Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

.NET framework build exe file #4

Open
gjxo12 opened this issue Jul 12, 2020 · 4 comments
Open

.NET framework build exe file #4

gjxo12 opened this issue Jul 12, 2020 · 4 comments

Comments

@gjxo12
Copy link

gjxo12 commented Jul 12, 2020

Hi, I tried to this project
and make exe file, Visual studio 2015 with .NET framework 4.5.2 Build Realese x64 and x86

allowedly, I set C:pin, source\tools\tiny-tracer and so on, using your youtube tutorial.

but my exe file result is empty. here is example

image

output,out file is empty.

and I tried other project exe file, Visual studio project 2015 build with C++ win32 project Relases x64 and x86
the Result is good. I get output.out with API Called.

is this any issue using .NET framework exe file or any Requirement using this project?

and Thank you for using your good project.

@hasherezade
Copy link
Owner

Hi! Indeed, this tool is dedicated to trace native modules only, and doesn't work for .NET executables. You can trace some DLLs within the .NET managed process though.

@gjxo12
Copy link
Author

gjxo12 commented Jul 14, 2020

Oh, I got it! Thank you for your rapid response.

if you don't mind, close this issue.

Have a nice day!

@AndyWatterman
Copy link

AndyWatterman commented Jul 6, 2021

Hello! It might be an interesting idea to analyze .NET malwares with PIN.
I've just find out that PIN tool supports managed platforms. It seems you could specify the option "-support_jit_api", which will help trace only JITted code. Later you could filter such code like:

VOID Instruction(INS ins, VOID *v)
{
    RTN rtn = INS_Rtn(ins);
    if (!RTN_Valid(rtn))
    {
        INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)InsNoRtnCount, IARG_END);
    }
}

So, as the result your tool will log only necessary code. This is in theory :-)
In practice, I could not make it works.

@hasherezade
Copy link
Owner

@crowman2 - thank you for the heads-up, I will check it and maybe add the support in the future

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants