Memory Trace with Memory Contents

Question

I'm trying to acquire a memory trace of a run of a simple program where I could see both address and data being read/written , eg W 0x7fffffffd928 4 0xe4d829d0 which would stand for writing a 4-byte value 0xe4d829d0 to the address 0x7fffffffd928 .

There's a tool in Valgrind (Lackey tool) which only gives you the address and data length. Since Valgrind tools' documentation is quite poor, I viewed Valgrind sources but there doesn't seem to be any direct access to the data.

Another possibility seems to be Pin from Intel but after reading its documentation I haven't found anything relevant either.

This seems to be a very simple problem, however, I can't figure out or find any solution. Thanks!

Answer 1

The key function for PIN is PIN_SafeCopy which must be surrounded by PIN_GetLock and PIN_ReleaseLock . See the full functional PIN tool at Philippe Teuwen's blog .