1

I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value :

#include <idc.idc>

static main()
{
    auto r_eip, code, eax;

    EnableTracing(TRACE_STEP, 1);

    for ( code = GetDebuggerEvent(WFNE_ANY|WFNE_CONT, -1); // resume
        code > 0;
        code = GetDebuggerEvent(WFNE_ANY, -1) )
    {                  
        r_eip = GetEventEa();

        eax = GetRegValue("EAX");
        Message("EAX:%08Xh\n", eax);

        if ( eax == 0x00000001 )
            break;
    }

    PauseProcess();
    EnableTracing(TRACE_STEP, 0);    
}

However it does not work : i get the following error message : "Variable 'EAX' is undefined

If i put the line with eax = GetRegValue(...) in comment, in run but then eax is always zero.

The code is adapted from here : https://www.hex-rays.com/products/ida/debugger/scriptable.shtml

2
  • See here
    – 0xec
    Jan 6, 2016 at 20:11
  • I already saw that page. What is suggested is to use eax variable directly without GetRegValue() call. I tried (and had to add auto eax to avoid error) : eax is always 0. I also tried the script posted at 22:05.45 :same there : eax is zero.
    – tigrou
    Jan 6, 2016 at 20:27

1 Answer 1

3

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed.

#include <idc.idc>

static main()
{
    for(;;)
    {
        StepInto();
        if (GetDebuggerEvent(WFNE_SUSP, -1) == STEP)
        {
            if (eax == 0) 
            {
                break;
            }
        }        
    }
    PauseProcess();
}
3
  • Thanks it works ! (although it is very slow, but this is to be expected)
    – tigrou
    Jan 6, 2016 at 21:45
  • @tigrou For a faster implementation, you can use DBI frameworks such as Intel Pin and DynamoRIO.
    – 0xec
    Jan 7, 2016 at 9:00
  • Actually it was used to debug DOSBOX, through idados. Unfortunately DOSBOX does not support memory read breakpoints, so the only way was to inspect registers continuously.
    – tigrou
    Jan 8, 2016 at 22:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.