The PIN tracer is currently unusable on an up-to-date Windows 11 machine.
There is no working combination of PIN kit + shipped pintool source:
- PIN 3.31 (the last MSVC kit, EOL June 2024) has a compatible pintool
source, but pin.exe wasn’t able to load any tool on Windows 11 24H2. - PIN 4.x runs fine on 24H2, but the shipped idadbg.cpp/idadbg.h do not
compile against it.
ENVIRONMENT
IDA Pro 9.3
Windows 11 24H2, build 26100
CPU: i7 14700k
Visual Studio 2019 Professional, MSVC 14.29.30133 (toolset v142)
Windows SDK 10.0.26100.0
clang 22.1.3 (VS “C++ Clang Compiler for Windows” component)
Pintool source: \idapin (idadbg.cpp, idadbg.h, idadbg_local.h,
idadbg.vcxproj, makefile)
idapin readme.txt
This is a PIN tool that is used to connect IDA Pro debugger and PIN.
IDA can use PIN to instrument a binary file, trace it, and even debug
it. Breakpoints can be added to the target process, it can be suspended and
the process state can be examined.
The PIN tool is shipped in the source form. You will need to compile it
for your operating system and PIN version.
Requirements:
Windows: pin-81205 or higher, msvc-2015, msvc-2017
Linux: pin-81205 or higher, gcc 4.8.2 or higher
Copyright Hex-Rays 2014-2019
PROBLEM 1: PIN 3.31 cannot load ANY pintool on Windows 11 24H2
idadbg64.dll builds successfully, but running it fails before the tool is initialized:
E: [tid:NNNNN] Failure to map DLL <path>\idadbg64.dll
E: System error 216 :
System error 216 is ERROR_EXE_MACHINE_TYPE_MISMATCH. The DLL is a valid PE32+
x64 image (machine=0x8664, magic=0x20B), matching PIN’s own shipped DLLs.
This is NOT specific to the IDA pintool. Building PIN’s own sample tool with the kit’s own makefile:
cd source/tools/ManualExamples
make TARGET=intel64 obj-intel64/inscount0.dll
and running it produces the identical error:
E: Failure to map DLL <path>\ManualExamples\obj-intel64\inscount0.dll
E: System error 216 :
PIN 3.31 is failing to load any tool at all on this OS build.
Things i also tried but did not change the outcome:
- BaseAddress 0 + /FIXED:NO (matching the kit’s own PIE := /FIXED:NO /BASE:0)
- RuntimeLibrary /MD instead of /MT (the kit’s makefile uses -MD -O2)
- PlatformToolset v142 vs v141
- adding pinipc.lib to the link
- building via the kit’s makefile with its exact documented flags
PROBLEM 2: PIN 4.x loads tools, but idadbg.cpp does not compile against it
Kit tested: pin-external-4.3-99850-gce5652921-clang-windows
Compiling the shipped idadbg.cpp against PIN 4.3 (via the kit’s own
pin-clang-cl++ wrapper, with the kit’s own flags) fails with two distinct
classes of error:
(a) idadbg.h assumes PIN’s STL iterators are raw pointers
In file included from idadbg.cpp:43:
.\idadbg.h(837,51): error: no viable conversion from returned value of type
'const_iterator' (aka '__wrap_iter<const unsigned char *>') to function
return type 'const unsigned char *'
837 | const unsigned char *buf() const { return array.begin(); }
.\idadbg.h(838,51): error: no viable conversion from returned value of type
'iterator' (aka '__wrap_iter<unsigned char *>') to function return type
'unsigned char *'
838 | unsigned char *buf() { return array.begin(); }
PIN 4.x uses libc++, whose container iterators are wrapper classes rather
than plain pointers. These need array.data() (or &array[0]).
(b) PIN 4.x’s own runtime headers conflict with the Windows SDK
idadbg_local.h includes Windows.h / Ws2tcpip.h for the socket transport,
which collides with the headers under /intel64/pinrt/include:
winsock2.h(2060,1): error: conflicting types for 'select'
note: previous declaration is here
<kit>/intel64/pinrt/bin/../include/sys/select.h(31,5)
winsock2.h(2244,1): error: conflicting types for 'gethostname'
note: previous declaration is here
<kit>/intel64/pinrt/bin/../include/unistd.h(132,5)
stralign.h(488,16): error: use of undeclared identifier '_wcsicmp'
These are runtime-model conflicts, not flag problems, PIN 4.x’s PinCRT
provides its own POSIX-ish headers that cannot coexist with the SDK’s
winsock headers as currently included.
REQUEST
Please ship an idadbg source revision that builds against Intel PIN 4.x
(current kits: 4.0-4.3).
Motivation: I would like to use the PIN tracer to get function/block
coverage on a large binary at usable speed,
breakpoint- and step-based tracing (add_bpt, enable_func_trace,
enable_insn_trace) are all bounded by one synchronous debugger round trip per
event, which is orders of magnitude too slow. PIN’s JIT instrumentation is
exactly the right tool, and right now it cannot be built or run.
ALSO:
Mentions:
First of all download PIN from http://www.pintool.org , and unpack it on your hard drive.
pintool.org redirects to a scam website.