How can I set breakpoint and get value of a register with IDApython

Question

How can I set a breakpoint and get the value of the EAX register with IDApython?

I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific address I want to get the value of the EAX register as text.

Answer 1

I can think of two methods to achieve this:

1. Using RunTo.
2. Setting a breakpoint, hooking debugger events and implementing dbg_bpt

1. Using RunTo

This is nearly trivial to do, but does not give the same amount of control as the second approach. It might be better for quick and dirty type of solutions, if that's what you're after.

Calling idc.RunTo(ea) will execute the process until an ea is reached, allowing you to then call idc.GetRegValue(name) to get the value of EAX.

Certain conditions (like an exception thrown or a different breakpoint being hit) will cause RutTo to return before the provided ea is reached. You could then call idc.GetDebuggerEvent to figure out what happened, but if you're gonna do that I suggest switching to the second approach.

Note RunTo will also start up a process if there's no running process.

2. Setting a breakpoint, hooking debugger events and implementing dbg_bpt

This is the safer and would be my recommended approach, while being harder to implement it allows properly handling other breakpoints and more control.

For this, you'll have to do three things:

1. Set up a breakpoint at given address.
2. Monitor for the breakpoint's trigger.
3. And finally act upon it.

Set up a breakpoint at given address

The most basic method of achieving this is by calling the idc.AddBpt(ea), which sets a software on execution breakpoint at that address.

Additional methods you could use include:

1. idc.AddBptEx(ea, size, bpttype) to have more control on the type of breakpoint you're creating.
2. idc. SetBptAttr(address, bptattr, value) to set the breakpoint's available attributes.
3. idc.SetBptCnd(ea, cnd) / idc. SetBptCndEx(ea, cnd, is_lowcnd) to set the breakpoint's trigger condition.

Read the documentation for the exact details.

Monitor for the breakpoint's trigger

For that, you'll need to install a Debugger Hooking class (any class that inherits idaapi.DBG_Hooks), which implements the dbg_bpt(tid, ea) method, which describe the thread id and linear address in which the breakpoint triggered. Returning 0 from dbg_bpt should prevent IDA from notifying the user it was triggered (assuming you'll handle it internally).

You'll have to instantiate your class and call the instance's Hook and Unhook methods for it to actually function. Please note it's better practice to install the hooks before creating the breakpoint.

And finally act upon it

While the debugger is running, you can call idc.GetRegValue(name) providing the register name to receive it's immediate value at that time.