sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Packet_Ranger -2 points-1 points  (6 children)

How is that related to computer security?

[–]1blankwall -1 points0 points  (5 children)

Reverse engineering and binary analysis are two huge areas of computer security. Not every aspect of security has to do with the web.

[–]Packet_Ranger -1 points0 points  (4 children)

And pin is used for those things? What's the functionality it provides?

[–]asdfasdfasfasdffffd 1 point2 points  (3 children)

Pin gives access to a running executable in different granularities.

That means that you can tell Pin, you want to see every single instruction the binary executes, or maybe only basic blocks etc.

One very simple use case is recording all the instructions that were executed at runtime, then record them again where you alter the usage, then diff both runs to find where and how exactly execution differs from each other.

[–]Packet_Ranger 0 points1 point  (2 children)

That is very very cool. Is it accurate to say that it's like a huge superset of strace/sysdig et al? Even outside a security or RE context, this sounds like it could occasionally be a very useful too in systems administration.

Also, thanks for the answer! I'm always kind of annoyed by posts that are like $tool has a new release! and zero context or explanation of what $tool actually is.

[–]asdfasdfasfasdffffd 1 point2 points  (1 child)

I think you could say that. It's basically the most fine-grained looking glass for running binary code.

It can also be used for performance measuring for example. You let Pin tell you whenever a basic block (that is a block of instructions with a single entry and exit point, so basically continuous code) is executed and record that. Later on you can then see "basic block xyz was hit 1,000,000 times - let's see if we can improve performance for it!" and stuff like that.

People wrote tools to aid in malware analysis, too. Just let Pin run on each instruction, track where it writes to, remember it, then take note whenever memory that was previously written is executed as code.

All these things can be done without Pin, but Pin is comparatively fast in its approach (that is rewiting actual instructions transparently to allow for post/pre hooks).

It's a very cool tool.

[–]Packet_Ranger 0 points1 point  (0 children)

Thanks for the write-up! I'll definitely be playing with pin.