Pin (computer program): Difference between revisions

Revision as of 11:48, 30 March 2015

Revision as of 03:20, 27 April 2015

Line 9:

| website = [http://www.intel.com/software/pintool www.intel.com/software/pintool]

}}

'''Pin''' is a platform for creating analysis tools. A pin tool comprises instrumentation, analysis and callback [[Subroutine|routines]]. Instrumentation routines are called when code that has not yet been recompiled is about to be run, and enable the insertion of analysis routines. Analysis routines are called when the code they are associated with it is runran. Callback routines are only called when specific conditions are met, or when a certain event has occurred. Pin provides an extensive [[application programming interface]] (API) for instrumentation at manydifferent abstraction levels, from one instruction to an entire binary module. It also supports callbacks for many events such as library loads, system calls, signals/exceptions and thread creation events.

Pin performs instrumentation by taking control of the program just after it loads into the memory. It thenThen [[Just-in-time compilation|just-in-time recompiles]] (JIT) small sections of the binary code using pin just before theyit areis runran. New instructions, whichto perform the analysis, are added to the recompiled code. These new instructions come from the Pintool. A large array of optimization techniques are used to obtain the lowest possible running time and memory use overhead. As of June 2010, Pin's average base overhead is 30 percent (without running a pintool).<ref>[http://www.cs.virginia.edu/kim/docs/ieeeComputer10.pdf Analyzing Parallel Programs with Pin]</ref>

== Features ==

=== Instrumentation modes ===

Pin supports two modes of instrumentation called JIT mode and Probe mode. JIT mode supports all features of Pin, while Probe mode supports a limited feature set but is far faster, adding almost no overhead to program's running time. JIT mode uses a just-in-time compiler to recompile all program code and insert instrumentation, while Probe mode uses [[Trampoline (computers)|code trampolines]] for instrumentation.

=== Platform independence ===

Line 34:

*'''[http://www.pinplay.org PinPlay]''' enables the capture and deterministic replay of the running of multithreaded programs under pin. Capturing the running of a program helps developers overcome the non-determinism inherent in multithreading.<ref>[http://delivery.acm.org/10.1145/1780000/1772958/p2-patil.pdf PinPlay: a framework for deterministic replay and reproducible analysis of parallel programs]</ref>

* Pin itself comes with many example tools that make use of its abilities. These tools are licensed under a BSD-like license.

== Uses as a Defence Mechanism ==

Most scholars think that one can use Pin tool or binary instrumentation techniques to detect malwares in the future. Unlike traditional antiviruses where scanning files is used to detect malwares, one can use tools like Pin tool to scan program's resources to detect abnormalities; thus detect malwares.

== See also ==