIENT::IMG_Gp | ( | IMG | img | ) |
ADDRINT LEVEL_PINCLIENT::IMG_HighAddress | ( | IMG | img | ) |
Tells the highest address of any code or data loaded by the image. This is the address of the last byte loaded by the image.
[in] | img | The Pin image handle. |
UINT32 LEVEL_PINCLIENT::IMG_Id | ( | IMG | x | ) |
Returns a unique ID for the image. If an image is unloaded, the ID is not reused for a different image. If an image is unloaded and the same one is loaded back, the ID is different.
IMG LEVEL_PINCLIENT::IMG_Invalid | ( | ) |
BOOL LEVEL_PINCLIENT::IMG_IsMainExecutable | ( | IMG | x | ) |
BOOL LEVEL_PINCLIENT::IMG_IsStaticExecutable | ( | IMG | x | ) |
ADDRINT LEVEL_PINCLIENT::IMG_LoadOffset | ( | IMG | img | ) |
ADDRINT LEVEL_PINCLIENT::IMG_LowAddress | ( | IMG | img | ) |
Tells the lowest address of any code or data loaded by the image.
[in] | img | The Pin image handle. |
const string& LEVEL_PINCLIENT::IMG_Name | ( | IMG | img | ) |
IMG LEVEL_PINCLIENT::IMG_Next | ( | IMG | img | ) |
UINT32 LEVEL_PINCLIENT::IMG_NumRegions | ( | IMG | img | ) |
IMG LEVEL_PINCLIENT::IMG_Open | ( | const string & | filename | ) |
Allows one to open an image and browse it statically. There can only be one image open at a time. File names are encoded in UTF8 (a superset of ASCII), this is supported for Linux (only for locales encoded in UTF8) and Windows.
[in] | filename | The image file name. |
IMG LEVEL_PINCLIENT::IMG_Prev | ( | IMG | img | ) |
ADDRINT LEVEL_PINCLIENT::IMG_RegionHighAddress | ( | IMG | img, | |
UINT32 | n | |||
) |
ADDRINT LEVEL_PINCLIENT::IMG_RegionLowAddress | ( | IMG | img, | |
UINT32 | n | |||
) |
SYM LEVEL_PINCLIENT::IMG_RegsymHead | ( | IMG | img | ) |
SEC LEVEL_PINCLIENT::IMG_SecHead | ( | IMG | img | ) |
SEC LEVEL_PINCLIENT::IMG_SecTail | ( | IMG | img | ) |
USIZE LEVEL_PINCLIENT::IMG_SizeMapped | ( | IMG | img | ) |
Tells the size of the raw image mapped by Pin, including the size of the image's symbolic information, which is not normally mapped by the application. Use this with IMG_StartAddress() to find the entire memory range of the raw image mapped by Pin.
Note, this does not give the address range of the image from the application's perspective. To get that, use IMG_LowAddress() and IMG_HighAddress().
On Linux, the file is mapped in image-load callback or after IMG_Open. In other cases the IMG_SizeMapped returns 0.
[in] | img | The Pin image handle. |
ADDRINT LEVEL_PINCLIENT::IMG_StartAddress | ( | IMG | img | ) |
On Windows, the whole image has been loaded by system loader at once. IMG_StartAddress() gives the pointer to the image, mapped by loader. If you are working inside image-load callback - IMG_LowAddress() and IMG_StartAddress() return the same value.
On Unix, the loader maps only portions of the image file that contain code and data. Additionally, Pin maps the whole image file for parsing. IMG_StartAddress() returns a pointer to the memory mapped file. After return form image-load callback the whole image file is being unmapped and the pointer becomes invalid. The IMG_StartAddress() returns 0.
Note, On Unix, the IMG_LowAddress() and IMG_StartAddress() return different values.
On IMG_Open(), Pin maps the whole image into memory and the pointer is valid until IMG_Close()
[in] | img | The Pin image handle. |
IMG_TYPE LEVEL_PINCLIENT::IMG_Type | ( | IMG | img | ) |
BOOL LEVEL_PINCLIENT::IMG_Valid | ( | IMG | img | ) |