Break On x86 Syscalls from Pintool

"Pin is a tool for the instrumentation of programs. It supports the Android*, Linux*, OS X* and Windows* operating systems and executables for the IA-32, Intel(R) 64 and Intel(R) Many Integrated Core architectures. Pin allows a tool to insert arbitrary code (written in C or C++) in arbitrary places in the executable. The code is added dynamically while the executable is running. This also makes it possible to attach Pin to an already running process" (https://software.intel.com/sites/landingpage/pintool/docs/81205/Pin/html/)

Pin has an API - "Pin_ApplicationBreakPoint" that can be used to stop execution in an application debugger as though a breakpoint was hit. This API can be made use to call an application debugger wherever & whenever we wish for it. The most common use case would obviously be to call the debugger at a specific place of interest. For the sake of this blog let us use this API to call the debugger at a specific syscall.

Well there's more easier way to break on a specific syscall under GDB using the "catch syscall <syscall name/number>" etc etc, but this blog is to understand the Pin's API, so let us stick to this easy task :)

The steps would be as follow,

1. During instrumentation find whether a instruction that is to be executed is a syscall
2. If it is a syscall instruction insert a call to get the syscall number and set a global flag
3. Insert another call in the same instruction to see if we need to send a SIGTRAP to GDB if the syscall is of our interest

The below recorded demo video illustrates how Pin is able to instruct GDB to break on a specific syscall number - 120 which belongs to the clone syscall.

The ideal use case for the above API would be during break into the application during complex conditions and during that you might require a full blown debugger to proceed further.

Execute Specific Function in Debugged Program in IDA - Appcall

IDA has a very good feature called Appcall that can help call a specific function from a debugged program. This feature can come in handy in cases where you need to run a bunch of inputs against a specific function in your debugged program. For example, in case of malware decrypting strings using specific functions etc.

For the purpose of exploring the Appcall feature lets consider a trivial example.

#include 

#pragma optimize( "", off )
int add(int a, int b)
{
 return a + b;
}

#pragma optimize( "", off )
int main()
{
 int c;
 std::cout << "About to call the function add\n";
 c = add(1, 2);
 std::cout << "This is the output: " << c;
}

In the above code there's a function called add which takes in couple of parameters, add them and return them. Using Appcall we will call the function add during our debugging session and pass specific inputs and print the output out.

After compiling and loading the executable in IDA we can spot the add function.


The address of the add function is at 0x5A1000 and has the function is sub_5A1000. Now we can debug the program and try to invoke this function using Appcall.



I've put a breakpoint just before the add function gets invoked. Open the Script Command windows to invoke the add function using Appcall.Once done invoke Appcall with the below arguments,

1. The Address to the function
2. The function declaration
3. Arguments to the function

To get the address of the function we can use the LocByName function. The function declaration can be obtained through decompiling the function.

Using the above details we can form a two liner script to execute and print the function's return value using Appcall.

auto ret = Appcall(LocByName("sub_5A1000"), "int sub_5A1000(int a, int b);", 5, 5);
Message("The output is: %d", ret);

Clicking on Run should output the result in the IDA's output window.





References:
https://hex-rays.com/products/ida/support/tutorials/debugging_appcall.pdf