NativeInstructionCounter

The NativeInstructionCounter’s purpose is to allow you to more easily count the number of instructions executed. Moreover, it also allows you to count other things, such as the number of calls, returns, or blocks. This can be useful when performing execution length analysis to find new paths.

NativeInstructionCounter

class revenge.techniques.native_instruction_counter.NativeInstructionCounter(process, from_modules=None, call=False, ret=False, exec=False, block=False, compile=False, exclude_ranges=None)

Bases: revenge.techniques.Technique

Counts instructions executed.

Parameters

• process – Base process instantiation

• from_modules (list, optional) – Restrict counting to those instructions that start from one of the listed modules.

• call (bool, optional) – Count calls

• ret (bool, optional) – Count rets

• exec (bool, optional) – Count all instructions

• block (bool, optional) – Count blocks

• compile (bool, optional) – Count Frida instruction compile

• exclude_ranges (list, optional) – [low, high] range pairs to exclude any trace items from.

Examples

# With no args, it will count individual assembly instructions
# executed
counter = process.techniques.NativeInstructionCounter()

# Need to apply it to use it
counter.apply()

# Resume the process to get execution going again
process.resume()

# Some point later, print out the count
print(counter)

### Can also be used as technique for specific call
strlen = process.memory["strlen"]
counter = process.techniques.NativeInstructionCounter()
strlen("hello", techniques=counter)
print(counter)

TYPE = 'stalk'

apply(threads=None)

Applies this technique, optionally to the given threads.

remove()

Removes this technique.

Counter

class revenge.techniques.native_instruction_counter.Counter(thread, script)

Bases: object

property count

Number of instructions executed.

Type

int

stop()

Stop tracing.