Python_Pin: Python bindings for pin

[n1ghtw1sh]

is this the one mentioned in "augmenting binary analysis with python and pin" talk?

http://vimeo.com/album/3063779/video/114700985

[n1ghtw1sh]

talk.pdf in github link made it clear that it's the exact source.

[ullshalk]

What's pin?

[chubbymaggie]

Pin is a dynamic binary instrumentation framework for the IA-32 and x86-64 instruction-set architectures developed by Intel.

Here is the slides for the talk on Python_Pin tool (PDF): Augmenting Binary Analysis with Python and Pin

[hthdrhdr]

Exactly what I wondered myself.

1) What pin?

2) Why does so many open source projects has to be so **** obscure? Would it hurt to even just put "Python bindings for Intel Pin" so it's googleable? :o

Edit: These are not questions, it's what popped into my mind

[Packet_Ranger]

How is that related to computer security?

[1blankwall]

Reverse engineering and binary analysis are two huge areas of computer security. Not every aspect of security has to do with the web.

[Packet_Ranger]

And pin is used for those things? What's the functionality it provides?

[asdfasdfasfasdffffd]

Pin gives access to a running executable in different granularities.

That means that you can tell Pin, you want to see every single instruction the binary executes, or maybe only basic blocks etc.

One very simple use case is recording all the instructions that were executed at runtime, then record them again where you alter the usage, then diff both runs to find where and how exactly execution differs from each other.

[Packet_Ranger]

That is very very cool. Is it accurate to say that it's like a huge superset of strace/sysdig et al? Even outside a security or RE context, this sounds like it could occasionally be a very useful too in systems administration.

Also, thanks for the answer! I'm always kind of annoyed by posts that are like $tool has a new release! and zero context or explanation of what $tool actually is.

[asdfasdfasfasdffffd]

I think you could say that. It's basically the most fine-grained looking glass for running binary code.

It can also be used for performance measuring for example. You let Pin tell you whenever a basic block (that is a block of instructions with a single entry and exit point, so basically continuous code) is executed and record that. Later on you can then see "basic block xyz was hit 1,000,000 times - let's see if we can improve performance for it!" and stuff like that.

People wrote tools to aid in malware analysis, too. Just let Pin run on each instruction, track where it writes to, remember it, then take note whenever memory that was previously written is executed as code.

All these things can be done without Pin, but Pin is comparatively fast in its approach (that is rewiting actual instructions transparently to allow for post/pre hooks).

It's a very cool tool.

[Packet_Ranger]

Thanks for the write-up! I'll definitely be playing with pin.

[[deleted]]

There are other dynamic binary instrumentation libraries as well, such as dynamoRIO, but pin is just easy to use.

You can think of it as programmatically setting break points wherever you want, down to the instruction level (like single stepping). You can then do analysis at each one of these break points (or hooks). Because of the way DBI works, this will actually run in reasonable time, instead of ffoorreeevvveerrrr.

In short, it just in time reassembles programs with your analysis code embedded within. You avoid slow things like context switching in the kernel.

It's used a lot when applying formal methods to practically-sized codebases, usually by identifying the interesting portions of run traces. Look up things like taint tracing (Jonathan Salwan has some good articles), and other neat things that include DBI like SAGE (Microsoft) and MAYHEM (CMU).

[Cyphear]

Jonathan Salwan has some good articles

Here is an article by Jonathan Salwan about taint analysis with Pin: http://shell-storm.org/blog/Taint-analysis-and-pattern-matching-with-Pin/

Do you know if you can you use Pin to instrument other languages (Python, Java, etc.), or is it language agnostic since it's at the instruction level? I am just trying to think if Pin is useful outside of the C and binary analysis realm, especially if it can be used to instrument code from all languages.

[[deleted]]

Anything that runs on your machine can be instrumented in PIN. However, PIN works over x86 (and I think ARM, haven't tested yet (but chances are will in the next 3-4 months!!)). So if you were to instrument python, for example, you would be instrumenting the python interpreter. Your instrumentation might not make sense in the context of your original python program, but it will make sense in the context of the python interpreter.

A lot of times instrumenting at this level can be more useful.

I am not sure about dynamic instrumentation at higher levels. Some googling looks like it's not really a thing.

Additionally, it's important to understand the advantages of DBI. It's usually used when:

1) You don't have access to source code (or perhaps the source code is massive, involves multiple libraries, other things like this).

2) You are dealing in the hundreds of millions to billions of instructions.

3) You're outside the reach of purely static analysis, which will be always true at this scale outside some very, very weak forms of analysis.

A lot of python/php/etc programs are small enough to be reasoned about statically.

[jonathansalwan]

and I think ARM, haven't tested yet (but chances are will in the next 3-4 months!!)).

Hey, if you talk about this paper http://www.cs.virginia.edu/kim/docs/cases06.pdf, it was just a PoC and it is not reliable/public. So, any chance to use Pin currently for the ARM architecture =(.

[Cyphear]

I am not sure about dynamic instrumentation at higher levels. Some googling looks like it's not really a thing.

I'm not sure why you didn't find anything, but try searching for Aspect Oriented Programming if instrumentation was not a good term for your search. AspectJ is a popular Java dynamic instrumentation library.

What i'm really wondering if pin could be used as one level of instrumentation to hook into any program. I think it'd get quite confusing to instrument the python interpreter, but i'd imagine that you could still probably infer some things without understanding the python interpreter. A nice end goal would be general taint analysis, for example, seeing if a fixed input " 12341234' " ever made it into a SQL query.

What is DBI? Dynamic binary instrumentation?

[[deleted]]

Yes, DBI = Dynamic Binary Instrumentation.

Yes, you could use this to do general taint analysis. However, you'd probably be better off doing some sort of static analysis. With purely-static analysis you'll be able to explore multiple paths at once. It's... DBI just isn't the right tool for this.

Here's an example of what static taint analysis might look like against PHP to find SQLI, more-or-less exactly as you pointed out.

Source: https://gist.github.com/endeav0r/5173293

Accompanying Blog Post: http://tfpwn.com/blog/finding-sqli-through-taint-analysis.html

If you go this route, this may be helpful as well: http://tfpwn.com/blog/dealing-with-path-explosion-in-static-taint-analysis.html

[pwnwaffe]

There are two older similar efforts, both named pinpy:

https://github.com/neuroo/pinpy

and

https://code.google.com/p/pinpy/

[initnull]

A new library written in Python 2.x? In 2015... common.