BIN2TL: Visualizing Program Dynamics with Perfetto
summary
A toolchain captures full execution with Intel PIN, converts per-instruction and per-call events into Perfetto/Chrome trace format, and produces an interactive timeline that shows function order, durations, call arguments and return values, and thread activity. It supports both ELF and PE binaries, uploads traces to Trace-cafe for inspection, and demonstrates low overhead in the demo while avoiding manual breakpoint choreography, turning repeated GDB/IDA cycles into a single visual profiling session.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:07Binary analysis challenges
- 3:06Static vs dynamic limits
- 6:51Desired analysis features
- 7:14BIN2TL concept
- 9:12Demo and Perfetto
- 11:37Threaded app tracing
- 13:28Instrumentation with Pin
- 14:59Why Pin over DBI
- 16:03Perfetto visualization benefits
- 17:10Live demo and upload
- 18:35Interpreting timeline
- 19:40Comparison with trace tools
- 21:48BIN2TL design
- 23:18Comparison with tracing tools
- 25:12Visualization granularity
- 27:49Summary and future
- 28:33Q&A
related talks
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
28mPostmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts
28mMPI: Multiple Perspective Attack Investigation...
16mHardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
10mBacktraces in the mirror: mad science by secrets of elves & dwarves!!
21mUtilizing RISC-V Trace Standards for Efficient Bugfixing and Profiling
01h 26mDebug C++ Code - Best Time Travel Debugging Tech
36mDebugging with eBPF on Arm Platforms