Windows平台下Intel PIN工具实现栈回溯的替代方案咨询

Oh, I feel your pain—this is one of those annoying gaps in PIN’s cross-platform support. The PIN_Backtrace function works great on Linux and macOS, but it’s completely missing on Windows. Luckily, we have two solid workarounds to get stack traces in your pintool, using either Windows native APIs or manual stack traversal.

Option 1: Use Windows' Native StackWalk64 API #

Windows has a built-in API called StackWalk64 designed exactly for this purpose—it lets you traverse the call stack by leveraging the thread’s context. To use it with PIN, we’ll grab the current register state via PIN’s context argument, then feed that into StackWalk64 to build our trace.

Step-by-Step Implementation #

1. First, initialize the Windows symbol engine at the start of your pintool (this lets us resolve addresses to function names):

   #include <windows.h>
   #include <imagehlp.h>
   #pragma comment(lib, "imagehlp.lib")
   
   VOID InitSymbolEngine() {
       SymInitialize(GetCurrentProcess(), NULL, TRUE);
       // Optional: Set system symbol path if you need OS function names
       // SymSetSearchPath(GetCurrentProcess(), "srv*C:\\Symbols*https://msdl.microsoft.com/download/symbols");
   }
   

2. Create a callback function to print the backtrace using StackWalk64:

   VOID PrintBacktrace(CONTEXT* ctx) {
       STACKFRAME64 stackFrame = {0};
       DWORD machineType = IMAGE_FILE_MACHINE_AMD64; // Use IMAGE_FILE_MACHINE_I386 for 32-bit
   
       // Populate stack frame with register values from PIN's context
   #ifdef _WIN64
       stackFrame.AddrPC.Offset = ctx->Rip;
       stackFrame.AddrPC.Mode = AddrModeFlat;
       stackFrame.AddrFrame.Offset = ctx->Rbp;
       stackFrame.AddrFrame.Mode = AddrModeFlat;
       stackFrame.AddrStack.Offset = ctx->Rsp;
       stackFrame.AddrStack.Mode = AddrModeFlat;
   #else
       stackFrame.AddrPC.Offset = ctx->Eip;
       stackFrame.AddrPC.Mode = AddrModeFlat;
       stackFrame.AddrFrame.Offset = ctx->Ebp;
       stackFrame.AddrFrame.Mode = AddrModeFlat;
       stackFrame.AddrStack.Offset = ctx->Esp;
       stackFrame.AddrStack.Mode = AddrModeFlat;
   #endif
   
       HANDLE process = GetCurrentProcess();
       HANDLE thread = GetCurrentThread();
   
       PIN_OutputDebugString("Call stack:\n");
       while (StackWalk64(machineType, process, thread, &stackFrame, ctx, NULL, SymFunctionTableAccess64, SymGetModuleBase64, NULL)) {
           if (stackFrame.AddrPC.Offset != 0) {
               char symbolBuffer[256];
               DWORD64 displacement = 0;
               IMAGEHLP_SYMBOL64* symbol = (IMAGEHLP_SYMBOL64*)symbolBuffer;
               symbol->SizeOfStruct = sizeof(IMAGEHLP_SYMBOL64);
               symbol->MaxNameLength = sizeof(symbolBuffer) - sizeof(IMAGEHLP_SYMBOL64);
   
               if (SymFromAddr(process, stackFrame.AddrPC.Offset, &displacement, symbol)) {
                   PIN_OutputDebugString("    %s + 0x%llX\n", symbol->Name, displacement);
               } else {
                   PIN_OutputDebugString("    0x%llX\n", stackFrame.AddrPC.Offset);
               }
           }
       }
   }
   

3. Hook this callback to your target instruction:

   VOID InstrumentInstruction(INS ins, VOID* v) {
       // Replace this with your logic to target specific instructions
       if (INS_Opcode(ins) == XED_ICLASS_CALL) {
           INS_InsertCall(ins, IPOINT_AFTER, (AFUNPTR)PrintBacktrace, IARG_CONTEXT, IARG_END);
       }
   }
   

4. Don’t forget to call InitSymbolEngine in your main function before starting PIN:

   int main(int argc, char* argv[]) {
       if (PIN_Init(argc, argv)) return Usage();
       InitSymbolEngine();
       INS_AddInstrumentFunction(InstrumentInstruction, NULL);
       PIN_StartProgram();
       return 0;
   }
   

Option 2: Manual Stack Traversal (Simple, No API Dependencies) #

If you don’t want to rely on Windows APIs or symbol resolution, you can manually traverse the stack using frame pointers. This works best for debug builds (since release builds often omit frame pointers with FPO optimization).

Implementation #

VOID ManualBacktrace(CONTEXT* ctx) {
   PIN_OutputDebugString("Manual call stack:\n");

#ifdef _WIN64
   UINT64 rbp = ctx->Rbp;
   UINT64 rip = ctx->Rip;
   PIN_OutputDebugString("    0x%llX\n", rip);

   while (rbp != 0) {
       // Return address is at [rbp + 8], previous frame pointer at [rbp]
       UINT64 returnAddr = *(UINT64*)(rbp + 8);
       if (returnAddr == 0) break;

       PIN_OutputDebugString("    0x%llX\n", returnAddr);
       rbp = *(UINT64*)rbp;
   }
#else
   UINT32 ebp = ctx->Ebp;
   UINT32 eip = ctx->Eip;
   PIN_OutputDebugString("    0x%X\n", eip);

   while (ebp != 0) {
       UINT32 returnAddr = *(UINT32*)(ebp + 4);
       if (returnAddr == 0) break;

       PIN_OutputDebugString("    0x%X\n", returnAddr);
       ebp = *(UINT32*)ebp;
   }
#endif
}

Just hook this function the same way as the StackWalk64 version—note that you’ll only get raw addresses, not function names, and this will fail if the target program uses frame pointer omission.

Key Notes #

• Bitness Matching: Make sure your pintool is compiled for the same architecture (32/64-bit) as the target program—mismatches will cause crashes or invalid register values.
• Symbol Resolution: For StackWalk64 to show function names, the target program must have PDB files available, and you may need to set the system symbol path for OS functions.
• Context Timing: Using IPOINT_AFTER ensures you get the register state after the target instruction executes, which is critical for accurate stack traces.

内容的提问来源于stack exchange，提问作者Francium