PIN: Tools using WinInet?

Brandon_Y_1 · ‎06-30-2016

Good morning,

I'm relatively new to PIN, but I have a few working tools that I made all tracing functions from Kernel32. I wanted to try identifying and tracing functions in WinInet, particularly InternetOpenUrlA, but as soon as I start adding the includes and linking off the lib file I start getting some errors that I'm unsure of. They all seem to be syntax errors in pinsync-windows.hpp, I don't know enough about this file to really dig in so I was hoping someone could help me understand what is wrong and what I might be able to do to fix this issue?

Errors start like this:

1>------ Build started: Project: MyPinTool, Configuration: Debug Win32 ------
1>  Source_InternetOpen.cpp
1>c:\pin-2.14-71313-msvc11-windows\source\include\pin\gen\pinsync-windows.hpp(41): warning C4091: 'extern ' : ignored on left of 'void' when no variable is declared
1>c:\pin-2.14-71313-msvc11-windows\source\include\pin\gen\pinsync-windows.hpp(73): error C2059: syntax error : '{'
1>c:\pin-2.14-71313-msvc11-windows\source\include\pin\gen\pinsync-windows.hpp(73): error C2334: unexpected token(s) preceding '{'; skipping apparent function body
1>C:\pin-2.14-71313-msvc11-windows\source\include\pin\gen\reg_ia32.PH(11): error C2059: syntax error : '('
1>C:\pin-2.14-71313-msvc11-windows\source\include\pin\gen\reg_ia32.PH(11): error C3805: '(': unexpected token, expected either '}' or a ','
1>C:\pin-2.14-71313-msvc11-windows\source\include\pin\gen\reg_ia32.PH(868): error C2143: syntax error : missing ')' before '}'

Just to get it out of the way, my includes look like this:

#include<Windows.h>
#include <WinInet.h>
#include "pin.H"
#include <iostream>
#include <fstream>
#pragma comment(lib, "wininet.lib")

My code is all listed below, I didn't want to put it up top in order to prevent clutter.

Thanks for any help, I really appreciate it.

-Brandon

#include<Windows.h>
#include <WinInet.h>
#include "pin.H"
#include <iostream>
#include <fstream>
#pragma comment(lib, "wininet.lib")


/* ===================================================================== */
/* Global Variables */
/* ===================================================================== */

std::ofstream TraceFile;

/* ===================================================================== */
/* Commandline Switches */
/* ===================================================================== */

KNOB<string> KnobOutputFile(KNOB_MODE_WRITEONCE, "pintool",
    "o", "w_InternetOpenUrlA.out.txt", "specify trace file name");

/* ===================================================================== */
/* Print Help Message                                                    */
/* ===================================================================== */

INT32 Usage()
{
    cerr << "This tool produces a trace of calls to InternetOpenUrlA.";
    cerr << endl << endl;
    cerr << KNOB_BASE::StringKnobSummary();
    cerr << endl;
    return -1;
}

/* ===================================================================== */
/* Analysis routines                                                     */
/* ===================================================================== */
 
VOID Before(HINTERNET hInternet, LPCTSTR lpszUrl,
            LPCTSTR lpszHeaders, DWORD dwHeadersLength, DWORD dwflags, DWORD_PTR dwContext) 
{
    TraceFile << "Before: " << hInternet << "(" << lpszUrl << lpszHeaders << ", "
              << dwHeadersLength << ", " << dwflags <<", "<< dwContext << ")" << endl;
}

VOID After(HINTERNET hInternet, LPCTSTR lpszUrl,
            LPCTSTR lpszHeaders, DWORD dwHeadersLength, DWORD dwflags, DWORD_PTR dwContext, ADDRINT ret)
{
    TraceFile << "After: " << hInternet << ", "<< lpszUrl <<", "<< lpszHeaders<<", "<<dwHeadersLength<<", "<<dwflags<<", "<<dwflags<<", "<<dwContext<<", "<< ret << dec << endl;
}


/* ===================================================================== */
/* Instrumentation routines                                              */
/* ===================================================================== */
   
VOID Image(IMG img, VOID *v)
{
    // Walk through the symbols in the symbol table.
    //
    for (SYM sym = IMG_RegsymHead(img); SYM_Valid(sym); sym = SYM_Next(sym))
    {
        string undFuncName = PIN_UndecorateSymbolName(SYM_Name(sym), UNDECORATION_NAME_ONLY);

        //  Find the RtlAllocHeap() function.
        if (undFuncName == "InternetOpenUrl")
        {
            RTN urlRtn = RTN_FindByAddress(IMG_LowAddress(img) + SYM_Value(sym));
            
            if (RTN_Valid(urlRtn))
            {
                // Instrument to print the input argument value and the return value.
                RTN_Open(urlRtn);
                
                RTN_InsertCall(urlRtn, IPOINT_BEFORE, (AFUNPTR)Before,
                               IARG_ADDRINT, "InternetOpenUrlA",
                               IARG_FUNCARG_ENTRYPOINT_VALUE, 0,
                               IARG_FUNCARG_ENTRYPOINT_VALUE, 1,
                               IARG_FUNCARG_ENTRYPOINT_VALUE, 2,
							   IARG_FUNCARG_ENTRYPOINT_VALUE, 3,
                               IARG_FUNCARG_ENTRYPOINT_VALUE, 4,
                               IARG_FUNCARG_ENTRYPOINT_VALUE, 5,
                               IARG_END);
                RTN_InsertCall(urlRtn, IPOINT_AFTER, (AFUNPTR)After,
                               IARG_ADDRINT, "VoidTheRetValue",
                               IARG_FUNCRET_EXITPOINT_VALUE,
                               IARG_END);
                
                RTN_Close(urlRtn);
            }
        }
    }
}

/* ===================================================================== */

VOID Fini(INT32 code, VOID *v)
{
    TraceFile.close();
}

/* ===================================================================== */
/* Main                                                                  */
/* ===================================================================== */

int main(int argc, char *argv[])
{
    // Initialize pin & symbol manager
    PIN_InitSymbols();
    if( PIN_Init(argc,argv) )
    {
        return Usage();
    }
    
    // Write to a file since cout and cerr maybe closed by the application
    TraceFile.open(KnobOutputFile.Value().c_str());
    TraceFile << hex;
    TraceFile.setf(ios::showbase);
    
    // Register Image to be called to instrument functions.
    IMG_AddInstrumentFunction(Image, 0);
    PIN_AddFiniFunction(Fini, 0);

    // Never returns
    PIN_StartProgram();
    
    return 0;
}

/* ===================================================================== */
/* eof */
/* ===================================================================== */

LexiS_Intel · ‎07-18-2016

Support for PIN is all provided in the PINHeads Yahoo group:

https://groups.yahoo.com/neo/groups/pinheads/info