Controlling program execution through binary instrumentation

Binary instrumentation has been widely used to observe dynamic program behavior, but current binary instrumentation systems do not allow the tool writer to alter the program execution path. This paper introduces some simple and general mechanisms for a binary instrumentation infrastructure to provide control over the application's execution path, allowing tools to replay or skip parts of the application, and to start or switch between threads. Specifically, the technique provides the following three functionalities for both single-threaded and multi-threaded applications: (1) checkpointing the execution state, (2) resuming execution at a checkpoint, and (3) starting execution at an arbitrary point in the program with a specified architectural state. We describe our implementation of these functionalities in Pin, a dynamic binary instrumentation infrastructure from Intel [5]. We demonstrate the usefulness of our mechanism by describing several binary instrumentation tools that have been built using this interface, including a transactional memory model and a thread scheduler.