Tracing Memory access of an Oracle Process:intel Pintools

Source: Internet
Author: User 7 Mahmoud Hatem troubleshoting

this blog post is motivated by a conversation with Frits Hoogland in his great blog Post the Curious Case of the missing semctl call  about how he managed to find  a useful memory address (suspecting a fixed SGA variable) used by a process in hi S investigation. So here I'll show how we can easily generates a trace of all/range of the memory addresses referenced by a Cceptable overhead.

For the going to use a Binary instrumentation Tool named was basically a tool to insert arbitrary code (WRI Tten in C or C + +) in arbitrary places in the executable. The code is added dynamically and the executable is running.

what is interesting are that Pin allow as to us to instrument only a class of instructions like Memory operations by using the Pin API which includes functions that classify and examine instructions. For more info please check:

    • Pin-a-dynamic-binary-instrumentation-tool
    • 76991/pin/html/index.html#maddresstrace
    • Pin-a-binary-instrumentation-tool-downloads

Using Pintools We can trace all/range of memory references inside a program by attaching to the running process.

Time for testing: (Oel6/uek4/oracle

    1. Download pin tools and install it as user Oracle (as Of  UPDATE 17/11/2016  )
    2. Build the sample tool for memory reference tracing (  CD source/tools/simpleexamples   make Obj-intel64/pin
    3. Test it using the Root/oracle User:

.. /.. /.. /pin-t Obj-intel64/

UPDATE 17/11/2016: The owner of the instrumented program ("Target to attach") need to access some files from the pin directory like (Pinbin, LINKER,ETC) so to trace the Oracle executable (owner of Oracle) using the root user for example  execute the following C Ommand after installing PIN: "Chown-r Oracle Pin_tools/pin-3.0-76991-gcc-linux" or simply install PIN using the Oracle US ER (if the instrumented program don ' t has access to some files in the pin directory, you'll receive the following Mislea ding  Error "E:pin loader can ' t open file/app/oracle/12.1.0/dbhome_1/bin/oracle:permission denied").

UPDATE 17/11/2016:   Good introduction to Intel Pin by Frits Hoogland:   introduction to Intel P In

let ' s try how we can find the address" 0X60027E20 "referenced inside" ksaamb "using PIN tools. ( As found by Frits Hoogland).

Using GDB We can verify that and our test case (deleting one line from a table followed by a commit) this address is ACCE Ssed 4 time (3 READS/1 writes):

using pin tools  (the test case took less, 2 sec to run and display all the memory add Ress referenced):

/pin-3.0-76991-gcc-linux/pin-pid 9266-t/pin-3.0-76991-gcc-linux/source/tools/simpleexamples/obj-intel64/

We have the memory address and it's content and also from where it's was referenced (instruction pointer). Using Addr2line We can display the actual symbol name:

Extract from the memory trace file:

This is a very simple example using-a ready-to-use sample tools. More complex plugin can is written depending on the needs.

Tracing Memory access of an Oracle Process:intel Pintools

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.