Valgrind

TLDR

Dynamic binary instrumentation frameworks simplify building dynamic binary analysis tools, yet research has largely focused on performance while overlooking their broader capabilities. The authors present Valgrind, a DBI framework aimed at enabling heavyweight dynamic binary analysis tools. Valgrind’s key feature is support for shadow values, allowing each register and memory value to be accompanied by a descriptive value—a powerful but previously difficult-to-implement technique. Valgrind’s shadow‑value support yields design features that set it apart from other DBI frameworks, enabling the creation of heavyweight tools that are otherwise infeasible, though such tools run more slowly than lightweight alternatives.

Abstract

Dynamic binary instrumentation (DBI) frameworks make it easy to build dynamic binary analysis (DBA) tools such as checkers and profilers. Much of the focus on DBI frameworks has been on performance; little attention has been paid to their capabilities. As a result, we believe the potential of DBI has not been fully exploited. In this paper we describe Valgrind, a DBI framework designed for building heavyweight DBA tools. We focus on its unique support for shadow values -a powerful but previously little-studied and difficult-to-implement DBA technique, which requires a tool to shadow every register and memory value with another value that describes it. This support accounts for several crucial design features that distinguish Valgrind from other DBI frameworks. Because of these features, lightweight tools built with Valgrind run comparatively slowly, but Valgrind can be used to build more interesting, heavyweight tools that are difficult or impossible to build with other DBI frameworks such as Pin and DynamoRIO.