Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • 2
    I'd definitely go with a DBI framework. PIN can do that easily (although you'll be restricted to x86 / x64). Check the pinatrace example source. Use PIN_SafeCopy (not used in the example) to access the memory, and you're done. Commented Mar 21, 2016 at 2:41
  • I think of DBI also, but PIN (and DynamoRIO) cannot trace kernel space accesses. Commented Mar 21, 2016 at 2:58
  • You can consult this (PDF) thesis report, specifically chapter 3 Commented Mar 21, 2016 at 9:10
  • @ExtremeCoders thanks, they are also using PANDA. Really seems like the way to go if one wants everything: different CPUs, kernel+userspace, different OSes. Commented Mar 21, 2016 at 10:06
  • As valgrind is open source, i'd guess it can't be too hard to add memory content to the --trace-mem=yes output. Commented Mar 21, 2016 at 17:48