Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best practice.

I was wondering if it's possible to store runtime variable values of your target process from a dynamic debugging session in your IDA database(or any other storage/tool) in some way. For example you run IDA debugger, or some external tool like olly/immunity, and store the encountered values (globals, function parameters) in IDA, so you can see actual values when doing your static analysis in IDA (for example on mouse over).

I don't know if anybody done this before, but it think it would be a really helpful feature.

Is this possible, any similar tool/solution out there you know of? How do you process static+dynamic data of the reversed application?

I'm not tied to IDA, but I find that environment to be most fitting for storing my result data. I'm interested in any solution.

share|improve this question
add comment

1 Answer

up vote 11 down vote accepted

funcap uses IDA's debugging API to record function calls in a program together with their arguments (before and after).

This is very useful when dealing with malware which uses helper functions to decrypt their strings, or programs which make many indirect calls.

a

share|improve this answer
    
Just what I was looking for, what a great tool! –  Dominik Antal Jan 23 at 20:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.