How to stop IDA debugger when a register is set to a particular value?

Question

I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value :

#include <idc.idc>

static main()
{
    auto r_eip, code, eax;

    EnableTracing(TRACE_STEP, 1);

    for ( code = GetDebuggerEvent(WFNE_ANY|WFNE_CONT, -1); // resume
        code > 0;
        code = GetDebuggerEvent(WFNE_ANY, -1) )
    {                  
        r_eip = GetEventEa();

        eax = GetRegValue("EAX");
        Message("EAX:%08Xh\n", eax);

        if ( eax == 0x00000001 )
            break;
    }

    PauseProcess();
    EnableTracing(TRACE_STEP, 0);    
}

However it does not work : i get the following error message : "Variable 'EAX' is undefined

If i put the line with eax = GetRegValue(...) in comment, in run but then eax is always zero.

The code is adapted from here : https://www.hex-rays.com/products/ida/debugger/scriptable.shtml

Answer 1

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed.

#include <idc.idc>

static main()
{
    for(;;)
    {
        StepInto();
        if (GetDebuggerEvent(WFNE_SUSP, -1) == STEP)
        {
            if (eax == 0) 
            {
                break;
            }
        }        
    }
    PauseProcess();
}