The specification for zero/low cost annotations lays out everything you need to know to find probe-ready points in the binary and modify them.
However, the only implementation I'm aware of that actually does this is libzca. Libzca uses Pin and supports only a limited usage model -- you can insert function calls at __notify_intrinsic probe-ready only at load-time, before Pin does its binary translation thing.
But we would really like to be able to turn these probes on and off at runtime. Does anyone have an implementation that would support that? A student is trying to build one, but needless to say it would be helpful to have some library-support for emitting the right assembly.